@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/passkeys/passkeys.service.js

@@ -0,0 +1,350 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasskeysService = void 0;
+const common_1 = require("@nestjs/common");
+const server_1 = require("@simplewebauthn/server");
+const typeorm_1 = require("typeorm");
+const auth_error_1 = require("../../common/auth-error.js");
+const random_secrets_1 = require("../../common/crypto/random-secrets.js");
+const rate_limiter_service_1 = require("../../common/rate-limiter.service.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const auth_events_service_1 = require("../events/auth-events.service.js");
+const settings_service_1 = require("../settings/settings.service.js");
+const sign_in_service_1 = require("../sign-in/sign-in.service.js");
+const sign_in_methods_service_1 = require("../users/sign-in-methods.service.js");
+const users_service_1 = require("../users/users.service.js");
+/**
+ * Passkeys (Face ID, Touch ID, Windows Hello, Android, security keys) through WebAuthn.
+ *
+ * Adding a passkey and signing in with one each take two requests:
+ * - ".../options": we create a random challenge and return options for the browser or app,
+ *   plus a `challengeToken` to send back with the verify request.
+ * - ".../verify": the device signed the challenge; we check the signature.
+ *
+ * Passkeys must use a fingerprint, face or PIN (user verification = required), which is why
+ * a passkey sign-in counts as two factors and skips the authenticator-app step.
+ */
+let PasskeysService = class PasskeysService {
+    options;
+    settingsService;
+    users;
+    signIn;
+    signInMethods;
+    rateLimiter;
+    events;
+    database;
+    constructor(options, settingsService, users, signIn, signInMethods, rateLimiter, events) {
+        this.options = options;
+        this.settingsService = settingsService;
+        this.users = users;
+        this.signIn = signIn;
+        this.signInMethods = signInMethods;
+        this.rateLimiter = rateLimiter;
+        this.events = events;
+        this.database = options.dataSource;
+    }
+    // -------------------------------------------------------------------------------------------
+    // Adding a passkey (user is signed in)
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Starts adding a passkey: creates a challenge and the options to pass to the browser
+     * (`navigator.credentials.create`, or SimpleWebAuthn's `startRegistration`).
+     *
+     * @param userId - The signed-in user.
+     * @returns `options` for the device, and a `challengeToken` to send back to finishRegistration.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED or NOT_CONFIGURED when passkeys are off or not set up.
+     * @throws AuthError VALIDATION_ERROR when the user already has the maximum number of passkeys.
+     */
+    async startRegistration(userId) {
+        const { passkeyOptions } = await this.getEnabledPasskeySettings();
+        const user = await this.users.getUserOrThrow(userId);
+        const existingPasskeys = await this.database.getRepository(entities_1.PasskeyEntity).find({ where: { userId } });
+        if (existingPasskeys.length >= constants_1.MAXIMUM_PASSKEYS_PER_USER)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.validationFailed, { problems: [constants_1.VALIDATION_PROBLEM.tooManyPasskeys] });
+        const browserOptions = await (0, server_1.generateRegistrationOptions)({
+            rpName: passkeyOptions.relyingPartyName,
+            rpID: passkeyOptions.relyingPartyId,
+            userID: new TextEncoder().encode(user.id),
+            userName: user.email ?? user.phoneNumber ?? user.id,
+            userDisplayName: [user.firstName, user.lastName].filter(Boolean).join(constants_1.DISPLAY_NAME_SEPARATOR) || (user.email ?? ''),
+            attestationType: constants_1.PASSKEY_ATTESTATION_TYPE,
+            // Stops the same device from being registered twice.
+            excludeCredentials: existingPasskeys.map((passkey) => ({
+                id: passkey.credentialId,
+                transports: passkey.transports,
+            })),
+            authenticatorSelection: { residentKey: constants_1.PASSKEY_RESIDENT_KEY, userVerification: constants_1.PASSKEY_USER_VERIFICATION },
+        });
+        const challengeToken = await this.saveCeremonyChallenge(constants_1.CHALLENGE_PURPOSE.passkeyRegistration, browserOptions.challenge, userId);
+        return { success: true, challengeToken, options: browserOptions };
+    }
+    /**
+     * Finishes adding a passkey: checks the device's response and saves the new passkey.
