@spinajs/authn-orm 0.0.0-stage → 3.0.0

package/README.md

@@ -1,3 +1,85 @@
-# Temporary Holding Version
+# `@spinajs/authn-orm`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+ORM stores and migrations for SpinaJS authentication (design §22.12, §22.13, §22.16,
+§22.18).
+
+## Migrations
+
+Importing the package registers `AuthnInitial_2026_10_02_00_00_00` on the `default` connection. It
+creates `authn_identity`, `authn_throttle`, `authn_audit`, `authn_secret`, `authn_mfa`,
+`authn_recovery_code` and `authn_nonce`. Nothing is carried over from 2.x `users_metadata`: 2.x TOTP
+enrolments, pending resets and invites do not survive the upgrade.
+
+## Services
+
+Each one is registered under its class name, so configuration can name it:
+
+| Contract | Class | Config |
+|---|---|---|
+| `AuthnThrottle` | `DbAuthnThrottle` | used when `authn.throttle.service` is unset (or named) |
+| `SecretStore` | `DbSecretStore` | — |
+| `IdentityLinkStore` | `DbIdentityLinkStore` | — |
+| `AuthnEventSink` | `DbAuthnAuditSink` | gets every event |
+| — | `DbNonceStore` (`NonceStore`, `MemoryNonceStore`) | — |
+| — | `DbMfaStore` | for MFA steps (authn-totp) |
+
+Once this package is imported, the core uses `DbAuthnThrottle` when `authn.throttle.service` is unset:
+it takes the only registered throttle besides `MemoryAuthnThrottle`. An app that wants the memory
+throttle names it. The package ships no config file: config files load whether or not their package
+is imported, so a shipped service name would break an app that has this package installed but unused
+(authn-totp depends on it). `DbAuthnAuditSink` gets every event once registered.
+
+The MFA cipher (`mfaKeyFrom`, `encryptMfaSecret`, `decryptMfaSecret`) uses AES-256-GCM.
+The format is `v1.<iv>.<tag>.<ct>`, and the additional authenticated data is
+`<identity>|<step>`. Callers must build the identity from `users.Uuid` exactly as it is
+stored (`user:<Uuid>`), or the secret will not decrypt. Recovery codes are stored as
+unsalted SHA-256, so steps must generate codes of at least 80 bits.
+The cipher and `identityKey` are also exported from the side-effect-free subpaths
+`@spinajs/authn-orm/cipher` and `@spinajs/authn-orm/identity`, which register nothing.
+
+Every store reads and writes through the package's models (`AuthnIdentity`, `AuthnSecret`,
+`AuthnNonce`, `AuthnMfa`, `AuthnRecoveryCode`, `AuthnThrottle`, `AuthnAudit`), which name the
+table and the `default` connection. The stores take no driver: a store awaits `ormReady()` before
+its first statement, and a test boots an Orm whose `default` connection is the database under test.
+The stores, `DbAuthnThrottle` and `DbMfaEnrolments` are `@PerChildInstance`: each container that
+resolves one gets its own instance, and the throttle reads that container's configuration.
+
+## Rules the stores keep
+
+- **Time comes from Node.** "Now" is `ctx.now`, or `Date` at call time; SQL `now()` is
+  never used. Every claim, expiry or compare-and-set is decided in SQL against bound
+  values. Datetimes are written as UTC (ISO-8601 text on SQLite).
+- **Secrets are never stored in clear:**
+  - single-use secrets and recovery codes are kept as SHA-256 only;
+  - TOTP secrets are kept as cipher text only;
+  - throttle keys are kept as an HMAC under `authn.audit.hashKey.secret`. Without that
+    secret the HMAC key is a public constant, so anyone who reads `authn_throttle` can
+    test guessed logins and IPs against it. The store warns once at start.
+- **A login throttles, it never locks.** Attempts are counted before verification, one
+  compare-and-set per key, so a burst gets exactly `free` verifications (A05, A06).
+
+## Supported drivers and known gaps
+
+- sqlite and postgres are tested against a real database. MySQL and MSSQL are checked only
+  as compiled SQL.
+- **postgres:** node-postgres reads `timestamp` as local time. A value that falls in the
+  local spring DST gap therefore reads back one hour late. This needs a fix in
+  orm-postgres; no store depends on such a read for a decision.
+- **MySQL and MSSQL:**
+  - `datetime` precision is lower, so the throttle's undo may miss, which errs towards
+    more throttling. A sub-second `baseDelayMs` is not supported there.
+  - Default collations ignore case. Every read therefore also checks identity, step,
+    purpose, provider and subject for exact equality in Node. Writes keyed by identity
+    still rely on the collation, so on these drivers the identity columns need a binary
+    collation.
+- **Races:** two parallel `issue` calls, or two `replaceRecoveryCodes` calls, for the same
+  identity and purpose can leave two live rows. This is because the stores use no
+  transactions, since the sqlite driver shares one handle.
+
+## Throttle store
+
+`DbAuthnThrottle` is a `StoreAuthnThrottle` (`@spinajs/authn`) over `DbThrottleStore`, a util `ThrottleStore` on
+`authn_throttle`. The flow rules, keys and config are in `packages/authn/src/throttle/README.md`. `DbThrottleStore`
+is exported for reuse and tests; `DbAuthnThrottle.createStore(options)` is the protected seam that builds it (override it to wrap or replace the store).
+Writes are compare-and-set statements without a transaction (the sqlite driver shares one handle), so a lost race
+only throttles more.

