@teincfood/core 0.10.19 → 0.10.20

package/dist/offline/service.d.ts

@@ -34,12 +34,26 @@ export interface OfflineSessionState {
     keyId: string | null;
     members: OfflineMemberCredential[];
 }
+interface OfflineActivationBaseArgs {
+    businessId: string;
+    appInstanceId?: string;
+    platform?: string;
+    deviceName?: string;
+    osVersion?: string;
+    appVersion?: string;
+}
 /**
- * First-time activation. Generates the device keypair, registers the public
- * key, stores the signed license and enrolls the current member's PIN.
+ * Activate the terminal license without creating any member PIN. The backend
+ * activation also enrolls the signed-in user, but the quick-login PIN is a
+ * separate, optional local credential.
  */
-export declare function activateOfflineDevice(args: {
-    businessId: string;
+export declare function activateOfflineLicense(args: OfflineActivationBaseArgs): Promise<OfflineActivationResult>;
+/**
+ * First-time activation plus the optional local quick-login PIN. Kept as the
+ * mobile-compatible entry point; desktop can call activateOfflineLicense()
+ * first and set the PIN later.
+ */
+export declare function activateOfflineDevice(args: OfflineActivationBaseArgs & {
     member: {
         userId: string;
         fullName: string;
@@ -48,12 +62,23 @@ export declare function activateOfflineDevice(args: {
         capabilities: string[];
     };
     pin: string;
-    appInstanceId?: string;
-    platform?: string;
-    deviceName?: string;
-    osVersion?: string;
-    appVersion?: string;
 }): Promise<OfflineActivationResult>;
+/**
+ * Set or change the local 6-digit quick-login PIN. Existing PINs must be
+ * confirmed first; changing a PIN never requires the network.
+ */
+export declare function setOfflineMemberPin(args: {
+    businessId: string;
+    userId: string;
+    newPin: string;
+    currentPin?: string;
+    member?: {
+        fullName: string;
+        email?: string | null;
+        role: string;
+        capabilities: string[];
+    };
+}): Promise<OfflineMemberCredential>;
 /** Refresh the signed license while online using the normal access token. */
 export declare function refreshOfflineLicense(businessId: string): Promise<OfflineActivationResult>;
 /**