+     *
+     * @param userId - The signed-in user (must be the one who called startRegistration).
+     * @param challengeToken - The token from startRegistration.
+     * @param deviceResponse - What the browser returned from `navigator.credentials.create`.
+     * @param passkeyName - A label like "MacBook"; a default name is used when empty.
+     * @param request - Who is asking (for the audit log).
+     * @returns The saved passkey.
+     * @throws AuthError INVALID_TOKEN when the challenge is unknown, used or expired.
+     * @throws AuthError INVALID_PASSKEY when the response doesn't check out.
+     */
+    async finishRegistration(userId, challengeToken, deviceResponse, passkeyName, request) {
+        const { passkeyOptions } = await this.getEnabledPasskeySettings();
+        const challenge = await this.useCeremonyChallenge(challengeToken, constants_1.CHALLENGE_PURPOSE.passkeyRegistration);
+        if (challenge.userId !== userId)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPasskey);
+        let verification;
+        try {
+            verification = await (0, server_1.verifyRegistrationResponse)({
+                response: deviceResponse,
+                expectedChallenge: challenge.webauthnChallenge,
+                expectedOrigin: passkeyOptions.allowedOrigins,
+                expectedRPID: passkeyOptions.relyingPartyId,
+                requireUserVerification: true,
+            });
+        }
+        catch {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPasskey);
+        }
+        if (!verification?.verified || !verification.registrationInfo)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPasskey);
+        const credential = this.readRegisteredCredential(verification.registrationInfo, deviceResponse);
+        const savedPasskey = await this.database.getRepository(entities_1.PasskeyEntity).save({
+            userId,
+            credentialId: credential.id,
+            publicKey: credential.publicKey,
+            signCount: credential.counter,
+            transports: credential.transports,
+            isBackedUp: credential.isBackedUp,
+            name: passkeyName?.trim() || constants_1.DEFAULT_PASSKEY_NAME,
+        });
+        await this.events.record({ name: constants_1.AUTH_EVENTS.passkeyAdded, userId, request, details: { passkeyId: savedPasskey.id } });
+        return { success: true, passkey: this.toSummary(savedPasskey) };
+    }
+    // -------------------------------------------------------------------------------------------
+    // Signing in with a passkey (no email needed: the device offers the user's passkeys)
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Starts signing in with a passkey. No email is needed: the device offers the user's passkeys.
+     *
+     * @param request - Who is asking (for rate limits).
+     * @returns `options` for `navigator.credentials.get`, and a `challengeToken` for finishSignIn.
+     * @throws AuthError TOO_MANY_REQUESTS after too many attempts from this IP.
+     */
+    async startSignIn(request) {
+        const { passkeyOptions } = await this.getEnabledPasskeySettings();
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.signInPerIp(request.ipAddress), constants_1.RATE_LIMITS.signInPerIp);
+        const browserOptions = await (0, server_1.generateAuthenticationOptions)({
+            rpID: passkeyOptions.relyingPartyId,
+            userVerification: constants_1.PASSKEY_USER_VERIFICATION,
+        });
+        const challengeToken = await this.saveCeremonyChallenge(constants_1.CHALLENGE_PURPOSE.passkeySignIn, browserOptions.challenge, null);
+        return { success: true, challengeToken, options: browserOptions };
+    }
+    /**
+     * Finishes signing in with a passkey: checks the signature and signs the user in.
+     * Passkeys count as two factors, so the authenticator-app step is skipped.
+     *
+     * @param challengeToken - The token from startSignIn.
+     * @param deviceResponse - What the browser returned from `navigator.credentials.get`.
+     * @param request - Who is asking.
+     * @returns Tokens.