package/lib/cjs/audit/db-audit-sink.d.ts

@@ -0,0 +1,11 @@
+import { AuthnEventSink } from '@spinajs/authn/contracts';
+import type { AuthnEvent } from '@spinajs/authn/contracts';
+/**
+ * One `authn_audit` row per event (SR-11). Nothing in an event makes the write fail, so a sink never fails a call
+ * whose work is already done (D4 over D1): free text longer than its column is cut, and an identity or actor that
+ * does not fit its column leaves the column null and goes whole into `data` (`identityRef`, `actorRef`).
+ */
+export declare class DbAuthnAuditSink extends AuthnEventSink {
+    publish(e: AuthnEvent): Promise<void>;
+}
+//# sourceMappingURL=db-audit-sink.d.ts.map

package/lib/cjs/audit/db-audit-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-audit-sink.d.ts","sourceRoot":"","sources":["../../../src/audit/db-audit-sink.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,0BAA0B,CAAC;AA0BtF;;;;GAIG;AACH,qBAEa,gBAAiB,SAAQ,cAAc;IACrC,OAAO,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BjD;CACF"}

package/lib/cjs/audit/db-audit-sink.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbAuthnAuditSink = void 0;
+const node_crypto_1 = require("node:crypto");
+const contracts_1 = require("@spinajs/authn/contracts");
+const di_1 = require("@spinajs/di");
+const orm_1 = require("@spinajs/orm");
+const identity_js_1 = require("../identity.js");
+const AuthnAudit_js_1 = require("../models/AuthnAudit.js");
+const sql_js_1 = require("../support/sql.js");
+const values_js_1 = require("../support/values.js");
+function keyOrNull(ref) {
+    if (!ref)
+        return null;
+    try {
+        return (0, identity_js_1.identityKey)(ref);
+    }
+    catch {
+        return null;
+    }
+}
+function json(value) {
+    try {
+        return JSON.stringify(value, (_k, v) => (typeof v === 'bigint' ? v.toString() : v));
+    }
+    catch {
+        return JSON.stringify({ unserialisable: true });
+    }
+}
+/**
+ * One `authn_audit` row per event (SR-11). Nothing in an event makes the write fail, so a sink never fails a call
+ * whose work is already done (D4 over D1): free text longer than its column is cut, and an identity or actor that
+ * does not fit its column leaves the column null and goes whole into `data` (`identityRef`, `actorRef`).
+ */
+let DbAuthnAuditSink = class DbAuthnAuditSink extends contracts_1.AuthnEventSink {
+    async publish(e) {
+        const identity = keyOrNull(e.identity);
+        const actor = keyOrNull(e.actor);
+        const extra = {
+            ...(e.identity && identity === null ? { identityRef: { type: e.identity.type, id: e.identity.id } } : {}),
+            ...(e.actor && actor === null ? { actorRef: { type: e.actor.type, id: e.actor.id } } : {}),
+        };
+        const data = e.data === undefined && Object.keys(extra).length === 0 ? undefined : { ...(e.data ?? {}), ...extra };
+        const at = (0, sql_js_1.instant)((0, sql_js_1.checkedMs)(e.at, 'DbAuthnAuditSink.publish: e.at'));
+        await (0, orm_1.ormReady)();
+        await AuthnAudit_js_1.AuthnAudit.insert((0, values_js_1.columnValues)({
+            id: (0, node_crypto_1.randomUUID)(),
+            at,
+            type: (0, sql_js_1.cutText)(e.type, 32),
+            outcome: (0, sql_js_1.cutText)(e.outcome, 8),
+            identity,
+            actor,
+            strategy: (0, sql_js_1.cutText)(e.strategy, 64),
+            reason: (0, sql_js_1.cutText)(e.reason, 64),
+            ip: (0, sql_js_1.cutText)(e.ip, 64),
+            user_agent: (0, sql_js_1.cutText)(e.userAgent, 255),
+            session: (0, sql_js_1.cutText)(e.session, 64),
+            data: data === undefined ? null : json(data),
+        }));
+    }
+};
+exports.DbAuthnAuditSink = DbAuthnAuditSink;
+exports.DbAuthnAuditSink = DbAuthnAuditSink = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)(contracts_1.AuthnEventSink)
+], DbAuthnAuditSink);
+//# sourceMappingURL=db-audit-sink.js.map

