@spinajs/rbac-http-user 2.0.501 → 2.0.504

package/lib/mjs/controllers/LoginController.js

@@ -63,7 +63,16 @@ let LoginController = class LoginController extends BaseController {
             session.Data.set('Logged', true);
             session.UserId = user.Id;
             const twoFaEnabledForUser = Boolean(user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]);
-            if (this.TwoFactorAuthForceUser && !twoFaEnabledForUser) {
+            // `forceUser` alone used to be enough to park the user in
+            // TwoFactorInitRequired. But every mutating `/user/2fa*` and
+            // `/auth/2fa/setup` handler now calls `assertSystemEnabled()` and throws
+            // 403 when `rbac.twoFactorAuth.enabled` is off — so a user forced into
+            // this branch while the system switch is off would have no route back
+            // out: setup2fa can no longer both enrol AND activate them. The
+            // system-wide switch has to gate this branch too, or every user without
+            // 2FA is locked out of the product the moment forceUser is on and the
+            // switch is off.
+            if (this.TwoFactorAuthEnabled && this.TwoFactorAuthForceUser && !twoFaEnabledForUser) {
                 this._log.trace('User logged in, 2fa init required', {
                     Uuid: user.Uuid
                 });

package/lib/mjs/controllers/LoginController.js.map

@@ -1 +1 @@
-{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACzI,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,OAAO,IAAI,eAAe,EAAE,SAAS,EAAE,WAAW,EAAmC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClL,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAkB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,cAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAe,IAAY,EAAU,WAAyB;QAC3G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACxD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,EAAE,CAAC;gBAE1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;oBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAChC,sEAAsE;gBACtE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;gBACzC,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,OAAO,IAAI,EAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAE9C,qEAAqE;gBACrE,6DAA6D;gBAC7D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;aACxD,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,aAAa,GAAG,GAAG,YAAY,SAAS,IAAI,GAAG,YAAY,eAAe,CAAC;YAEjF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,iCAAiC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAE/G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,oBAAoB,WAAW,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;YAElF,OAAO,IAAI,YAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAc,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC7G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,EAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE;oBACjC,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;oBAC9B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB,EAAqB,OAAiB;QAErH,OAAO,IAAI,EAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YAEzD,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,yDAAyD;YACzD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACxC,UAAU,EAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAyB,IAAI,IAAI;YAE3E,gEAAgE;YAChE,0EAA0E;YAC1E,uEAAuE;YACvE,kEAAkE;SACrC,CAAC,CAAC;IACnC,CAAC;CACF,CAAA;AAlOW;IADT,UAAU,EAAE;8BACY,aAAa;sDAAC;AAG7B;IADT,iBAAiB,CAAC,WAAW,CAAC;8BACP,YAAY;qDAAC;AAG3B;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;wDAAC;AAKjC;IAHT,MAAM,CAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,MAAM,CAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;uDAAC;AAGrC;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;2CAAC;AAcf;IAFZ,IAAI,EAAE;IACN,mBAAmB,EAAE;IACF,WAAA,YAAY,EAAE,CAAA;IAAgB,WAAA,SAAS,EAAE,CAAA;IAAgB,WAAA,IAAI,EAAE,CAAA;;qCAAxC,IAAI,UAAkD,YAAY;;4CA4G5G;AAiBY;IAFZ,IAAI,EAAE;IACN,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,SAAS,EAAE,CAAA;IAAgB,WAAA,eAAe,EAAE,CAAA;IAAqB,WAAA,YAAY,EAAE,CAAA;;qDAAO,IAAI;;6CA8B9G;AAcY;IAFZ,GAAG,EAAE;IACL,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,YAAY,EAAE,CAAA;IAAc,WAAA,WAAW,EAAE,CAAA;IAAsB,WAAA,eAAe,EAAE,CAAA;;qCAA3D,IAAI;;6CAmB7C;AAnOU,eAAe;IAD3B,QAAQ,CAAC,MAAM,CAAC;GACJ,eAAe,CAoO3B"}
+{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACzI,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,OAAO,IAAI,eAAe,EAAE,SAAS,EAAE,WAAW,EAAmC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClL,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAkB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,cAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAe,IAAY,EAAU,WAAyB;QAC3G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,0DAA0D;YAC1D,6DAA6D;YAC7D,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,gEAAgE;YAChE,wEAAwE;YACxE,sEAAsE;YACtE,iBAAiB;YACjB,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,EAAE,CAAC;gBAE1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;oBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAChC,sEAAsE;gBACtE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;gBACzC,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,OAAO,IAAI,EAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAE9C,qEAAqE;gBACrE,6DAA6D;gBAC7D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;aACxD,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,aAAa,GAAG,GAAG,YAAY,SAAS,IAAI,GAAG,YAAY,eAAe,CAAC;YAEjF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,iCAAiC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAE/G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,oBAAoB,WAAW,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;YAElF,OAAO,IAAI,YAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAc,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC7G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,EAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE;oBACjC,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;oBAC9B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB,EAAqB,OAAiB;QAErH,OAAO,IAAI,EAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YAEzD,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,yDAAyD;YACzD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACxC,UAAU,EAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAyB,IAAI,IAAI;YAE3E,gEAAgE;YAChE,0EAA0E;YAC1E,uEAAuE;YACvE,kEAAkE;SACrC,CAAC,CAAC;IACnC,CAAC;CACF,CAAA;AA3OW;IADT,UAAU,EAAE;8BACY,aAAa;sDAAC;AAG7B;IADT,iBAAiB,CAAC,WAAW,CAAC;8BACP,YAAY;qDAAC;AAG3B;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;wDAAC;AAKjC;IAHT,MAAM,CAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,MAAM,CAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;uDAAC;AAGrC;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;2CAAC;AAcf;IAFZ,IAAI,EAAE;IACN,mBAAmB,EAAE;IACF,WAAA,YAAY,EAAE,CAAA;IAAgB,WAAA,SAAS,EAAE,CAAA;IAAgB,WAAA,IAAI,EAAE,CAAA;;qCAAxC,IAAI,UAAkD,YAAY;;4CAqH5G;AAiBY;IAFZ,IAAI,EAAE;IACN,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,SAAS,EAAE,CAAA;IAAgB,WAAA,eAAe,EAAE,CAAA;IAAqB,WAAA,YAAY,EAAE,CAAA;;qDAAO,IAAI;;6CA8B9G;AAcY;IAFZ,GAAG,EAAE;IACL,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,YAAY,EAAE,CAAA;IAAc,WAAA,WAAW,EAAE,CAAA;IAAsB,WAAA,eAAe,EAAE,CAAA;;qCAA3D,IAAI;;6CAmB7C;AA5OU,eAAe;IAD3B,QAAQ,CAAC,MAAM,CAAC;GACJ,eAAe,CA6O3B"}

