@solidxai/core 0.1.13-beta.19 → 0.1.13-beta.20

package/dist/services/mpin.service.js

@@ -0,0 +1,282 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var MpinService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MpinService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const error_messages_1 = require("../constants/error-messages");
+const success_messages_1 = require("../constants/success-messages");
+const user_device_credential_repository_1 = require("../repository/user-device-credential.repository");
+const user_repository_1 = require("../repository/user.repository");
+const authentication_service_1 = require("./authentication.service");
+const hashing_service_1 = require("./hashing.service");
+const setting_service_1 = require("./setting.service");
+const user_activity_history_service_1 = require("./user-activity-history.service");
+const MPIN_DENYLIST = new Set([
+    '0000', '1111', '2222', '3333', '4444', '5555', '6666', '7777', '8888', '9999',
+    '1234', '4321', '1212', '2001', '1004', '2000', '6969', '2580',
+    '000000', '111111', '123456', '654321', '121212', '112233', '123123',
+]);
+let MpinService = MpinService_1 = class MpinService {
+    constructor(credentialRepository, userRepository, hashingService, settingService, authenticationService, userActivityHistoryService) {
+        this.credentialRepository = credentialRepository;
+        this.userRepository = userRepository;
+        this.hashingService = hashingService;
+        this.settingService = settingService;
+        this.authenticationService = authenticationService;
+        this.userActivityHistoryService = userActivityHistoryService;
+        this.logger = new common_1.Logger(MpinService_1.name);
+    }
+    async setupMpin(activeUser, dto) {
+        this.assertEnabled();
+        this.assertMpinAcceptable(dto.mpin);
+        const user = await this.userRepository.findOne({ where: { id: activeUser.sub } });
+        if (!user) {
+            throw new common_1.NotFoundException(error_messages_1.ERROR_MESSAGES.USER_NOT_FOUND);
+        }
+        const deviceId = dto.deviceId.toLowerCase();
+        const existing = await this.credentialRepository.findOne({
+            where: { user: { id: user.id }, deviceId },
+        });
+        const record = existing ?? this.credentialRepository.create({
+            user,
+            deviceId,
+        });
+        record.credentialKey = this.buildCredentialKey(user.username, deviceId);
+        const credentialRef = this.mintCredentialRef();
+        record.hashedCredentialRef = this.hashCredentialRef(credentialRef);
+        record.hashedMpin = await this.hashingService.hash(dto.mpin);
+        record.mpinScheme = this.hashingService.name();
+        record.mpinSchemeVersion = this.hashingService.currentVersion();
+        record.deviceName = dto.deviceName ?? null;
+        record.platform = dto.platform ?? null;
+        record.isActive = true;
+        record.failedAttempts = 0;
+        record.lockedUntil = null;
+        await this.evictOldestIfAtCap(user.id, existing?.id);
+        await this.credentialRepository.save(record);
+        return { credentialRef, message: success_messages_1.SUCCESS_MESSAGES.MPIN_SETUP_SUCCESS };
+    }
+    async changeMpin(activeUser, dto) {
+        this.assertEnabled();
+        this.assertMpinAcceptable(dto.newMpin);
+        const credential = await this.credentialRepository.findOne({
+            where: {
+                hashedCredentialRef: this.hashCredentialRef(dto.credentialRef),
+                user: { id: activeUser.sub },
+            },
+        });
+        if (!credential || !credential.isActive) {
+            throw new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_INVALID);
+        }
+        this.assertNotLocked(credential);
+        const matches = await this.hashingService.compare(dto.currentMpin, credential.hashedMpin, credential.mpinSchemeVersion);
+        if (!matches) {
+            throw await this.registerFailedAttempt(credential);
+        }
+        const credentialRef = this.mintCredentialRef();
+        credential.hashedCredentialRef = this.hashCredentialRef(credentialRef);
+        credential.hashedMpin = await this.hashingService.hash(dto.newMpin);
+        credential.mpinScheme = this.hashingService.name();
+        credential.mpinSchemeVersion = this.hashingService.currentVersion();
+        credential.failedAttempts = 0;
+        credential.lockedUntil = null;
+        await this.credentialRepository.save(credential);
+        return { credentialRef, message: success_messages_1.SUCCESS_MESSAGES.MPIN_CHANGED_SUCCESS };
+    }
+    async loginWithMpin(dto) {
+        this.assertEnabled();
+        const credential = await this.credentialRepository.findOne({
+            where: { hashedCredentialRef: this.hashCredentialRef(dto.credentialRef) },
+            relations: { user: { roles: true } },
+        });
+        if (!credential || !credential.user) {
+            throw new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_INVALID);
+        }
+        if (!credential.isActive) {
+            throw new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_REVOKED);
+        }
+        this.assertNotLocked(credential);
+        const matches = await this.hashingService.compare(dto.mpin, credential.hashedMpin, credential.mpinSchemeVersion);
+        if (!matches) {
+            throw await this.registerFailedAttempt(credential);
+        }
+        credential.failedAttempts = 0;
+        credential.lockedUntil = null;
+        credential.lastUsedAt = new Date();
+        if (this.hashingService.needsRehash(credential.hashedMpin, credential.mpinSchemeVersion)) {
+            credential.hashedMpin = await this.hashingService.hash(dto.mpin);
+            credential.mpinScheme = this.hashingService.name();
+            credential.mpinSchemeVersion = this.hashingService.currentVersion();
+        }
+        await this.credentialRepository.save(credential);
+        const user = credential.user;
+        await this.userActivityHistoryService.logEvent('login', user);
+        const tokens = await this.authenticationService.generateTokens(user, credential.deviceId);
+        return {
+            user: {
+                id: user.id,
+                email: user.email,
+                mobile: user.mobile,
+                username: user.username,
+                forcePasswordChange: user.forcePasswordChange,