package/lib/cjs/audit/db-audit-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-audit-sink.js","sourceRoot":"","sources":["../../../src/audit/db-audit-sink.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6CAAyC;AAEzC,wDAA0D;AAE1D,oCAA2D;AAC3D,sCAAwC;AAExC,gDAA6C;AAC7C,2DAAqD;AACrD,8CAAgE;AAChE,oDAAoD;AAEpD,SAAS,SAAS,CAAC,GAA2C;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;GAIG;AAGI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,0BAAc;IAC3C,KAAK,CAAC,OAAO,CAAC,CAAa;QAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;QACnH,MAAM,EAAE,GAAG,IAAA,gBAAO,EAAC,IAAA,kBAAS,EAAC,CAAC,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,0BAAU,CAAC,MAAM,CACrB,IAAA,wBAAY,EAAa;YACvB,EAAE,EAAE,IAAA,wBAAU,GAAE;YAChB,EAAE;YACF,IAAI,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,QAAQ,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,MAAM,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7B,EAAE,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACrB,UAAU,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC;YACrC,OAAO,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/B,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7C,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;;2BA5BY,gBAAgB;IAF5B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,0BAAc,CAAC;GACd,gBAAgB,CA4B5B"}

package/lib/cjs/audit/index.d.ts

@@ -0,0 +1,2 @@
+export { DbAuthnAuditSink } from './db-audit-sink.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}

package/lib/cjs/audit/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbAuthnAuditSink = void 0;
+var db_audit_sink_js_1 = require("./db-audit-sink.js");
+Object.defineProperty(exports, "DbAuthnAuditSink", { enumerable: true, get: function () { return db_audit_sink_js_1.DbAuthnAuditSink; } });
+//# sourceMappingURL=index.js.map

package/lib/cjs/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":";;;AAAA,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA"}

package/lib/cjs/identity.d.ts

@@ -0,0 +1,6 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+/** `${type}:${id}`, the form `identity` and `actor` columns hold (D1). Never truncates: too long throws. */
+export declare function identityKey(ref: IdentityRef, maxLength?: number): string;
+/** Splits at the first `:`; the id may contain more. */
+export declare function parseIdentityKey(key: string): IdentityRef;
+//# sourceMappingURL=identity.d.ts.map

package/lib/cjs/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAI5D,4GAA4G;AAC5G,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,SAAM,GAAG,MAAM,CAWrE;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAMzD"}

package/lib/cjs/identity.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityKey = identityKey;
+exports.parseIdentityKey = parseIdentityKey;
+const exceptions_1 = require("@spinajs/exceptions");
+const util_1 = require("@spinajs/util");
+/** `${type}:${id}`, the form `identity` and `actor` columns hold (D1). Never truncates: too long throws. */
+function identityKey(ref, maxLength = 100) {
+    (0, util_1._check_arg)((0, util_1._is_string)((0, util_1._non_empty)()))(ref?.type, 'identity type');
+    if (ref.type.includes(':')) {
+        throw new exceptions_1.InvalidArgument(`identity type "${ref.type}" contains ":"`);
+    }
+    const key = `${ref.type}:${ref.id}`;
+    if (key.length > maxLength) {
+        throw new exceptions_1.InvalidArgument(`identity key of type "${ref.type}" is ${key.length} characters long, the column holds ${maxLength}`);
+    }
+    return key;
+}
+/** Splits at the first `:`; the id may contain more. */
+function parseIdentityKey(key) {
+    const at = key.indexOf(':');
+    if (at <= 0) {
+        throw new exceptions_1.InvalidArgument('identity key is not of the form <type>:<id>');
+    }
+    return { type: key.slice(0, at), id: key.slice(at + 1) };
+}
+//# sourceMappingURL=identity.js.map

