@striae-org/striae 5.4.0 → 5.4.1

package/app/components/auth/mfa-verification.tsx

@@ -316,6 +316,13 @@ export const MFAVerification = ({ resolver, onSuccess, onError, onCancel }: MFAV
             <p className={styles.description}>
               Enter the 6-digit code from your authenticator app.
             </p>
+            <p className={styles.note}>
+              Lost access to your authenticator app?{' '}
+              <a href="https://striae.org/support" target="_blank" rel="noopener noreferrer">
+                Contact support
+              </a>{' '}
+              to recover your account.
+            </p>
             <input
               type="text"
               inputMode="numeric"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@striae-org/striae",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "private": false,
   "description": "Striae is a specialized, cloud-native platform designed to streamline forensic firearms identification by providing an intuitive environment for digital comparison image annotation, authenticated confirmations, and automated report generation.",
   "license": "Apache-2.0",
@@ -40,23 +40,22 @@
     "scripts/",
     "functions/",
     "public/",
-    "workers/*/package.json",
-    "workers/*/src/**/*.example.ts",
-    "workers/*/src/**/*.ts",
-    "workers/pdf-worker/scripts/*.js",
+    "workers/",
+    "!workers/*/.wrangler",
+    "!workers/*/package-lock.json",
+    "!workers/*/worker-configuration.d.ts",
+    "!workers/*/wrangler.jsonc",
     "!workers/*/src/**/*worker.ts",
     "!workers/pdf-worker/src/assets/**/*",
     "workers/pdf-worker/src/assets/generated-assets.example.ts",
     "!workers/pdf-worker/src/formats/**/*",
     "workers/pdf-worker/src/formats/format-striae.ts",
-    "workers/pdf-worker/src/report-types.ts",
-    "workers/*/wrangler.jsonc.example",
     ".env.example",
     "primershear.emails.example",
     "firebase.json",
     "tsconfig.json",
     "vite.config.ts",
-    "worker-configuration.d.ts",
+    "/worker-configuration.d.ts",
     "wrangler.toml.example",
     "LICENSE"
   ],
@@ -83,6 +82,7 @@
     "preview": "npm run build && wrangler pages dev",
     "cf-typegen": "wrangler types",
     "enable-totp-mfa": "node ./scripts/enable-totp-mfa.mjs",
+    "unenroll-totp-mfa": "node ./scripts/unenroll-totp-mfa.mjs",
     "update-versions": "node ./scripts/update-markdown-versions.cjs",
     "update-compatibility-dates": "node ./scripts/update-compatibility-dates.cjs",
     "deploy-config": "bash ./scripts/deploy-config.sh",