+                roles: (user.roles ?? []).map((role) => role.name),
+            },
+            ...tokens,
+        };
+    }
+    async listDevices(activeUser) {
+        this.assertEnabled();
+        const credentials = await this.credentialRepository.find({
+            where: { user: { id: activeUser.sub }, isActive: true },
+        });
+        return credentials
+            .sort((a, b) => this.lastUsedMillis(b) - this.lastUsedMillis(a))
+            .map((credential) => this.toDeviceView(credential));
+    }
+    async revokeDevice(activeUser, id) {
+        this.assertEnabled();
+        const credential = await this.credentialRepository.findOne({
+            where: { id, user: { id: activeUser.sub } },
+        });
+        if (!credential) {
+            throw new common_1.NotFoundException(error_messages_1.ERROR_MESSAGES.MPIN_CREDENTIAL_NOT_FOUND);
+        }
+        credential.isActive = false;
+        await this.credentialRepository.save(credential);
+        return { message: success_messages_1.SUCCESS_MESSAGES.MPIN_DEVICE_REVOKED };
+    }
+    toDeviceView(credential) {
+        return {
+            id: credential.id,
+            deviceId: credential.deviceId,
+            deviceName: credential.deviceName,
+            platform: credential.platform,
+            isActive: credential.isActive,
+            failedAttempts: credential.failedAttempts,
+            lockedUntil: credential.lockedUntil,
+            lastUsedAt: credential.lastUsedAt,
+            createdAt: credential.createdAt,
+        };
+    }
+    assertEnabled() {
+        if (!this.settingService.getConfigValue('mpinEnabled')) {
+            throw new common_1.NotFoundException(error_messages_1.ERROR_MESSAGES.MPIN_NOT_ENABLED);
+        }
+    }
+    assertNotLocked(credential) {
+        if (credential.lockedUntil && credential.lockedUntil.getTime() > Date.now()) {
+            throw new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_LOCKED);
+        }
+    }
+    assertMpinAcceptable(mpin) {
+        const pattern = String(this.settingService.getConfigValue('mpinRegex') ?? '^\\d{4,6}$');
+        let matches = false;
+        try {
+            matches = new RegExp(pattern).test(mpin);
+        }
+        catch {
+            this.logger.error(`Invalid mpinRegex setting: ${pattern}`);
+            throw new common_1.BadRequestException(error_messages_1.ERROR_MESSAGES.MPIN_FORMAT_INVALID);
+        }
+        if (!matches) {
+            throw new common_1.BadRequestException(error_messages_1.ERROR_MESSAGES.MPIN_FORMAT_INVALID);
+        }
+        if (this.isPredictable(mpin)) {
+            throw new common_1.BadRequestException(error_messages_1.ERROR_MESSAGES.MPIN_TOO_PREDICTABLE);
+        }
+    }
+    isPredictable(mpin) {
+        if (/^(\d)\1+$/.test(mpin)) {
+            return true;
+        }
+        if (this.isSequential(mpin)) {
+            return true;
+        }
+        return MPIN_DENYLIST.has(mpin);
+    }
+    isSequential(mpin) {
+        let ascending = true;
+        let descending = true;
+        for (let i = 1; i < mpin.length; i++) {
+            const step = mpin.charCodeAt(i) - mpin.charCodeAt(i - 1);
+            if (step !== 1)
+                ascending = false;
+            if (step !== -1)
+                descending = false;
+        }
+        return ascending || descending;
+    }
+    async registerFailedAttempt(credential) {
+        const lockThreshold = Number(this.settingService.getConfigValue('mpinMaxFailedAttempts'));
+        const deactivateThreshold = Number(this.settingService.getConfigValue('mpinMaxTotalFailedAttempts'));
+        const lockoutSeconds = Number(this.settingService.getConfigValue('mpinLockoutDuration'));
+        credential.failedAttempts += 1;
+        let error = new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_INVALID);
+        if (credential.isActive && deactivateThreshold > 0 && credential.failedAttempts >= deactivateThreshold) {
+            credential.isActive = false;
+            credential.lockedUntil = null;
+            error = new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_REVOKED);
+        }
+        else if (credential.isActive && lockThreshold > 0 && credential.failedAttempts % lockThreshold === 0) {
+            credential.lockedUntil = new Date(Date.now() + lockoutSeconds * 1000);
+            error = new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_LOCKED);
+        }
+        await this.credentialRepository.save(credential);
+        return error;
+    }
+    async evictOldestIfAtCap(userId, excludeId) {
+        const cap = Number(this.settingService.getConfigValue('mpinMaxDevicesPerUser'));
+        if (!cap || cap <= 0) {
+            return;
+        }
+        const active = (await this.credentialRepository.find({
+            where: { user: { id: userId }, isActive: true },
+        })).filter((credential) => credential.id !== excludeId);
+        const overflow = active.length - (cap - 1);
+        if (overflow <= 0) {
+            return;
+        }
+        const doomed = active
+            .sort((a, b) => this.lastUsedMillis(a) - this.lastUsedMillis(b))
+            .slice(0, overflow);
+        for (const credential of doomed) {
+            credential.isActive = false;
+        }
+        await this.credentialRepository.save(doomed);
+        this.logger.log(`Evicted ${doomed.length} MPIN credential(s) for user ${userId} at the device cap of ${cap}`);
+    }
+    lastUsedMillis(credential) {
+        return credential.lastUsedAt?.getTime() ?? credential.createdAt?.getTime() ?? 0;
+    }
+    buildCredentialKey(username, deviceId) {
+        const normalizedUsername = (username ?? '').trim().toLowerCase().replace(/\s+/g, '-');
+        return `${normalizedUsername}-${deviceId}`;
+    }
+    mintCredentialRef() {
+        return (0, crypto_1.randomBytes)(32).toString('hex');
+    }
+    hashCredentialRef(credentialRef) {
+        return (0, crypto_1.createHash)('sha256').update(credentialRef).digest('hex');
+    }
+};
+exports.MpinService = MpinService;
+exports.MpinService = MpinService = MpinService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_device_credential_repository_1.UserDeviceCredentialRepository,
+        user_repository_1.UserRepository,
+        hashing_service_1.HashingService,
+        setting_service_1.SettingService,
+        authentication_service_1.AuthenticationService,
+        user_activity_history_service_1.UserActivityHistoryService])