package/lib/cjs/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":";;;;AACA,oDAAsD;AACtD,wCAAmE;AAEnE,4GAA4G;AAC5G,qBAA4B,GAAgB,EAAE,SAAS,GAAG,GAAG;IAC3D,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACjE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,4BAAe,CAAC,kBAAkB,GAAG,CAAC,IAAI,gBAAgB,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,4BAAe,CAAC,yBAAyB,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,sCAAsC,SAAS,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,0BAAiC,GAAW;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,4BAAe,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC"}

package/lib/cjs/index.d.ts

@@ -0,0 +1,10 @@
+export * from './migrations/index.js';
+export * from './models/index.js';
+export * from './identity.js';
+export * from './throttle/index.js';
+export * from './secrets/index.js';
+export * from './links/index.js';
+export * from './nonces/index.js';
+export * from './mfa/index.js';
+export * from './audit/index.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}

package/lib/cjs/index.js

@@ -0,0 +1,26 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./migrations/index.js"), exports);
+__exportStar(require("./models/index.js"), exports);
+__exportStar(require("./identity.js"), exports);
+__exportStar(require("./throttle/index.js"), exports);
+__exportStar(require("./secrets/index.js"), exports);
+__exportStar(require("./links/index.js"), exports);
+__exportStar(require("./nonces/index.js"), exports);
+__exportStar(require("./mfa/index.js"), exports);
+__exportStar(require("./audit/index.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAAsC;AACtC,oDAAkC;AAClC,gDAA8B;AAC9B,sDAAoC;AACpC,qDAAmC;AACnC,mDAAiC;AACjC,oDAAkC;AAClC,iDAA+B;AAC/B,mDAAiC"}

package/lib/cjs/links/db-link-store.d.ts

@@ -0,0 +1,13 @@
+import { IdentityLinkStore } from '@spinajs/authn/contracts';
+import type { ExternalSubject, IdentityLink, IdentityRef } from '@spinajs/authn/contracts';
+/** `authn_identity`: external subjects linked to identities (A19). Values longer than their columns throw (D1). */
+export declare class DbIdentityLinkStore extends IdentityLinkStore {
+    find(provider: string, subject: string): Promise<IdentityLink | null>;
+    list(identity: IdentityRef): Promise<readonly IdentityLink[]>;
+    /** A duplicate (provider, subject) rejects with `ResourceDuplicated` (the unique index decides). */
+    link(identity: IdentityRef, external: ExternalSubject): Promise<IdentityLink>;
+    unlink(id: string): Promise<void>;
+    /** Sets `last_used_at` (default now); true when the link exists. */
+    touch(id: string, at?: Date): Promise<boolean>;
+}
+//# sourceMappingURL=db-link-store.d.ts.map

package/lib/cjs/links/db-link-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-link-store.d.ts","sourceRoot":"","sources":["../../../src/links/db-link-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAiB3F,mHAAmH;AACnH,qBAEa,mBAAoB,SAAQ,iBAAiB;IAC3C,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAOjF;IAEY,IAAI,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAKzE;IAED,oGAAoG;IACvF,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgBzF;IAEY,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7C;IAED,oEAAoE;IACvD,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAKtE;CACF"}

