@spinajs/authn-orm 0.0.0-stage → 3.0.0

package/lib/mjs/mfa/cipher.js

@@ -0,0 +1,76 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import { InvalidArgument, InvalidOption } from '@spinajs/exceptions';
+import { _check_arg, _is_string, _non_empty, _reg_match } from '@spinajs/util';
+import { identityKey } from '../identity.js';
+const ALGORITHM = 'aes-256-gcm';
+const VERSION = 'v1';
+const KEY_BYTES = 32;
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const HEX = /^[0-9a-fA-F]{64}$/;
+const BASE64 = /^[A-Za-z0-9+/]{43}=?$/;
+const BASE64URL = /^[A-Za-z0-9_-]{43}$/;
+/**
+ * Reads a 32-byte key given as 64 hex characters, base64 (44, or 43 unpadded) or base64url (43). Anything else
+ * throws `InvalidOption`; the message never contains the value.
+ */
+export function mfaKeyFrom(secret) {
+    let key;
+    if (typeof secret === 'string') {
+        if (HEX.test(secret)) {
+            key = Buffer.from(secret, 'hex');
+        }
+        else if (BASE64.test(secret) || BASE64URL.test(secret)) {
+            key = Buffer.from(secret, 'base64');
+            // Unused low bits in the last character would let several texts name one key.
+            if (key.toString('base64url') !== secret.replace(/=$/, '').replace(/\+/g, '-').replace(/\//g, '_'))
+                key = undefined;
+        }
+    }
+    if (!key || key.length !== KEY_BYTES) {
+        throw new InvalidOption('authn.mfa.encryptionKey.secret must be 32 bytes given as 64 hex characters, base64 or base64url');
+    }
+    const result = { keyId: createHash('sha256').update(key).digest('base64url').slice(0, 16) };
+    Object.defineProperty(result, 'key', { value: key, enumerable: false });
+    return Object.freeze(result);
+}
+function aad(identity, step) {
+    const id = typeof identity === 'string' ? identity : identityKey(identity);
+    _check_arg(_is_string(_non_empty()))(id, 'identity');
+    // With no "|" in the step, the last "|" splits the AAD into exactly one (identity, step) pair.
+    _check_arg(_is_string(_non_empty(), _reg_match(/^[^|]*$/)))(step, 'step');
+    return Buffer.from(`${id}|${step}`, 'utf8');
+}
+/** AES-256-GCM under `key` with AAD `${identity}|${step}`; returns `v1.<iv>.<tag>.<ct>`, each part base64url. */
+export function encryptMfaSecret(key, identity, step, plain) {
+    _check_arg(_is_string(_non_empty()))(plain, 'plain');
+    const ad = aad(identity, step);
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv(ALGORITHM, key.key, iv, { authTagLength: TAG_BYTES });
+    cipher.setAAD(ad);
+    const ct = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+    return [VERSION, iv.toString('base64url'), cipher.getAuthTag().toString('base64url'), ct.toString('base64url')].join('.');
+}
+const PART = /^[A-Za-z0-9_-]+$/;
+/** Throws `InvalidArgument` on a malformed text, another key, a changed text or another row's identity or step. */
+export function decryptMfaSecret(key, identity, step, enc) {
+    const ad = aad(identity, step);
+    const parts = typeof enc === 'string' ? enc.split('.') : [];
+    if (parts.length !== 4 || parts[0] !== VERSION || !parts.slice(1).every((p) => PART.test(p))) {
+        throw new InvalidArgument('MFA cipher: the cipher text is not of the form v1.<iv>.<tag>.<ct>');
+    }
+    const [iv, tag, ct] = parts.slice(1).map((p) => Buffer.from(p, 'base64url'));
+    if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES) {
+        throw new InvalidArgument('MFA cipher: the cipher text has a wrong IV or tag length');
+    }
+    try {
+        const decipher = createDecipheriv(ALGORITHM, key.key, iv, { authTagLength: TAG_BYTES });
+        decipher.setAAD(ad);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ct), decipher.final()]).toString('utf8');
+    }
+    catch (err) {
+        throw new InvalidArgument('MFA cipher: the cipher text does not decrypt under this key for this identity and step', undefined, undefined, err);
+    }
+}
+//# sourceMappingURL=cipher.js.map