package/lib/mjs/controllers/TwoFactorAuthController.d.ts

@@ -1,7 +1,7 @@
 import { TokenDto } from './../dto/token-dto.js';
 import { BaseController, Ok, ForbiddenResponse } from '@spinajs/http';
 import { ISession, SessionProvider, User as UserModel, AccessControl } from '@spinajs/rbac';
-import { IEnable2faResponse, IUserWithGrants } from '@spinajs/rbac-http';
+import { IEnable2faResponse, IUserWithGrants, TwoFactorAuthConfig } from '@spinajs/rbac-http';
 import { SessionCookieFactory } from '../services/SessionCookies.js';
 /**
  * Two-factor authentication during login.
@@ -24,6 +24,7 @@ export declare class TwoFactorAuthController extends BaseController {
     protected SessionProvider: SessionProvider;
     protected SessionCookies: SessionCookieFactory;
     protected AC: AccessControl;
+    protected TwoFactorConfig: TwoFactorAuthConfig;
     /**
      * Set up two-factor authentication during login
      * Generates a TOTP secret for a user who must enrol before continuing — the state
@@ -53,5 +54,23 @@ export declare class TwoFactorAuthController extends BaseController {
      * verification without a TOTP/DB setup.
      */
     protected verifyTwoFactorToken(user: UserModel, token: string): Promise<void>;
+    /**
+     * Store the TOTP secret without switching 2fa on. Wrapped in a protected
+     * method for the same reason as {@link verifyTwoFactorToken}.
+     */
+    protected enrol(user: UserModel): Promise<unknown>;
+    /** Switch 2fa on for an account whose secret was just verified. */
+    protected activateEnrolment(user: UserModel): Promise<unknown>;
+    /**
+     * Refuse to start enrolment while 2FA is switched off system-wide.
+     *
+     * `TwoFacRouteEnabled` cannot do this job here either: @spinajs/http merges
+     * a route's policies into one gate that passes when ANY of them resolves,
+     * and this controller also carries `NotAuthorizedPolicy`, which succeeds
+     * for exactly the callers these routes serve — so `TwoFacRouteEnabled`
+     * rejecting cannot stop them. The check has to live where it cannot be
+     * short-circuited.
+     */
+    protected assertSystemEnabled(): void;
 }
 //# sourceMappingURL=TwoFactorAuthController.d.ts.map

package/lib/mjs/controllers/TwoFactorAuthController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAQ,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAO/G,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAIpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;;;OAWG;IAEU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAS9E;IAED;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC,CAuC3J;IAED;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;CACF"}
+{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAQ,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAO/G,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAE/C;;;;;;;;;;;OAWG;IAEU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAgB9E;IAED;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC,CA8C3J;IAED;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED,mEAAmE;IACnE,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7D;IAED;;;;;;;;;OASG;IACH,SAAS,CAAC,mBAAmB,IAAI,IAAI,CAMpC;CACF"}