package/dist/offline/service.js

@@ -12,7 +12,7 @@ import { getConnectivityState } from "../adapters/connectivity";
 import { syncLogger } from "../utils/sync-logger";
 import { offlineRandomBytes } from "./random";
 import { base64UrlDecode, base64UrlEncode, canonicalDeviceChallenge, decodeLicensePayload, evaluateOfflineLicense, generateOfflineDeviceKeypair, loadAndVerifyOfflineLicense, newOfflineNonce, signDeviceChallenge, verifyOfflineLicense, } from "./license";
-import { clearOfflineDevice, createOfflineMemberCredential, getDevicePrivateKey, getOfflineMember, getStoredLicense, getStoredLicenseKeyId, getStoredLicensePublicKey, listOfflineMembers, markOfflineMemberLogin, removeOfflineMember, saveDevicePrivateKey, saveStoredLicense, saveStoredLicenseKeyId, saveStoredLicensePublicKey, verifyOfflineMemberPin, } from "./store";
+import { clearOfflineDevice, createOfflineMemberCredential, getDevicePrivateKey, getOfflineMember, getStoredLicense, getStoredLicenseKeyId, getStoredLicensePublicKey, listOfflineMembers, markOfflineMemberLogin, removeOfflineMember, saveDevicePrivateKey, saveStoredLicense, saveStoredLicenseKeyId, saveStoredLicensePublicKey, updateOfflineMemberPin, verifyOfflineMemberPin, } from "./store";
 function randomBytes(length) {
     return offlineRandomBytes(length);
 }
@@ -29,10 +29,11 @@ async function getPrivateKeyBytes() {
     }
 }
 /**
- * First-time activation. Generates the device keypair, registers the public
- * key, stores the signed license and enrolls the current member's PIN.
+ * Activate the terminal license without creating any member PIN. The backend
+ * activation also enrolls the signed-in user, but the quick-login PIN is a
+ * separate, optional local credential.
  */
-export async function activateOfflineDevice(args) {
+export async function activateOfflineLicense(args) {
     if (!getAuthToken())
         throw new Error("Sign in online before activating this device");
     const deviceId = args.appInstanceId ?? (await getAppInstanceIdAsync());
@@ -57,6 +58,15 @@ export async function activateOfflineDevice(args) {
     await saveStoredLicense(args.businessId, data.license);
     await saveStoredLicensePublicKey(args.businessId, data.public_key);
     await saveStoredLicenseKeyId(args.businessId, data.key_id);
+    return { ...data, payload: verified };
+}
+/**
+ * First-time activation plus the optional local quick-login PIN. Kept as the
+ * mobile-compatible entry point; desktop can call activateOfflineLicense()
+ * first and set the PIN later.
+ */
+export async function activateOfflineDevice(args) {
+    const result = await activateOfflineLicense(args);
     await createOfflineMemberCredential({
         businessId: args.businessId,
         userId: args.member.userId,
@@ -70,14 +80,51 @@ export async function activateOfflineDevice(args) {
     // the intent explicit and is idempotent.
     await enrollMemberOnDevice({
         businessId: args.businessId,
-        deviceId,
+        deviceId: args.appInstanceId,
         userId: args.member.userId,
     }).catch((error) => {
         syncLogger.warn("OfflineAuth", "Member enrollment call failed", {
             error: String(error),
         });
     });
-    return { ...data, payload: verified };
+    return result;
+}
+/**
+ * Set or change the local 6-digit quick-login PIN. Existing PINs must be
+ * confirmed first; changing a PIN never requires the network.
+ */
+export async function setOfflineMemberPin(args) {
+    if (!/^\d{6}$/.test(args.newPin)) {
+        throw new Error("Offline PIN must be exactly 6 digits");
+    }
+    const existing = await getOfflineMember(args.userId, args.businessId);
+    if (existing) {
+        if (existing.pin_hash) {
+            if (!args.currentPin) {
+                throw new Error("Enter your current 6-digit PIN");
+            }
+            const valid = await verifyOfflineMemberPin(args.userId, args.currentPin, args.businessId);
+            if (!valid)
+                throw new Error("Current PIN is incorrect");
+        }
+        await updateOfflineMemberPin(args.userId, args.businessId, args.newPin);
+        const updated = await getOfflineMember(args.userId, args.businessId);
+        if (!updated)
+            throw new Error("Could not update the offline PIN");
+        return updated;
+    }
+    if (!args.member) {
+        throw new Error("Sign in online once before setting up an offline PIN");
+    }
+    return createOfflineMemberCredential({
+        businessId: args.businessId,
+        userId: args.userId,
+        fullName: args.member.fullName,
+        email: args.member.email,
+        role: args.member.role,
+        capabilities: args.member.capabilities,
+        pin: args.newPin,
+    });
 }
 /** Refresh the signed license while online using the normal access token. */
 export async function refreshOfflineLicense(businessId) {

package/dist/offline/store.d.ts

@@ -70,6 +70,8 @@ export declare function createOfflineMemberCredential(args: {
     capabilities: string[];
     pin: string;
 }): Promise<OfflineMemberCredential>;
+/** Replace an existing member's PIN without changing their role/capabilities. */
+export declare function updateOfflineMemberPin(userId: string, businessId: string, pin: string): Promise<void>;
 export declare const OFFLINE_PIN_MAX_ATTEMPTS = 5;
 export interface OfflinePinLockState {
     failedAttempts: number;

package/dist/offline/store.js

@@ -201,6 +201,23 @@ export async function createOfflineMemberCredential(args) {
     await saveOfflineMember(member);
     return member;
 }
+/** Replace an existing member's PIN without changing their role/capabilities. */
+export async function updateOfflineMemberPin(userId, businessId, pin) {
+    if (!/^\d{6}$/.test(pin)) {
+        throw new Error("Offline PIN must be exactly 6 digits");
+    }
+    const member = await getOfflineMember(userId, businessId);
+    if (!member)
+        throw new Error("This member has no offline credential on this device");
+    const salt = randomHex(32);
+    await saveOfflineMember({
+        ...member,
+        pin_salt: salt,
+        pin_hash: await hashPin(pin, salt),
+        failed_attempts: 0,
+        locked_until: null,
+    });
+}
 export const OFFLINE_PIN_MAX_ATTEMPTS = 5;
 export async function getOfflinePinLockState(userId, businessId) {
     const member = await getOfflineMember(userId, businessId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teincfood/core",
-  "version": "0.10.19",
+  "version": "0.10.20",
   "description": "TeincFood shared offline-first core — types, sync engine, local DB, reference data, and repositories for mobile + desktop",
   "type": "module",
   "main": "dist/index.js",