package/lib/mjs/mfa/cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../../src/mfa/cipher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGxF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AAUrB,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAChC,MAAM,MAAM,GAAG,uBAAuB,CAAC;AACvC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,IAAI,GAAuB,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpC,8EAA8E;YAC9E,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,GAAG,GAAG,SAAS,CAAC;QACtH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CAAC,iGAAiG,CAAC,CAAC;IAC7H,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAoC,CAAC;IAC9H,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,GAAG,CAAC,QAA8B,EAAE,IAAY;IACvD,MAAM,EAAE,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC3E,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACrD,+FAA+F;IAC/F,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAA8B,EAAE,IAAY,EAAE,KAAa;IACvG,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACpF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5H,CAAC;AAED,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAEhC,mHAAmH;AACnH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAA8B,EAAE,IAAY,EAAE,GAAW;IACrG,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,eAAe,CAAC,mEAAmE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7E,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,0DAA0D,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,wFAAwF,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACjJ,CAAC;AACH,CAAC"}

package/lib/mjs/mfa/db-mfa-enrolments.d.ts

@@ -0,0 +1,14 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+import { MfaEnrolments } from '@spinajs/authn/mfa-enrolments';
+import { DbMfaStore } from './db-mfa-store.js';
+/** The confirmed steps of `authn_mfa` for DefaultMfaPolicy and authn:check-config, whether authn.mfa.steps lists them or not. */
+export declare class DbMfaEnrolments extends MfaEnrolments {
+    private readonly db?;
+    protected DbMfaStore: DbMfaStore;
+    /** DI passes nothing and injects `DbMfaStore`. */
+    constructor(db?: DbMfaStore | undefined);
+    private store;
+    stepsOf(id: IdentityRef): Promise<readonly string[]>;
+    stepNames(): Promise<readonly string[]>;
+}
+//# sourceMappingURL=db-mfa-enrolments.d.ts.map

package/lib/mjs/mfa/db-mfa-enrolments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-enrolments.d.ts","sourceRoot":"","sources":["../../../src/mfa/db-mfa-enrolments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAG9D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,iIAAiI;AACjI,qBAEa,eAAgB,SAAQ,aAAa;IAKpC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAHhC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAEjC,kDAAkD;IAClD,YAA6B,EAAE,CAAC,EAAE,UAAU,YAAA,EAE3C;IAED,OAAO,CAAC,KAAK;IAIN,OAAO,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAE1D;IAEM,SAAS,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAE7C;CACF"}

package/lib/mjs/mfa/db-mfa-enrolments.js

@@ -0,0 +1,40 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { MfaEnrolments } from '@spinajs/authn/mfa-enrolments';
+import { Autoinject, Injectable, PerChildInstance } from '@spinajs/di';
+import { DbMfaStore } from './db-mfa-store.js';
+/** The confirmed steps of `authn_mfa` for DefaultMfaPolicy and authn:check-config, whether authn.mfa.steps lists them or not. */
+let DbMfaEnrolments = class DbMfaEnrolments extends MfaEnrolments {
+    /** DI passes nothing and injects `DbMfaStore`. */
+    constructor(db) {
+        super();
+        this.db = db;
+    }
+    store() {
+        return this.db ?? this.DbMfaStore;
+    }
+    stepsOf(id) {
+        return this.store().confirmedSteps(id);
+    }
+    stepNames() {
+        return this.store().confirmedStepNames();
+    }
+};
+__decorate([
+    Autoinject(DbMfaStore),
+    __metadata("design:type", DbMfaStore)
+], DbMfaEnrolments.prototype, "DbMfaStore", void 0);
+DbMfaEnrolments = __decorate([
+    PerChildInstance(),
+    Injectable(MfaEnrolments),
+    __metadata("design:paramtypes", [DbMfaStore])
+], DbMfaEnrolments);
+export { DbMfaEnrolments };
+//# sourceMappingURL=db-mfa-enrolments.js.map

package/lib/mjs/mfa/db-mfa-enrolments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-enrolments.js","sourceRoot":"","sources":["../../../src/mfa/db-mfa-enrolments.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,iIAAiI;AAG1H,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,aAAa;IAIhD,kDAAkD;IAClD,YAA6B,EAAe;QAC1C,KAAK,EAAE,CAAC;kBADmB,EAAE;IAE/B,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAEM,OAAO,CAAC,EAAe;QAC5B,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;IAC3C,CAAC;CACF,CAAA;AAlBW;IADT,UAAU,CAAC,UAAU,CAAC;8BACD,UAAU;mDAAC;AAFtB,eAAe;IAF3B,gBAAgB,EAAE;IAClB,UAAU,CAAC,aAAa,CAAC;qCAMU,UAAU;GALjC,eAAe,CAoB3B"}

