@spinajs/rbac-http-user 2.0.504 → 2.0.506
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/controllers/LoginController.js +2 -2
- package/lib/cjs/controllers/LoginController.js.map +1 -1
- package/lib/cjs/controllers/TwoFactorAuthController.d.ts +4 -13
- package/lib/cjs/controllers/TwoFactorAuthController.d.ts.map +1 -1
- package/lib/cjs/controllers/TwoFactorAuthController.js +5 -22
- package/lib/cjs/controllers/TwoFactorAuthController.js.map +1 -1
- package/lib/cjs/controllers/TwoFactorAuthUserController.d.ts +10 -22
- package/lib/cjs/controllers/TwoFactorAuthUserController.d.ts.map +1 -1
- package/lib/cjs/controllers/TwoFactorAuthUserController.js +11 -35
- package/lib/cjs/controllers/TwoFactorAuthUserController.js.map +1 -1
- package/lib/mjs/controllers/LoginController.js +2 -2
- package/lib/mjs/controllers/LoginController.js.map +1 -1
- package/lib/mjs/controllers/TwoFactorAuthController.d.ts +4 -13
- package/lib/mjs/controllers/TwoFactorAuthController.d.ts.map +1 -1
- package/lib/mjs/controllers/TwoFactorAuthController.js +6 -23
- package/lib/mjs/controllers/TwoFactorAuthController.js.map +1 -1
- package/lib/mjs/controllers/TwoFactorAuthUserController.d.ts +10 -22
- package/lib/mjs/controllers/TwoFactorAuthUserController.d.ts.map +1 -1
- package/lib/mjs/controllers/TwoFactorAuthUserController.js +12 -36
- package/lib/mjs/controllers/TwoFactorAuthUserController.js.map +1 -1
- package/lib/tsconfig.cjs.tsbuildinfo +1 -1
- package/lib/tsconfig.mjs.tsbuildinfo +1 -1
- package/package.json +15 -15
|
@@ -68,8 +68,8 @@ let LoginController = class LoginController extends http_1.BaseController {
|
|
|
68
68
|
const twoFaEnabledForUser = Boolean(user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED]);
|
|
69
69
|
// `forceUser` alone used to be enough to park the user in
|
|
70
70
|
// TwoFactorInitRequired. But every mutating `/user/2fa*` and
|
|
71
|
-
// `/auth/2fa/setup`
|
|
72
|
-
// 403 when `rbac.twoFactorAuth.enabled` is off — so a user forced into
|
|
71
|
+
// `/auth/2fa/setup` route is now gated by `TwoFactorAuthEnabled` and
|
|
72
|
+
// answers 403 when `rbac.twoFactorAuth.enabled` is off — so a user forced into
|
|
73
73
|
// this branch while the system switch is off would have no route back
|
|
74
74
|
// out: setup2fa can no longer both enrol AND activate them. The
|
|
75
75
|
// system-wide switch has to gate this branch too, or every user without
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8DAAuD;AACvD,wCAAoG;AACpG,wCAAyI;AACzI,oDAAiE;AACjE,oCAA6C;AAC7C,0DAAkF;AAElF,kDAAkL;AAClL,wCAAqC;AAErC,4CAA6D;AAC7D,qEAAqE;AACrE,qDAA4D;AAC5D,kEAAmE;AAGnE;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAe,IAAY,EAAU,WAAyB;QAC3G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAA,YAAK,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,kBAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,0DAA0D;YAC1D,6DAA6D;YAC7D,
|
|
1
|
+
{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,8DAAuD;AACvD,wCAAoG;AACpG,wCAAyI;AACzI,oDAAiE;AACjE,oCAA6C;AAC7C,0DAAkF;AAElF,kDAAkL;AAClL,wCAAqC;AAErC,4CAA6D;AAC7D,qEAAqE;AACrE,qDAA4D;AAC5D,kEAAmE;AAGnE;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAe,IAAY,EAAU,WAAyB;QAC3G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAA,YAAK,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,kBAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,0DAA0D;YAC1D,6DAA6D;YAC7D,qEAAqE;YACrE,+EAA+E;YAC/E,sEAAsE;YACtE,gEAAgE;YAChE,wEAAwE;YACxE,sEAAsE;YACtE,iBAAiB;YACjB,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,EAAE,CAAC;gBAE1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;oBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,MAAM,GAAG,IAAA,+BAAmB,EAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAChC,sEAAsE;gBACtE,OAAO,EAAE,IAAA,oBAAa,EAAC,OAAO,CAAC,SAAS,CAAC;gBACzC,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,OAAO,IAAI,SAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAE9C,qEAAqE;gBACrE,6DAA6D;gBAC7D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;aACxD,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,aAAa,GAAG,GAAG,YAAY,sBAAS,IAAI,GAAG,YAAY,4BAAe,CAAC;YAEjF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,iCAAiC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,sBAAS,CAAC,CAAC,CAAC,8BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAE/G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,oBAAoB,WAAW,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;YAElF,OAAO,IAAI,mBAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAc,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC7G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,SAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,OAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,SAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE;oBACjC,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;oBAC9B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB,EAAqB,OAAiB;QAErH,OAAO,IAAI,SAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YAEzD,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,yDAAyD;YACzD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACxC,UAAU,EAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAyB,IAAI,IAAI;YAE3E,gEAAgE;YAChE,0EAA0E;YAC1E,uEAAuE;YACvE,kEAAkE;SACrC,CAAC,CAAC;IACnC,CAAC;CACF,CAAA;;AA3OW;IADT,IAAA,eAAU,GAAE;8BACY,6BAAa;sDAAC;AAG7B;IADT,IAAA,iCAAiB,EAAC,WAAW,CAAC;8BACP,mBAAY;qDAAC;AAG3B;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;wDAAC;AAKjC;IAHT,IAAA,sBAAM,EAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,IAAA,sBAAM,EAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACP,wCAAoB;uDAAC;AAGrC;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;2CAAC;AAcf;IAFZ,IAAA,WAAI,GAAE;IACN,IAAA,+BAAmB,GAAE;IACF,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAgB,WAAA,IAAA,qBAAS,GAAE,CAAA;IAAgB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAxC,WAAI,UAAkD,+BAAY;;4CAqH5G;AAiBY;IAFZ,IAAA,WAAI,GAAE;IACN,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,qBAAS,GAAE,CAAA;IAAgB,WAAA,IAAA,mBAAe,GAAE,CAAA;IAAqB,WAAA,IAAA,gBAAY,GAAE,CAAA;;qDAAO,WAAI;;6CA8B9G;AAcY;IAFZ,IAAA,UAAG,GAAE;IACL,IAAA,aAAM,EAAC,wBAAY,CAAC;IACA,WAAA,IAAA,gBAAY,GAAE,CAAA;IAAc,WAAA,IAAA,uBAAW,GAAE,CAAA;IAAsB,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCAA3D,WAAI;;6CAmB7C;0BA5OU,eAAe;IAD3B,IAAA,eAAQ,EAAC,MAAM,CAAC;GACJ,eAAe,CA6O3B"}
|
|
@@ -8,8 +8,10 @@ import { SessionCookieFactory } from '../services/SessionCookies.js';
|
|
|
8
8
|
*
|
|
9
9
|
* These routes serve the narrow window between a successful password check and
|
|
10
10
|
* full authorization: the session is `Logged` but not `Authorized` and carries
|
|
11
|
-
* the `TwoFactorAuth` marker. Both class policies
|
|
12
|
-
* closes the moment
|
|
11
|
+
* the `TwoFactorAuth` marker. Both class policies are passed to one `@Policy`
|
|
12
|
+
* call, so they are combined with AND and the window closes the moment
|
|
13
|
+
* verification succeeds. `TwoFacRouteEnabled` also enforces the system-wide
|
|
14
|
+
* switch, by way of the `TwoFactorAuthEnabled` it extends.