+     * @throws AuthError INVALID_TOKEN when the challenge is unknown, used or expired.
+     * @throws AuthError INVALID_PASSKEY when the passkey is unknown or the signature is wrong.
+     */
+    async finishSignIn(challengeToken, deviceResponse, request) {
+        const { settings, passkeyOptions } = await this.getEnabledPasskeySettings();
+        const challenge = await this.useCeremonyChallenge(challengeToken, constants_1.CHALLENGE_PURPOSE.passkeySignIn);
+        const credentialId = typeof deviceResponse?.id === 'string' ? deviceResponse.id : '';
+        const passkey = await this.database.getRepository(entities_1.PasskeyEntity).findOne({ where: { credentialId } });
+        if (!passkey)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPasskey);
+        let verification;
+        try {
+            verification = await (0, server_1.verifyAuthenticationResponse)({
+                response: deviceResponse,
+                expectedChallenge: challenge.webauthnChallenge,
+                expectedOrigin: passkeyOptions.allowedOrigins,
+                expectedRPID: passkeyOptions.relyingPartyId,
+                requireUserVerification: true,
+                credential: {
+                    id: passkey.credentialId,
+                    publicKey: new Uint8Array(Buffer.from(passkey.publicKey, constants_1.TEXT_ENCODING.base64Url)),
+                    counter: passkey.signCount,
+                    transports: passkey.transports,
+                },
+            });
+        }
+        catch {
+            verification = undefined;
+        }
+        if (!verification?.verified) {
+            await this.signIn.recordFailedSignIn(passkey.userId, constants_1.SIGN_IN_METHOD.passkey, constants_1.SIGN_IN_FAILURE_REASON.passkeySignatureInvalid, request);
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPasskey);
+        }
+        await this.database.getRepository(entities_1.PasskeyEntity).update({ id: passkey.id }, { signCount: verification.authenticationInfo?.newCounter ?? passkey.signCount, lastUsedAt: new Date() });
+        const user = await this.users.findUserById(passkey.userId);
+        if (!user)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPasskey);
+        return this.signIn.completeSignIn(user, constants_1.SIGN_IN_METHOD.passkey, request, settings);
+    }
+    // -------------------------------------------------------------------------------------------
+    // Managing passkeys
+    // -------------------------------------------------------------------------------------------
+    /**
+     * @param userId - The signed-in user.
+     * @returns The user's passkeys, oldest first.
+     */
+    async listPasskeys(userId) {
+        const passkeys = await this.database.getRepository(entities_1.PasskeyEntity).find({ where: { userId }, order: { createdAt: constants_1.SORT_ORDER.oldestFirst } });
+        return passkeys.map((passkey) => this.toSummary(passkey));
+    }
+    /**
+     * @param userId - The signed-in user.
+     * @param passkeyId - One of the user's passkeys.
+     * @param newName - The new label.
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the passkey isn't the user's.
+     */
+    async renamePasskey(userId, passkeyId, newName) {
+        const result = await this.database.getRepository(entities_1.PasskeyEntity).update({ id: passkeyId, userId }, { name: newName.trim() });
+        if (!result.affected)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        return { success: true };
+    }
+    /**
+     * Removes one of the user's passkeys, unless it is their last way to sign in.
+     *
+     * @param userId - The signed-in user.
+     * @param passkeyId - One of the user's passkeys.
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the passkey isn't the user's.
+     * @throws AuthError LAST_SIGN_IN_METHOD when it is the user's only way to sign in.
+     */
+    async removePasskey(userId, passkeyId, request) {
+        const settings = await this.settingsService.getSettings();
+        const passkeys = this.database.getRepository(entities_1.PasskeyEntity);
+        if (!(await passkeys.exists({ where: { id: passkeyId, userId } })))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        await this.signInMethods.assertCanRemove(await this.users.getUserOrThrow(userId), settings, constants_1.REMOVABLE_SIGN_IN_METHOD.passkey);
+        await passkeys.delete({ id: passkeyId, userId });
+        await this.events.record({ name: constants_1.AUTH_EVENTS.passkeyRemoved, userId, request, details: { passkeyId } });
+        return { success: true };
+    }
+    // -------------------------------------------------------------------------------------------
+    /**
+     * @returns The current settings and the app's passkey options (relying party id, origins).
