@stacksjs/auth 0.73.3 → 0.74.0

package/dist/authenticator.d.ts

@@ -13,5 +13,18 @@ export declare function verifyTwoFactorCode(token: Token, secret: Secret): Promi
  * @returns The otpauth:// URI string
  */
 export declare function generateTwoFactorUri(user?: string, service?: string, secret?: Secret): string;
+/**
+ * Render an otpauth:// URI as a scannable QR code.
+ *
+ * SVG rather than a data URI: it stays sharp at any size, can be inlined into
+ * a server-rendered page or an email, and is a few hundred bytes rather than
+ * tens of kilobytes. `ts-qr-codes` is a pure, synchronous string function with
+ * no runtime dependencies of its own, so this costs nothing at import time.
+ *
+ * Every authenticator setup flow needs this. Leaving it to the caller meant
+ * each one either shipped an encoder to the browser or, more often, fell back
+ * to asking the user to type a 32-character secret by hand.
+ */
+export declare function twoFactorQrCode(uri: string, size?: number): string;
 export type Token = string;
 export type Secret = string;

package/dist/authenticator.js

@@ -1 +1 @@
-import{generateTOTP,generateTOTPSecret,totpKeyUri,verifyTOTP}from"@stacksjs/ts-auth";export function generateTwoFactorSecret(){return generateTOTPSecret()}export async function generateTwoFactorToken(secret){return generateTOTP({secret})}export async function verifyTwoFactorCode(token,secret){return verifyTOTP(token,{secret})}export function generateTwoFactorUri(user,service,secret){const userIdentifier=user||"johndoe@example.com",serviceName=service||"StacksJS 2fa",otpSecret=secret||generateTwoFactorSecret();return totpKeyUri(userIdentifier,serviceName,otpSecret)}
+import{generateTOTP,generateTOTPSecret,totpKeyUri,verifyTOTP}from"@stacksjs/ts-auth";import{toSvg}from"ts-qr-codes";export function generateTwoFactorSecret(){return generateTOTPSecret()}export async function generateTwoFactorToken(secret){return generateTOTP({secret})}export async function verifyTwoFactorCode(token,secret){return verifyTOTP(token,{secret})}export function generateTwoFactorUri(user,service,secret){const userIdentifier=user||"johndoe@example.com",serviceName=service||"StacksJS 2fa",otpSecret=secret||generateTwoFactorSecret();return totpKeyUri(userIdentifier,serviceName,otpSecret)}const DEFAULT_QR_SIZE=240;export function twoFactorQrCode(uri,size=DEFAULT_QR_SIZE){return toSvg(uri,{size,title:"Two-factor authentication setup"})}

package/dist/two-factor.d.ts

@@ -8,9 +8,15 @@
 export declare function getTwoFactorState(userId: number): Promise<{ secret: string | null, enabled: boolean }>;
 export declare function isTwoFactorEnabled(user: TwoFactorUser): boolean;
 /**
- * Generate a new (unpersisted) secret + otpauth:// URI for setup.
+ * Generate a new (unpersisted) secret + otpauth:// URI for setup, along with
+ * the URI rendered as a scannable QR code.
+ *
+ * The QR code comes back here rather than being left to the caller because
+ * every setup screen needs one, and a caller that has to find its own encoder
+ * either ships one to the browser or falls back to asking the user to type a
+ * 32-character secret by hand. Clients that render their own still have `uri`.
  */
-export declare function generateTwoFactorSetup(email: string, serviceName?: string): { secret: string, uri: string };
+export declare function generateTwoFactorSetup(email: string, serviceName?: string): { secret: string, uri: string, qr: string };
 /**
  * Stash a freshly generated secret server-side while the user goes
  * scan/enter it into their authenticator app. Single pending secret