|
|
13
15
|
*
|
|
14
16
|
* Managing a TOTP device outside that window — enrolling for the first time, or
|
|
15
17
|
* turning 2FA off — lives on {@link TwoFactorAuthUserController} under
|
|
@@ -61,16 +63,5 @@ export declare class TwoFactorAuthController extends BaseController {
|
|
|
61
63
|
protected enrol(user: UserModel): Promise<unknown>;
|
|
62
64
|
/** Switch 2fa on for an account whose secret was just verified. */
|
|
63
65
|
protected activateEnrolment(user: UserModel): Promise<unknown>;
|
|
64
|
-
/**
|
|
65
|
-
* Refuse to start enrolment while 2FA is switched off system-wide.
|
|
66
|
-
*
|
|
67
|
-
* `TwoFacRouteEnabled` cannot do this job here either: @spinajs/http merges
|
|
68
|
-
* a route's policies into one gate that passes when ANY of them resolves,
|
|
69
|
-
* and this controller also carries `NotAuthorizedPolicy`, which succeeds
|
|
70
|
-
* for exactly the callers these routes serve — so `TwoFacRouteEnabled`
|
|
71
|
-
* rejecting cannot stop them. The check has to live where it cannot be
|
|
72
|
-
* short-circuited.
|
|
73
|
-
*/
|
|
74
|
-
protected assertSystemEnabled(): void;
|
|
75
66
|
}
|
|
76
67
|
//# sourceMappingURL=TwoFactorAuthController.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAQ,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAO/G,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAQ,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAO/G,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAEa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAE/C;;;;;;;;;;;OAWG;IAEU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAc9E;IAED;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC,CA8C3J;IAED;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED,mEAAmE;IACnE,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7D;CAEF"}
|
|
@@ -32,8 +32,10 @@ const grants_js_1 = require("../services/grants.js");
|
|
|
32
32
|
*
|
|
33
33
|
* These routes serve the narrow window between a successful password check and
|
|
34
34
|
* full authorization: the session is `Logged` but not `Authorized` and carries
|
|
35
|
-
* the `TwoFactorAuth` marker. Both class policies
|
|
36
|
-
* closes the moment
|
|
35
|
+
* the `TwoFactorAuth` marker. Both class policies are passed to one `@Policy`
|
|
36
|
+
* call, so they are combined with AND and the window closes the moment
|
|
37
|
+
* verification succeeds. `TwoFacRouteEnabled` also enforces the system-wide
|
|
38
|
+
* switch, by way of the `TwoFactorAuthEnabled` it extends.
|
|
37
39
|
*
|
|
38
40
|
* Managing a TOTP device outside that window — enrolling for the first time, or
|
|
39
41
|
* turning 2FA off — lives on {@link TwoFactorAuthUserController} under
|
|
@@ -58,7 +60,6 @@ let TwoFactorAuthController = class TwoFactorAuthController extends http_1.BaseC
|
|
|
58
60
|
* @response 403 Session is not awaiting two-factor enrolment
|
|
59
61
|
*/
|
|
60
62
|
async setup2fa(user) {
|
|
61
|
-
this.assertSystemEnabled();
|
|
62
63
|
if (user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED]) {
|
|
63
64
|
throw new exceptions_1.BadRequest(`User ${user.Uuid} already has 2fa enabled`);
|
|
64
65
|
}
|
|
@@ -141,23 +142,6 @@ let TwoFactorAuthController = class TwoFactorAuthController extends http_1.BaseC
|
|
|
141
142
|
activateEnrolment(user) {
|
|
142
143
|
return (0, _2fa_js_1.activateUser2Fa)(user);
|
|
143
144
|
}
|
|
144
|
-
/**
|
|
145
|
-
* Refuse to start enrolment while 2FA is switched off system-wide.
|
|
146
|
-
*
|
|
147
|
-
* `TwoFacRouteEnabled` cannot do this job here either: @spinajs/http merges
|
|
148
|
-
* a route's policies into one gate that passes when ANY of them resolves,
|
|
149
|
-
* and this controller also carries `NotAuthorizedPolicy`, which succeeds
|
|
150
|
-
* for exactly the callers these routes serve — so `TwoFacRouteEnabled`
|
|
151
|
-
* rejecting cannot stop them. The check has to live where it cannot be
|
|
152
|
-
* short-circuited.