+], MpinService);
+//# sourceMappingURL=mpin.service.js.map

package/dist/services/mpin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mpin.service.js","sourceRoot":"","sources":["../../src/services/mpin.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAMwB;AACxB,mCAAiD;AACjD,gEAA8D;AAC9D,oEAAkE;AAMlE,uGAAkG;AAClG,mEAAgE;AAEhE,qEAAiE;AACjE,uDAAmD;AACnD,uDAAmD;AACnD,mFAA6E;AAO7E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9D,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;CACvE,CAAC,CAAC;AAGI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGpB,YACqB,oBAAoD,EACpD,cAA8B,EAC9B,cAA8B,EAC9B,cAA8B,EAC9B,qBAA4C,EAC5C,0BAAsD;QALtD,yBAAoB,GAApB,oBAAoB,CAAgC;QACpD,mBAAc,GAAd,cAAc,CAAgB;QAC9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,+BAA0B,GAA1B,0BAA0B,CAA4B;QAR1D,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IASnD,CAAC;IAIL,KAAK,CAAC,SAAS,CAAC,UAA0B,EAAE,GAAiB;QACzD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAKpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,0BAAiB,CAAC,+BAAc,CAAC,cAAc,CAAC,CAAC;QAC/D,CAAC;QAOD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACrD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE;SAC7C,CAAC,CAAC;QAIH,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;YACxD,IAAI;YACJ,QAAQ;SACX,CAAC,CAAC;QAKH,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACnE,MAAM,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QAChE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;QAC3C,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC;QACvC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAE1B,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAI7C,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAgB,CAAC,kBAAkB,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAA0B,EAAE,GAAkB;QAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAIvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE;gBACH,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC9D,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE;aAC/B;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7C,GAAG,CAAC,WAAW,EACf,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,iBAAiB,CAC/B,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC;QAID,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACvE,UAAU,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnD,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QACpE,UAAU,CAAC,cAAc,GAAG,CAAC,CAAC;QAC9B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAgB,CAAC,oBAAoB,EAAE,CAAC;IAC7E,CAAC;IAID,KAAK,CAAC,aAAa,CAAC,GAAiB;QACjC,IAAI,CAAC,aAAa,EAAE,CAAC;QAIrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;YACzE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;SACvC,CAAC,CAAC;QAGH,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QAUD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QAID,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7C,GAAG,CAAC,IAAI,EACR,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,iBAAiB,CAC/B,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC;QAED,UAAU,CAAC,cAAc,GAAG,CAAC,CAAC;QAC9B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,UAAU,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvF,UAAU,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACnD,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAK9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE1F,OAAO;YACH,IAAI,EAAE;gBACF,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aACrD;YACD,GAAG,MAAM;SACZ,CAAC;IACN,CAAC;IAID,KAAK,CAAC,WAAW,CAAC,UAA0B;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YACrD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC1D,CAAC,CAAC;QAEH,OAAO,WAAW;aACb,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;aAC/D,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAA0B,EAAE,EAAU;QACrD,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,0BAAiB,CAAC,+BAAc,CAAC,yBAAyB,CAAC,CAAC;QAC1E,CAAC;QAKD,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;QAC5B,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,OAAO,EAAE,OAAO,EAAE,mCAAgB,CAAC,mBAAmB,EAAE,CAAC;IAC7D,CAAC;IAUO,YAAY,CAAC,UAAgC;QACjD,OAAO;YACH,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,SAAS,EAAE,UAAU,CAAC,SAAS;SAClC,CAAC;IACN,CAAC;IAEO,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,aAAa,CAAC,EAAE,CAAC;YAEvE,MAAM,IAAI,0BAAiB,CAAC,+BAAc,CAAC,gBAAgB,CAAC,CAAC;QACjE,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAgC;QACpD,IAAI,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;IAEO,oBAAoB,CAAC,IAAY;QACrC,MAAM,OAAO,GAAG,MAAM,CAClB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,WAAW,CAAC,IAAI,YAAY,CACpF,CAAC;QAMF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACD,OAAO,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YAC3D,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,mBAAmB,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,mBAAmB,CAAC,CAAC;QACtE,CAAC;QAID,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAI3B,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,oBAAoB,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,IAAY;QAC9B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,IAAY;QAC7B,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,KAAK,CAAC;gBAAE,SAAS,GAAG,KAAK,CAAC;YAClC,IAAI,IAAI,KAAK,CAAC,CAAC;gBAAE,UAAU,GAAG,KAAK,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,IAAI,UAAU,CAAC;IACnC,CAAC;IAUO,KAAK,CAAC,qBAAqB,CAC/B,UAAgC;QAEhC,MAAM,aAAa,GAAG,MAAM,CACxB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,uBAAuB,CAAC,CAChF,CAAC;QACF,MAAM,mBAAmB,GAAG,MAAM,CAC9B,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,4BAA4B,CAAC,CACrF,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,CACzB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,qBAAqB,CAAC,CAC9E,CAAC;QAEF,UAAU,CAAC,cAAc,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAG,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QAEnE,IAAI,UAAU,CAAC,QAAQ,IAAI,mBAAmB,GAAG,CAAC,IAAI,UAAU,CAAC,cAAc,IAAI,mBAAmB,EAAE,CAAC;YACrG,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;YAC5B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;YAK9B,KAAK,GAAG,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,IAAI,aAAa,GAAG,CAAC,IAAI,UAAU,CAAC,cAAc,GAAG,aAAa,KAAK,CAAC,EAAE,CAAC;YACrG,UAAU,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,CAAC;YACtE,KAAK,GAAG,IAAI,8BAAqB,CAAC,+BAAc,CAAC,WAAW,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACjB,CAAC;IAQO,