package/lib/mjs/controllers/TwoFactorAuthController.js

@@ -16,11 +16,11 @@ import { SessionProvider, User as UserModel, AccessControl, regenerateSession }
 import { Session } from '@spinajs/rbac-http';
 import { Body, Policy } from '@spinajs/http';
 import { TwoFacRouteEnabled } from '../policies/2FaPolicy.js';
-import { AutoinjectService } from '@spinajs/configuration';
+import { AutoinjectService, Config } from '@spinajs/configuration';
 import { Autoinject } from '@spinajs/di';
 import { User, NotAuthorizedPolicy } from '@spinajs/rbac-http';
-import { auth2Fa, enableUser2Fa } from '../actions/2fa.js';
-import { InvalidOperation } from '@spinajs/exceptions';
+import { auth2Fa, activateUser2Fa, beginUser2FaEnrolment } from '../actions/2fa.js';
+import { BadRequest, Forbidden } from '@spinajs/exceptions';
 import { TWO_FA_METATADATA_KEYS } from '../2fa/Default2FaToken.js';
 import { SessionCookieFactory } from '../services/SessionCookies.js';
 import { activeRoleOf, buildUserWithGrants } from '../services/grants.js';
@@ -55,10 +55,15 @@ let TwoFactorAuthController = class TwoFactorAuthController extends BaseControll
      * @response 403 Session is not awaiting two-factor enrolment
      */
     async setup2fa(user) {
+        this.assertSystemEnabled();
         if (user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) {
-            throw new InvalidOperation(`User ${user.Uuid} already has 2fa enabled`);
+            throw new BadRequest(`User ${user.Uuid} already has 2fa enabled`);
         }
-        const result = await enableUser2Fa(user);
+        // Re-running setup on an account that already started enrolling is allowed:
+        // it replaces an unconfirmed secret, which is exactly how a user who lost
+        // the QR gets a new one. There is nothing to steal — the caller could reach
+        // the same state from scratch.
+        const result = await this.enrol(user);
         return new Ok({
             otp: result,
         });
@@ -75,6 +80,12 @@ let TwoFactorAuthController = class TwoFactorAuthController extends BaseControll
     async verifyToken(logged, token, session) {
         try {
             await this.verifyTwoFactorToken(logged, token.Token);
+            // A pending enrolment (secret stored, `2fa:enabled` unset) becomes real
+            // here and nowhere else — this is the first moment the user has proven
+            // possession of the device.
+            if (!logged.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) {
+                await this.activateEnrolment(logged);
+            }
             // 2fa complete, mark as authorized
             // fron now on user is considered authorized
             session.Data.set('Authorized', true);
@@ -116,6 +127,34 @@ let TwoFactorAuthController = class TwoFactorAuthController extends BaseControll
     verifyTwoFactorToken(user, token) {
         return auth2Fa(user, token);
     }
+    /**
+     * Store the TOTP secret without switching 2fa on. Wrapped in a protected
+     * method for the same reason as {@link verifyTwoFactorToken}.
+     */
+    enrol(user) {
+        return beginUser2FaEnrolment(user);
+    }
+    /** Switch 2fa on for an account whose secret was just verified. */
+    activateEnrolment(user) {
+        return activateUser2Fa(user);
+    }
+    /**
+     * Refuse to start enrolment while 2FA is switched off system-wide.
+     *
+     * `TwoFacRouteEnabled` cannot do this job here either: @spinajs/http merges
+     * a route's policies into one gate that passes when ANY of them resolves,
+     * and this controller also carries `NotAuthorizedPolicy`, which succeeds
+     * for exactly the callers these routes serve — so `TwoFacRouteEnabled`
+     * rejecting cannot stop them. The check has to live where it cannot be
+     * short-circuited.
+     */
+    assertSystemEnabled() {
+        if (this.TwoFactorConfig?.enabled === false) {
+            throw Object.assign(new Forbidden('2 factor auth is not enabled'), {
+                error: { code: 'E_2FA_SYSTEM_DISABLED', message: '2 factor auth is not enabled' },
+            });
+        }
+    }
 };
 __decorate([
     AutoinjectService('rbac.session'),
@@ -129,6 +168,10 @@ __decorate([
     Autoinject(AccessControl),
     __metadata("design:type", AccessControl)
 ], TwoFactorAuthController.prototype, "AC", void 0);
+__decorate([
+    Config('rbac.twoFactorAuth'),
+    __metadata("design:type", Object)
+], TwoFactorAuthController.prototype, "TwoFactorConfig", void 0);
 __decorate([
     Post('2fa/setup'),
     __param(0, User()),