package/lib/cjs/links/db-link-store.js

@@ -0,0 +1,88 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbIdentityLinkStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const contracts_1 = require("@spinajs/authn/contracts");
+const di_1 = require("@spinajs/di");
+const exceptions_1 = require("@spinajs/exceptions");
+const orm_1 = require("@spinajs/orm");
+const AuthnIdentity_js_1 = require("../models/AuthnIdentity.js");
+const sql_js_1 = require("../support/sql.js");
+const values_js_1 = require("../support/values.js");
+const LINK_COLUMNS = ['id', 'identity_type', 'identity_id', 'provider', 'subject', 'email', 'linked_at', 'last_used_at'];
+function identityParts(ref) {
+    const type = (0, sql_js_1.checkedText)(ref?.type, 16, 'DbIdentityLinkStore: identity type');
+    if (type.includes(':'))
+        throw new exceptions_1.InvalidArgument(`DbIdentityLinkStore: identity type "${type}" contains ":"`);
+    return { type, id: (0, sql_js_1.checkedText)(ref.id, 64, 'DbIdentityLinkStore: identity id') };
+}
+/** `authn_identity`: external subjects linked to identities (A19). Values longer than their columns throw (D1). */
+let DbIdentityLinkStore = class DbIdentityLinkStore extends contracts_1.IdentityLinkStore {
+    async find(provider, subject) {
+        await (0, orm_1.ormReady)();
+        const rows = await AuthnIdentity_js_1.AuthnIdentity.query().columns(LINK_COLUMNS).where('provider', provider).where('subject', subject);
+        // MySQL and MSSQL default collations ignore case (and accents or trailing spaces): a subject differing only that
+        // way must not sign in as another account.
+        const exact = rows.find((r) => r.provider === provider && r.subject === subject);
+        return exact ? toLink(exact) : null;
+    }
+    async list(identity) {
+        const { type, id } = identityParts(identity);
+        await (0, orm_1.ormReady)();
+        const rows = await AuthnIdentity_js_1.AuthnIdentity.query().columns(LINK_COLUMNS).where('identity_type', type).where('identity_id', id).orderBy('linked_at');
+        return rows.filter((r) => r.identity_type === type && r.identity_id === id).map(toLink);
+    }
+    /** A duplicate (provider, subject) rejects with `ResourceDuplicated` (the unique index decides). */
+    async link(identity, external) {
+        const { type, id } = identityParts(identity);
+        const provider = (0, sql_js_1.checkedText)(external?.provider, 128, 'DbIdentityLinkStore: provider');
+        const subject = (0, sql_js_1.checkedText)(external.subject, 255, 'DbIdentityLinkStore: subject');
+        const email = external.email === undefined || external.email === null ? undefined : (0, sql_js_1.checkedText)(external.email, 255, 'DbIdentityLinkStore: email', true);
+        const nowMs = (0, sql_js_1.checkedMs)(new Date(), 'DbIdentityLinkStore.link: the clock');
+        await (0, orm_1.ormReady)();
+        const linkId = (0, node_crypto_1.randomUUID)();
+        try {
+            await AuthnIdentity_js_1.AuthnIdentity.insert((0, values_js_1.columnValues)({ id: linkId, identity_type: type, identity_id: id, provider, subject, email: email ?? null, email_verified: external.emailVerified === true, attributes: null, linked_at: (0, sql_js_1.instant)(nowMs), last_used_at: null }));
+        }
+        catch (err) {
+            if (err instanceof orm_1.UniqueViolation)
+                throw new exceptions_1.ResourceDuplicated(`DbIdentityLinkStore: (${provider}, subject) is already linked`, err);
+            throw err;
+        }
+        return { id: linkId, identity: { type, id }, provider, subject, ...(email !== undefined ? { email } : {}), linkedAt: new Date(nowMs) };
+    }
+    async unlink(id) {
+        await (0, orm_1.ormReady)();
+        await AuthnIdentity_js_1.AuthnIdentity.destroy().where('id', id);
+    }
+    /** Sets `last_used_at` (default now); true when the link exists. */
+    async touch(id, at = new Date()) {
+        const ms = (0, sql_js_1.checkedMs)(at, 'DbIdentityLinkStore.touch: at');
+        await (0, orm_1.ormReady)();
+        const { RowsAffected } = await AuthnIdentity_js_1.AuthnIdentity.update({ last_used_at: (0, sql_js_1.instant)(ms) }).where('id', id);
+        return RowsAffected === 1;
+    }
+};
+exports.DbIdentityLinkStore = DbIdentityLinkStore;
+exports.DbIdentityLinkStore = DbIdentityLinkStore = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)(contracts_1.IdentityLinkStore)
+], DbIdentityLinkStore);
+function toLink(r) {
+    return {
+        id: r.id,
+        identity: { type: r.identity_type, id: r.identity_id },
+        provider: r.provider,
+        subject: r.subject,
+        ...(r.email !== null && r.email !== undefined ? { email: r.email } : {}),
+        linkedAt: (0, sql_js_1.dateOf)(r.linked_at),
+        ...(r.last_used_at ? { lastUsedAt: (0, sql_js_1.dateOf)(r.last_used_at) } : {}),
+    };
+}
+//# sourceMappingURL=db-link-store.js.map