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,SAAkB;QAC/D,MAAM,GAAG,GAAG,MAAM,CACd,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,uBAAuB,CAAC,CAChF,CAAC;QACF,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YACjD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAGxD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QAKD,MAAM,MAAM,GAAG,MAAM;aAChB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;aAC/D,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAExB,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;YAC9B,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CACX,WAAW,MAAM,CAAC,MAAM,gCAAgC,MAAM,yBAAyB,GAAG,EAAE,CAC/F,CAAC;IACN,CAAC;IAEO,cAAc,CAAC,UAAgC;QACnD,OAAO,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IAUO,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;QACzD,MAAM,kBAAkB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtF,OAAO,GAAG,kBAAkB,IAAI,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAEO,iBAAiB;QACrB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAKO,iBAAiB,CAAC,aAAqB;QAC3C,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;CACJ,CAAA;AA3ZY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAKkC,kEAA8B;QACpC,gCAAc;QACd,gCAAc;QACd,gCAAc;QACP,8CAAqB;QAChB,0DAA0B;GATlE,WAAW,CA2ZvB","sourcesContent":["import {\n    BadRequestException,\n    Injectable,\n    Logger,\n    NotFoundException,\n    UnauthorizedException,\n} from '@nestjs/common';\nimport { createHash, randomBytes } from 'crypto';\nimport { ERROR_MESSAGES } from 'src/constants/error-messages';\nimport { SUCCESS_MESSAGES } from 'src/constants/success-messages';\nimport { ChangeMpinDto } from 'src/dtos/change-mpin.dto';\nimport { MpinLoginDto } from 'src/dtos/mpin-login.dto';\nimport { SetupMpinDto } from 'src/dtos/setup-mpin.dto';\nimport { UserDeviceCredential } from 'src/entities/user-device-credential.entity';\nimport { ActiveUserData } from 'src/interfaces/active-user-data.interface';\nimport { UserDeviceCredentialRepository } from 'src/repository/user-device-credential.repository';\nimport { UserRepository } from 'src/repository/user.repository';\nimport type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';\nimport { AuthenticationService } from './authentication.service';\nimport { HashingService } from './hashing.service';\nimport { SettingService } from './setting.service';\nimport { UserActivityHistoryService } from './user-activity-history.service';\n\n/**\n * The most-chosen PINs in published analyses of breached sets. `1234` alone\n * accounts for roughly a tenth of four-digit choices, so a list this short\n * removes a disproportionate share of guessable values.\n */\nconst MPIN_DENYLIST = new Set([\n    '0000', '1111', '2222', '3333', '4444', '5555', '6666', '7777', '8888', '9999',\n    '1234', '4321', '1212', '2001', '1004', '2000', '6969', '2580',\n    '000000', '111111', '123456', '654321', '121212', '112233', '123123',\n]);\n\n@Injectable()\nexport class MpinService {\n    private readonly logger = new Logger(MpinService.name);\n\n    constructor(\n        private readonly credentialRepository: UserDeviceCredentialRepository,\n        private readonly userRepository: UserRepository,\n        private readonly hashingService: HashingService,\n        private readonly settingService: SettingService,\n        private readonly authenticationService: AuthenticationService,\n        private readonly userActivityHistoryService: UserActivityHistoryService,\n    ) { }\n\n    // ---------------------------------------------------------------- setup\n\n    async setupMpin(activeUser: ActiveUserData, dto: SetupMpinDto) {\n        this.assertEnabled();\n        this.assertMpinAcceptable(dto.mpin);\n\n        // The account comes from the access token, never from the body - a\n        // client can only ever create a credential for the user it is signed\n        // in as.\n        const user = await this.userRepository.findOne({ where: { id: activeUser.sub } });\n        if (!user) {\n            throw new NotFoundException(ERROR_MESSAGES.USER_NOT_FOUND);\n        }\n\n        // Lower-cased because @IsUUID is case-insensitive: iOS renders a UUID\n        // uppercase (identifierForVendor.uuidString) while Android renders it\n        // lowercase, and both validate. Without normalising, the same physical\n        // device could present two spellings, miss this exact-match lookup and\n        // end up with two credential rows consuming two slots against the cap.\n        const deviceId = dto.deviceId.toLowerCase();\n\n        const existing = await this.credentialRepository.findOne({\n            where: { user: { id: user.id }, deviceId },\n        });\n\n        // Re-running setup on the same device rotates the credential rather\n        // than adding a second one.\n        const record = existing ?? this.credentialRepository.create({\n            user,\n            deviceId,\n        });\n\n        // Recomputed on every setup so a renamed user does not keep a stale\n        // key. It is an identifier for humans and tooling, never a lookup key,\n        // so drift here costs nothing operationally.\n        record.credentialKey = this.buildCredentialKey(user.username, deviceId);\n\n        const credentialRef = this.mintCredentialRef();\n        record.hashedCredentialRef = this.hashCredentialRef(credentialRef);\n        record.hashedMpin = await this.hashingService.hash(dto.mpin);\n        record.mpinScheme = this.hashingService.name();\n        record.mpinSchemeVersion = this.hashingService.currentVersion();\n        record.deviceName = dto.deviceName ?? null;\n        record.platform = dto.platform ?? null;\n        record.isActive = true;\n        record.failedAttempts = 0;\n        record.lockedUntil = null;\n\n        await this.evictOldestIfAtCap(user.id, existing?.id);\n        await this.credentialRepository.save(record);\n\n        // Returned once. Only its SHA-256 is stored, so it can never be\n        // re-issued - the client must persist it before reporting success.\n        return { credentialRef, message: SUCCESS_MESSAGES.MPIN_SETUP_SUCCESS };\n    }\n\n    async changeMpin(activeUser: ActiveUserData, dto: ChangeMpinDto) {\n        this.assertEnabled();\n        this.assertMpinAcceptable(dto.newMpin);\n\n        // Scoped to the caller, so holding someone else's handle is not enough\n        // to change their MPIN.