package/scripts/unenroll-totp-mfa.mjs

@@ -0,0 +1,82 @@
+/**
+ * Admin script to unenroll a user's TOTP MFA factor via Firebase Admin SDK.
+ * Run with: npm run unenroll-totp-mfa -- <uid>
+ *
+ * Requires app/config/admin-service.json (gitignored service account key).
+ * Docs: https://firebase.google.com/docs/auth/admin/manage-users#unenroll_a_user_from_mfa
+ */
+
+import { createRequire } from 'module';
+import { fileURLToPath } from 'url';
+import { dirname, resolve } from 'path';
+import { initializeApp, cert, getApps } from 'firebase-admin/app';
+import { getAuth } from 'firebase-admin/auth';
+
+const require = createRequire(import.meta.url);
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+const uid = process.argv[2];
+
+if (!uid) {
+  console.error('\n❌ No UID provided.');
+  console.error('\nUsage: npm run unenroll-totp-mfa -- <uid>');
+  process.exit(1);
+}
+
+const serviceAccountPath = resolve(__dirname, '../app/config/admin-service.json');
+
+let serviceAccount;
+try {
+  serviceAccount = require(serviceAccountPath);
+} catch {
+  console.error(`\n❌ Could not load service account key from:\n   ${serviceAccountPath}`);
+  console.error('\nMake sure app/config/admin-service.json exists (it is gitignored).');
+  process.exit(1);
+}
+
+if (getApps().length === 0) {
+  initializeApp({ credential: cert(serviceAccount) });
+}
+
+const auth = getAuth();
+
+console.log(`\n🔍 Fetching MFA factors for UID: ${uid}...`);
+
+let userRecord;
+try {
+  userRecord = await auth.getUser(uid);
+} catch (err) {
+  console.error(`\n❌ Could not fetch user record for UID: ${uid}`);
+  console.error(err?.message ?? err);
+  process.exit(1);
+}
+
+const enrolledFactors = userRecord.multiFactor?.enrolledFactors ?? [];
+const totpFactors = enrolledFactors.filter((f) => f.factorId === 'totp');
+const remainingFactors = enrolledFactors.filter((f) => f.factorId !== 'totp');
+
+if (totpFactors.length === 0) {
+  console.log(`\nℹ️  No TOTP MFA factors found for UID: ${uid}`);
+  console.log('   Nothing to unenroll.');
+  process.exit(0);
+}
+
+console.log(`\n   Found ${totpFactors.length} TOTP factor(s):`);
+for (const factor of totpFactors) {
+  console.log(`   - ${factor.uid}  (displayName: ${factor.displayName ?? 'n/a'}, enrolled: ${factor.enrollmentTime})`);
+}
+
+try {
+  await auth.updateUser(uid, {
+    multiFactor: {
+      enrolledFactors: remainingFactors,
+    },
+  });
+
+  console.log(`\n✅ Successfully unenrolled ${totpFactors.length} TOTP factor(s) for UID: ${uid}`);
+  console.log('   The user will need to re-enroll TOTP on their next login.');
+} catch (err) {
+  console.error(`\n❌ Failed to unenroll TOTP factor(s) for UID: ${uid}`);
+  console.error(err?.message ?? err);
+  process.exit(1);
+}

package/workers/audit-worker/.editorconfig

@@ -0,0 +1,12 @@
+# http://editorconfig.org
+root = true
+
+[*]
+indent_style = tab
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.yml]
+indent_style = space

package/workers/audit-worker/.prettierrc

@@ -0,0 +1,6 @@
+{
+	"printWidth": 140,
+	"singleQuote": true,
+	"semi": true,
+	"useTabs": true
+}

package/workers/data-worker/.editorconfig

@@ -0,0 +1,12 @@
+# http://editorconfig.org
+root = true
+
+[*]
+indent_style = tab
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.yml]
+indent_style = space

package/workers/data-worker/.prettierrc

@@ -0,0 +1,6 @@
+{
+	"printWidth": 140,
+	"singleQuote": true,
+	"semi": true,
+	"useTabs": true
+}

package/workers/image-worker/.editorconfig

@@ -0,0 +1,12 @@
+# http://editorconfig.org
+root = true
+
+[*]
+indent_style = tab
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.yml]
+indent_style = space

package/workers/image-worker/.prettierrc

@@ -0,0 +1,6 @@
+{
+	"printWidth": 140,
+	"singleQuote": true,
+	"semi": true,
+	"useTabs": true
+}

package/workers/pdf-worker/.editorconfig

@@ -0,0 +1,12 @@
+# http://editorconfig.org
+root = true
+
+[*]
+indent_style = tab
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.yml]
+indent_style = space

package/workers/pdf-worker/.prettierrc

@@ -0,0 +1,6 @@
+{
+	"printWidth": 140,
+	"singleQuote": true,
+	"semi": true,
+	"useTabs": true
+}

package/workers/user-worker/.editorconfig

@@ -0,0 +1,12 @@
+# http://editorconfig.org
+root = true
+
+[*]
+indent_style = tab
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.yml]
+indent_style = space

package/workers/user-worker/.prettierrc

@@ -0,0 +1,6 @@
+{
+	"printWidth": 140,
+	"singleQuote": true,
+	"semi": true,
+	"useTabs": true
+}