package/lib/cjs/links/db-link-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-link-store.js","sourceRoot":"","sources":["../../../src/links/db-link-store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6CAAyC;AAEzC,wDAA6D;AAE7D,oCAA2D;AAC3D,oDAA0E;AAC1E,sCAAyD;AAEzD,iEAA2D;AAC3D,8CAA4E;AAC5E,oDAAoD;AAEpD,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAEzH,SAAS,aAAa,CAAC,GAAgB;IACrC,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,4BAAe,CAAC,uCAAuC,IAAI,gBAAgB,CAAC,CAAC;IAC/G,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAA,oBAAW,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,kCAAkC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,mHAAmH;AAG5G,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,6BAAiB;IACjD,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAAe;QACjD,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,gCAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrH,iHAAiH;QACjH,2CAA2C;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,QAAqB;QACrC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,gCAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1I,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,oGAAoG;IAC7F,KAAK,CAAC,IAAI,CAAC,QAAqB,EAAE,QAAyB;QAChE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,IAAA,oBAAW,EAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACzJ,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC3E,MAAM,IAAA,cAAQ,GAAE,CAAC;QAEjB,MAAM,MAAM,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,gCAAa,CAAC,MAAM,CAAC,IAAA,wBAAY,EAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAA,gBAAO,EAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3Q,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAe;gBAAE,MAAM,IAAI,+BAAkB,CAAC,yBAAyB,QAAQ,8BAA8B,EAAE,GAAG,CAAC,CAAC;YACvI,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACzI,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAU;QAC5B,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,gCAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,oEAAoE;IAC7D,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE;QAClD,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC1D,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,gCAAa,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAA,gBAAO,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;;8BAhDY,mBAAmB;IAF/B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,6BAAiB,CAAC;GACjB,mBAAmB,CAgD/B;AAED,SAAS,MAAM,CAAC,CAAgB;IAC9B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;QACtD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,QAAQ,EAAE,IAAA,eAAM,EAAC,CAAC,CAAC,SAAS,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAA,eAAM,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC"}

package/lib/cjs/links/index.d.ts

@@ -0,0 +1,2 @@
+export { DbIdentityLinkStore } from './db-link-store.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/links/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/links/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/lib/cjs/links/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbIdentityLinkStore = void 0;
+var db_link_store_js_1 = require("./db-link-store.js");
+Object.defineProperty(exports, "DbIdentityLinkStore", { enumerable: true, get: function () { return db_link_store_js_1.DbIdentityLinkStore; } });
+//# sourceMappingURL=index.js.map

package/lib/cjs/links/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/links/index.ts"],"names":[],"mappings":";;;AAAA,uDAAyD;AAAhD,uHAAA,mBAAmB,OAAA"}

package/lib/cjs/mfa/cipher.d.ts

@@ -0,0 +1,18 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+/** The MFA encryption key (`authn.mfa.encryptionKey.secret`) and its id, which `authn_mfa.key_id` stores. */
+export interface MfaKey {
+    /** Not enumerable, so it stays out of logs and JSON. */
+    readonly key: Buffer;
+    /** The first 16 characters of base64url(SHA-256(key)). */
+    readonly keyId: string;
+}
+/**
+ * Reads a 32-byte key given as 64 hex characters, base64 (44, or 43 unpadded) or base64url (43). Anything else
+ * throws `InvalidOption`; the message never contains the value.
+ */
+export declare function mfaKeyFrom(secret: string): MfaKey;
+/** AES-256-GCM under `key` with AAD `${identity}|${step}`; returns `v1.<iv>.<tag>.<ct>`, each part base64url. */
+export declare function encryptMfaSecret(key: MfaKey, identity: IdentityRef | string, step: string, plain: string): string;
+/** Throws `InvalidArgument` on a malformed text, another key, a changed text or another row's identity or step. */
+export declare function decryptMfaSecret(key: MfaKey, identity: IdentityRef | string, step: string, enc: string): string;
+//# sourceMappingURL=cipher.d.ts.map

package/lib/cjs/mfa/cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../../src/mfa/cipher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAY5D,6GAA6G;AAC7G,MAAM,WAAW,MAAM;IACrB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBjD;AAUD,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQjH;AAID,mHAAmH;AACnH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAmB/G"}