\n        const credential = await this.credentialRepository.findOne({\n            where: {\n                hashedCredentialRef: this.hashCredentialRef(dto.credentialRef),\n                user: { id: activeUser.sub },\n            },\n        });\n\n        if (!credential || !credential.isActive) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_INVALID);\n        }\n        this.assertNotLocked(credential);\n\n        const matches = await this.hashingService.compare(\n            dto.currentMpin,\n            credential.hashedMpin,\n            credential.mpinSchemeVersion,\n        );\n        if (!matches) {\n            throw await this.registerFailedAttempt(credential);\n        }\n\n        // Rotate the handle alongside the MPIN: a changed credential should\n        // invalidate anything captured previously.\n        const credentialRef = this.mintCredentialRef();\n        credential.hashedCredentialRef = this.hashCredentialRef(credentialRef);\n        credential.hashedMpin = await this.hashingService.hash(dto.newMpin);\n        credential.mpinScheme = this.hashingService.name();\n        credential.mpinSchemeVersion = this.hashingService.currentVersion();\n        credential.failedAttempts = 0;\n        credential.lockedUntil = null;\n        await this.credentialRepository.save(credential);\n\n        return { credentialRef, message: SUCCESS_MESSAGES.MPIN_CHANGED_SUCCESS };\n    }\n\n    // ---------------------------------------------------------------- login\n\n    async loginWithMpin(dto: MpinLoginDto) {\n        this.assertEnabled();\n\n        // A single indexed exact-match lookup. The row already names the user,\n        // so there is nothing to resolve and no identifier to enumerate with.\n        const credential = await this.credentialRepository.findOne({\n            where: { hashedCredentialRef: this.hashCredentialRef(dto.credentialRef) },\n            relations: { user: { roles: true } },\n        });\n\n        // An unknown handle is reported exactly as a wrong MPIN is.\n        if (!credential || !credential.user) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_INVALID);\n        }\n\n        // A dead credential is reported as such regardless of what MPIN was\n        // supplied. Gating this on a correct MPIN would be marginally more\n        // conservative, but it protects almost nothing - \"this dead handle was\n        // once real\" grants no capability - and it costs an asymmetry that\n        // reads as a bug: the attempt that causes deactivation reports\n        // MPIN_REVOKED, while the very next identical attempt would report\n        // MPIN_INVALID. The enumeration resistance that matters comes from the\n        // handle being unguessable, not from this branch.\n        if (!credential.isActive) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_REVOKED);\n        }\n\n        // Checked before the hash comparison, so attempts made during a lockout\n        // neither extend it nor cost a bcrypt call.\n        this.assertNotLocked(credential);\n\n        const matches = await this.hashingService.compare(\n            dto.mpin,\n            credential.hashedMpin,\n            credential.mpinSchemeVersion,\n        );\n\n        if (!matches) {\n            throw await this.registerFailedAttempt(credential);\n        }\n\n        credential.failedAttempts = 0;\n        credential.lockedUntil = null;\n        credential.lastUsedAt = new Date();\n        if (this.hashingService.needsRehash(credential.hashedMpin, credential.mpinSchemeVersion)) {\n            credential.hashedMpin = await this.hashingService.hash(dto.mpin);\n            credential.mpinScheme = this.hashingService.name();\n            credential.mpinSchemeVersion = this.hashingService.currentVersion();\n        }\n        await this.credentialRepository.save(credential);\n\n        const user = credential.user;\n        await this.userActivityHistoryService.logEvent('login', user);\n\n        // A fresh token pair - never a replay of a stored refresh token. This\n        // is what makes MPIN survive logout and refresh-token expiry. The\n        // stable deviceId keeps repeat logins in one session bucket.\n        const tokens = await this.authenticationService.generateTokens(user, credential.deviceId);\n\n        return {\n            user: {\n                id: user.id,\n                email: user.email,\n                mobile: user.mobile,\n                username: user.username,\n                forcePasswordChange: user.forcePasswordChange,\n                roles: (user.roles ?? []).map((role) => role.name),\n            },\n            ...tokens,\n        };\n    }\n\n    // ----------------------------------------------------- device management\n\n    async listDevices(activeUser: ActiveUserData) {\n        this.assertEnabled();\n\n        const credentials = await this.credentialRepository.find({\n            where: { user: { id: activeUser.sub }, isActive: true },\n        });\n\n        return credentials\n            .sort((a, b) => this.lastUsedMillis(b) - this.lastUsedMillis(a))\n            .map((credential) => this.toDeviceView(credential));\n    }\n\n    async revokeDevice(activeUser: ActiveUserData, id: number) {\n        this.assertEnabled();\n\n        const credential = await this.credentialRepository.findOne({\n            where: { id, user: { id: activeUser.sub } },\n        });\n        if (!credential) {\n            throw new NotFoundException(ERROR_MESSAGES.MPIN_CREDENTIAL_NOT_FOUND);\n        }\n\n        // Soft-delete. The row survives so a correct MPIN can be answered with\n        // MPIN_REVOKED rather than a baffling MPIN_INVALID; only active rows\n        // count towards the device cap.\n        credential.isActive = false;\n        await this.credentialRepository.save(credential);\n\n        return { message: SUCCESS_MESSAGES.MPIN_DEVICE_REVOKED };\n    }\n\n    // -------------------------------------------------------------- internals\n\n    /**\n     * Never exposes the stored hashes, independently of whatever serialiser\n     * configuration a consuming app runs. The entity also withholds them via\n     * @Exclude()/@Expose(), but building the response explicitly means a\n     * carelessly added decorator cannot leak a credential.