|
|
153
|
-
*/
|
|
154
|
-
assertSystemEnabled() {
|
|
155
|
-
if (this.TwoFactorConfig?.enabled === false) {
|
|
156
|
-
throw Object.assign(new exceptions_1.Forbidden('2 factor auth is not enabled'), {
|
|
157
|
-
error: { code: 'E_2FA_SYSTEM_DISABLED', message: '2 factor auth is not enabled' },
|
|
158
|
-
});
|
|
159
|
-
}
|
|
160
|
-
}
|
|
161
145
|
};
|
|
162
146
|
exports.TwoFactorAuthController = TwoFactorAuthController;
|
|
163
147
|
__decorate([
|
|
@@ -194,7 +178,6 @@ __decorate([
|
|
|
194
178
|
], TwoFactorAuthController.prototype, "verifyToken", null);
|
|
195
179
|
exports.TwoFactorAuthController = TwoFactorAuthController = __decorate([
|
|
196
180
|
(0, http_1.BasePath)('auth'),
|
|
197
|
-
(0, http_2.Policy)(_2FaPolicy_js_1.TwoFacRouteEnabled)
|
|
198
|
-
(0, http_2.Policy)(rbac_http_2.NotAuthorizedPolicy)
|
|
181
|
+
(0, http_2.Policy)([_2FaPolicy_js_1.TwoFacRouteEnabled, rbac_http_2.NotAuthorizedPolicy])
|
|
199
182
|
], TwoFactorAuthController);
|
|
200
183
|
//# sourceMappingURL=TwoFactorAuthController.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAAiD;AACjD,wCAAsF;AACtF,wCAA+G;AAC/G,kDAA6C;AAC7C,wCAA6C;AAE7C,4DAA8D;AAC9D,0DAAmE;AACnE,oCAAyC;AACzC,kDAAyH;AACzH,+CAAoF;AACpF,
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAAiD;AACjD,wCAAsF;AACtF,wCAA+G;AAC/G,kDAA6C;AAC7C,wCAA6C;AAE7C,4DAA8D;AAC9D,0DAAmE;AACnE,oCAAyC;AACzC,kDAAyH;AACzH,+CAAoF;AACpF,oDAAiD;AACjD,kEAAmE;AACnE,qEAAqE;AACrE,qDAA0E;AAE1E;;;;;;;;;;;;;;;;;;GAkBG;AAGI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,qBAAc;IAazD;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,uBAAU,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QACpE,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,SAAE,CAAC;YACZ,GAAG,EAAE,MAAgB;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QACvG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,wEAAwE;YACxE,uEAAuE;YACvE,4BAA4B;YAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YAED,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAG,IAAA,wBAAY,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEjD,OAAO,IAAI,SAAE,CAAC,IAAA,+BAAmB,EAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC9D,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,OAAO,IAAI,wBAAiB,CAAC;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QAC3D,OAAO,IAAA,iBAAO,EAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,IAAe;QAC7B,OAAO,IAAA,+BAAqB,EAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,mEAAmE;IACzD,iBAAiB,CAAC,IAAe;QACzC,OAAO,IAAA,yBAAe,EAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CAEF,CAAA;;AAxHW;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;gEAAC;AAGjC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACP,wCAAoB;+DAAC;AAGrC;IADT,IAAA,eAAU,EAAC,oBAAa,CAAC;8BACZ,oBAAa;mDAAC;AAGlB;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;gEACkB;AAelC;IADZ,IAAA,WAAI,EAAC,WAAW,CAAC;IACK,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;uDAc5C;AAYY;IADZ,IAAA,WAAI,EAAC,YAAY,CAAC;IACO,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAqB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,mBAAO,GAAE,CAAA;;qCAA9C,WAAS,EAAiB,uBAAQ;;0DA8C1E;kCAlGU,uBAAuB;IAFnC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,CAAC,kCAAkB,EAAE,+BAAmB,CAAC,CAAC;GACrC,uBAAuB,CA0HnC"}
|
|
@@ -16,9 +16,10 @@ export interface ITwoFactorStatus {
|
|
|
16
16
|
Pending: boolean;
|
|
17
17
|
/**
|
|
18
18
|
* Whether 2FA is switched on system-wide (`rbac.twoFactorAuth.enabled`). The
|
|
19
|
-
* frontend hides its 2FA controls when this is false
|
|
20
|
-
*
|
|
21
|
-
*
|
|
19
|
+
* frontend hides its 2FA controls when this is false. Reading the status is
|
|
20
|
+
* deliberately left ungated by the switch so this can be reported at all —
|
|
21
|
+
* the mutating routes are the ones that refuse with 403
|
|
22
|
+
* `E_2FA_SYSTEM_DISABLED`.
|
|
22
23
|
*/
|
|
23
24
|
SystemEnabled: boolean;
|
|
24
25
|
}
|
|
@@ -36,16 +37,12 @@ export interface ITwoFactorStatus {
|
|
|
36
37
|
* not be enough to attach an attacker-controlled authenticator or to strip the
|
|
37
38
|
* second factor off the account.
|
|
38
39
|
*
|
|
39
|
-
*
|
|
40
|
-
*
|
|
41
|
-
*
|
|
42
|
-
*
|
|
43
|
-
*
|
|
44
|
-
*
|
|
45
|
-
* decides. That is why the system-wide switch (`rbac.twoFactorAuth.enabled`)
|
|
46
|
-
* is *also* enforced directly in the mutating handlers, via
|
|
47
|
-
* {@link assertSystemEnabled}, which is the check that actually matters for
|
|
48
|
-
* an authorized caller.
|
|
40
|
+
* The system-wide switch (`rbac.twoFactorAuth.enabled`) is enforced by
|
|
41
|
+
* `TwoFactorAuthEnabled`, passed to `@Permission` on each mutating route so it
|
|
42
|
+
* shares a policy group with the permission check and is therefore required
|
|
43
|
+
* rather than merely offered as an alternative. It is deliberately NOT a class
|
|
44
|
+
* policy: `status` stays readable while the switch is off, which is how the
|
|
45
|
+
* frontend learns to hide its 2FA controls.
|
|
49
46
|
*
|
|
50
47
|
* @tags Two-Factor Settings
|
|
51
48
|
*/
|
|
@@ -126,15 +123,6 @@ export declare class TwoFactorAuthUserController extends BaseController {
|
|
|
126
123
|
* @response 403 Forbidden — insufficient permissions
|
|
127
124
|
*/
|
|
128
125
|
reset(user: UserModel, confirmation: ConfirmPasswordDto, session: ISession): Promise<Ok<IEnable2faResponse> | Unauthorized>;
|
|
129
|
-
/**
|
|
130
|
-
* Refuse a mutation while 2FA is switched off system-wide.
|
|
131
|
-
*
|
|
132
|
-
* The `TwoFactorAuthEnabled` policy cannot do this job: @spinajs/http merges
|
|
133
|
-
* a route's policies into one gate that passes when ANY of them resolves, and
|
|
134
|
-
* these routes also carry AuthorizedPolicy, which succeeds for every
|
|
135
|
-
* logged-in caller. The check has to live where it cannot be short-circuited.
|
|
136
|
-
*/
|
|
137
|
-
protected assertSystemEnabled(): void;
|
|
138
126
|
/**
|
|
139
127
|
* Rotates the session id after the account's authentication requirements
|
|
140
128
|
* changed, and returns the response options carrying the new cookie.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthUserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,iBAAiB,EAAO,EAAE,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAqB,MAAM,eAAe,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAoB,kBAAkB,EAAoD,mBAAmB,EAAQ,MAAM,oBAAoB,CAAC;AAEvJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAKrE,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthUserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,iBAAiB,EAAO,EAAE,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAqB,MAAM,eAAe,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAoB,kBAAkB,EAAoD,mBAAmB,EAAQ,MAAM,oBAAoB,CAAC;AAEvJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAKrE,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAGa,2BAA4B,SAAQ,cAAc;IAE7D,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAE/C;;;;;;;OAOG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAQ1E;IAED;;;;;;;;;;;OAWG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC,CAiB3K;IAED;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,iBAAiB,CAAC,CA+B5I;IAED;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC,CAYxJ;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC,CAc1K;IAED;;;;;;;;;OASG;IACH,UAAgB,MAAM,CAAC,OAAO,EAAE,QAAQ;;;;;;;;;;;;OAWvC;IAED;;;;OAIG;IACH,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED,kEAAkE;IAClE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3E;IAED,2EAA2E;IAC3E,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnD;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,CAY/F;CACF"}
|
|
@@ -39,16 +39,12 @@ const _2FaPolicy_js_1 = require("../policies/2FaPolicy.js");
|
|
|
39
39
|
* not be enough to attach an attacker-controlled authenticator or to strip the
|
|
40
40
|
* second factor off the account.