package/lib/mjs/mfa/db-mfa-store.d.ts

@@ -0,0 +1,51 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+/** One MFA step of an identity as stored. */
+export interface MfaRecord {
+    /** Cipher text exactly as `putPending` was given it; this store never encrypts or decrypts. */
+    readonly secretEnc: string;
+    readonly keyId: string;
+    readonly confirmedAt: Date | null;
+    /** The last accepted time step. */
+    readonly lastStep: number | null;
+    readonly createdAt: Date;
+}
+/**
+ * `authn_mfa` and `authn_recovery_code` for MFA steps (authn-totp, N5). Rows are keyed by `identityKey(id)` and
+ * the step name. The store keeps cipher text and its key id only (SR-09); recovery codes are stored as hex SHA-256,
+ * never raw, and callers normalise a code before passing it. Replay and single use are decided in SQL (SR-15, D10).
+ *
+ * Without transactions (the sqlite driver shares one handle) `replaceRecoveryCodes` deletes and then inserts: two
+ * parallel calls for one identity may leave both sets.
+ */
+export declare class DbMfaStore {
+    get(id: IdentityRef, step: string): Promise<MfaRecord | null>;
+    /**
+     * Stores the step unconfirmed, with no accepted time step and created now, replacing a pending one. A confirmed
+     * step is never overwritten: false means a confirmed row exists and nothing changed. The
+     * replacing update is conditional on `confirmed_at IS NULL`, so a confirmation that lands first always wins.
+     */
+    putPending(id: IdentityRef, step: string, secretEnc: string, keyId: string): Promise<boolean>;
+    /**
+     * Sets `confirmed_at` (default now); true when the step exists. With `expectedSecretEnc`, only an unconfirmed step
+     * holding that cipher text is confirmed, so the answer is true for exactly the call that confirmed it.
+     */
+    confirm(id: IdentityRef, step: string, at?: Date, expectedSecretEnc?: string): Promise<boolean>;
+    /** True once per time step, and never for a step at or below the last accepted one (SR-15); false when the step does not exist. */
+    acceptStep(id: IdentityRef, step: string, timeStep: number): Promise<boolean>;
+    remove(id: IdentityRef, step: string): Promise<void>;
+    /** The names of the identity's confirmed steps. */
+    confirmedSteps(id: IdentityRef): Promise<string[]>;
+    /**
+     * Each step name with a confirmed row of any identity, once. Deduplicated here, not with DISTINCT, which folds
+     * `totp` and `TOTP` into one under a case-blind collation (MySQL's default); one row per confirmed enrolment.
+     */
+    confirmedStepNames(): Promise<string[]>;
+    /** Deletes the identity's codes, then stores the SHA-256 of each new one. Empty or repeated codes throw. */
+    replaceRecoveryCodes(id: IdentityRef, rawCodes: readonly string[]): Promise<void>;
+    /** Spends the code in one conditional update; true for exactly one caller. */
+    redeemRecoveryCode(id: IdentityRef, raw: string): Promise<boolean>;
+    /** Unused codes. */
+    countRecoveryCodes(id: IdentityRef): Promise<number>;
+    removeRecoveryCodes(id: IdentityRef): Promise<void>;
+}
+//# sourceMappingURL=db-mfa-store.d.ts.map

package/lib/mjs/mfa/db-mfa-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-store.d.ts","sourceRoot":"","sources":["../../../src/mfa/db-mfa-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAmB5D,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IAClC,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAkBD;;;;;;;GAOG;AACH,qBAEa,UAAU;IACR,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAczE;IAED;;;;OAIG;IACU,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBzG;IAED;;;OAGG;IACU,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAavH;IAED,mIAAmI;IACtH,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUzF;IAEY,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhE;IAED,mDAAmD;IACtC,cAAc,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAK9D;IAED;;;OAGG;IACU,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAInD;IAED,4GAA4G;IAC/F,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7F;IAED,8EAA8E;IACjE,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9E;IAED,oBAAoB;IACP,kBAAkB,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAKhE;IAEY,mBAAmB,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;CACF"}