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when passkeys are turned off in settings.
+     * @throws AuthError NOT_CONFIGURED when AuthOptions.passkeys is not set.
+     */
+    async getEnabledPasskeySettings() {
+        const settings = await this.settingsService.getSettings();
+        if (!settings.passkeys.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signInMethodDisabled);
+        if (!this.options.passkeys)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notConfigured);
+        return { settings, passkeyOptions: this.options.passkeys };
+    }
+    /**
+     * Stores the WebAuthn challenge until the finish request arrives, behind a "ch_..." token (only the token's hash is stored).
+     *
+     * @param purpose - Registration or sign-in.
+     * @param webauthnChallenge - The random challenge the device must sign.
+     * @param userId - The user adding a passkey, or null for sign-in.
+     * @returns The plain token for the client.
+     */
+    async saveCeremonyChallenge(purpose, webauthnChallenge, userId) {
+        const { plainToken, tokenHash } = (0, random_secrets_1.createRandomToken)(constants_1.TOKEN_PREFIX.signInChallenge);
+        await this.database.getRepository(entities_1.SignInChallengeEntity).insert({
+            purpose,
+            userId,
+            webauthnChallenge,
+            challengeTokenHash: tokenHash,
+            expiresAt: new Date(Date.now() + constants_1.PASSKEY_CHALLENGE_LIFETIME_SECONDS * constants_1.SECOND_IN_MILLISECONDS),
+        });
+        return plainToken;
+    }
+    /**
+     * Uses up a ceremony challenge (once only, before it expires).
+     *
+     * @param challengeToken - The token from startRegistration or startSignIn.
+     * @param purpose - Registration or sign-in.
+     * @returns The user who started it (null for sign-in) and the WebAuthn challenge.
+     * @throws AuthError INVALID_TOKEN when the token is unknown, used, expired or for another purpose.
+     */
+    async useCeremonyChallenge(challengeToken, purpose) {
+        if (!(0, random_secrets_1.hasRandomTokenFormat)(challengeToken, constants_1.TOKEN_PREFIX.signInChallenge))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidOrExpiredLink);
+        const challenges = this.database.getRepository(entities_1.SignInChallengeEntity);
+        const challenge = await challenges.findOne({
+            where: { challengeTokenHash: (0, random_secrets_1.sha256Hex)(challengeToken), purpose, usedAt: (0, typeorm_1.IsNull)() },
+        });
+        if (!challenge || !challenge.webauthnChallenge || challenge.expiresAt.getTime() <= Date.now()) {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidOrExpiredLink);
+        }
+        const result = await challenges.update({ id: challenge.id, usedAt: (0, typeorm_1.IsNull)() }, { usedAt: new Date() });
+        if (!result.affected)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidOrExpiredLink);
+        return { userId: challenge.userId, webauthnChallenge: challenge.webauthnChallenge };
+    }
+    /**
+     * Reads the new credential from the library's result. SimpleWebAuthn v11+ nests it under
+     * `credential`; older versions used flat fields. Both are handled so an upgrade can't break sign-up.
+     *
+     * @param registrationInfo - `verification.registrationInfo` from SimpleWebAuthn.
+     * @param deviceResponse - The browser's response (fallback source for transports).
+     * @returns The credential id and public key (base64url), counter, transports and backup state.