|
|
41
41
|
*
|
|
42
|
-
*
|
|
43
|
-
*
|
|
44
|
-
*
|
|
45
|
-
*
|
|
46
|
-
*
|
|
47
|
-
*
|
|
48
|
-
* decides. That is why the system-wide switch (`rbac.twoFactorAuth.enabled`)
|
|
49
|
-
* is *also* enforced directly in the mutating handlers, via
|
|
50
|
-
* {@link assertSystemEnabled}, which is the check that actually matters for
|
|
51
|
-
* an authorized caller.
|
|
42
|
+
* The system-wide switch (`rbac.twoFactorAuth.enabled`) is enforced by
|
|
43
|
+
* `TwoFactorAuthEnabled`, passed to `@Permission` on each mutating route so it
|
|
44
|
+
* shares a policy group with the permission check and is therefore required
|
|
45
|
+
* rather than merely offered as an alternative. It is deliberately NOT a class
|
|
46
|
+
* policy: `status` stays readable while the switch is off, which is how the
|
|
47
|
+
* frontend learns to hide its 2FA controls.
|
|
52
48
|
*
|
|
53
49
|
* @tags Two-Factor Settings
|
|
54
50
|
*/
|
|
@@ -82,7 +78,6 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends http
|
|
|
82
78
|
* @response 403 Forbidden — insufficient permissions
|
|
83
79
|
*/
|
|
84
80
|
async enable(user, confirmation, session) {
|
|
85
|
-
this.assertSystemEnabled();
|
|
86
81
|
if (user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED]) {
|
|
87
82
|
throw new exceptions_1.BadRequest(`User ${user.Uuid} already has 2fa enabled`);
|
|
88
83
|
}
|
|
@@ -108,7 +103,6 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends http
|
|
|
108
103
|
* @response 403 Invalid or expired TOTP code
|
|
109
104
|
*/
|
|
110
105
|
async confirm(user, token, session) {
|
|
111
|
-
this.assertSystemEnabled();
|
|
112
106
|
// `activate()` never clears the stored token, so an already-enabled
|
|
113
107
|
// account still has one and would otherwise be able to call this route
|
|
114
108
|
// again with a currently-valid code. Only the pending state — a token
|
|
@@ -148,7 +142,6 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends http
|
|
|
148
142
|
* @response 403 Forbidden — insufficient permissions
|
|
149
143
|
*/
|
|
150
144
|
async disable(user, confirmation, session) {
|
|
151
|
-
this.assertSystemEnabled();
|
|
152
145
|
if (!user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED]) {
|
|
153
146
|
throw new exceptions_1.BadRequest(`User ${user.Uuid} already has 2fa disabled`);
|
|
154
147
|
}
|
|
@@ -187,7 +180,6 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends http
|
|
|
187
180
|
* @response 403 Forbidden — insufficient permissions
|
|
188
181
|
*/
|
|
189
182
|
async reset(user, confirmation, session) {
|
|
190
|
-
this.assertSystemEnabled();
|
|
191
183
|
if (!user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.ENABLED] && !user.Metadata[Default2FaToken_js_1.TWO_FA_METATADATA_KEYS.TOKEN]) {
|
|
192
184
|
throw new exceptions_1.BadRequest(`User ${user.Uuid} has no 2fa to reset`);
|
|
193
185
|
}
|
|
@@ -199,21 +191,6 @@ let TwoFactorAuthUserController = class TwoFactorAuthUserController extends http
|
|
|
199
191
|
const result = await this.enrol(user);
|
|
200
192
|
return new http_1.Ok({ otp: result }, await this.rotate(session));
|
|
201
193
|
}
|
|
202
|
-
/**
|
|
203
|
-
* Refuse a mutation while 2FA is switched off system-wide.
|
|
204
|
-
*
|
|
205
|
-
* The `TwoFactorAuthEnabled` policy cannot do this job: @spinajs/http merges
|
|
206
|
-
* a route's policies into one gate that passes when ANY of them resolves, and
|
|
207
|
-
* these routes also carry AuthorizedPolicy, which succeeds for every
|
|
208
|
-
* logged-in caller. The check has to live where it cannot be short-circuited.
|
|
209
|
-
*/
|
|
210
|
-
assertSystemEnabled() {
|
|
211
|
-
if (this.TwoFactorConfig?.enabled === false) {
|
|
212
|
-
throw Object.assign(new exceptions_1.Forbidden('2 factor auth is not enabled'), {
|
|
213
|
-
error: { code: 'E_2FA_SYSTEM_DISABLED', message: '2 factor auth is not enabled' },
|
|
214
|
-
});
|
|
215
|
-
}
|
|
216
|
-
}
|
|
217
194
|
/**
|
|
218
195
|
* Rotates the session id after the account's authentication requirements
|
|
219
196
|
* changed, and returns the response options carrying the new cookie.