package/dist/two-factor.js

@@ -1 +1 @@
-import{randomBytes}from"node:crypto";import{db,sqlDateTime,parseSqlDateTime}from"@stacksjs/database";import{generateTwoFactorSecret,generateTwoFactorUri,verifyTwoFactorCode}from"./authenticator";import{RateLimiter}from"./rate-limiter";const DEFAULT_CHALLENGE_TTL_SECONDS=300,TWO_FACTOR_RATE_LIMIT_PREFIX="2fa:",TWO_FACTOR_STEP_SECONDS=30;function currentTotpStep(){return Math.floor(Date.now()/1000/TWO_FACTOR_STEP_SECONDS)}async function getLastUsedTwoFactorStep(userId){try{const value=(await db.selectFrom("users").where("id","=",userId).selectAll().executeTakeFirst())?.two_factor_last_used_step;return value==null?null:Number(value)}catch{return null}}async function setLastUsedTwoFactorStep(userId,step){try{await db.updateTable("users").set({two_factor_last_used_step:step}).where("id","=",userId).executeTakeFirst()}catch{}}export async function getTwoFactorState(userId){const row=await db.selectFrom("users").where("id","=",userId).select(["two_factor_secret","two_factor_enabled"]).executeTakeFirst();return{secret:row?.two_factor_secret??null,enabled:Boolean(row?.two_factor_enabled)}}export function isTwoFactorEnabled(user){return Boolean(user.two_factor_enabled)}export function generateTwoFactorSetup(email,serviceName){const secret=generateTwoFactorSecret(),uri=generateTwoFactorUri(email,serviceName,secret);return{secret,uri}}const PENDING_SECRET_TTL_SECONDS=600;export async function stashPendingTwoFactorSecret(userId,secret,ttlSeconds=PENDING_SECRET_TTL_SECONDS){const expiresAt=sqlDateTime(new Date(Date.now()+ttlSeconds*1000));await db.deleteFrom("two_factor_pending_secrets").where("user_id","=",userId).execute();await db.insertInto("two_factor_pending_secrets").values({user_id:userId,secret,expires_at:expiresAt}).execute()}export async function consumePendingTwoFactorSecret(userId){const row=await db.selectFrom("two_factor_pending_secrets").where("user_id","=",userId).selectAll().executeTakeFirst();if(!row)return null;await db.deleteFrom("two_factor_pending_secrets").where("user_id","=",userId).execute();const expiresAt=parseSqlDateTime(row.expires_at)?.getTime()??0;if(Date.now()>expiresAt)return null;return String(row.secret)}export async function enableTwoFactor(userId,secret,code){if(!await verifyTwoFactorCode(code,secret))return!1;await db.updateTable("users").set({two_factor_secret:secret,two_factor_enabled:!0}).where("id","=",userId).executeTakeFirst();return!0}export async function disableTwoFactor(userId){await db.updateTable("users").set({two_factor_secret:null,two_factor_enabled:!1}).where("id","=",userId).executeTakeFirst()}export async function verifyTwoFactorLoginCode(userId,code){const rateKey=`${TWO_FACTOR_RATE_LIMIT_PREFIX}${userId}`;await RateLimiter.validateAttempt(rateKey);const{secret,enabled}=await getTwoFactorState(userId);if(!enabled||!secret)return!1;if(!await verifyTwoFactorCode(code,secret)){await RateLimiter.recordFailedAttempt(rateKey);return!1}const step=currentTotpStep(),lastStep=await getLastUsedTwoFactorStep(userId);if(lastStep!==null&&step<=lastStep)return!1;await setLastUsedTwoFactorStep(userId,step);await RateLimiter.resetAttempts(rateKey);return!0}export async function createTwoFactorChallenge(userId,ttlSeconds=DEFAULT_CHALLENGE_TTL_SECONDS){const id=randomBytes(32).toString("hex"),expiresAt=sqlDateTime(new Date(Date.now()+ttlSeconds*1000));await db.deleteFrom("two_factor_challenges").where("user_id","=",userId).execute();await db.insertInto("two_factor_challenges").values({id,user_id:userId,expires_at:expiresAt}).execute();return id}export async function consumeTwoFactorChallenge(challengeToken){const row=await db.selectFrom("two_factor_challenges").where("id","=",challengeToken).selectAll().executeTakeFirst();if(!row)return null;await db.deleteFrom("two_factor_challenges").where("id","=",challengeToken).execute();const expiresAt=parseSqlDateTime(row.expires_at)?.getTime()??0;if(Date.now()>expiresAt)return null;return Number(row.user_id)}export const TwoFactor={isEnabled:isTwoFactorEnabled,getState:getTwoFactorState,generateSetup:generateTwoFactorSetup,stashPendingSecret:stashPendingTwoFactorSecret,consumePendingSecret:consumePendingTwoFactorSecret,enable:enableTwoFactor,disable:disableTwoFactor,verifyLoginCode:verifyTwoFactorLoginCode,createChallenge:createTwoFactorChallenge,consumeChallenge:consumeTwoFactorChallenge};