package/lib/mjs/mfa/db-mfa-store.js

@@ -0,0 +1,187 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { randomUUID } from 'node:crypto';
+import { Injectable, PerChildInstance } from '@spinajs/di';
+import { InvalidArgument, UnexpectedServerError } from '@spinajs/exceptions';
+import { UniqueViolation, ormReady } from '@spinajs/orm';
+import { _between, _check_arg, _integer, _is_array, _is_number, _is_string, _max_length, _non_empty, _try_check_arg } from '@spinajs/util';
+import { identityKey } from '../identity.js';
+import { AuthnMfa } from '../models/AuthnMfa.js';
+import { AuthnRecoveryCode } from '../models/AuthnRecoveryCode.js';
+import { checkedMs, checkedText, dateOf, instant, sha256hex } from '../support/sql.js';
+import { columnValues } from '../support/values.js';
+/** Each retry means a parallel `remove` deleted the row between this call's insert and update. */
+const MAX_TRIES = 8;
+/** As DbSecretStore: longer input is refused before hashing. */
+const RAW_MAX = 1024;
+const stepName = (step) => checkedText(step, 32, 'DbMfaStore: step');
+function lastStepOf(value) {
+    if (value === null || value === undefined)
+        return null;
+    const n = typeof value === 'number' ? value : Number(String(value));
+    if (!Number.isSafeInteger(n))
+        throw new UnexpectedServerError(`DbMfaStore: last_step ${String(value)} is not a safe integer`);
+    return n;
+}
+const confirmed = (r) => r.confirmed_at !== null && r.confirmed_at !== undefined;
+/** The columns `putPending` writes: unconfirmed, no accepted time step. */
+function pending(secretEnc, keyId, createdAt) {
+    return columnValues({ secret_enc: secretEnc, secret_hash: sha256hex(secretEnc), key_id: keyId, confirmed_at: null, last_step: null, created_at: createdAt });
+}
+/**
+ * `authn_mfa` and `authn_recovery_code` for MFA steps (authn-totp, N5). Rows are keyed by `identityKey(id)` and
+ * the step name. The store keeps cipher text and its key id only (SR-09); recovery codes are stored as hex SHA-256,
+ * never raw, and callers normalise a code before passing it. Replay and single use are decided in SQL (SR-15, D10).
+ *
+ * Without transactions (the sqlite driver shares one handle) `replaceRecoveryCodes` deletes and then inserts: two
+ * parallel calls for one identity may leave both sets.
+ */
+let DbMfaStore = class DbMfaStore {
+    async get(id, step) {
+        const identity = identityKey(id);
+        const name = stepName(step);
+        await ormReady();
+        const rows = await AuthnMfa.query().columns(['identity', 'step', 'secret_enc', 'key_id', 'last_step', 'confirmed_at', 'created_at']).where('identity', identity).where('step', name);
+        const r = rows.find((x) => x.identity === identity && x.step === name);
+        if (!r)
+            return null;
+        return {
+            secretEnc: r.secret_enc,
+            keyId: r.key_id,
+            confirmedAt: r.confirmed_at ? dateOf(r.confirmed_at) : null,
+            lastStep: lastStepOf(r.last_step),
+            createdAt: dateOf(r.created_at),
+        };
+    }
+    /**
+     * Stores the step unconfirmed, with no accepted time step and created now, replacing a pending one. A confirmed
+     * step is never overwritten: false means a confirmed row exists and nothing changed. The
+     * replacing update is conditional on `confirmed_at IS NULL`, so a confirmation that lands first always wins.
+     */
+    async putPending(id, step, secretEnc, keyId) {
+        const identity = identityKey(id);
+        const name = stepName(step);
+        checkedText(secretEnc, Number.MAX_SAFE_INTEGER, 'DbMfaStore: secretEnc');
+        checkedText(keyId, 32, 'DbMfaStore: keyId');
+        const ms = checkedMs(new Date(), 'DbMfaStore.putPending: the clock');
+        await ormReady();
+        const fields = pending(secretEnc, keyId, instant(ms));
+        for (let i = 0; i < MAX_TRIES; i++) {
+            try {
+                await AuthnMfa.insert({ identity, step: name, ...fields });
+                return true;
+            }
+            catch (err) {
+                if (!(err instanceof UniqueViolation))
+                    throw err;
+            }
+            if ((await AuthnMfa.update(fields).where('identity', identity).where('step', name).whereNull('confirmed_at')).RowsAffected === 1)
+                return true;
+            // No row updated: either it is confirmed, or a parallel remove deleted it and the insert is worth retrying.
+            if ((await this.get(id, name))?.confirmedAt)
+                return false;
+        }
+        throw new UnexpectedServerError(`DbMfaStore.putPending: the ${name} row kept changing under this call`);
+    }
+    /**
+     * Sets `confirmed_at` (default now); true when the step exists. With `expectedSecretEnc`, only an unconfirmed step