|
|
@@ -292,7 +269,7 @@ __decorate([
|
|
|
292
269
|
], TwoFactorAuthUserController.prototype, "status", null);
|
|
293
270
|
__decorate([
|
|
294
271
|
(0, http_1.Post)('2fa/enable'),
|
|
295
|
-
(0, rbac_http_1.Permission)(['updateOwn']),
|
|
272
|
+
(0, rbac_http_1.Permission)(['updateOwn'], _2FaPolicy_js_1.TwoFactorAuthEnabled),
|
|
296
273
|
__param(0, (0, rbac_http_1.User)()),
|
|
297
274
|
__param(1, (0, http_1.Body)()),
|
|
298
275
|
__param(2, (0, rbac_http_1.Session)()),
|
|
@@ -302,7 +279,7 @@ __decorate([
|
|
|
302
279
|
], TwoFactorAuthUserController.prototype, "enable", null);
|
|
303
280
|
__decorate([
|
|
304
281
|
(0, http_1.Post)('2fa/confirm'),
|
|
305
|
-
(0, rbac_http_1.Permission)(['updateOwn']),
|
|
282
|
+
(0, rbac_http_1.Permission)(['updateOwn'], _2FaPolicy_js_1.TwoFactorAuthEnabled),
|
|
306
283
|
__param(0, (0, rbac_http_1.User)()),
|
|
307
284
|
__param(1, (0, http_1.Body)()),
|
|
308
285
|
__param(2, (0, rbac_http_1.Session)()),
|
|
@@ -312,7 +289,7 @@ __decorate([
|
|
|
312
289
|
], TwoFactorAuthUserController.prototype, "confirm", null);
|
|
313
290
|
__decorate([
|
|
314
291
|
(0, http_1.Post)('2fa/disable'),
|
|
315
|
-
(0, rbac_http_1.Permission)(['updateOwn']),
|
|
292
|
+
(0, rbac_http_1.Permission)(['updateOwn'], _2FaPolicy_js_1.TwoFactorAuthEnabled),
|
|
316
293
|
__param(0, (0, rbac_http_1.User)()),
|
|
317
294
|
__param(1, (0, http_1.Body)()),
|
|
318
295
|
__param(2, (0, rbac_http_1.Session)()),
|
|
@@ -322,7 +299,7 @@ __decorate([
|
|
|
322
299
|
], TwoFactorAuthUserController.prototype, "disable", null);
|
|
323
300
|
__decorate([
|
|
324
301
|
(0, http_1.Post)('2fa/reset'),
|
|
325
|
-
(0, rbac_http_1.Permission)(['updateOwn']),
|
|
302
|
+
(0, rbac_http_1.Permission)(['updateOwn'], _2FaPolicy_js_1.TwoFactorAuthEnabled),
|
|
326
303
|
__param(0, (0, rbac_http_1.User)()),
|
|
327
304
|
__param(1, (0, http_1.Body)()),
|
|
328
305
|
__param(2, (0, rbac_http_1.Session)()),
|
|
@@ -333,7 +310,6 @@ __decorate([
|
|
|
333
310
|
exports.TwoFactorAuthUserController = TwoFactorAuthUserController = __decorate([
|
|
334
311
|
(0, http_1.BasePath)('user'),
|
|
335
312
|
(0, rbac_http_1.Resource)('user'),
|
|
336
|
-
(0, http_1.Policy)(rbac_http_1.AuthorizedPolicy)
|
|
337
|
-
(0, http_1.Policy)(_2FaPolicy_js_1.TwoFactorAuthEnabled)
|
|
313
|
+
(0, http_1.Policy)(rbac_http_1.AuthorizedPolicy)
|
|
338
314
|
], TwoFactorAuthUserController);
|
|
339
315
|
//# sourceMappingURL=TwoFactorAuthUserController.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthUserController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAuH;AACvH,wCAAwG;AAExG,oCAAyC;AACzC,0DAAmE;AACnE,kDAAuJ;AACvJ,
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthUserController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAuH;AACvH,wCAAwG;AAExG,oCAAyC;AACzC,0DAAmE;AACnE,kDAAuJ;AACvJ,oDAAiD;AACjD,4EAAoE;AACpE,sDAA+C;AAC/C,qEAAqE;AACrE,+CAA0F;AAC1F,kEAAmE;AACnE,4DAAgE;AAuBhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAII,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,qBAAc;IAa7D;;;;;;;OAOG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAEvE,OAAO,IAAI,SAAE,CAAC;YACZ,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,KAAK,CAAC,CAAC;YACzE,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,KAAK,KAAK;SACvD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,YAAgC,EAAqB,OAAiB;QACzH,IAAI,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,uBAAU,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,SAAE,CAAC,EAAE,GAAG,EAAE,MAAgB,EAAE,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAU,KAAe,EAAqB,OAAiB;QACzG,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,uBAAU,CAAC,QAAQ,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,kEAAkE;YAClE,qEAAqE;YACrE,qDAAqD;YACrD,IAAI,CAAC,CAAC,GAAG,YAAY,mBAAY,CAAC,EAAE,CAAC;gBACnC,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAE7E,OAAO,IAAI,wBAAiB,CAAC;gBAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,0BAA0B;QAC1B,OAAO,IAAI,SAAE,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,OAAO,CAAS,IAAe,EAAU,YAAgC,EAAqB,OAAiB;QAC1H,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,uBAAU,CAAC,QAAQ,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,SAAE,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAS,IAAe,EAAU,YAAgC,EAAqB,OAAiB;QACxH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,2CAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,uBAAU,CAAC,QAAQ,IAAI,CAAC,IAAI,sBAAsB,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,SAAE,CAAC,EAAE,GAAG,EAAE,MAAgB,EAAE,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IACO,KAAK,CAAC,MAAM,CAAC,OAAiB;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3E,OAAO;YACL,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,IAAe;QAC7B,OAAO,IAAA,+BAAqB,EAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,kEAAkE;IACxD,gBAAgB,CAAC,IAAe,EAAE,KAAa;QACvD,OAAO,IAAA,wBAAc,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,2EAA2E;IACjE,OAAO,CAAC,IAAe;QAC/B,OAAO,IAAA,wBAAc,EAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAAC,IAAe,EAAE,QAAgB;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,IAAI,gCAAgC,CAAC,CAAC;YAErF,OAAO,IAAI,mBAAY,CAAC;gBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;;AA/OW;IADT,IAAA,iCAAiB,EAAC,eAAe,CAAC;8BACP,uBAAgB;qEAAC;AAGnC;IADT,IAAA,iCAAiB,EAAC,cAAc,CAAC;8BACP,sBAAe;oEAAC;AAGjC;IADT,IAAA,eAAU,EAAC,wCAAoB,CAAC;8BACP,wCAAoB;mEAAC;AAGrC;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;oEACkB;AAYlC;IAFZ,IAAA,UAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACH,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;yDAQ1C;AAgBY;IAFZ,IAAA,WAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,EAAE,oCAAoB,CAAC;IAC3B,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCAAvE,WAAS,EAAwB,4CAAkB;;yDAiBpF;AAcY;IAFZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,EAAE,oCAAoB,CAAC;IAC1B,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCAAtD,WAAS,EAAiB,uBAAQ;;0DA+BpE;AAcY;IAFZ,IAAA,WAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,EAAE,oCAAoB,CAAC;IAC1B,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCAAvE,WAAS,EAAwB,4CAAkB;;0DAYrF;AA+BY;IAFZ,IAAA,WAAI,EAAC,WAAW,CAAC;IACjB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,EAAE,oCAAoB,CAAC;IAC5B,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,mBAAe,GAAE,CAAA;;qCAAvE,WAAS,EAAwB,4CAAkB;;wDAcnF;sCApLU,2BAA2B;IAHvC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,aAAM,EAAC,4BAAgB,CAAC;GACZ,2BAA2B,CAiPvC"}
|
|
@@ -65,8 +65,8 @@ let LoginController = class LoginController extends BaseController {
|
|
|
65
65
|
const twoFaEnabledForUser = Boolean(user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]);
|
|
66
