@stacksjs/auth 0.70.88 → 0.70.90

package/dist/tokens.js

@@ -0,0 +1,489 @@
+import process from "node:process";
+import { createHash, randomBytes } from "node:crypto";
+import { db } from "@stacksjs/database";
+import { HttpError } from "@stacksjs/error-handling";
+import { getCurrentRequest } from "@stacksjs/router";
+import { env } from "@stacksjs/env";
+import { sqlHelpers } from "@stacksjs/database";
+const dbDriver = env.DB_CONNECTION || "sqlite", sql = sqlHelpers(dbDriver), { isPostgres, isMysql, now, boolTrue, boolFalse } = sql;
+function param(index) {
+  return sql.param(index);
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function bearerLookupHash(bearer) {
+  const colonIdx = bearer.indexOf(":"), lookup = colonIdx === -1 ? bearer : bearer.substring(0, colonIdx);
+  return hashToken(lookup);
+}
+function generateSecureToken(bytes = 40) {
+  return randomBytes(bytes).toString("hex");
+}
+export async function getPasswordChangedAt(userId, q = db) {
+  if (userId === null || userId === void 0)
+    return null;
+  try {
+    const value = (await q.unsafe(`
+      SELECT password_changed_at FROM users WHERE id = ${param(1)} LIMIT 1
+    `, [userId]))[0]?.password_changed_at;
+    if (value === null || value === void 0)
+      return null;
+    const parsed = new Date(String(value));
+    return Number.isNaN(parsed.getTime()) ? null : parsed;
+  } catch {
+    return null;
+  }
+}
+export function isIssuedBeforePasswordChange(createdAt, changedAt) {
+  if (!changedAt)
+    return !1;
+  if (createdAt === null || createdAt === void 0)
+    return !1;
+  const created = new Date(String(createdAt));
+  if (Number.isNaN(created.getTime()))
+    return !1;
+  return created.getTime() < changedAt.getTime();
+}
+export async function tokens(userId) {
+  return (await db.unsafe(`
+    SELECT t.*, c.provider as client_provider
+    FROM oauth_access_tokens t
+    LEFT JOIN oauth_clients c ON t.oauth_client_id = c.id
+    WHERE t.user_id = ${param(1)}
+    AND t.revoked = ${boolFalse}
+    ORDER BY t.created_at DESC
+  `, [userId])).map((row) => ({
+    id: row.id,
+    userId: row.user_id,
+    clientId: row.oauth_client_id,
+    name: row.name || "access-token",
+    scopes: parseScopes(row.scopes),
+    revoked: !!row.revoked,
+    expiresAt: row.expires_at ? new Date(row.expires_at) : null,
+    createdAt: new Date(row.created_at),
+    updatedAt: row.updated_at ? new Date(row.updated_at) : new Date
+  }));
+}
+export async function findToken(plainTextToken) {
+  const hashedToken = bearerLookupHash(plainTextToken), row = (await db.unsafe(`
+    SELECT * FROM oauth_access_tokens
+    WHERE token = ${param(1)}
+    AND revoked = ${boolFalse}
+    AND (expires_at IS NULL OR expires_at > ${now})
+    LIMIT 1
+  `, [hashedToken]))[0];
+  if (!row)
+    return null;
+  if (isIssuedBeforePasswordChange(row.created_at, await getPasswordChangedAt(row.user_id)))
+    return null;
+  return {
+    id: row.id,
+    userId: row.user_id,
+    clientId: row.oauth_client_id,
+    name: row.name || "access-token",
+    scopes: parseScopes(row.scopes),
+    revoked: !!row.revoked,
+    expiresAt: row.expires_at ? new Date(row.expires_at) : null,
+    createdAt: new Date(row.created_at),
+    updatedAt: row.updated_at ? new Date(row.updated_at) : new Date
+  };
+}
+export async function currentAccessToken() {
+  const request = getCurrentRequest();
+  if (!request)
+    return null;
+  const attached = request._currentAccessToken;
+  if (attached)
+    return attached;
+  const bearerToken = request.bearerToken?.();
+  if (!bearerToken)
+    return null;