+     */
+    readRegisteredCredential(registrationInfo, deviceResponse) {
+        const toBase64Url = (bytes) => typeof bytes === 'string' ? bytes : Buffer.from(bytes).toString(constants_1.TEXT_ENCODING.base64Url);
+        const nested = registrationInfo.credential;
+        return {
+            id: toBase64Url(nested?.id ?? registrationInfo.credentialID),
+            publicKey: toBase64Url(nested?.publicKey ?? registrationInfo.credentialPublicKey),
+            counter: Number(nested?.counter ?? registrationInfo.counter ?? 0),
+            transports: (nested?.transports ?? deviceResponse?.response?.transports ?? []),
+            isBackedUp: registrationInfo.credentialBackedUp === true,
+        };
+    }
+    /**
+     * @param passkey - The passkey row.
+     * @returns The passkey as shown to its owner (no public key).
+     */
+    toSummary(passkey) {
+        return {
+            id: passkey.id,
+            name: passkey.name,
+            isBackedUp: passkey.isBackedUp,
+            createdAt: passkey.createdAt.toISOString(),
+            lastUsedAt: passkey.lastUsedAt?.toISOString() ?? null,
+        };
+    }
+};
+exports.PasskeysService = PasskeysService;
+exports.PasskeysService = PasskeysService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, settings_service_1.SettingsService,
+        users_service_1.UsersService,
+        sign_in_service_1.SignInService,
+        sign_in_methods_service_1.SignInMethodsService,
+        rate_limiter_service_1.RateLimiterService,
+        auth_events_service_1.AuthEventsService])
+], PasskeysService);
+//# sourceMappingURL=passkeys.service.js.map

package/dist/features/passkeys/passkeys.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.service.js","sourceRoot":"","sources":["../../../src/features/passkeys/passkeys.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,mDAKgC;AAGhC,qCAA6C;AAE7C,oDAAgD;AAChD,mEAAoG;AACpG,wEAAmE;AAEnE,2CAsBqB;AACrB,kDAA6F;AAC7F,+EAA0E;AAC1E,2EAAuE;AAEvE,wEAAmE;AAEnE,sFAAgF;AAChF,kEAA8D;AAW9D;;;;;;;;;;GAUG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IAIqB;IAC5B;IACA;IACA;IACA;IACA;IACA;IATF,QAAQ,CAAa;IAEtC,YAC+C,OAAoB,EAChD,eAAgC,EAChC,KAAmB,EACnB,MAAqB,EACrB,aAAmC,EACnC,WAA+B,EAC/B,MAAyB;QANG,YAAO,GAAP,OAAO,CAAa;QAChD,oBAAe,GAAf,eAAe,CAAiB;QAChC,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAAe;QACrB,kBAAa,GAAb,aAAa,CAAsB;QACnC,gBAAW,GAAX,WAAW,CAAoB;QAC/B,WAAM,GAAN,MAAM,CAAmB;QAE1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED,8FAA8F;IAC9F,uCAAuC;IACvC,8FAA8F;IAE9F;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,IAAI,gBAAgB,CAAC,MAAM,IAAI,qCAAyB;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,8BAAkB,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAEhK,MAAM,cAAc,GAAG,MAAM,IAAA,oCAA2B,EAAC;YACvD,MAAM,EAAE,cAAc,CAAC,gBAAgB;YACvC,IAAI,EAAE,cAAc,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE;YACnD,eAAe,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,kCAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACnH,eAAe,EAAE,oCAAwB;YACzC,qDAAqD;YACrD,kBAAkB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrD,EAAE,EAAE,OAAO,CAAC,YAAY;gBACxB,UAAU,EAAE,OAAO,CAAC,UAA4C;aACjE,CAAC,CAAC;YACH,sBAAsB,EAAE,EAAE,WAAW,EAAE,gCAAoB,EAAE,gBAAgB,EAAE,qCAAyB,EAAE;SAC3G,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,6BAAiB,CAAC,mBAAmB,EAAE,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjI,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,cAAuB,EAAE,cAAmB,EAAE,WAA+B,EAAE,OAAuB;QAC7I,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,EAAE,6BAAiB,CAAC,mBAAmB,CAAC,CAAC;QACzG,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,cAAc,CAAC,CAAC;QAEjF,IAAI,YAAiB,CAAC;QACtB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAA,mCAA0B,EAAC;gBAC9C,QAAQ,EAAE,cAAc;gBACxB,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;gBAC9C,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,YAAY,EAAE,cAAc,CAAC,cAAc;gBAC3C,uBAAuB,EAAE,IAAI;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,cAAc,CAAC,CAAC;QAE/G,MAAM,UAAU,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAChG,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,IAAI,CAAC;YACzE,MAAM;YACN,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,OAAO;YAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,gCAAoB;SAClD,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,8FAA8F;IAC9F,qFAAqF;IACrF,8FAA8F;IAE9F;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,OAAuB;QACvC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAClE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,WAAW,CAAC,CAAC;QACvG,MAAM,cAAc,GAAG,MAAM,IAAA,sCAA6B,EAAC;YACzD,IAAI,EAAE,cAAc,CAAC,cAAc;YACnC,gBAAgB,EAAE,qCAAyB;SAC5C,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,6BAAiB,CAAC,aAAa,EAAE,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACzH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,YAAY,CAAC,cAAuB,EAAE,cAAmB,EAAE,OAAuB;QACtF,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC5E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,EAAE,6BAAiB,CAAC,aAAa,CAAC,CAAC;QAEnG,MAAM,YAAY,GAAG,OAAO,cAAc,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,cAAc,CAAC,CAAC;QAE9D,IAAI,YAAiB,CAAC;QACtB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAA,qCAA4B,EAAC;gBAChD,QAAQ,EAAE,cAAc;gBACxB,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;gBAC9C,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,YAAY,EAAE,cAAc,CAAC,cAAc;gBAC3C,uBAAuB,EAAE,IAAI;gBAC7B,UAAU,EAAE;oBACV,EAAE,EAAE,OAAO,CAAC,YAAY;oBACxB,SAAS,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,yBAAa,CAAC,SAAS,CAAC,CAAC;oBAClF,OAAO,EAAE,OAAO,CAAC,SAAS;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAA4C;iBACjE;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,SAAS,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,0BAAc,CAAC,OAAO,EAAE,kCAAsB,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;YACtI,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,cAAc,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,MAAM,CACrD,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAClB,EAAE,SAAS,EAAE,YAAY,CAAC,kBAAkB,EAAE,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CACxG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,cAAc,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,0BAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAED,8FAA8F;IAC9F,oBAAoB;IACpB,8FAA8F;IAE9F;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5I,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5H,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAuB;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAC9G,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,oCAAwB,CAAC,OAAO,CAAC,CAAC;QAC9H,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxG,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED,8FAA8F;IAE9F;;;;OAIG;IACK,KAAK,CAAC,yBAAyB;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC;QAC3E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,qBAAqB,CAAC,OAAyB,EAAE,iBAAyB,EAAE,MAAqB;QAC7G,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAA,kCAAiB,EAAC,wBAAY,CAAC,eAAe,CAAC,CAAC;QAClF,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,MAAM,CAAC;YAC9D,OAAO;YACP,MAAM;YACN,iBAAiB;YACjB,kBAAkB,EAAE,SAAS;YAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,8CAAkC,GAAG,kCAAsB,CAAC;SAC9F,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,oBAAoB,CAAC,cAAuB,EAAE,OAAyB;QACnF,IAAI,CAAC,IAAA,qCAAoB,EAAC,cAAc,EAAE,wBAAY,CAAC,eAAe,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QAC/H,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YACzC,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAA,0BAAS,EAAC,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAA,gBAAM,GAAE,EAAE;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9F,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,EAAE,CAAC;IACtF,CAAC;IAED;;;;;;;OAOG;IACK,wBAAwB,CAAC,gBAAqB,EAAE,cAAmB;QACzE,MAAM,WAAW,GAAG,CAAC,KAA0B,EAAE,EAAE,CACjD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,yBAAa,CAAC,SAAS,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,IAAI,gBAAgB,CAAC,YAAY,CAAC;YAC5D,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,IAAI,gBAAgB,CAAC,mBAAmB,CAAC;YACjF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,gBAAgB,CAAC,OAAO,IAAI,CAAC,CAAC;YACjE,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,IAAI,cAAc,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAa;YAC1F,UAAU,EAAE,gBAAgB,CAAC,kBAAkB,KAAK,IAAI;SACzD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,OAAsB;QACtC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;SACtD,CAAC;IACJ,CAAC;CACF,CAAA;AAlTY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACO,kCAAe;QACzB,4BAAY;QACX,+BAAa;QACN,8CAAoB;QACtB,yCAAkB;QACvB,uCAAiB;GAVjC,eAAe,CAkT3B"}