66
|
// `forceUser` alone used to be enough to park the user in
|
|
67
67
|
// TwoFactorInitRequired. But every mutating `/user/2fa*` and
|
|
68
|
-
// `/auth/2fa/setup`
|
|
69
|
-
// 403 when `rbac.twoFactorAuth.enabled` is off — so a user forced into
|
|
68
|
+
// `/auth/2fa/setup` route is now gated by `TwoFactorAuthEnabled` and
|
|
69
|
+
// answers 403 when `rbac.twoFactorAuth.enabled` is off — so a user forced into
|
|
70
70
|
// this branch while the system switch is off would have no route back
|
|
71
71
|
// out: setup2fa can no longer both enrol AND activate them. The
|
|
72
72
|
// system-wide switch has to gate this branch too, or every user without
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACzI,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,OAAO,IAAI,eAAe,EAAE,SAAS,EAAE,WAAW,EAAmC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClL,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAkB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,cAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAe,IAAY,EAAU,WAAyB;QAC3G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,0DAA0D;YAC1D,6DAA6D;YAC7D,
|
|
1
|
+
{"version":3,"file":"LoginController.js","sourceRoot":"","sources":["../../../src/controllers/LoginController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACzI,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAAE,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,OAAO,IAAI,eAAe,EAAE,SAAS,EAAE,WAAW,EAAmC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClL,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAkB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,cAAc;IA2BjD;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,KAAK,CAAiB,MAAY,EAAe,IAAY,EAAU,WAAyB;QAC3G,IAAI,CAAC;YAEH,0DAA0D;YAC1D,2BAA2B;YAC3B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAElC,IAAI,MAAsB,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,oEAAoE;YACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAED,8BAA8B;YAC9B,sEAAsE;YACtE,+EAA+E;YAC/E,yDAAyD;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAEzB,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;YAEnF,0DAA0D;YAC1D,6DAA6D;YAC7D,qEAAqE;YACrE,+EAA+E;YAC/E,sEAAsE;YACtE,gEAAgE;YAChE,wEAAwE;YACxE,sEAAsE;YACtE,iBAAiB;YACjB,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBACI,IAAI,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,EAAE,CAAC;gBAE1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;gBAExC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBAEN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBAErC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iCAAiC,EAAE;oBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEH,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAChC,sEAAsE;gBACtE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;gBACzC,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YAEH,OAAO,IAAI,EAAE,CAAC,MAAM,EAAE;gBACpB,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAE9C,qEAAqE;gBACrE,6DAA6D;gBAC7D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;aACxD,CAAC,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,aAAa,GAAG,GAAG,YAAY,SAAS,IAAI,GAAG,YAAY,eAAe,CAAC;YAEjF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAY,EAAE,iCAAiC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAE/G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAY,EAAE,oBAAoB,WAAW,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;YAElF,OAAO,IAAI,YAAY,CAAC;gBACtB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,6BAA6B;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAc,IAAY,EAAqB,OAAiB,EAAkB,IAAU;QAC7G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,EAAE,EAAE,CAAC;QAClB,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,kCAAkC;QAClC,iEAAiE;QACjE,gDAAgD;QAChD,0EAA0E;QAC1E,sBAAsB;QACtB,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE;oBACjC,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;oBAC9B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAiB,IAAU,EAAiB,UAAkB,EAAqB,OAAiB;QAErH,OAAO,IAAI,EAAE,CAAC;YACZ,GAAG,IAAI,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YAEzD,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,yEAAyE;YACzE,yDAAyD;YACzD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACxC,UAAU,EAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAyB,IAAI,IAAI;YAE3E,gEAAgE;YAChE,0EAA0E;YAC1E,uEAAuE;YACvE,kEAAkE;SACrC,CAAC,CAAC;IACnC,CAAC;CACF,CAAA;AA3OW;IADT,UAAU,EAAE;8BACY,aAAa;sDAAC;AAG7B;IADT,iBAAiB,CAAC,WAAW,CAAC;8BACP,YAAY;qDAAC;AAG3B;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;wDAAC;AAKjC;IAHT,MAAM,CAAC,4BAA4B,EAAE;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC;;6DACsC;AAM9B;IAHT,MAAM,CAAC,8BAA8B,EAAE;QACtC,YAAY,EAAE,KAAK;KACpB,CAAC;;+DACwC;AAGhC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;uDAAC;AAGrC;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;2CAAC;AAcf;IAFZ,IAAI,EAAE;IACN,mBAAmB,EAAE;IACF,WAAA,YAAY,EAAE,CAAA;IAAgB,WAAA,SAAS,EAAE,CAAA;IAAgB,WAAA,IAAI,EAAE,CAAA;;qCAAxC,IAAI,UAAkD,YAAY;;4CAqH5G;AAiBY;IAFZ,IAAI,EAAE;IACN,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,SAAS,EAAE,CAAA;IAAgB,WAAA,eAAe,EAAE,CAAA;IAAqB,WAAA,YAAY,EAAE,CAAA;;qDAAO,IAAI;;6CA8B9G;AAcY;IAFZ,GAAG,EAAE;IACL,MAAM,CAAC,YAAY,CAAC;IACA,WAAA,YAAY,EAAE,CAAA;IAAc,WAAA,WAAW,EAAE,CAAA;IAAsB,WAAA,eAAe,EAAE,CAAA;;qCAA3D,IAAI;;6CAmB7C;AA5OU,eAAe;IAD3B,QAAQ,CAAC,MAAM,CAAC;GACJ,eAAe,CA6O3B"}
|
|
@@ -8,8 +8,10 @@ import { SessionCookieFactory } from '../services/SessionCookies.js';
|
|
|
8
8
|
*
|
|
9
9
|
* These routes serve the narrow window between a successful password check and
|
|
10
10
|
* full authorization: the session is `Logged` but not `Authorized` and carries
|
|
11
|
-
* the `TwoFactorAuth` marker. Both class policies
|
|
12
|
-
* closes the moment
|
|
11
|
+
* the `TwoFactorAuth` marker. Both class policies are passed to one `@Policy`
|
|
12
|
+
* call, so they are combined with AND and the window closes the moment
|
|
13
|
+
* verification succeeds. `TwoFacRouteEnabled` also enforces the system-wide
|
|
14
|
+
* switch, by way of the `TwoFactorAuthEnabled` it extends.
|
|
13
15
|
*
|
|
14
16
|
* Managing a TOTP device outside that window — enrolling for the first time, or
|
|
15
17
|
* turning 2FA off — lives on {@link TwoFactorAuthUserController} under
|
|
@@ -61,16 +63,5 @@ export declare class TwoFactorAuthController extends BaseController {
|
|
|
61
63
|
protected enrol(user: UserModel): Promise<unknown>;
|
|
62
64
|
/** Switch 2fa on for an account whose secret was just verified. */
|
|
63
65
|
protected activateEnrolment(user: UserModel): Promise<unknown>;
|
|
64
|
-
/**
|
|
65
|
-
* Refuse to start enrolment while 2FA is switched off system-wide.