\n     */\n    private toDeviceView(credential: UserDeviceCredential) {\n        return {\n            id: credential.id,\n            deviceId: credential.deviceId,\n            deviceName: credential.deviceName,\n            platform: credential.platform,\n            isActive: credential.isActive,\n            failedAttempts: credential.failedAttempts,\n            lockedUntil: credential.lockedUntil,\n            lastUsedAt: credential.lastUsedAt,\n            createdAt: credential.createdAt,\n        };\n    }\n\n    private assertEnabled(): void {\n        if (!this.settingService.getConfigValue<SolidCoreSetting>('mpinEnabled')) {\n            // 404 rather than 403: a disabled feature should look absent.\n            throw new NotFoundException(ERROR_MESSAGES.MPIN_NOT_ENABLED);\n        }\n    }\n\n    private assertNotLocked(credential: UserDeviceCredential): void {\n        if (credential.lockedUntil && credential.lockedUntil.getTime() > Date.now()) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_LOCKED);\n        }\n    }\n\n    private assertMpinAcceptable(mpin: string): void {\n        const pattern = String(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinRegex') ?? '^\\\\d{4,6}$',\n        );\n\n        // Fails closed. `matches` starts false and a malformed pattern - the\n        // setting is admin-editable free text - becomes a rejection rather\n        // than a skipped check, so a typo cannot silently let users set an\n        // MPIN weaker than policy allows.\n        let matches = false;\n        try {\n            matches = new RegExp(pattern).test(mpin);\n        } catch {\n            this.logger.error(`Invalid mpinRegex setting: ${pattern}`);\n            throw new BadRequestException(ERROR_MESSAGES.MPIN_FORMAT_INVALID);\n        }\n\n        if (!matches) {\n            throw new BadRequestException(ERROR_MESSAGES.MPIN_FORMAT_INVALID);\n        }\n\n        // Predictability is semantics, not shape - a regex expressing \"not\n        // sequential\" would be unreadable and easy to get subtly wrong.\n        if (this.isPredictable(mpin)) {\n            // Safe to distinguish, and 400 rather than 401: this only ever\n            // happens on a bearer-authenticated route, so it is a validation\n            // failure rather than an authentication one.\n            throw new BadRequestException(ERROR_MESSAGES.MPIN_TOO_PREDICTABLE);\n        }\n    }\n\n    private isPredictable(mpin: string): boolean {\n        if (/^(\\d)\\1+$/.test(mpin)) {\n            return true;\n        }\n        if (this.isSequential(mpin)) {\n            return true;\n        }\n        return MPIN_DENYLIST.has(mpin);\n    }\n\n    private isSequential(mpin: string): boolean {\n        let ascending = true;\n        let descending = true;\n        for (let i = 1; i < mpin.length; i++) {\n            const step = mpin.charCodeAt(i) - mpin.charCodeAt(i - 1);\n            if (step !== 1) ascending = false;\n            if (step !== -1) descending = false;\n        }\n        return ascending || descending;\n    }\n\n    /**\n     * Records a failure and escalates. `failedAttempts` is cumulative and\n     * resets only on success - never when a lockout expires - which is what\n     * makes the second threshold detectable without a separate counter.\n     *\n     * Returns the exception for the caller to throw, so the save is always\n     * awaited before the response leaves.\n     */\n    private async registerFailedAttempt(\n        credential: UserDeviceCredential,\n    ): Promise<UnauthorizedException> {\n        const lockThreshold = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinMaxFailedAttempts'),\n        );\n        const deactivateThreshold = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinMaxTotalFailedAttempts'),\n        );\n        const lockoutSeconds = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinLockoutDuration'),\n        );\n\n        credential.failedAttempts += 1;\n        let error = new UnauthorizedException(ERROR_MESSAGES.MPIN_INVALID);\n\n        if (credential.isActive && deactivateThreshold > 0 && credential.failedAttempts >= deactivateThreshold) {\n            credential.isActive = false;\n            credential.lockedUntil = null;\n            // This attempt caused the deactivation, so it is reported. The\n            // caller reached the limit on a handle they demonstrably hold and\n            // caused this state themselves, so nothing is disclosed - and\n            // without it they would keep retrying a permanently dead credential.\n            error = new UnauthorizedException(ERROR_MESSAGES.MPIN_REVOKED);\n        } else if (credential.isActive && lockThreshold > 0 && credential.failedAttempts % lockThreshold === 0) {\n            credential.lockedUntil = new Date(Date.now() + lockoutSeconds * 1000);\n            error = new UnauthorizedException(ERROR_MESSAGES.MPIN_LOCKED);\n        }\n\n        await this.credentialRepository.save(credential);\n        return error;\n    }\n\n    /**\n     * The cap evicts rather than rejects. A reinstall wipes the client's\n     * deviceId, so the app generates a new one and setup adds a row instead of\n     * replacing the old, orphaned one. Rejecting at the cap would mean a user\n     * who reinstalls a few times could never set MPIN up again.\n     */\n    private async evictOldestIfAtCap(userId: number, excludeId?: number): Promise<void> {\n        const cap = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinMaxDevicesPerUser'),\n        );\n        if (!cap || cap <= 0) {\n            return;\n        }\n\n        const active = (await this.credentialRepository.find({\n            where: { user: { id: userId }, isActive: true },\n        })).filter((credential) => credential.id !== excludeId);\n\n        // One slot is about to be taken by the credential being written.\n        const overflow = active.length - (cap - 1);\n        if (overflow <= 0) {\n            return;\n        }\n\n        // Sorted in JS rather than SQL because a never-used credential has a\n        // null lastUsedAt, and Postgres sorts nulls last on ASC - which would\n        // treat the least-used rows as the most recently used.\n        const doomed = active\n            .sort((a, b) => this.lastUsedMillis(a) - this.lastUsedMillis(b))\n            .slice(0, overflow);\n\n        for (const credential of doomed) {\n            credential.isActive = false;\n        }\n        await this.credentialRepository.save(doomed);\n        this.logger.log(\n            `Evicted ${doomed.length} MPIN credential(s) for user ${userId} at the device cap of ${cap}`,\n        );\n    }\n\n    private lastUsedMillis(credential: UserDeviceCredential): number {\n        return credential.lastUsedAt?.getTime() ?? credential.createdAt?.getTime() ?? 