+  const token = await findToken(bearerToken);
+  if (token)
+    request._currentAccessToken = token;
+  return token;
+}
+export const token = currentAccessToken;
+export async function tokenCan(scope) {
+  const accessToken = await currentAccessToken();
+  if (!accessToken)
+    return !1;
+  if (accessToken.scopes.includes("*"))
+    return !0;
+  return accessToken.scopes.includes(scope);
+}
+export async function tokenCant(scope) {
+  return !await tokenCan(scope);
+}
+export async function tokenCanAll(scopes) {
+  const accessToken = await currentAccessToken();
+  if (!accessToken)
+    return !1;
+  if (accessToken.scopes.includes("*"))
+    return !0;
+  return scopes.every((scope) => accessToken.scopes.includes(scope));
+}
+export async function tokenCanAny(scopes) {
+  const accessToken = await currentAccessToken();
+  if (!accessToken)
+    return !1;
+  if (accessToken.scopes.includes("*"))
+    return !0;
+  return scopes.some((scope) => accessToken.scopes.includes(scope));
+}
+export async function tokenAbilities() {
+  return (await currentAccessToken())?.scopes || [];
+}
+export async function createToken(userId, name = "access-token", scopes = ["*"], options = {}) {
+  const {
+    expiresInMinutes = 60,
+    withRefreshToken = !0,
+    refreshExpiresInDays = 30
+  } = options, client = (await db.unsafe(`
+    SELECT id FROM oauth_clients WHERE personal_access_client = ${boolTrue} LIMIT 1
+  `))[0];
+  if (!client)
+    throw new HttpError(500, "No personal access client found. Run ./buddy auth:setup first.");
+  const plainTextToken = generateSecureToken(40), hashedToken = hashToken(plainTextToken), expiresAt = new Date;
+  expiresAt.setMinutes(expiresAt.getMinutes() + expiresInMinutes);
+  if (isPostgres)
+    await db.unsafe(`
+      INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
+      VALUES ($1, $2, $3, $4, $5, false, $6, NOW(), NOW())
+    `, [userId, client.id, hashedToken, name, JSON.stringify(scopes), expiresAt.toISOString()]);
+  else
+    await db.unsafe(`
+      INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, 0, ?, ${now}, ${now})
+    `, [userId, client.id, hashedToken, name, JSON.stringify(scopes), expiresAt.toISOString()]);
+  const row = (await db.unsafe(`
+    SELECT * FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
+  `, [hashedToken]))[0];
+  if (!row)
+    throw new HttpError(500, "Failed to create access token \u2014 inserted row not found");
+  const accessToken = {
+    id: row.id,
+    userId: row.user_id,
+    clientId: row.oauth_client_id,
+    name: row.name,
+    scopes: parseScopes(row.scopes),
+    revoked: !1,
+    expiresAt,
+    createdAt: new Date(row.created_at),
+    updatedAt: new Date(row.updated_at)
+  };
+  let refreshTokenPlain;
+  if (withRefreshToken) {
+    refreshTokenPlain = generateSecureToken(40);
+    const hashedRefreshToken = hashToken(refreshTokenPlain), refreshExpiresAt = new Date;
+    refreshExpiresAt.setDate(refreshExpiresAt.getDate() + refreshExpiresInDays);
+    if (isPostgres)
+      await db.unsafe(`
+        INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
+        VALUES ($1, $2, false, $3, NOW())
+      `, [accessToken.id, hashedRefreshToken, refreshExpiresAt.toISOString()]);
+    else
+      await db.unsafe(`
+        INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
+        VALUES (?, ?, 0, ?, ${now})
+      `, [accessToken.id, hashedRefreshToken, refreshExpiresAt.toISOString()]);
+  }
+  return {
+    accessToken,
+    plainTextToken,
+    refreshToken: refreshTokenPlain,
+    expiresIn: expiresInMinutes * 60
+  };