|
|
66
|
-
*
|
|
67
|
-
* `TwoFacRouteEnabled` cannot do this job here either: @spinajs/http merges
|
|
68
|
-
* a route's policies into one gate that passes when ANY of them resolves,
|
|
69
|
-
* and this controller also carries `NotAuthorizedPolicy`, which succeeds
|
|
70
|
-
* for exactly the callers these routes serve — so `TwoFacRouteEnabled`
|
|
71
|
-
* rejecting cannot stop them. The check has to live where it cannot be
|
|
72
|
-
* short-circuited.
|
|
73
|
-
*/
|
|
74
|
-
protected assertSystemEnabled(): void;
|
|
75
66
|
}
|
|
76
67
|
//# sourceMappingURL=TwoFactorAuthController.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAQ,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAO/G,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAY,EAAE,EAAQ,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAO/G,OAAO,EAA6B,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAGrE;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAEa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,EAAE,EAAE,aAAa,CAAC;IAG5B,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAE/C;;;;;;;;;;;OAWG;IAEU,QAAQ,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAc9E;IAED;;;;;;;;OAQG;IAEU,WAAW,CAAS,MAAM,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAa,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,iBAAiB,CAAC,CA8C3J;IAED;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED,mEAAmE;IACnE,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7D;CAEF"}
|
|
@@ -20,7 +20,7 @@ import { AutoinjectService, Config } from '@spinajs/configuration';
|
|
|
20
20
|
import { Autoinject } from '@spinajs/di';
|
|
21
21
|
import { User, NotAuthorizedPolicy } from '@spinajs/rbac-http';
|
|
22
22
|
import { auth2Fa, activateUser2Fa, beginUser2FaEnrolment } from '../actions/2fa.js';
|
|
23
|
-
import { BadRequest
|
|
23
|
+
import { BadRequest } from '@spinajs/exceptions';
|
|
24
24
|
import { TWO_FA_METATADATA_KEYS } from '../2fa/Default2FaToken.js';
|
|
25
25
|
import { SessionCookieFactory } from '../services/SessionCookies.js';
|
|
26
26
|
import { activeRoleOf, buildUserWithGrants } from '../services/grants.js';
|
|
@@ -29,8 +29,10 @@ import { activeRoleOf, buildUserWithGrants } from '../services/grants.js';
|
|
|
29
29
|
*
|
|
30
30
|
* These routes serve the narrow window between a successful password check and
|
|
31
31
|
* full authorization: the session is `Logged` but not `Authorized` and carries
|
|
32
|
-
* the `TwoFactorAuth` marker. Both class policies
|
|
33
|
-
* closes the moment
|
|
32
|
+
* the `TwoFactorAuth` marker. Both class policies are passed to one `@Policy`
|
|
33
|
+
* call, so they are combined with AND and the window closes the moment
|
|
34
|
+
* verification succeeds. `TwoFacRouteEnabled` also enforces the system-wide
|
|
35
|
+
* switch, by way of the `TwoFactorAuthEnabled` it extends.
|
|
34
36
|
*
|
|
35
37
|
* Managing a TOTP device outside that window — enrolling for the first time, or
|
|
36
38
|
* turning 2FA off — lives on {@link TwoFactorAuthUserController} under
|
|
@@ -55,7 +57,6 @@ let TwoFactorAuthController = class TwoFactorAuthController extends BaseControll
|
|
|
55
57
|
* @response 403 Session is not awaiting two-factor enrolment
|
|
56
58
|
*/
|
|
57
59
|
async setup2fa(user) {
|
|
58
|
-
this.assertSystemEnabled();
|
|
59
60
|
if (user.Metadata[TWO_FA_METATADATA_KEYS.ENABLED]) {
|
|
60
61
|
throw new BadRequest(`User ${user.Uuid} already has 2fa enabled`);
|
|
61
62
|
}
|
|
@@ -138,23 +139,6 @@ let TwoFactorAuthController = class TwoFactorAuthController extends BaseControll
|
|
|
138
139
|
activateEnrolment(user) {
|
|
139
140
|
return activateUser2Fa(user);
|
|
140
141
|
}
|
|
141
|
-
/**
|
|
142
|
-
* Refuse to start enrolment while 2FA is switched off system-wide.
|
|
143
|
-
*
|
|
144
|
-
* `TwoFacRouteEnabled` cannot do this job here either: @spinajs/http merges
|
|
145
|
-
* a route's policies into one gate that passes when ANY of them resolves,
|
|
146
|
-
* and this controller also carries `NotAuthorizedPolicy`, which succeeds
|
|
147
|
-
* for exactly the callers these routes serve — so `TwoFacRouteEnabled`
|
|
148
|
-
* rejecting cannot stop them. The check has to live where it cannot be
|
|
149
|
-
* short-circuited.