package/lib/mjs/controllers/TwoFactorAuthController.js.map

@@ -1 +1 @@
-{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAY,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAuC,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AAII,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,cAAc;IAUzD;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,EAAE,CAAC;YACZ,GAAG,EAAE,MAAgB;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QACvG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEjD,OAAO,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC9D,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QAC3D,OAAO,OAAO,CAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IAC/C,CAAC;CACF,CAAA;AA3FW;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;gEAAC;AAGjC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;+DAAC;AAGrC;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;mDAAC;AAef;IADZ,IAAI,CAAC,WAAW,CAAC;IACK,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;uDAS5C;AAYY;IADZ,IAAI,CAAC,YAAY,CAAC;IACO,WAAA,IAAI,EAAE,CAAA;IAAqB,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,OAAO,EAAE,CAAA;;qCAA9C,SAAS,EAAiB,QAAQ;;0DAuC1E;AAnFU,uBAAuB;IAHnC,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,kBAAkB,CAAC;IAC1B,MAAM,CAAC,mBAAmB,CAAC;GACf,uBAAuB,CA6FnC"}
+{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAY,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAA4D,MAAM,oBAAoB,CAAC;AACzH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AAII,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,cAAc;IAazD;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE3B,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QACpE,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,EAAE,CAAC;YACZ,GAAG,EAAE,MAAgB;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QACvG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,wEAAwE;YACxE,uEAAuE;YACvE,4BAA4B;YAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YAED,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEjD,OAAO,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC9D,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QAC3D,OAAO,OAAO,CAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,IAAe;QAC7B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,mEAAmE;IACzD,iBAAiB,CAAC,IAAe;QACzC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;OASG;IACO,mBAAmB;QAC3B,IAAI,IAAI,CAAC,eAAe,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,8BAA8B,CAAC,EAAE;gBACjE,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,8BAA8B,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AA3IW;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;gEAAC;AAGjC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;+DAAC;AAGrC;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;mDAAC;AAGlB;IADT,MAAM,CAAC,oBAAoB,CAAC;;gEACkB;AAelC;IADZ,IAAI,CAAC,WAAW,CAAC;IACK,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;uDAgB5C;AAYY;IADZ,IAAI,CAAC,YAAY,CAAC;IACO,WAAA,IAAI,EAAE,CAAA;IAAqB,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,OAAO,EAAE,CAAA;;qCAA9C,SAAS,EAAiB,QAAQ;;0DA8C1E;AApGU,uBAAuB;IAHnC,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,kBAAkB,CAAC;IAC1B,MAAM,CAAC,mBAAmB,CAAC;GACf,uBAAuB,CA6InC"}