+}
+export async function refreshToken(refreshTokenPlain, options = {}) {
+  const {
+    expiresInMinutes = 60,
+    refreshExpiresInDays = 30
+  } = options, hashedRefreshToken = hashToken(refreshTokenPlain);
+  return await db.transaction(async (rawTrx) => {
+    const trx = rawTrx, forUpdate = isPostgres || isMysql ? " FOR UPDATE" : "", refreshRow = (await trx.unsafe(`
+      SELECT r.*, t.user_id, t.oauth_client_id, t.name, t.scopes
+      FROM oauth_refresh_tokens r
+      JOIN oauth_access_tokens t ON r.access_token_id = t.id
+      WHERE r.token = ${param(1)}
+      AND r.revoked = ${boolFalse}
+      AND (r.expires_at IS NULL OR r.expires_at > ${now})
+      LIMIT 1${forUpdate}
+    `, [hashedRefreshToken]))[0];
+    if (!refreshRow)
+      throw new HttpError(401, "Invalid or expired refresh token");
+    if (isIssuedBeforePasswordChange(refreshRow.created_at, await getPasswordChangedAt(refreshRow.user_id, trx)))
+      throw new HttpError(401, "Invalid or expired refresh token");
+    await trx.unsafe(`
+      UPDATE oauth_refresh_tokens
+      SET revoked = ${boolTrue}
+      WHERE id = ${param(1)}
+    `, [refreshRow.id]);
+    await trx.unsafe(`
+      UPDATE oauth_access_tokens
+      SET revoked = ${boolTrue}
+      WHERE id = ${param(1)}
+    `, [refreshRow.access_token_id]);
+    const plainTextToken = generateSecureToken(40), hashedToken = hashToken(plainTextToken), expiresAt = new Date;
+    expiresAt.setMinutes(expiresAt.getMinutes() + expiresInMinutes);
+    if (isPostgres)
+      await trx.unsafe(`
+        INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
+        VALUES ($1, $2, $3, $4, $5, false, $6, NOW(), NOW())
+      `, [refreshRow.user_id, refreshRow.oauth_client_id, hashedToken, refreshRow.name, refreshRow.scopes, expiresAt.toISOString()]);
+    else
+      await trx.unsafe(`
+        INSERT INTO oauth_access_tokens (user_id, oauth_client_id, token, name, scopes, revoked, expires_at, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, 0, ?, ${now}, ${now})
+      `, [refreshRow.user_id, refreshRow.oauth_client_id, hashedToken, refreshRow.name, refreshRow.scopes, expiresAt.toISOString()]);
+    const row = (await trx.unsafe(`
+      SELECT * FROM oauth_access_tokens WHERE token = ${param(1)} LIMIT 1
+    `, [hashedToken]))[0], accessToken = {
+      id: row.id,
+      userId: row.user_id,
+      clientId: row.oauth_client_id,
+      name: row.name,
+      scopes: parseScopes(row.scopes),
+      revoked: !1,
+      expiresAt,
+      createdAt: new Date(row.created_at),
+      updatedAt: new Date(row.updated_at)
+    };
+    if (isIssuedBeforePasswordChange(row.created_at, await getPasswordChangedAt(refreshRow.user_id, trx)))
+      throw new HttpError(401, "Invalid or expired refresh token");
+    const newRefreshTokenPlain = generateSecureToken(40), newHashedRefreshToken = hashToken(newRefreshTokenPlain), refreshExpiresAt = new Date;
+    refreshExpiresAt.setDate(refreshExpiresAt.getDate() + refreshExpiresInDays);
+    if (isPostgres)
+      await trx.unsafe(`
+        INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
+        VALUES ($1, $2, false, $3, NOW())
+      `, [accessToken.id, newHashedRefreshToken, refreshExpiresAt.toISOString()]);
+    else
+      await trx.unsafe(`
+        INSERT INTO oauth_refresh_tokens (access_token_id, token, revoked, expires_at, created_at)
+        VALUES (?, ?, 0, ?, ${now})
+      `, [accessToken.id, newHashedRefreshToken, refreshExpiresAt.toISOString()]);
+    return {
+      accessToken,
+      plainTextToken,
+      refreshToken: newRefreshTokenPlain,