|
|
150
|
-
*/
|
|
151
|
-
assertSystemEnabled() {
|
|
152
|
-
if (this.TwoFactorConfig?.enabled === false) {
|
|
153
|
-
throw Object.assign(new Forbidden('2 factor auth is not enabled'), {
|
|
154
|
-
error: { code: 'E_2FA_SYSTEM_DISABLED', message: '2 factor auth is not enabled' },
|
|
155
|
-
});
|
|
156
|
-
}
|
|
157
|
-
}
|
|
158
142
|
};
|
|
159
143
|
__decorate([
|
|
160
144
|
AutoinjectService('rbac.session'),
|
|
@@ -190,8 +174,7 @@ __decorate([
|
|
|
190
174
|
], TwoFactorAuthController.prototype, "verifyToken", null);
|
|
191
175
|
TwoFactorAuthController = __decorate([
|
|
192
176
|
BasePath('auth'),
|
|
193
|
-
Policy(TwoFacRouteEnabled)
|
|
194
|
-
Policy(NotAuthorizedPolicy)
|
|
177
|
+
Policy([TwoFacRouteEnabled, NotAuthorizedPolicy])
|
|
195
178
|
], TwoFactorAuthController);
|
|
196
179
|
export { TwoFactorAuthController };
|
|
197
180
|
//# sourceMappingURL=TwoFactorAuthController.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAY,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAA4D,MAAM,oBAAoB,CAAC;AACzH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthController.js","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAY,eAAe,EAAE,IAAI,IAAI,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAA4D,MAAM,oBAAoB,CAAC;AACzH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;;;;;;;;;;;;;;;;GAkBG;AAGI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,cAAc;IAazD;;;;;;;;;;;OAWG;IAEU,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAe;QAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QACpE,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,EAAE,CAAC;YACZ,GAAG,EAAE,MAAgB;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IAEU,AAAN,KAAK,CAAC,WAAW,CAAS,MAAiB,EAAU,KAAe,EAAa,OAAiB;QACvG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAErD,wEAAwE;YACxE,uEAAuE;YACvE,4BAA4B;YAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YAED,mCAAmC;YACnC,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAErC,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;YAEH,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEjD,OAAO,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC9D,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,OAAO,IAAI,iBAAiB,CAAC;gBAC3B,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,kBAAkB;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACO,oBAAoB,CAAC,IAAe,EAAE,KAAa;QAC3D,OAAO,OAAO,CAAC,IAAI,EAAE,KAAK,CAAkB,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,IAAe;QAC7B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,mEAAmE;IACzD,iBAAiB,CAAC,IAAe;QACzC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CAEF,CAAA;AAxHW;IADT,iBAAiB,CAAC,cAAc,CAAC;8BACP,eAAe;gEAAC;AAGjC;IADT,UAAU,CAAC,oBAAoB,CAAC;8BACP,oBAAoB;+DAAC;AAGrC;IADT,UAAU,CAAC,aAAa,CAAC;8BACZ,aAAa;mDAAC;AAGlB;IADT,MAAM,CAAC,oBAAoB,CAAC;;gEACkB;AAelC;IADZ,IAAI,CAAC,WAAW,CAAC;IACK,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;uDAc5C;AAYY;IADZ,IAAI,CAAC,YAAY,CAAC;IACO,WAAA,IAAI,EAAE,CAAA;IAAqB,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,OAAO,EAAE,CAAA;;qCAA9C,SAAS,EAAiB,QAAQ;;0DA8C1E;AAlGU,uBAAuB;IAFnC,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;GACrC,uBAAuB,CA0HnC"}
|
|
@@ -16,9 +16,10 @@ export interface ITwoFactorStatus {
|
|
|
16
16
|
Pending: boolean;
|
|
17
17
|
/**
|
|
18
18
|
* Whether 2FA is switched on system-wide (`rbac.twoFactorAuth.enabled`). The
|
|
19
|
-
* frontend hides its 2FA controls when this is false
|
|
20
|
-
*
|
|
21
|
-
*
|
|
19
|
+
* frontend hides its 2FA controls when this is false. Reading the status is
|
|
20
|
+
* deliberately left ungated by the switch so this can be reported at all —
|
|
21
|
+
* the mutating routes are the ones that refuse with 403
|
|
22
|
+
* `E_2FA_SYSTEM_DISABLED`.
|
|
22
23
|
*/
|
|
23
24
|
SystemEnabled: boolean;
|
|
24
25
|
}
|
|
@@ -36,16 +37,12 @@ export interface ITwoFactorStatus {
|
|
|
36
37
|
* not be enough to attach an attacker-controlled authenticator or to strip the
|
|
37
38
|
* second factor off the account.
|
|
38
39
|
*
|
|
39
|
-
*
|
|
40
|
-
*
|
|
41
|
-
*
|
|
42
|
-
*
|
|
43
|
-
*
|
|
44
|
-
*
|
|
45
|
-
* decides. That is why the system-wide switch (`rbac.twoFactorAuth.enabled`)
|
|
46
|
-
* is *also* enforced directly in the mutating handlers, via
|
|
47
|
-
* {@link assertSystemEnabled}, which is the check that actually matters for
|
|
48
|
-
* an authorized caller.
|
|
40
|
+
* The system-wide switch (`rbac.twoFactorAuth.enabled`) is enforced by
|
|
41
|
+
* `TwoFactorAuthEnabled`, passed to `@Permission` on each mutating route so it
|
|
42
|
+
* shares a policy group with the permission check and is therefore required
|
|
43
|
+
* rather than merely offered as an alternative. It is deliberately NOT a class
|
|
44
|
+
* policy: `status` stays readable while the switch is off, which is how the
|
|
45
|
+
* frontend learns to hide its 2FA controls.
|
|
49
46
|
*
|
|
50
47
|
* @tags Two-Factor Settings
|
|
51
48
|
*/
|
|
@@ -126,15 +123,6 @@ export declare class TwoFactorAuthUserController extends BaseController {
|
|
|
126
123
|
* @response 403 Forbidden — insufficient permissions
|
|
127
124
|
*/
|
|
128
125
|
reset(user: UserModel, confirmation: ConfirmPasswordDto, session: ISession): Promise<Ok<IEnable2faResponse> | Unauthorized>;
|
|
129
|
-
/**
|
|
130
|
-
* Refuse a mutation while 2FA is switched off system-wide.
|
|
131
|
-
*
|
|
132
|
-
* The `TwoFactorAuthEnabled` policy cannot do this job: @spinajs/http merges
|
|
133
|
-
* a route's policies into one gate that passes when ANY of them resolves, and
|
|
134
|
-
* these routes also carry AuthorizedPolicy, which succeeds for every
|
|
135
|
-
* logged-in caller. The check has to live where it cannot be short-circuited.
|
|
136
|
-
*/
|
|
137
|
-
protected assertSystemEnabled(): void;
|
|
138
126
|
/**
|
|
139
127
|
* Rotates the session id after the account's authentication requirements
|
|
140
128
|
* changed, and returns the response options carrying the new cookie.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TwoFactorAuthUserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,iBAAiB,EAAO,EAAE,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAqB,MAAM,eAAe,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAoB,kBAAkB,EAAoD,mBAAmB,EAAQ,MAAM,oBAAoB,CAAC;AAEvJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAKrE,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB
|
|
1
|
+
{"version":3,"file":"TwoFactorAuthUserController.d.ts","sourceRoot":"","sources":["../../../src/controllers/TwoFactorAuthUserController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkB,iBAAiB,EAAO,EAAE,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAC;AACvH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,SAAS,EAAqB,MAAM,eAAe,CAAC;AACxG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAoB,kBAAkB,EAAoD,mBAAmB,EAAQ,MAAM,oBAAoB,CAAC;AAEvJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAKrE,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAGa,2BAA4B,SAAQ,cAAc;IAE7D,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAG7C,SAAS,CAAC,eAAe,EAAE,eAAe,CAAC;IAG3C,SAAS,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG/C,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAE/C;;;;;;;OAOG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAQ1E;IAED;;;;;;;;;;;OAWG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC,CAiB3K;IAED;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAU,KAAK,EAAE,QAAQ,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,iBAAiB,CAAC,CA+B5I;IAED;;;;;;;;;OASG;IAGU,OAAO,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC,CAYxJ;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IAGU,KAAK,CAAS,IAAI,EAAE,SAAS,EAAU,YAAY,EAAE,kBAAkB,EAAqB,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,YAAY,CAAC,CAc1K;IAED;;;;;;;;;OASG;IACH,UAAgB,MAAM,CAAC,OAAO,EAAE,QAAQ;;;;;;;;;;;;OAWvC;IAED;;;;OAIG;IACH,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED,kEAAkE;IAClE,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3E;IAED,2EAA2E;IAC3E,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnD;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC,CAY/F;CACF"}
|