package/lib/mjs/controllers/TwoFactorAuthUserController.d.ts

@@ -1,12 +1,26 @@
-import { BaseController, Ok, Unauthorized } from '@spinajs/http';
+import { BaseController, ForbiddenResponse, Ok, Unauthorized } from '@spinajs/http';
 import { PasswordProvider, SessionProvider, User as UserModel } from '@spinajs/rbac';
 import type { ISession } from '@spinajs/rbac';
-import { IEnable2faResponse } from '@spinajs/rbac-http';
+import { IEnable2faResponse, TwoFactorAuthConfig } from '@spinajs/rbac-http';
 import { ConfirmPasswordDto } from '../dto/confirm-password-dto.js';
+import { TokenDto } from '../dto/token-dto.js';
 import { SessionCookieFactory } from '../services/SessionCookies.js';
 /** Whether the authenticated user currently has a TOTP device enrolled. */
 export interface ITwoFactorStatus {
     Enabled: boolean;
+    /**
+     * A secret was issued but never confirmed. The account is not protected — the
+     * distinction exists so the UI can say "you started this" rather than
+     * "you have no 2fa".
+     */
+    Pending: boolean;
+    /**
+     * Whether 2FA is switched on system-wide (`rbac.twoFactorAuth.enabled`). The
+     * frontend hides its 2FA controls when this is false; it is reported here
+     * rather than signalled by an error because the guarding policy cannot
+     * reject an authorized caller.
+     */
+    SystemEnabled: boolean;
 }
 /**
  * Self-service two-factor authentication.
@@ -22,12 +36,24 @@ export interface ITwoFactorStatus {
  * not be enough to attach an attacker-controlled authenticator or to strip the
  * second factor off the account.
  *
+ * `TwoFactorAuthEnabled` stays on the class as the guard for callers it is
+ * able to reject, but it cannot block an authorized caller here:
+ * `@spinajs/http` merges every policy on a route into ONE gate that lets the
+ * route run when ANY policy resolves, and `AuthorizedPolicy` below resolves
+ * for any logged-in caller — so once a session is authorized, that policy
+ * alone is enough to pass the gate regardless of what `TwoFactorAuthEnabled`
+ * decides. That is why the system-wide switch (`rbac.twoFactorAuth.enabled`)
+ * is *also* enforced directly in the mutating handlers, via
+ * {@link assertSystemEnabled}, which is the check that actually matters for
+ * an authorized caller.
+ *
  * @tags Two-Factor Settings
  */
 export declare class TwoFactorAuthUserController extends BaseController {
     protected PasswordProvider: PasswordProvider;
     protected SessionProvider: SessionProvider;
     protected SessionCookies: SessionCookieFactory;
+    protected TwoFactorConfig: TwoFactorAuthConfig;
     /**
      * Get own two-factor status
      * Reports whether the authenticated user currently has a TOTP device enrolled.
@@ -41,6 +67,8 @@ export declare class TwoFactorAuthUserController extends BaseController {
      * Enable own two-factor authentication
      * Generates a TOTP secret for the authenticated user and returns the OTP provisioning
      * URI to scan with an authenticator app. Requires the account password to be re-entered.
+     * 2FA stays off until the new code is confirmed with `POST /user/2fa/confirm` — a caller
+     * that stops after this call leaves the account unprotected, believing it is enrolled.
      * @security cookieAuth
      * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
      * @response 400 Two-factor authentication is already enabled for this user
@@ -48,6 +76,17 @@ export declare class TwoFactorAuthUserController extends BaseController {
      * @response 403 Forbidden — insufficient permissions
      */
     enable(user: UserModel, confirmation: ConfirmPasswordDto, session: ISession): Promise<Ok<IEnable2faResponse> | Unauthorized>;
+    /**
+     * Confirm own two-factor enrolment
+     * Verifies a code generated from the secret handed out by `POST /user/2fa/enable`
+     * or `POST /user/2fa/reset`, and only then switches 2FA on.
+     * @security cookieAuth
+     * @response 200 Two-factor authentication is now active
+     * @response 400 There is no pending enrolment to confirm
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Invalid or expired TOTP code
+     */
+    confirm(user: UserModel, token: TokenDto, session: ISession): Promise<Ok | ForbiddenResponse>;
     /**
      * Disable own two-factor authentication
      * Removes the TOTP secret and disables 2FA for the authenticated user.
@@ -59,6 +98,43 @@ export declare class TwoFactorAuthUserController extends BaseController {
      * @response 403 Forbidden — insufficient permissions
      */
     disable(user: UserModel, confirmation: ConfirmPasswordDto, session: ISession): Promise<Ok | Unauthorized>;
+    /**
+     * Reset own two-factor authentication
+     * Removes the current TOTP device and issues a new secret in a single request,
+     * returning the provisioning URI to scan. 2FA stays off until the new code is
+     * confirmed with `POST /user/2fa/confirm`. Requires the account password.
+     *
+     * Folding disable-then-enable into one request removes the client-side gap
+     * where abandoning the flow between the two calls could strand the account
+     * without a second factor. It does not remove the server-side one: if
+     * `enrol` fails after `unenrol` already removed the old device, the account
+     * is left with no device at all — there is nothing to roll back to, since
+     * the old secret is already gone. That leaves the account in the ordinary
+     * `none` state, which every route here already handles: `GET /user/2fa`
+     * reports it and `POST /user/2fa/enable` starts a fresh enrolment.
+     *
+     * A caller who abandons before confirming is left password-only — the same
+     * gap as `enable`. The only built-in recovery is `rbac.twoFactorAuth.forceUser`
+     * pushing the account back through enrolment at next login, and this package's
+     * own default for that flag is `false` (see `src/config/rbac-http.ts`), so a
+     * consumer that has not set it will see the downgrade become silent and
+     * permanent rather than recovered.
+     * @security cookieAuth
+     * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
+     * @response 400 There is no two-factor device to reset
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    reset(user: UserModel, confirmation: ConfirmPasswordDto, session: ISession): Promise<Ok<IEnable2faResponse> | Unauthorized>;
+    /**
+     * Refuse a mutation while 2FA is switched off system-wide.
+     *
+     * The `TwoFactorAuthEnabled` policy cannot do this job: @spinajs/http merges
+     * a route's policies into one gate that passes when ANY of them resolves, and
+     * these routes also carry AuthorizedPolicy, which succeeds for every
+     * logged-in caller. The check has to live where it cannot be short-circuited.
+     */
+    protected assertSystemEnabled(): void;
     /**
      * Rotates the session id after the account's authentication requirements
      * changed, and returns the response options carrying the new cookie.
@@ -83,10 +159,13 @@ export declare class TwoFactorAuthUserController extends BaseController {
         }[];
     }>;
     /**
-     * Generate and store the TOTP secret, returning the provisioning URI. Wraps
-     * the module-level action so tests can stub it without a TOTP/DB setup.
+     * Store the TOTP secret and return the provisioning URI, leaving 2fa off until
+     * confirmed. Wraps the module-level action so tests can stub it without a
+     * TOTP/DB setup.
      */
     protected enrol(user: UserModel): Promise<unknown>;
+    /** Verify a code against the pending secret and switch 2fa on. */
+    protected confirmEnrolment(user: UserModel, token: string): Promise<unknown>;
     /** Clear the TOTP secret. Wrapped for the same reason as {@link enrol}. */
     protected unenrol(user: UserModel): Promise<unknown>;
     /**