+      expiresIn: expiresInMinutes * 60
+    };
+  });
+}
+export async function validateRefreshToken(refreshTokenPlain) {
+  const hashedRefreshToken = hashToken(refreshTokenPlain);
+  return (await db.unsafe(`
+    SELECT id FROM oauth_refresh_tokens
+    WHERE token = ${param(1)}
+    AND revoked = ${boolFalse}
+    AND (expires_at IS NULL OR expires_at > ${now})
+    LIMIT 1
+  `, [hashedRefreshToken])).length > 0;
+}
+export async function revokeRefreshToken(refreshTokenPlain) {
+  const hashedRefreshToken = hashToken(refreshTokenPlain);
+  await db.unsafe(`
+    UPDATE oauth_refresh_tokens
+    SET revoked = ${boolTrue}
+    WHERE token = ${param(1)}
+  `, [hashedRefreshToken]);
+}
+export async function revokeAllRefreshTokens(userId) {
+  await db.unsafe(`
+    UPDATE oauth_refresh_tokens
+    SET revoked = ${boolTrue}
+    WHERE access_token_id IN (
+      SELECT id FROM oauth_access_tokens WHERE user_id = ${param(1)}
+    )
+  `, [userId]);
+}
+export async function deleteExpiredRefreshTokens() {
+  const result = await db.unsafe(`
+    DELETE FROM oauth_refresh_tokens
+    WHERE expires_at < ${now}
+  `);
+  return result?.changes || result?.rowCount || 0;
+}
+export async function deleteRevokedRefreshTokens(daysOld = 7) {
+  const cutoffDate = new Date;
+  cutoffDate.setDate(cutoffDate.getDate() - daysOld);
+  const result = await db.unsafe(`
+    DELETE FROM oauth_refresh_tokens
+    WHERE revoked = ${boolTrue} AND created_at < ${param(1)}
+  `, [cutoffDate.toISOString()]);
+  return result?.changes || result?.rowCount || 0;
+}
+export async function revokeToken(plainTextToken) {
+  const hashedToken = bearerLookupHash(plainTextToken);
+  await db.unsafe(`
+    UPDATE oauth_refresh_tokens
+    SET revoked = ${boolTrue}
+    WHERE access_token_id IN (
+      SELECT id FROM oauth_access_tokens WHERE token = ${param(1)}
+    )
+  `, [hashedToken]);
+  await db.unsafe(`
+    UPDATE oauth_access_tokens
+    SET revoked = ${boolTrue}, updated_at = ${now}
+    WHERE token = ${param(1)}
+  `, [hashedToken]);
+}
+export async function revokeTokenById(tokenId) {
+  await db.unsafe(`
+    UPDATE oauth_refresh_tokens
+    SET revoked = ${boolTrue}
+    WHERE access_token_id = ${param(1)}
+  `, [tokenId]);
+  await db.unsafe(`
+    UPDATE oauth_access_tokens
+    SET revoked = ${boolTrue}, updated_at = ${now}
+    WHERE id = ${param(1)}
+  `, [tokenId]);
+}
+export async function revokeAllTokens(userId) {
+  await revokeAllRefreshTokens(userId);
+  await db.unsafe(`
+    UPDATE oauth_access_tokens
+    SET revoked = ${boolTrue}, updated_at = ${now}
+    WHERE user_id = ${param(1)}
+  `, [userId]);
+}
+export async function revokeOtherTokens(userId) {
+  const current = await currentAccessToken();
+  if (!current)
+    return revokeAllTokens(userId);
+  if (isPostgres) {
+    await db.unsafe(`
+      UPDATE oauth_refresh_tokens
+      SET revoked = true
+      WHERE access_token_id IN (
+        SELECT id FROM oauth_access_tokens WHERE user_id = $1 AND id != $2
+      )
+    `, [userId, current.id]);
+    await db.unsafe(`
+      UPDATE oauth_access_tokens
+      SET revoked = true, updated_at = NOW()
+      WHERE user_id = $1 AND id != $2
+    `, [userId, current.id]);
+  } else {
+    await db.unsafe(`
+      UPDATE oauth_refresh_tokens
+      SET revoked = 1
+      WHERE access_token_id IN (
+        SELECT id FROM oauth_access_tokens WHERE user_id = ? AND id != ?
+      )
+    `, [userId, current.id]);
+    await db.unsafe(`
+      UPDATE oauth_access_tokens
+      SET revoked = 1, updated_at = ${now}
+      WHERE user_id = ? AND id != ?