0;\n    }\n\n    /**\n     * `<username>-<deviceId>`, the model's natural key.\n     *\n     * Not slugified: lodash `kebabCase` splits digit/letter boundaries, so it\n     * would shred a UUID into `3-f-7-b-8-a-10-...`. The username is lower-cased\n     * and stripped of whitespace, which is enough for a key that is only ever\n     * read, never parsed back into its parts.\n     */\n    private buildCredentialKey(username: string, deviceId: string): string {\n        const normalizedUsername = (username ?? '').trim().toLowerCase().replace(/\\s+/g, '-');\n        return `${normalizedUsername}-${deviceId}`;\n    }\n\n    private mintCredentialRef(): string {\n        return randomBytes(32).toString('hex');\n    }\n\n    // SHA-256, not bcrypt: 256 bits of randomness has nothing to brute-force,\n    // so a slow hash would only add latency to every login. Same reasoning as\n    // ApiKeyService.hash.\n    private hashCredentialRef(credentialRef: string): string {\n        return createHash('sha256').update(credentialRef).digest('hex');\n    }\n}\n"]}

package/dist/services/settings/default-settings-provider.service.d.ts

@@ -1073,6 +1073,66 @@ declare const getSolidCoreSettings: (isProd: boolean) => [{
     readonly group: "authentication-settings";
     readonly sortOrder: 200;
     readonly controlType: "boolean";
+}, {
+    readonly moduleName: "solid-core";
+    readonly key: "mpinEnabled";
+    readonly value: false;
+    readonly level: SettingLevel.SystemAdminEditable;
+    readonly label: "Enable MPIN Sign-in";
+    readonly group: "authentication-settings";
+    readonly sortOrder: 210;
+    readonly controlType: "boolean";
+    readonly helpText: "Allows users to set a short device PIN for faster sign-in. Every MPIN route returns 404 while this is off.";
+}, {
+    readonly moduleName: "solid-core";
+    readonly key: "mpinRegex";
+    readonly value: string;
+    readonly level: SettingLevel.SystemAdminEditable;
+    readonly label: "MPIN Format";
+    readonly group: "authentication-settings";
+    readonly sortOrder: 211;
+    readonly controlType: "shortText";
+    readonly helpText: "Regular expression the MPIN must match. Sole authority on MPIN length - the default allows 4 to 6 digits. Predictable PINs (repeated or sequential digits) are rejected separately.";
+}, {
+    readonly moduleName: "solid-core";
+    readonly key: "mpinMaxFailedAttempts";
+    readonly value: number;
+    readonly level: SettingLevel.SystemAdminEditable;
+    readonly label: "MPIN Attempts Before Lockout";
+    readonly group: "authentication-settings";
+    readonly sortOrder: 212;
+    readonly controlType: "numeric";
+    readonly helpText: "Cumulative failed attempts that trigger a temporary lockout. The counter resets only on a successful MPIN sign-in, not when the lockout expires.";
+}, {
+    readonly moduleName: "solid-core";
+    readonly key: "mpinLockoutDuration";
+    readonly value: number;
+    readonly level: SettingLevel.SystemAdminEditable;
+    readonly label: "MPIN Lockout Duration (seconds)";
+    readonly group: "authentication-settings";
+    readonly sortOrder: 213;
+    readonly controlType: "numeric";
+    readonly helpText: "How long the temporary lockout lasts.";
+}, {
+    readonly moduleName: "solid-core";
+    readonly key: "mpinMaxTotalFailedAttempts";
+    readonly value: number;
+    readonly level: SettingLevel.SystemAdminEditable;
+    readonly label: "MPIN Attempts Before Permanent Deactivation";
+    readonly group: "authentication-settings";
+    readonly sortOrder: 214;
+    readonly controlType: "numeric";
+    readonly helpText: "Cumulative failed attempts that permanently disable MPIN on that device. Must exceed the lockout threshold. The account itself is never locked - the user signs in normally and sets MPIN up again.";
+}, {
+    readonly moduleName: "solid-core";
+    readonly key: "mpinMaxDevicesPerUser";
+    readonly value: number;
+    readonly level: SettingLevel.SystemAdminEditable;
+    readonly label: "Max MPIN Devices Per User";
+    readonly group: "authentication-settings";
+    readonly sortOrder: 215;
+    readonly controlType: "numeric";
+    readonly helpText: "At the cap the least recently used credential is evicted rather than the setup rejected, so repeated app reinstalls cannot lock a user out of MPIN setup.";
 }, {
     readonly moduleName: "solid-core";
     readonly key: "queuesDefaultBroker";
@@ -2400,6 +2460,66 @@ export declare class SolidCoreDefaultSettingsProvider implements ISettingsProvid
         readonly group: "authentication-settings";
         readonly sortOrder: 200;
         readonly controlType: "boolean";
+    }, {
+        readonly moduleName: "solid-core";
+        readonly key: "mpinEnabled";
+        readonly value: false;
+        readonly level: SettingLevel.SystemAdminEditable;
+        readonly label: "Enable MPIN Sign-in";
+        readonly group: "authentication-settings";
+        readonly sortOrder: 210;
+        readonly controlType: "boolean";
+        readonly helpText: "Allows users to set a short device PIN for faster sign-in. Every MPIN route returns 404 while this is off.";
+    }, {
+        readonly moduleName: "solid-core";
+        readonly key: "mpinRegex";
+        readonly value: string;
+        readonly level: SettingLevel.SystemAdminEditable;
+        readonly label: "MPIN Format";
+        readonly group: "authentication-settings";
+        readonly sortOrder: 211;
+        readonly controlType: "shortText";
+        readonly helpText: "Regular expression the MPIN must match. Sole authority on MPIN length - the default allows 4 to 6 digits. Predictable PINs (repeated or sequential digits) are rejected separately.";
+    }, {
+        readonly moduleName: "solid-core";
+        readonly key: "mpinMaxFailedAttempts";
+        readonly value: number;
+        readonly level: SettingLevel.SystemAdminEditable;
+        readonly label: "MPIN Attempts Before Lockout";
+        readonly group: "authentication-settings";
+        readonly sortOrder: 212;
+        readonly controlType: "numeric";
+        readonly helpText: "Cumulative failed attempts that trigger a temporary lockout. The counter resets only on a successful MPIN sign-in, not when the lockout expires.";
+    }, {
+        readonly moduleName: "solid-core";