+     * holding that cipher text is confirmed, so the answer is true for exactly the call that confirmed it.
+     */
+    async confirm(id, step, at = new Date(), expectedSecretEnc) {
+        const identity = identityKey(id);
+        const name = stepName(step);
+        const ms = checkedMs(at, 'DbMfaStore.confirm: at');
+        if (expectedSecretEnc !== undefined)
+            checkedText(expectedSecretEnc, Number.MAX_SAFE_INTEGER, 'DbMfaStore: expectedSecretEnc');
+        await ormReady();
+        const q = AuthnMfa.update({ confirmed_at: instant(ms) })
+            .where('identity', identity)
+            .where('step', name);
+        if (expectedSecretEnc !== undefined) {
+            q.whereNull('confirmed_at').where('secret_hash', sha256hex(expectedSecretEnc));
+        }
+        return (await q).RowsAffected === 1;
+    }
+    /** True once per time step, and never for a step at or below the last accepted one (SR-15); false when the step does not exist. */
+    async acceptStep(id, step, timeStep) {
+        const identity = identityKey(id);
+        const name = stepName(step);
+        _check_arg(_is_number(_integer(), _between(0, Number.MAX_SAFE_INTEGER)))(timeStep, 'timeStep');
+        await ormReady();
+        const older = function () {
+            this.whereNull('last_step');
+            this.orWhere('last_step', '<', timeStep);
+        };
+        return (await AuthnMfa.update({ last_step: timeStep }).where('identity', identity).where('step', name).where(older)).RowsAffected === 1;
+    }
+    async remove(id, step) {
+        const identity = identityKey(id);
+        const name = stepName(step);
+        await ormReady();
+        await AuthnMfa.destroy().where('identity', identity).where('step', name);
+    }
+    /** The names of the identity's confirmed steps. */
+    async confirmedSteps(id) {
+        const identity = identityKey(id);
+        await ormReady();
+        const rows = await AuthnMfa.query().columns(['identity', 'step', 'confirmed_at']).where('identity', identity).whereNotNull('confirmed_at');
+        return rows.filter((r) => r.identity === identity && confirmed(r)).map((r) => r.step);
+    }
+    /**
+     * Each step name with a confirmed row of any identity, once. Deduplicated here, not with DISTINCT, which folds
+     * `totp` and `TOTP` into one under a case-blind collation (MySQL's default); one row per confirmed enrolment.
+     */
+    async confirmedStepNames() {
+        await ormReady();
+        const rows = await AuthnMfa.query().columns(['step', 'confirmed_at']).whereNotNull('confirmed_at');
+        return [...new Set(rows.filter(confirmed).map((r) => r.step))];
+    }
+    /** Deletes the identity's codes, then stores the SHA-256 of each new one. Empty or repeated codes throw. */
+    async replaceRecoveryCodes(id, rawCodes) {
+        const identity = identityKey(id);
+        _check_arg(_is_array())(rawCodes, 'rawCodes');
+        const hashes = rawCodes.map((code) => sha256hex(checkedText(code, Number.MAX_SAFE_INTEGER, 'DbMfaStore: a recovery code')));
+        if (new Set(hashes).size !== hashes.length)
+            throw new InvalidArgument('DbMfaStore.replaceRecoveryCodes: the codes repeat');
+        await ormReady();
+        await AuthnRecoveryCode.destroy().where('identity', identity);
+        if (hashes.length === 0)
+            return;
+        await AuthnRecoveryCode.insert(hashes.map((code_hash) => columnValues({ id: randomUUID(), identity, code_hash, used_at: null })));
+    }
+    /** Spends the code in one conditional update; true for exactly one caller. */
+    async redeemRecoveryCode(id, raw) {
+        const identity = identityKey(id);
+        if (!_try_check_arg(_is_string(_non_empty(), _max_length(RAW_MAX)))(raw, 'raw')[0])
+            return false;
+        const ms = checkedMs(new Date(), 'DbMfaStore.redeemRecoveryCode: the clock');
+        await ormReady();
+        const r = await AuthnRecoveryCode.update({ used_at: instant(ms) })
+            .where('identity', identity)
+            .where('code_hash', sha256hex(raw))
+            .whereNull('used_at');
+        return r.RowsAffected > 0;
+    }
+    /** Unused codes. */
+    async countRecoveryCodes(id) {
+        const identity = identityKey(id);
+        await ormReady();
+        const rows = await AuthnRecoveryCode.query().columns(['identity']).where('identity', identity).whereNull('used_at');
+        return rows.filter((r) => r.identity === identity).length;
+    }
+    async removeRecoveryCodes(id) {
+        const identity = identityKey(id);
+        await ormReady();
+        await AuthnRecoveryCode.destroy().where('identity', identity);
+    }
+};
+DbMfaStore = __decorate([
+    PerChildInstance(),
+    Injectable()
+], DbMfaStore);
+export { DbMfaStore };
+//# sourceMappingURL=db-mfa-store.js.map