package/lib/mjs/controllers/TwoFactorAuthUserController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TwoFactorAuthUserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAuB,EAAE,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAqB,MAAM,eAAe,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAoB,kBAAkB,EAA0D,MAAM,oBAAoB,CAAC;AAGlI,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAIa,2BAA4B,SAAQ,cAAc;IAE7D,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAE/C;;;;;;;OAOG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAE1E;IAED;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC,CAkB3K;IAED;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC,CAYxJ;IAED;;;;;;;;;OASG;IACH,UAAgB,MAAM,CAAC,OAAO,EAAE,QAAQ;;;;;;;;;;;;OAWvC;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED,2EAA2E;IAC3E,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnD;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,CAY/F;CACF"}
+{"version":3,"file":"TwoFactorAuthUserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,iBAAiB,EAAO,EAAE,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAqB,MAAM,eAAe,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAoB,kBAAkB,EAAoD,mBAAmB,EAAQ,MAAM,oBAAoB,CAAC;AAEvJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAKrE,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAIa,2BAA4B,SAAQ,cAAc;IAE7D,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAE/C;;;;;;;OAOG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAQ1E;IAED;;;;;;;;;;;OAWG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC,CAmB3K;IAED;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,iBAAiB,CAAC,CAiC5I;IAED;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC,CAcxJ;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC,CAgB1K;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,mBAAmB,IAAI,IAAI,CAMpC;IAED;;;;;;;;;OASG;IACH,UAAgB,MAAM,CAAC,OAAO,EAAE,QAAQ;;;;;;;;;;;;OAWvC;IAED;;;;OAIG;IACH,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED,kEAAkE;IAClE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3E;IAED,2EAA2E;IAC3E,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnD;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,CAY/F;CACF"}