+    `, [userId, current.id]);
+  }
+}
+export async function deleteExpiredTokens() {
+  await db.unsafe(`
+    DELETE FROM oauth_refresh_tokens
+    WHERE access_token_id IN (
+      SELECT id FROM oauth_access_tokens WHERE expires_at < ${now}
+    )
+  `);
+  const result = await db.unsafe(`
+    DELETE FROM oauth_access_tokens
+    WHERE expires_at < ${now}
+  `);
+  return result?.changes || result?.rowCount || 0;
+}
+export async function deleteRevokedTokens(daysOld = 7) {
+  const cutoffDate = new Date;
+  cutoffDate.setDate(cutoffDate.getDate() - daysOld);
+  await db.unsafe(`
+    DELETE FROM oauth_refresh_tokens
+    WHERE access_token_id IN (
+      SELECT id FROM oauth_access_tokens WHERE revoked = ${boolTrue} AND updated_at < ${param(1)}
+    )
+  `, [cutoffDate.toISOString()]);
+  const result = await db.unsafe(`
+    DELETE FROM oauth_access_tokens
+    WHERE revoked = ${boolTrue} AND updated_at < ${param(1)}
+  `, [cutoffDate.toISOString()]);
+  return result?.changes || result?.rowCount || 0;
+}
+export async function clients(userId) {
+  return (await db.unsafe(`
+    SELECT * FROM oauth_clients
+    WHERE user_id = ${param(1)} AND revoked = ${boolFalse}
+    ORDER BY created_at DESC
+  `, [userId])).map(mapToOAuthClient);
+}
+export async function findClient(clientId) {
+  const row = (await db.unsafe(`
+    SELECT * FROM oauth_clients WHERE id = ${param(1)} LIMIT 1
+  `, [clientId]))[0];
+  return row ? mapToOAuthClient(row) : null;
+}
+export async function createClient(options) {
+  const secret = generateSecureToken(40);
+  if (isPostgres)
+    await db.unsafe(`
+      INSERT INTO oauth_clients (name, secret, provider, redirect, personal_access_client, password_client, revoked, created_at)
+      VALUES ($1, $2, 'local', $3, $4, $5, false, NOW())
+    `, [
+      options.name,
+      secret,
+      options.redirect,
+      options.personalAccessClient || !1,
+      options.passwordClient || !1
+    ]);
+  else
+    await db.unsafe(`
+      INSERT INTO oauth_clients (name, secret, provider, redirect, personal_access_client, password_client, revoked, created_at)
+      VALUES (?, ?, 'local', ?, ?, ?, 0, ${now})
+    `, [
+      options.name,
+      secret,
+      options.redirect,
+      options.personalAccessClient ? 1 : 0,
+      options.passwordClient ? 1 : 0
+    ]);
+  const inserted = await db.unsafe(`
+    SELECT * FROM oauth_clients WHERE secret = ${param(1)} LIMIT 1
+  `, [secret]);
+  return {
+    client: mapToOAuthClient(inserted[0]),
+    plainTextSecret: secret
+  };
+}
+export async function revokeClient(clientId) {
+  await db.unsafe(`
+    UPDATE oauth_clients
+    SET revoked = ${boolTrue}, updated_at = ${now}
+    WHERE id = ${param(1)}
+  `, [clientId]);
+}
+export function parseScopes(scopes) {
+  if (!scopes)
+    return [];
+  if (Array.isArray(scopes))
+    return scopes;
+  try {
+    const parsed = JSON.parse(scopes);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+function mapToOAuthClient(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    secret: row.secret,
+    provider: row.provider,
+    redirect: row.redirect,
+    personalAccessClient: Boolean(row.personal_access_client),
+    passwordClient: Boolean(row.password_client),
+    revoked: Boolean(row.revoked),
+    createdAt: row.created_at ? new Date(row.created_at) : new Date,
+    updatedAt: row.updated_at ? new Date(row.updated_at) : null
+  };
+}

package/dist/two-factor.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Reads `two_factor_secret`/`two_factor_enabled` directly — these are
+ * guarantee-ALTER columns (see ensureUsersAuthColumns), not part of
+ * the User model's typed `attributes`, so callers query them the same
+ * way email-verification.ts reads email_verified_at: raw db access,
+ * not the ORM model.