package/lib/mjs/mfa/db-mfa-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-store.js","sourceRoot":"","sources":["../../../src/mfa/db-mfa-store.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAI3I,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,kGAAkG;AAClG,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,gEAAgE;AAChE,MAAM,OAAO,GAAG,IAAI,CAAC;AAarB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAErF,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC9H,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC;AAEpG,2EAA2E;AAC3E,SAAS,OAAO,CAAC,SAAiB,EAAE,KAAa,EAAE,SAAmB;IACpE,OAAO,YAAY,CAAW,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;AACzK,CAAC;AAED;;;;;;;GAOG;AAGI,IAAM,UAAU,GAAhB,MAAM,UAAU;IACd,KAAK,CAAC,GAAG,CAAC,EAAe,EAAE,IAAY;QAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrL,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,KAAK,EAAE,CAAC,CAAC,MAAM;YACf,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YAC3D,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACjC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;SAChC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,UAAU,CAAC,EAAe,EAAE,IAAY,EAAE,SAAiB,EAAE,KAAa;QACrF,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;QACzE,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACrE,MAAM,QAAQ,EAAE,CAAC;QAEjB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,eAAe,CAAC;oBAAE,MAAM,GAAG,CAAC;YACnD,CAAC;YACD,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9I,4GAA4G;YAC5G,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,WAAW;gBAAE,OAAO,KAAK,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,IAAI,oCAAoC,CAAC,CAAC;IAC1G,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,OAAO,CAAC,EAAe,EAAE,IAAY,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE,EAAE,iBAA0B;QACnG,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACnD,IAAI,iBAAiB,KAAK,SAAS;YAAE,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QAC9H,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;aACrD,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;aAC3B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,mIAAmI;IAC5H,KAAK,CAAC,UAAU,CAAC,EAAe,EAAE,IAAY,EAAE,QAAgB;QACrE,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/F,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG;YACZ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC;IAC1I,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAe,EAAE,IAAY;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,mDAAmD;IAC5C,KAAK,CAAC,cAAc,CAAC,EAAe;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAC3I,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB;QAC7B,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,4GAA4G;IACrG,KAAK,CAAC,oBAAoB,CAAC,EAAe,EAAE,QAA2B;QAC5E,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;QAC5H,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;QAC3H,MAAM,QAAQ,EAAE,CAAC;QAEjB,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAoB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvJ,CAAC;IAED,8EAA8E;IACvE,KAAK,CAAC,kBAAkB,CAAC,EAAe,EAAE,GAAW;QAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjG,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAC7E,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;aAC/D,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;aAC3B,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;aAClC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,oBAAoB;IACb,KAAK,CAAC,kBAAkB,CAAC,EAAe;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpH,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,EAAe;QAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AA7IY,UAAU;IAFtB,gBAAgB,EAAE;IAClB,UAAU,EAAE;GACA,UAAU,CA6ItB"}