package/dist/features/passwordless/passwordless-auth.service.d.ts

@@ -0,0 +1,152 @@
+import { RateLimiterService } from '../../common/rate-limiter.service.js';
+import { RequestContext } from '../../common/request-context.js';
+import { LinkTokensService } from '../email-links/link-tokens.service.js';
+import { NotificationsService } from '../notifications/notifications.service.js';
+import { OneTimeCodesService } from '../one-time-codes/one-time-codes.service.js';
+import { SettingsService } from '../settings/settings.service.js';
+import { SignInService } from '../sign-in/sign-in.service.js';
+import { SignInResult } from '../sign-in/sign-in.types.js';
+import { UsersService } from '../users/users.service.js';
+import { SignUpDetailsInput } from './passwordless.dto';
+/**
+ * Sign in without a password:
+ * - Email OTP: a 6-digit code by email.
+ * - Magic link: a one-click link by email.
+ * - Phone OTP: a 6-digit code by SMS.
+ *
+ * The same endpoints also VERIFY the email / phone of an existing account, because receiving the
+ * code proves ownership. If the settings allow sign-up, an unknown email / phone gets a new account.
+ *
+ * "Send" endpoints always answer the same, so they never reveal who has an account.
+ */
+export declare class PasswordlessAuthService {
+    private readonly settingsService;
+    private readonly users;
+    private readonly signIn;
+    private readonly oneTimeCodes;
+    private readonly linkTokens;
+    private readonly notifications;
+    private readonly rateLimiter;
+    constructor(settingsService: SettingsService, users: UsersService, signIn: SignInService, oneTimeCodes: OneTimeCodesService, linkTokens: LinkTokensService, notifications: NotificationsService, rateLimiter: RateLimiterService);
+    /**
+     * Emails a 6-digit sign-in code. Always answers the same, whether or not the email has an account.
+     *
+     * @param typedEmail - The email from the request.
+     * @param request - Who is asking (for rate limits).
+     * @returns A generic success message.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when email codes are turned off.
+     * @throws AuthError TOO_MANY_REQUESTS (with `retryAfterSeconds`) when a code was sent to this email a moment ago.
+     * @throws AuthError TOO_MANY_REQUESTS after too many codes for this IP or email.
+     */
+    sendEmailCode(typedEmail: unknown, request: RequestContext): Promise<{
+        success: true;
+        message: "If this destination can receive codes, a code is on its way.";
+    }>;
+    /**
+     * Signs in with an email code. This also verifies the email, and creates the account when the
+     * email is new and sign-up is allowed.
+     *
+     * @param typedEmail - The email the code was sent to.
+     * @param code - The code the user typed.
+     * @param signUpDetails - Names and consents, only needed when this creates a new account.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     * @throws AuthError OTP_EXPIRED or INVALID_OTP when the code is not usable or wrong.
+     * @throws AuthError SIGN_UP_CLOSED when the email is new and sign-up is not allowed.
+     */
+    verifyEmailCode(typedEmail: unknown, code: unknown, signUpDetails: SignUpDetailsInput, request: RequestContext): Promise<SignInResult>;
+    /**
+     * Emails a one-click sign-in link. Always answers the same, whether or not the email has an account.
+     *
+     * @param typedEmail - The email from the request.
+     * @param request - Who is asking (for rate limits).