+ */
+export declare function getTwoFactorState(userId: number): Promise<{ secret: string | null, enabled: boolean }>;
+export declare function isTwoFactorEnabled(user: TwoFactorUser): boolean;
+/**
+ * Generate a new (unpersisted) secret + otpauth:// URI for setup.
+ */
+export declare function generateTwoFactorSetup(email: string, serviceName?: string): { secret: string, uri: string };
+/**
+ * Stash a freshly generated secret server-side while the user goes
+ * scan/enter it into their authenticator app. Single pending secret
+ * per user — generating a new one invalidates any prior unconfirmed
+ * attempt, same delete-then-insert shape as storeWebAuthnChallenge.
+ */
+export declare function stashPendingTwoFactorSecret(userId: number, secret: string, ttlSeconds?: number): Promise<void>;
+/**
+ * Consume (delete-on-read) the pending secret stashed for a user, or
+ * null if none exists / it expired.
+ */
+export declare function consumePendingTwoFactorSecret(userId: number): Promise<string | null>;
+/**
+ * Verify the setup code against the not-yet-persisted secret and, if
+ * valid, persist it + flip `two_factor_enabled` on.
+ */
+export declare function enableTwoFactor(userId: number, secret: string, code: string): Promise<boolean>;
+export declare function disableTwoFactor(userId: number): Promise<void>;
+/**
+ * Verify a live login/dashboard-reauth code against the user's
+ * already-persisted secret.
+ */
+export declare function verifyTwoFactorLoginCode(userId: number, code: string): Promise<boolean>;
+/**
+ * Create a single-use, short-lived login challenge for a user whose
+ * password just verified but who still needs to supply a TOTP code.
+ * Mirrors storeWebAuthnChallenge's delete-then-insert shape, keyed by
+ * an opaque random id instead of (user_id, purpose) since a user can
+ * only have one login attempt in flight that matters here.
+ */
+export declare function createTwoFactorChallenge(userId: number, ttlSeconds?: number): Promise<string>;
+/**
+ * Consume (delete-on-read) a login challenge and return the user id it
+ * was issued for, or null if missing/expired.
+ */
+export declare function consumeTwoFactorChallenge(challengeToken: string): Promise<number | null>;
+export declare const TwoFactor: {
+  isEnabled: unknown;
+  getState: unknown;
+  generateSetup: unknown;
+  stashPendingSecret: unknown;
+  consumePendingSecret: unknown;
+  enable: unknown;
+  disable: unknown;
+  verifyLoginCode: unknown;
+  createChallenge: unknown;
+  consumeChallenge: unknown
+};
+export declare interface TwoFactorUser {
+  id: number
+  email?: string
+  two_factor_secret?: string | null
+  two_factor_enabled?: boolean | number | null
+}

package/dist/two-factor.js

@@ -0,0 +1,113 @@
+import { randomBytes } from "node:crypto";
+import { db } from "@stacksjs/database";
+import { generateTwoFactorSecret, generateTwoFactorUri, verifyTwoFactorCode } from "./authenticator";
+import { RateLimiter } from "./rate-limiter";
+const DEFAULT_CHALLENGE_TTL_SECONDS = 300, TWO_FACTOR_RATE_LIMIT_PREFIX = "2fa:", TWO_FACTOR_STEP_SECONDS = 30;
+function currentTotpStep() {
+  return Math.floor(Date.now() / 1000 / TWO_FACTOR_STEP_SECONDS);
+}
+async function getLastUsedTwoFactorStep(userId) {
+  try {
+    const value = (await db.selectFrom("users").where("id", "=", userId).selectAll().executeTakeFirst())?.two_factor_last_used_step;
+    return value == null ? null : Number(value);
+  } catch {
+    return null;
+  }
+}
+async function setLastUsedTwoFactorStep(userId, step) {
+  try {
+    await db.updateTable("users").set({ two_factor_last_used_step: step }).where("id", "=", userId).executeTakeFirst();
+  } catch {}
+}
+export async function getTwoFactorState(userId) {
+  const row = await db.selectFrom("users").where("id", "=", userId).select(["two_factor_secret", "two_factor_enabled"]).executeTakeFirst();