package/lib/mjs/mfa/index.d.ts

@@ -0,0 +1,4 @@
+export * from './db-mfa-store.js';
+export * from './db-mfa-enrolments.js';
+export * from './cipher.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/mfa/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC"}

package/lib/mjs/mfa/index.js

@@ -0,0 +1,4 @@
+export * from './db-mfa-store.js';
+export * from './db-mfa-enrolments.js';
+export * from './cipher.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/mfa/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC"}

package/lib/mjs/migrations/AuthnInitial_2026_10_02_00_00_00.d.ts

@@ -0,0 +1,10 @@
+import { OrmDriver, OrmMigration } from '@spinajs/orm';
+/**
+ * The authn-orm tables of design §22.16, plus `authn_recovery_code_owner`. The schema builder has no `char`
+ * type, so the `char(64)` hash columns are `varchar(64)`.
+ */
+export declare class AuthnInitial_2026_10_02_00_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    down(connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=AuthnInitial_2026_10_02_00_00_00.d.ts.map

package/lib/mjs/migrations/AuthnInitial_2026_10_02_00_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnInitial_2026_10_02_00_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/AuthnInitial_2026_10_02_00_00_00.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIlE;;;GAGG;AACH,qBACa,gCAAiC,SAAQ,YAAY;IACnD,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA4EpD;IAEY,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAItD;CACF"}

package/lib/mjs/migrations/AuthnInitial_2026_10_02_00_00_00.js

@@ -0,0 +1,95 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Migration, OrmMigration } from '@spinajs/orm';
+const TABLES = ['authn_identity', 'authn_throttle', 'authn_audit', 'authn_secret', 'authn_mfa', 'authn_recovery_code', 'authn_nonce'];
+/**
+ * The authn-orm tables of design §22.16, plus `authn_recovery_code_owner`. The schema builder has no `char`
+ * type, so the `char(64)` hash columns are `varchar(64)`.
+ */
+let AuthnInitial_2026_10_02_00_00_00 = class AuthnInitial_2026_10_02_00_00_00 extends OrmMigration {
+    async up(connection) {
+        await connection.schema().createTable('authn_identity', (table) => {
+            table.string('id', 36).notNull().primaryKey();
+            table.string('identity_type', 16).notNull();
+            table.string('identity_id', 64).notNull();
+            table.string('provider', 128).notNull();
+            table.string('subject', 255).notNull();
+            table.string('email', 255);
+            table.boolean('email_verified').notNull().default().value(0);
+            table.text('attributes');
+            table.dateTime('linked_at').notNull();
+            table.dateTime('last_used_at');
+        });
+        await connection.index().unique().table('authn_identity').name('authn_identity_subject').columns(['provider', 'subject']);
+        await connection.index().table('authn_identity').name('authn_identity_owner').columns(['identity_type', 'identity_id']);
+        await connection.schema().createTable('authn_throttle', (table) => {
+            table.string('k', 255).notNull().primaryKey();
+            table.int('attempts').notNull();
+            table.dateTime('last_attempt_at').notNull();
+            table.dateTime('next_allowed_at').notNull();
+            table.dateTime('updated_at').notNull();
+        });
+        await connection.schema().createTable('authn_audit', (table) => {
+            table.string('id', 36).notNull().primaryKey();
+            table.dateTime('at').notNull();
+            table.string('type', 32).notNull();
+            table.string('outcome', 8).notNull();
+            table.string('identity', 100);
+            table.string('actor', 100);
+            table.string('strategy', 64);
+            table.string('reason', 64);
+            table.string('ip', 64);
+            table.string('user_agent', 255);
+            table.string('session', 64);
+            table.text('data');
+        });
+        await connection.index().table('authn_audit').name('authn_audit_at').columns(['at']);
+        await connection.index().table('authn_audit').name('authn_audit_identity').columns(['identity', 'at']);
+        await connection.schema().createTable('authn_secret', (table) => {
+            table.string('id', 36).notNull().primaryKey();
+            table.string('identity', 100).notNull();
+            table.string('purpose', 32).notNull();
+            table.string('secret_hash', 64).notNull();
+            table.dateTime('expires_at').notNull();
+            table.dateTime('used_at');
+            table.dateTime('created_at').notNull();
+        });
+        await connection.index().unique().table('authn_secret').name('authn_secret_hash').columns(['secret_hash']);
+        await connection.index().table('authn_secret').name('authn_secret_owner').columns(['identity', 'purpose']);
+        await connection.schema().createTable('authn_mfa', (table) => {
+            table.string('identity', 100).notNull().primaryKey();
+            table.string('step', 32).notNull().primaryKey();
+            table.text('secret_enc').notNull();
+            table.string('secret_hash', 64).notNull();
+            table.string('key_id', 32).notNull();
+            table.dateTime('confirmed_at');
+            table.bigint('last_step');
+            table.dateTime('created_at').notNull();
+        });
+        await connection.schema().createTable('authn_recovery_code', (table) => {
+            table.string('id', 36).notNull().primaryKey();
+            table.string('identity', 100).notNull();
+            table.string('code_hash', 64).notNull();
+            table.dateTime('used_at');
+        });
+        await connection.index().table('authn_recovery_code').name('authn_recovery_code_owner').columns(['identity']);
+        await connection.schema().createTable('authn_nonce', (table) => {
+            table.string('k', 160).notNull().primaryKey();
+            table.dateTime('expires_at').notNull();
+        });
+    }
+    async down(connection) {
+        for (const table of [...TABLES].reverse()) {
+            await connection.schema().dropTable(table);
+        }
+    }
+};
+AuthnInitial_2026_10_02_00_00_00 = __decorate([
+    Migration('default')
+], AuthnInitial_2026_10_02_00_00_00);
+export { AuthnInitial_2026_10_02_00_00_00 };
+//# sourceMappingURL=AuthnInitial_2026_10_02_00_00_00.js.map