+     * @returns A generic success message.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when magic links are turned off.
+     * @throws AuthError TOO_MANY_REQUESTS after too many emails for this IP or address.
+     */
+    sendMagicLink(typedEmail: unknown, request: RequestContext): Promise<{
+        success: true;
+        message: "If this email can sign in, a sign-in link is on its way.";
+    }>;
+    /**
+     * Signs in with the token from a magic link. This also verifies the email, and creates the account
+     * when the email is new and sign-up is allowed.
+     *
+     * @param token - The token from the link.
+     * @param signUpDetails - Names and consents, only needed when this creates a new account.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     * @throws AuthError INVALID_TOKEN when the link is unknown, used or expired.
+     * @throws AuthError SIGN_UP_CLOSED when the email is new and sign-up is not allowed.
+     */
+    verifyMagicLink(token: unknown, signUpDetails: SignUpDetailsInput, request: RequestContext): Promise<SignInResult>;
+    /**
+     * Sends a 6-digit sign-in code by SMS. Always answers the same, whether or not the number has an account.
+     *
+     * @param typedPhoneNumber - The phone number from the request, with country code.
+     * @param request - Who is asking (for rate limits).
+     * @returns A generic success message.
+     * @throws AuthError PHONE_COUNTRY_NOT_ALLOWED when the country code is not in the allowed list.
+     * @throws AuthError TOO_MANY_REQUESTS (with `retryAfterSeconds`) when a code was sent to this number a moment ago.
+     */
+    sendPhoneCode(typedPhoneNumber: unknown, request: RequestContext): Promise<{
+        success: true;
+        message: "If this destination can receive codes, a code is on its way.";
+    }>;
+    /**
+     * Signs in with an SMS code. This also verifies the phone number, and creates the account when the
+     * number is new and sign-up is allowed.
+     *
+     * @param typedPhoneNumber - The number the code was sent to.
+     * @param code - The code the user typed.
+     * @param signUpDetails - Names and consents, only needed when this creates a new account.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     * @throws AuthError OTP_EXPIRED or INVALID_OTP when the code is not usable or wrong.
+     */
+    verifyPhoneCode(typedPhoneNumber: unknown, code: unknown, signUpDetails: SignUpDetailsInput, request: RequestContext): Promise<SignInResult>;
+    /**
+     * @returns The current settings.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when phone codes are turned off.
+     * @throws AuthError NOT_CONFIGURED when the app has no SMS sender.
+     */
+    private getPhoneSettings;
+    /**
+     * Applies the "send a code" rate limits for both the IP and the destination.
+     *
+     * @param destination - The email or phone number the code goes to.
+     * @param request - Who is asking.
+     * @throws AuthError TOO_MANY_REQUESTS when either limit is reached.
+     */
+    private consumeSendLimits;
+    /**
+     * Decides whether to actually send: existing users who may sign in, or new ones when sign-up is allowed.
+     *
+     * @param user - The existing account, or null.
+     * @param allowSignUp - Whether this sign-in method may create accounts.
+     * @param email - The normalized email.
+     * @param settings - The current settings.
+     * @returns True when the code or link should be sent.
+     */
+    private mayReceiveMessage;
+    /**
+     * Checks that a new account may be created with this method and these details.
+     *
+     * @param allowSignUp - Whether this sign-in method may create accounts.
+     * @param details - The names and consents from the request.
+     * @param settings - The current settings.
+     * @param email - The new account's email, or null for phone sign-up.
+     * @throws AuthError SIGN_UP_CLOSED, EMAIL_DOMAIN_NOT_ALLOWED, or an error for missing details.
+     */
+    private assertMaySignUp;
+    /**
+     * Creates an account whose email or phone is already verified (the user just received the code).
+     *
+     * @param contact - The email or the phone number the code was sent to.
+     * @param details - The names and consents from the request.
+     * @param settings - The current settings.
+     * @param request - Who is asking (for the audit log).
+     * @returns The new user.
+     */
+    private createVerifiedUser;
+}