package/lib/mjs/controllers/TwoFactorAuthUserController.js

@@ -10,17 +10,18 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { BaseController, BasePath, Body, Get, Ok, Policy, Post, Unauthorized } from '@spinajs/http';
+import { BaseController, BasePath, Body, ForbiddenResponse, Get, Ok, Policy, Post, Unauthorized } from '@spinajs/http';
 import { PasswordProvider, SessionProvider, User as UserModel, regenerateSession } from '@spinajs/rbac';
 import { Autoinject } from '@spinajs/di';
-import { AutoinjectService } from '@spinajs/configuration';
+import { AutoinjectService, Config } from '@spinajs/configuration';
 import { AuthorizedPolicy, Permission, Resource, Session as SessionRouteArg, User } from '@spinajs/rbac-http';
-import { InvalidOperation } from '@spinajs/exceptions';
-import { TwoFactorAuthEnabled } from '../policies/2FaPolicy.js';
+import { BadRequest, Forbidden } from '@spinajs/exceptions';
 import { ConfirmPasswordDto } from '../dto/confirm-password-dto.js';
+import { TokenDto } from '../dto/token-dto.js';
 import { SessionCookieFactory } from '../services/SessionCookies.js';
-import { disableUser2Fa, enableUser2Fa } from '../actions/2fa.js';
+import { beginUser2FaEnrolment, confirmUser2Fa, disableUser2Fa } from '../actions/2fa.js';
 import { TWO_FA_METATADATA_KEYS } from '../2fa/Default2FaToken.js';
+import { TwoFactorAuthEnabled } from '../policies/2FaPolicy.js';
 /**
  * Self-service two-factor authentication.
  *
@@ -35,6 +36,17 @@ import { TWO_FA_METATADATA_KEYS } from '../2fa/Default2FaToken.js';
  * not be enough to attach an attacker-controlled authenticator or to strip the
  * second factor off the account.
  *
+ * `TwoFactorAuthEnabled` stays on the class as the guard for callers it is
+ * able to reject, but it cannot block an authorized caller here:
+ * `@spinajs/http` merges every policy on a route into ONE gate that lets the
+ * route run when ANY policy resolves, and `AuthorizedPolicy` below resolves
+ * for any logged-in caller — so once a session is authorized, that policy
+ * alone is enough to pass the gate regardless of what `TwoFactorAuthEnabled`
+ * decides. That is why the system-wide switch (`rbac.twoFactorAuth.enabled`)
+ * is *also* enforced directly in the mutating handlers, via
+ * {@link assertSystemEnabled}, which is the check that actually matters for
+ * an authorized caller.
+ *
  * @tags Two-Factor Settings
  */
 let TwoFactorAuthUserController = class TwoFactorAuthUserController extends BaseController {
@@ -47,12 +59,19 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends Base
      * @response 403 Forbidden — insufficient permissions
      */
     async status(user) {
-        return new Ok({ Enabled: Boolean(user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) });
+        const enabled = Boolean(user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]);
+        return new Ok({
+            Enabled: enabled,
+            Pending: !enabled && Boolean(user.Metadata[TWO_FA_METATADATA_KEYS.TOKEN]),
+            SystemEnabled: this.TwoFactorConfig?.enabled !== false,
+        });
     }
     /**
      * Enable own two-factor authentication
      * Generates a TOTP secret for the authenticated user and returns the OTP provisioning
      * URI to scan with an authenticator app. Requires the account password to be re-entered.
+     * 2FA stays off until the new code is confirmed with `POST /user/2fa/confirm` — a caller
+     * that stops after this call leaves the account unprotected, believing it is enrolled.
      * @security cookieAuth
      * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
      * @response 400 Two-factor authentication is already enabled for this user
@@ -60,21 +79,61 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends Base
      * @response 403 Forbidden — insufficient permissions
      */
     async enable(user, confirmation, session) {
+        this.assertSystemEnabled();
         if (user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) {
-            throw new InvalidOperation(`User ${user.Uuid} already has 2fa enabled`);
+            throw new BadRequest(`User ${user.Uuid} already has 2fa enabled`);
         }
         const confirmed = await this.confirmPassword(user, confirmation.Password);
         if (confirmed !== true) {
             return confirmed;
         }
-        // NOTE: enrolment takes effect immediately — the secret is stored and
-        // `2fa:enabled` is set before the user has proven they scanned it. That is
-        // the same contract the login-time setup route follows, and it is what the
-        // login check reads. A user who never scans the returned URI locks
-        // themselves out and needs an administrator 2FA reset to recover.
+        // The secret is stored but 2fa stays OFF until `POST /user/2fa/confirm`
+        // accepts a code generated from it. A user who never scans is left pending,
+        // which the login check treats exactly like having no device — no lockout,
+        // and the next attempt simply issues a new secret.
         const result = await this.enrol(user);
         return new Ok({ otp: result }, await this.rotate(session));
     }
+    /**
+     * Confirm own two-factor enrolment
+     * Verifies a code generated from the secret handed out by `POST /user/2fa/enable`
+     * or `POST /user/2fa/reset`, and only then switches 2FA on.
+     * @security cookieAuth
+     * @response 200 Two-factor authentication is now active
+     * @response 400 There is no pending enrolment to confirm
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Invalid or expired TOTP code
+     */
+    async confirm(user, token, session) {
+        this.assertSystemEnabled();
+        // `activate()` never clears the stored token, so an already-enabled
+        // account still has one and would otherwise be able to call this route
+        // again with a currently-valid code. Only the pending state — a token
+        // without 2fa being enabled yet — is an enrolment left to confirm.
+        if (user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED] || !user.Metadata[TWO_FA_METATADATA_KEYS.TOKEN]) {
+            throw new BadRequest(`User ${user.Uuid} has no pending 2fa enrolment`);
+        }
+        try {
+            await this.confirmEnrolment(user, token.Token);
+        }
+        catch (err) {
+            // `confirmUser2Fa` throws `Unauthorized` for a rejected code — the only
+            // case this route should report as "wrong code". Anything else (a
+            // database outage during activation, for instance) must surface as a
+            // 500, not be misreported to the user as a bad code.
+            if (!(err instanceof Unauthorized)) {
+                throw err;
+            }
+            this._log.warn(`2fa confirmation rejected for ${user.Uuid}`, { error: err });
+            return new ForbiddenResponse({
+                error: { code: 'E_2FA_FAILED', message: '2fa check failed' },