package/lib/mjs/migrations/AuthnInitial_2026_10_02_00_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnInitial_2026_10_02_00_00_00.js","sourceRoot":"","sources":["../../../src/migrations/AuthnInitial_2026_10_02_00_00_00.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,SAAS,EAAa,YAAY,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,MAAM,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,qBAAqB,EAAE,aAAa,CAAC,CAAC;AAEtI;;;GAGG;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAiC,SAAQ,YAAY;IACzD,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAChE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACvC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3B,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1H,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;QAExH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAChE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;YAChC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE;YAC7D,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACrC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3B,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC7B,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAChC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QAEvG,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;YAC9D,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;YACvC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC1B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3G,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QAE3G,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3D,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YACrD,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACrC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC/B,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC1B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE;YACrE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAE9G,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE;YAC7D,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,UAAqB;QACrC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1C,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;CACF,CAAA;AApFY,gCAAgC;IAD5C,SAAS,CAAC,SAAS,CAAC;GACR,gCAAgC,CAoF5C"}

package/lib/mjs/migrations/index.d.ts

@@ -0,0 +1,2 @@
+export * from './AuthnInitial_2026_10_02_00_00_00.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC"}

package/lib/mjs/migrations/index.js

@@ -0,0 +1,2 @@
+export * from './AuthnInitial_2026_10_02_00_00_00.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC"}

package/lib/mjs/models/AuthnAudit.d.ts

@@ -0,0 +1,18 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnAudit extends ModelBase<AuthnAudit> {
+    id: string;
+    at: DateTime;
+    type: string;
+    outcome: string;
+    identity?: string | null;
+    actor?: string | null;
+    strategy?: string | null;
+    reason?: string | null;
+    ip?: string | null;
+    user_agent?: string | null;
+    session?: string | null;
+    /** JSON text. */
+    data?: string | null;
+}
+//# sourceMappingURL=AuthnAudit.d.ts.map

package/lib/mjs/models/AuthnAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnAudit.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnAudit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,UAAW,SAAQ,SAAS,CAAC,UAAU,CAAC;IAE5C,EAAE,EAAE,MAAM,CAAC;IAGX,EAAE,EAAE,QAAQ,CAAC;IAEb,IAAI,EAAE,MAAM,CAAC;IAEb,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B,iBAAiB;IACV,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B"}

package/lib/mjs/models/AuthnAudit.js

@@ -0,0 +1,27 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+let AuthnAudit = class AuthnAudit extends ModelBase {
+};
+__decorate([
+    Primary({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnAudit.prototype, "id", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnAudit.prototype, "at", void 0);
+AuthnAudit = __decorate([
+    Connection('default'),
+    Model('authn_audit')
+], AuthnAudit);
+export { AuthnAudit };
+//# sourceMappingURL=AuthnAudit.js.map