package/lib/cjs/mfa/cipher.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mfaKeyFrom = mfaKeyFrom;
+exports.encryptMfaSecret = encryptMfaSecret;
+exports.decryptMfaSecret = decryptMfaSecret;
+const node_crypto_1 = require("node:crypto");
+const exceptions_1 = require("@spinajs/exceptions");
+const util_1 = require("@spinajs/util");
+const identity_js_1 = require("../identity.js");
+const ALGORITHM = 'aes-256-gcm';
+const VERSION = 'v1';
+const KEY_BYTES = 32;
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const HEX = /^[0-9a-fA-F]{64}$/;
+const BASE64 = /^[A-Za-z0-9+/]{43}=?$/;
+const BASE64URL = /^[A-Za-z0-9_-]{43}$/;
+/**
+ * Reads a 32-byte key given as 64 hex characters, base64 (44, or 43 unpadded) or base64url (43). Anything else
+ * throws `InvalidOption`; the message never contains the value.
+ */
+function mfaKeyFrom(secret) {
+    let key;
+    if (typeof secret === 'string') {
+        if (HEX.test(secret)) {
+            key = Buffer.from(secret, 'hex');
+        }
+        else if (BASE64.test(secret) || BASE64URL.test(secret)) {
+            key = Buffer.from(secret, 'base64');
+            // Unused low bits in the last character would let several texts name one key.
+            if (key.toString('base64url') !== secret.replace(/=$/, '').replace(/\+/g, '-').replace(/\//g, '_'))
+                key = undefined;
+        }
+    }
+    if (!key || key.length !== KEY_BYTES) {
+        throw new exceptions_1.InvalidOption('authn.mfa.encryptionKey.secret must be 32 bytes given as 64 hex characters, base64 or base64url');
+    }
+    const result = { keyId: (0, node_crypto_1.createHash)('sha256').update(key).digest('base64url').slice(0, 16) };
+    Object.defineProperty(result, 'key', { value: key, enumerable: false });
+    return Object.freeze(result);
+}
+function aad(identity, step) {
+    const id = typeof identity === 'string' ? identity : (0, identity_js_1.identityKey)(identity);
+    (0, util_1._check_arg)((0, util_1._is_string)((0, util_1._non_empty)()))(id, 'identity');
+    // With no "|" in the step, the last "|" splits the AAD into exactly one (identity, step) pair.
+    (0, util_1._check_arg)((0, util_1._is_string)((0, util_1._non_empty)(), (0, util_1._reg_match)(/^[^|]*$/)))(step, 'step');
+    return Buffer.from(`${id}|${step}`, 'utf8');
+}
+/** AES-256-GCM under `key` with AAD `${identity}|${step}`; returns `v1.<iv>.<tag>.<ct>`, each part base64url. */
+function encryptMfaSecret(key, identity, step, plain) {
+    (0, util_1._check_arg)((0, util_1._is_string)((0, util_1._non_empty)()))(plain, 'plain');
+    const ad = aad(identity, step);
+    const iv = (0, node_crypto_1.randomBytes)(IV_BYTES);
+    const cipher = (0, node_crypto_1.createCipheriv)(ALGORITHM, key.key, iv, { authTagLength: TAG_BYTES });
+    cipher.setAAD(ad);
+    const ct = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+    return [VERSION, iv.toString('base64url'), cipher.getAuthTag().toString('base64url'), ct.toString('base64url')].join('.');
+}
+const PART = /^[A-Za-z0-9_-]+$/;
+/** Throws `InvalidArgument` on a malformed text, another key, a changed text or another row's identity or step. */
+function decryptMfaSecret(key, identity, step, enc) {
+    const ad = aad(identity, step);
+    const parts = typeof enc === 'string' ? enc.split('.') : [];
+    if (parts.length !== 4 || parts[0] !== VERSION || !parts.slice(1).every((p) => PART.test(p))) {
+        throw new exceptions_1.InvalidArgument('MFA cipher: the cipher text is not of the form v1.<iv>.<tag>.<ct>');
+    }
+    const [iv, tag, ct] = parts.slice(1).map((p) => Buffer.from(p, 'base64url'));
+    if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES) {
+        throw new exceptions_1.InvalidArgument('MFA cipher: the cipher text has a wrong IV or tag length');
+    }
+    try {
+        const decipher = (0, node_crypto_1.createDecipheriv)(ALGORITHM, key.key, iv, { authTagLength: TAG_BYTES });
+        decipher.setAAD(ad);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ct), decipher.final()]).toString('utf8');
+    }
+    catch (err) {
+        throw new exceptions_1.InvalidArgument('MFA cipher: the cipher text does not decrypt under this key for this identity and step', undefined, undefined, err);
+    }
+}
+//# sourceMappingURL=cipher.js.map

package/lib/cjs/mfa/cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../../src/mfa/cipher.ts"],"names":[],"mappings":";;;;;AAAA,6CAAwF;AAGxF,oDAAqE;AACrE,wCAA+E;AAE/E,gDAA6C;AAE7C,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AAUrB,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAChC,MAAM,MAAM,GAAG,uBAAuB,CAAC;AACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC;;;GAGG;AACH,oBAA2B,MAAc;IACvC,IAAI,GAAuB,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpC,8EAA8E;YAC9E,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,GAAG,GAAG,SAAS,CAAC;QACtH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,0BAAa,CAAC,iGAAiG,CAAC,CAAC;IAC7H,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAoC,CAAC;IAC9H,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,GAAG,CAAC,QAA8B,EAAE,IAAY;IACvD,MAAM,EAAE,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;IAC3E,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACrD,+FAA+F;IAC/F,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,iBAAU,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,iHAAiH;AACjH,0BAAiC,GAAW,EAAE,QAA8B,EAAE,IAAY,EAAE,KAAa;IACvG,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACpF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5H,CAAC;AAED,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAEhC,mHAAmH;AACnH,0BAAiC,GAAW,EAAE,QAA8B,EAAE,IAAY,EAAE,GAAW;IACrG,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,4BAAe,CAAC,mEAAmE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7E,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,4BAAe,CAAC,0DAA0D,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,4BAAe,CAAC,wFAAwF,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC"}