+        readonly key: "mpinLockoutDuration";
+        readonly value: number;
+        readonly level: SettingLevel.SystemAdminEditable;
+        readonly label: "MPIN Lockout Duration (seconds)";
+        readonly group: "authentication-settings";
+        readonly sortOrder: 213;
+        readonly controlType: "numeric";
+        readonly helpText: "How long the temporary lockout lasts.";
+    }, {
+        readonly moduleName: "solid-core";
+        readonly key: "mpinMaxTotalFailedAttempts";
+        readonly value: number;
+        readonly level: SettingLevel.SystemAdminEditable;
+        readonly label: "MPIN Attempts Before Permanent Deactivation";
+        readonly group: "authentication-settings";
+        readonly sortOrder: 214;
+        readonly controlType: "numeric";
+        readonly helpText: "Cumulative failed attempts that permanently disable MPIN on that device. Must exceed the lockout threshold. The account itself is never locked - the user signs in normally and sets MPIN up again.";
+    }, {
+        readonly moduleName: "solid-core";
+        readonly key: "mpinMaxDevicesPerUser";
+        readonly value: number;
+        readonly level: SettingLevel.SystemAdminEditable;
+        readonly label: "Max MPIN Devices Per User";
+        readonly group: "authentication-settings";
+        readonly sortOrder: 215;
+        readonly controlType: "numeric";
+        readonly helpText: "At the cap the least recently used credential is evicted rather than the setup rejected, so repeated app reinstalls cannot lock a user out of MPIN setup.";
     }, {
         readonly moduleName: "solid-core";
         readonly key: "queuesDefaultBroker";

package/dist/services/settings/default-settings-provider.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-settings-provider.service.d.ts","sourceRoot":"","sources":["../../../src/services/settings/default-settings-provider.service.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,iBAAiB,EAEjB,YAAY,EACb,MAAM,gBAAgB,CAAC;AAGxB,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AACxD,eAAO,MAAM,8BAA8B,wBAAwB,CAAC;AAUpE,QAAA,MAAM,oBAAoB,GAAI,QAAQ,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8+CH,CAAC;AAG3C,MAAM,MAAM,gBAAgB,GAAG,UAAU,CACvC,OAAO,oBAAoB,CAC5B,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;AAGjB,qBAEa,gCAAiC,YAAW,iBAAiB;IACxE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIZ"}
+{"version":3,"file":"default-settings-provider.service.d.ts","sourceRoot":"","sources":["../../../src/services/settings/default-settings-provider.service.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,iBAAiB,EAEjB,YAAY,EACb,MAAM,gBAAgB,CAAC;AAGxB,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AACxD,eAAO,MAAM,8BAA8B,wBAAwB,CAAC;AAUpE,QAAA,MAAM,oBAAoB,GAAI,QAAQ,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqjDH,CAAC;AAG3C,MAAM,MAAM,gBAAgB,GAAG,UAAU,CACvC,OAAO,oBAAoB,CAC5B,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;AAGjB,qBAEa,gCAAiC,YAAW,iBAAiB;IACxE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIZ"}

package/dist/services/settings/default-settings-provider.service.js

@@ -1201,6 +1201,72 @@ const getSolidCoreSettings = (isProd) => [
         sortOrder: 200,
         controlType: "boolean",
     },
+    {
+        moduleName: "solid-core",
+        key: "mpinEnabled",
+        value: false,
+        level: interfaces_1.SettingLevel.SystemAdminEditable,
+        label: "Enable MPIN Sign-in",
+        group: "authentication-settings",
+        sortOrder: 210,
+        controlType: "boolean",
+        helpText: "Allows users to set a short device PIN for faster sign-in. Every MPIN route returns 404 while this is off.",
+    },
+    {
+        moduleName: "solid-core",
+        key: "mpinRegex",
+        value: process.env.IAM_MPIN_REGEX ?? "^\\d{4,6}$",
+        level: interfaces_1.SettingLevel.SystemAdminEditable,
+        label: "MPIN Format",
+        group: "authentication-settings",
+        sortOrder: 211,
+        controlType: "shortText",
+        helpText: "Regular expression the MPIN must match. Sole authority on MPIN length - the default allows 4 to 6 digits. Predictable PINs (repeated or sequential digits) are rejected separately.",
+    },
+    {
+        moduleName: "solid-core",
+        key: "mpinMaxFailedAttempts",
+        value: parseInt(process.env.IAM_MPIN_MAX_FAILED_ATTEMPTS ?? "5", 10),
+        level: interfaces_1.SettingLevel.SystemAdminEditable,
+        label: "MPIN Attempts Before Lockout",
+        group: "authentication-settings",
+        sortOrder: 212,
+        controlType: "numeric",
+        helpText: "Cumulative failed attempts that trigger a temporary lockout. The counter resets only on a successful MPIN sign-in, not when the lockout expires.",
+    },
+    {
+        moduleName: "solid-core",
+        key: "mpinLockoutDuration",
+        value: parseInt(process.env.IAM_MPIN_LOCKOUT_DURATION ?? "900", 10),
+        level: interfaces_1.SettingLevel.SystemAdminEditable,
+        label: "MPIN Lockout Duration (seconds)",
+        group: "authentication-settings",
+        sortOrder: 213,
+        controlType: "numeric",
+        helpText: "How long the temporary lockout lasts.",
+    },
+    {
+        moduleName: "solid-core",
+        key: "mpinMaxTotalFailedAttempts",
+        value: parseInt(process.env.IAM_MPIN_MAX_TOTAL_FAILED_ATTEMPTS ?? "10", 10),
+        level: interfaces_1.SettingLevel.SystemAdminEditable,
+        label: "MPIN Attempts Before Permanent Deactivation",
+        group: "authentication-settings",
+        sortOrder: 214,
+        controlType: "numeric",
+        helpText: "Cumulative failed attempts that permanently disable MPIN on that device. Must exceed the lockout threshold. The account itself is never locked - the user signs in normally and sets MPIN up again.",
+    },
+    {
+        moduleName: "solid-core",
+        key: "mpinMaxDevicesPerUser",
+        value: parseInt(process.env.IAM_MPIN_MAX_DEVICES_PER_USER ?? "5", 10),
+        level: interfaces_1.SettingLevel.SystemAdminEditable,
+        label: "Max MPIN Devices Per User",
+        group: "authentication-settings",
+        sortOrder: 215,
+        controlType: "numeric",
+        helpText: "At the cap the least recently used credential is evicted rather than the setup rejected, so repeated app reinstalls cannot lock a user out of MPIN setup.",
+    },
     {
         moduleName: "solid-core",
         key: "queuesDefaultBroker",