+  return {
+    secret: row?.two_factor_secret ?? null,
+    enabled: Boolean(row?.two_factor_enabled)
+  };
+}
+export function isTwoFactorEnabled(user) {
+  return Boolean(user.two_factor_enabled);
+}
+export function generateTwoFactorSetup(email, serviceName) {
+  const secret = generateTwoFactorSecret(), uri = generateTwoFactorUri(email, serviceName, secret);
+  return { secret, uri };
+}
+const PENDING_SECRET_TTL_SECONDS = 600;
+export async function stashPendingTwoFactorSecret(userId, secret, ttlSeconds = PENDING_SECRET_TTL_SECONDS) {
+  const expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString();
+  await db.deleteFrom("two_factor_pending_secrets").where("user_id", "=", userId).execute();
+  await db.insertInto("two_factor_pending_secrets").values({
+    user_id: userId,
+    secret,
+    expires_at: expiresAt
+  }).execute();
+}
+export async function consumePendingTwoFactorSecret(userId) {
+  const row = await db.selectFrom("two_factor_pending_secrets").where("user_id", "=", userId).selectAll().executeTakeFirst();
+  if (!row)
+    return null;
+  await db.deleteFrom("two_factor_pending_secrets").where("user_id", "=", userId).execute();
+  const expiresAt = row.expires_at ? new Date(String(row.expires_at)).getTime() : 0;
+  if (Date.now() > expiresAt)
+    return null;
+  return String(row.secret);
+}
+export async function enableTwoFactor(userId, secret, code) {
+  if (!await verifyTwoFactorCode(code, secret))
+    return !1;
+  await db.updateTable("users").set({ two_factor_secret: secret, two_factor_enabled: !0 }).where("id", "=", userId).executeTakeFirst();
+  return !0;
+}
+export async function disableTwoFactor(userId) {
+  await db.updateTable("users").set({ two_factor_secret: null, two_factor_enabled: !1 }).where("id", "=", userId).executeTakeFirst();
+}
+export async function verifyTwoFactorLoginCode(userId, code) {
+  const rateKey = `${TWO_FACTOR_RATE_LIMIT_PREFIX}${userId}`;
+  await RateLimiter.validateAttempt(rateKey);
+  const { secret, enabled } = await getTwoFactorState(userId);
+  if (!enabled || !secret)
+    return !1;
+  if (!await verifyTwoFactorCode(code, secret)) {
+    await RateLimiter.recordFailedAttempt(rateKey);
+    return !1;
+  }
+  const step = currentTotpStep(), lastStep = await getLastUsedTwoFactorStep(userId);
+  if (lastStep !== null && step <= lastStep)
+    return !1;
+  await setLastUsedTwoFactorStep(userId, step);
+  await RateLimiter.resetAttempts(rateKey);
+  return !0;
+}
+export async function createTwoFactorChallenge(userId, ttlSeconds = DEFAULT_CHALLENGE_TTL_SECONDS) {
+  const id = randomBytes(32).toString("hex"), expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString();
+  await db.deleteFrom("two_factor_challenges").where("user_id", "=", userId).execute();
+  await db.insertInto("two_factor_challenges").values({
+    id,
+    user_id: userId,
+    expires_at: expiresAt
+  }).execute();
+  return id;
+}
+export async function consumeTwoFactorChallenge(challengeToken) {
+  const row = await db.selectFrom("two_factor_challenges").where("id", "=", challengeToken).selectAll().executeTakeFirst();
+  if (!row)
+    return null;
+  await db.deleteFrom("two_factor_challenges").where("id", "=", challengeToken).execute();
+  const expiresAt = row.expires_at ? new Date(String(row.expires_at)).getTime() : 0;
+  if (Date.now() > expiresAt)
+    return null;
+  return Number(row.user_id);
+}
+export const TwoFactor = {
+  isEnabled: isTwoFactorEnabled,
+  getState: getTwoFactorState,
+  generateSetup: generateTwoFactorSetup,
+  stashPendingSecret: stashPendingTwoFactorSecret,
+  consumePendingSecret: consumePendingTwoFactorSecret,
+  enable: enableTwoFactor,
+  disable: disableTwoFactor,
+  verifyLoginCode: verifyTwoFactorLoginCode,
+  createChallenge: createTwoFactorChallenge,
+  consumeChallenge: consumeTwoFactorChallenge
+};