package/lib/cjs/mfa/db-mfa-enrolments.d.ts

@@ -0,0 +1,14 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+import { MfaEnrolments } from '@spinajs/authn/mfa-enrolments';
+import { DbMfaStore } from './db-mfa-store.js';
+/** The confirmed steps of `authn_mfa` for DefaultMfaPolicy and authn:check-config, whether authn.mfa.steps lists them or not. */
+export declare class DbMfaEnrolments extends MfaEnrolments {
+    private readonly db?;
+    protected DbMfaStore: DbMfaStore;
+    /** DI passes nothing and injects `DbMfaStore`. */
+    constructor(db?: DbMfaStore | undefined);
+    private store;
+    stepsOf(id: IdentityRef): Promise<readonly string[]>;
+    stepNames(): Promise<readonly string[]>;
+}
+//# sourceMappingURL=db-mfa-enrolments.d.ts.map

package/lib/cjs/mfa/db-mfa-enrolments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-enrolments.d.ts","sourceRoot":"","sources":["../../../src/mfa/db-mfa-enrolments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAG9D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,iIAAiI;AACjI,qBAEa,eAAgB,SAAQ,aAAa;IAKpC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAHhC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAEjC,kDAAkD;IAClD,YAA6B,EAAE,CAAC,EAAE,UAAU,YAAA,EAE3C;IAED,OAAO,CAAC,KAAK;IAIN,OAAO,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAE1D;IAEM,SAAS,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAE7C;CACF"}

package/lib/cjs/mfa/db-mfa-enrolments.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbMfaEnrolments = void 0;
+const mfa_enrolments_1 = require("@spinajs/authn/mfa-enrolments");
+const di_1 = require("@spinajs/di");
+const db_mfa_store_js_1 = require("./db-mfa-store.js");
+/** The confirmed steps of `authn_mfa` for DefaultMfaPolicy and authn:check-config, whether authn.mfa.steps lists them or not. */
+let DbMfaEnrolments = class DbMfaEnrolments extends mfa_enrolments_1.MfaEnrolments {
+    /** DI passes nothing and injects `DbMfaStore`. */
+    constructor(db) {
+        super();
+        this.db = db;
+    }
+    store() {
+        return this.db ?? this.DbMfaStore;
+    }
+    stepsOf(id) {
+        return this.store().confirmedSteps(id);
+    }
+    stepNames() {
+        return this.store().confirmedStepNames();
+    }
+};
+exports.DbMfaEnrolments = DbMfaEnrolments;
+__decorate([
+    (0, di_1.Autoinject)(db_mfa_store_js_1.DbMfaStore),
+    __metadata("design:type", db_mfa_store_js_1.DbMfaStore)
+], DbMfaEnrolments.prototype, "DbMfaStore", void 0);
+exports.DbMfaEnrolments = DbMfaEnrolments = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)(mfa_enrolments_1.MfaEnrolments),
+    __metadata("design:paramtypes", [db_mfa_store_js_1.DbMfaStore])
+], DbMfaEnrolments);
+//# sourceMappingURL=db-mfa-enrolments.js.map

package/lib/cjs/mfa/db-mfa-enrolments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-enrolments.js","sourceRoot":"","sources":["../../../src/mfa/db-mfa-enrolments.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,kEAA8D;AAC9D,oCAAuE;AAEvE,uDAA+C;AAE/C,iIAAiI;AAG1H,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,8BAAa;IAIhD,kDAAkD;IAClD,YAA6B,EAAe;QAC1C,KAAK,EAAE,CAAC;kBADmB,EAAE;IAE/B,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAEM,OAAO,CAAC,EAAe;QAC5B,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;IAC3C,CAAC;CACF,CAAA;;AAlBW;IADT,IAAA,eAAU,EAAC,4BAAU,CAAC;8BACD,4BAAU;mDAAC;0BAFtB,eAAe;IAF3B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,8BAAa,CAAC;qCAMU,4BAAU;GALjC,eAAe,CAoB3B"}