+import{randomBytes}from"node:crypto";import{db,sqlDateTime,parseSqlDateTime}from"@stacksjs/database";import{generateTwoFactorSecret,generateTwoFactorUri,twoFactorQrCode,verifyTwoFactorCode}from"./authenticator";import{RateLimiter}from"./rate-limiter";const DEFAULT_CHALLENGE_TTL_SECONDS=300,TWO_FACTOR_RATE_LIMIT_PREFIX="2fa:",TWO_FACTOR_STEP_SECONDS=30;function currentTotpStep(){return Math.floor(Date.now()/1000/TWO_FACTOR_STEP_SECONDS)}async function getLastUsedTwoFactorStep(userId){try{const value=(await db.selectFrom("users").where("id","=",userId).selectAll().executeTakeFirst())?.two_factor_last_used_step;return value==null?null:Number(value)}catch{return null}}async function setLastUsedTwoFactorStep(userId,step){try{await db.updateTable("users").set({two_factor_last_used_step:step}).where("id","=",userId).executeTakeFirst()}catch{}}export async function getTwoFactorState(userId){const row=await db.selectFrom("users").where("id","=",userId).select(["two_factor_secret","two_factor_enabled"]).executeTakeFirst();return{secret:row?.two_factor_secret??null,enabled:Boolean(row?.two_factor_enabled)}}export function isTwoFactorEnabled(user){return Boolean(user.two_factor_enabled)}export function generateTwoFactorSetup(email,serviceName){const secret=generateTwoFactorSecret(),uri=generateTwoFactorUri(email,serviceName,secret);return{secret,uri,qr:twoFactorQrCode(uri)}}const PENDING_SECRET_TTL_SECONDS=600;export async function stashPendingTwoFactorSecret(userId,secret,ttlSeconds=PENDING_SECRET_TTL_SECONDS){const expiresAt=sqlDateTime(new Date(Date.now()+ttlSeconds*1000));await db.deleteFrom("two_factor_pending_secrets").where("user_id","=",userId).execute();await db.insertInto("two_factor_pending_secrets").values({user_id:userId,secret,expires_at:expiresAt}).execute()}export async function consumePendingTwoFactorSecret(userId){const row=await db.selectFrom("two_factor_pending_secrets").where("user_id","=",userId).selectAll().executeTakeFirst();if(!row)return null;await db.deleteFrom("two_factor_pending_secrets").where("user_id","=",userId).execute();const expiresAt=parseSqlDateTime(row.expires_at)?.getTime()??0;if(Date.now()>expiresAt)return null;return String(row.secret)}export async function enableTwoFactor(userId,secret,code){if(!await verifyTwoFactorCode(code,secret))return!1;await db.updateTable("users").set({two_factor_secret:secret,two_factor_enabled:!0}).where("id","=",userId).executeTakeFirst();return!0}export async function disableTwoFactor(userId){await db.updateTable("users").set({two_factor_secret:null,two_factor_enabled:!1}).where("id","=",userId).executeTakeFirst()}export async function verifyTwoFactorLoginCode(userId,code){const rateKey=`${TWO_FACTOR_RATE_LIMIT_PREFIX}${userId}`;await RateLimiter.validateAttempt(rateKey);const{secret,enabled}=await getTwoFactorState(userId);if(!enabled||!secret)return!1;if(!await verifyTwoFactorCode(code,secret)){await RateLimiter.recordFailedAttempt(rateKey);return!1}const step=currentTotpStep(),lastStep=await getLastUsedTwoFactorStep(userId);if(lastStep!==null&&step<=lastStep)return!1;await setLastUsedTwoFactorStep(userId,step);await RateLimiter.resetAttempts(rateKey);return!0}export async function createTwoFactorChallenge(userId,ttlSeconds=DEFAULT_CHALLENGE_TTL_SECONDS){const id=randomBytes(32).toString("hex"),expiresAt=sqlDateTime(new Date(Date.now()+ttlSeconds*1000));await db.deleteFrom("two_factor_challenges").where("user_id","=",userId).execute();await db.insertInto("two_factor_challenges").values({id,user_id:userId,expires_at:expiresAt}).execute();return id}export async function consumeTwoFactorChallenge(challengeToken){const row=await db.selectFrom("two_factor_challenges").where("id","=",challengeToken).selectAll().executeTakeFirst();if(!row)return null;await db.deleteFrom("two_factor_challenges").where("id","=",challengeToken).execute();const expiresAt=parseSqlDateTime(row.expires_at)?.getTime()??0;if(Date.now()>expiresAt)return null;return Number(row.user_id)}export const TwoFactor={isEnabled:isTwoFactorEnabled,getState:getTwoFactorState,generateSetup:generateTwoFactorSetup,stashPendingSecret:stashPendingTwoFactorSecret,consumePendingSecret:consumePendingTwoFactorSecret,enable:enableTwoFactor,disable:disableTwoFactor,verifyLoginCode:verifyTwoFactorLoginCode,createChallenge:createTwoFactorChallenge,consumeChallenge:consumeTwoFactorChallenge};

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.73.3",
+  "version": "0.74.0",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -58,11 +58,22 @@
   },
   "dependencies": {
     "@stacksjs/bun-router": "^0.1.8",
-    "@stacksjs/ts-auth": "^0.4.4"
+    "@stacksjs/cache": "0.74.0",
+    "@stacksjs/config": "0.74.0",
+    "@stacksjs/database": "0.74.0",
+    "@stacksjs/email": "0.74.0",
+    "@stacksjs/env": "0.74.0",
+    "@stacksjs/error-handling": "0.74.0",
+    "@stacksjs/logging": "0.74.0",
+    "@stacksjs/orm": "0.74.0",
+    "@stacksjs/path": "0.74.0",
+    "@stacksjs/router": "0.74.0",
+    "@stacksjs/security": "0.74.0",
+    "@stacksjs/storage": "0.74.0",
+    "@stacksjs/ts-auth": "^0.4.4",
+    "ts-qr-codes": "^0.1.8"
   },
   "devDependencies": {
-    "better-dx": "^0.2.24",
-    "@stacksjs/error-handling": "0.73.3",
-    "@stacksjs/router": "0.73.3"
+    "better-dx": "^0.2.24"
   }
 }