+            });
+        }
+        // No password here on purpose: the password was confirmed by the enable or
+        // reset call that issued this secret, and the code is itself the proof this
+        // route exists to demand.
+        return new Ok(null, await this.rotate(session));
+    }
     /**
      * Disable own two-factor authentication
      * Removes the TOTP secret and disables 2FA for the authenticated user.
@@ -86,8 +145,9 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends Base
      * @response 403 Forbidden — insufficient permissions
      */
     async disable(user, confirmation, session) {
+        this.assertSystemEnabled();
         if (!user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) {
-            throw new InvalidOperation(`User ${user.Uuid} already has 2fa disabled`);
+            throw new BadRequest(`User ${user.Uuid} already has 2fa disabled`);
         }
         const confirmed = await this.confirmPassword(user, confirmation.Password);
         if (confirmed !== true) {
@@ -96,6 +156,61 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends Base
         await this.unenrol(user);
         return new Ok(null, await this.rotate(session));
     }
+    /**
+     * Reset own two-factor authentication
+     * Removes the current TOTP device and issues a new secret in a single request,
+     * returning the provisioning URI to scan. 2FA stays off until the new code is
+     * confirmed with `POST /user/2fa/confirm`. Requires the account password.
+     *
+     * Folding disable-then-enable into one request removes the client-side gap
+     * where abandoning the flow between the two calls could strand the account
+     * without a second factor. It does not remove the server-side one: if
+     * `enrol` fails after `unenrol` already removed the old device, the account
+     * is left with no device at all — there is nothing to roll back to, since
+     * the old secret is already gone. That leaves the account in the ordinary
+     * `none` state, which every route here already handles: `GET /user/2fa`
+     * reports it and `POST /user/2fa/enable` starts a fresh enrolment.
+     *
+     * A caller who abandons before confirming is left password-only — the same
+     * gap as `enable`. The only built-in recovery is `rbac.twoFactorAuth.forceUser`
+     * pushing the account back through enrolment at next login, and this package's
+     * own default for that flag is `false` (see `src/config/rbac-http.ts`), so a
+     * consumer that has not set it will see the downgrade become silent and
+     * permanent rather than recovered.
+     * @security cookieAuth
+     * @returns {IEnable2faResponse} OTP provisioning URI to scan with an authenticator app
+     * @response 400 There is no two-factor device to reset
+     * @response 401 Unauthorized — valid session required, or password invalid
+     * @response 403 Forbidden — insufficient permissions
+     */
+    async reset(user, confirmation, session) {
+        this.assertSystemEnabled();
+        if (!user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED] && !user.Metadata[TWO_FA_METATADATA_KEYS.TOKEN]) {
+            throw new BadRequest(`User ${user.Uuid} has no 2fa to reset`);
+        }
+        const confirmed = await this.confirmPassword(user, confirmation.Password);
+        if (confirmed !== true) {
+            return confirmed;
+        }
+        await this.unenrol(user);
+        const result = await this.enrol(user);
+        return new Ok({ otp: result }, await this.rotate(session));
+    }
+    /**
+     * Refuse a mutation while 2FA is switched off system-wide.
+     *
+     * The `TwoFactorAuthEnabled` policy cannot do this job: @spinajs/http merges
+     * a route's policies into one gate that passes when ANY of them resolves, and
+     * these routes also carry AuthorizedPolicy, which succeeds for every
+     * logged-in caller. The check has to live where it cannot be short-circuited.
+     */
+    assertSystemEnabled() {
+        if (this.TwoFactorConfig?.enabled === false) {
+            throw Object.assign(new Forbidden('2 factor auth is not enabled'), {
+                error: { code: 'E_2FA_SYSTEM_DISABLED', message: '2 factor auth is not enabled' },
+            });
+        }
+    }
     /**
      * Rotates the session id after the account's authentication requirements
      * changed, and returns the response options carrying the new cookie.
@@ -117,11 +232,16 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends Base
         };
     }
     /**
-     * Generate and store the TOTP secret, returning the provisioning URI. Wraps
-     * the module-level action so tests can stub it without a TOTP/DB setup.
+     * Store the TOTP secret and return the provisioning URI, leaving 2fa off until
+     * confirmed. Wraps the module-level action so tests can stub it without a
+     * TOTP/DB setup.
      */
     enrol(user) {
-        return enableUser2Fa(user);
+        return beginUser2FaEnrolment(user);
+    }
+    /** Verify a code against the pending secret and switch 2fa on. */
+    confirmEnrolment(user, token) {
+        return confirmUser2Fa(user, token);
     }
     /** Clear the TOTP secret. Wrapped for the same reason as {@link enrol}. */
     unenrol(user) {
@@ -154,6 +274,10 @@ __decorate([
     Autoinject(SessionCookieFactory),
     __metadata("design:type", SessionCookieFactory)
 ], TwoFactorAuthUserController.prototype, "SessionCookies", void 0);
+__decorate([
+    Config('rbac.twoFactorAuth'),
+    __metadata("design:type", Object)
+], TwoFactorAuthUserController.prototype, "TwoFactorConfig", void 0);
 __decorate([
     Get('2fa'),
     Permission(['readOwn']),
@@ -172,6 +296,16 @@ __decorate([
     __metadata("design:paramtypes", [UserModel, ConfirmPasswordDto, Object]),
     __metadata("design:returntype", Promise)
 ], TwoFactorAuthUserController.prototype, "enable", null);
+__decorate([
+    Post('2fa/confirm'),
+    Permission(['updateOwn']),
+    __param(0, User()),
+    __param(1, Body()),
+    __param(2, SessionRouteArg()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, TokenDto, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorAuthUserController.prototype, "confirm", null);
 __decorate([
     Post('2fa/disable'),
     Permission(['updateOwn']),
@@ -182,6 +316,16 @@ __decorate([
     __metadata("design:paramtypes", [UserModel, ConfirmPasswordDto, Object]),
     __metadata("design:returntype", Promise)
 ], TwoFactorAuthUserController.prototype, "disable", null);
+__decorate([
+    Post('2fa/reset'),
+    Permission(['updateOwn']),
+    __param(0, User()),
+    __param(1, Body()),
+    __param(2, SessionRouteArg()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, ConfirmPasswordDto, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorAuthUserController.prototype, "reset", null);
 TwoFactorAuthUserController = __decorate([
     BasePath('user'),
     Resource('user'),