@tinyrack/issuary-server 0.30.0 → 0.32.1

package/dist/routes/api/auth/email/verify/post.js

@@ -5,6 +5,7 @@ import { TAGS } from '../../../../../lib/swagger-tags.js';
 import { e } from '../../../../../schemas/error.js';
 import { f } from '../../../../../schemas/field.js';
 import { r } from '../../../../../schemas/response.js';
+import { withUserSecurity } from '../../../../../services/user-security.service.js';
 export const authEmailVerifyPost = new Hono().post('/auth/email/verify', describeRoute({
     tags: [TAGS.AUTH],
     summary: 'Verify Email',
@@ -22,7 +23,7 @@ export const authEmailVerifyPost = new Hono().post('/auth/email/verify', describ
                     schema: resolver(e.InvalidVerificationToken.Schema),
                 },
             },
-            description: 'Invalid verification token',
+            description: 'Invalid, expired, used, or revoked verification token. Request a new email.',
         },
         403: {
             content: {
@@ -39,17 +40,33 @@ export const authEmailVerifyPost = new Hono().post('/auth/email/verify', describ
     const services = c.var.services;
     const session = c.var.session;
     const body = c.req.valid('json');
-    const user = await services.emailService.verifyEmail(body.token);
-    const userSession = await services.userService.getSessionUserBySub(user.sub);
-    const available2FAMethods = services.userService.getAvailable2FASetupMethods();
-    if (userSession.second_factor_required &&
-        !userSession.totp_registered &&
-        userSession.passkey_count === 0 &&
-        available2FAMethods.length > 0) {
-        session.setPending2FASetupSession(user.sub);
+    if (!services.config.email)
+        throw new e.EmailNotActivated.Error();
+    const candidate = await services.mikro.emailVerification.findOne({
+        token: body.token,
+        verified: false,
+        expiresAt: { $gt: new Date() },
+    });
+    if (!candidate)
+        throw new e.InvalidVerificationToken.Error();
+    return session.atomic(() => withUserSecurity(services.mikro, candidate.user.sub, async () => {
+        const user = await services.emailService.verifyEmail(body.token);
+        const userSession = await services.userService.getSessionUserBySub(user.sub);
+        const registeredMethods = await services.userService.userRegistered2FAMethods(user.sub);
+        if (registeredMethods.length > 0) {
+            session.setPending2FASession(user.sub, user.token_epoch);
+            return c.json({ user: userSession }, 200);
+        }
+        const available2FAMethods = services.userService.getAvailable2FASetupMethods();
+        if (userSession.second_factor_required &&
+            !userSession.totp_registered &&
+            userSession.passkey_count === 0 &&
+            available2FAMethods.length > 0) {
+            session.setPending2FASetupSession(user.sub, user.token_epoch);
+            return c.json({ user: userSession }, 200);
+        }
+        session.setUserSession(user.sub, user.token_epoch);
         return c.json({ user: userSession }, 200);
-    }
-    session.setUserSession(user.sub);
-    return c.json({ user: userSession }, 200);
+    }, { includeDeleted: true }));
 });
 //# sourceMappingURL=post.js.map

package/dist/routes/api/auth/email/verify/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/email/verify/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACxD,oBAAoB,EACpB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,cAAc;IACvB,WAAW,EAAE,2CAA2C;IACxD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;aACzD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;iBACpD;aACF;YACD,WAAW,EAAE,4BAA4B;SAC1C;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EAAE,6BAA6B;SAC3C;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,KAAK;CACf,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,mBAAmB,CAChE,IAAI,CAAC,GAAG,CACT,CAAC;IACF,MAAM,mBAAmB,GACvB,QAAQ,CAAC,WAAW,CAAC,2BAA2B,EAAE,CAAC;IAErD,IACE,WAAW,CAAC,sBAAsB;QAClC,CAAC,WAAW,CAAC,eAAe;QAC5B,WAAW,CAAC,aAAa,KAAK,CAAC;QAC/B,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/email/verify/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AAEpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACxD,oBAAoB,EACpB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,cAAc;IACvB,WAAW,EAAE,2CAA2C;IACxD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;aACzD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;iBACpD;aACF;YACD,WAAW,EACT,6EAA6E;SAChF;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EAAE,6BAA6B;SAC3C;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,KAAK;CACf,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAC/D,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;IAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CACzB,gBAAgB,CACd,QAAQ,CAAC,KAAK,EACd,SAAS,CAAC,IAAI,CAAC,GAAG,EAClB,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,mBAAmB,CAChE,IAAI,CAAC,GAAG,CACT,CAAC;QACF,MAAM,iBAAiB,GACrB,MAAM,QAAQ,CAAC,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,mBAAmB,GACvB,QAAQ,CAAC,WAAW,CAAC,2BAA2B,EAAE,CAAC;QAErD,IACE,WAAW,CAAC,sBAAsB;YAClC,CAAC,WAAW,CAAC,eAAe;YAC5B,WAAW,CAAC,aAAa,KAAK,CAAC;YAC/B,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAC9B,CAAC;YACD,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC,EACD,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CACF,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/routes/api/auth/login/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/auth/login/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAMzD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAgFzB,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/auth/login/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAMzD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAiFzB,CAAC"}

package/dist/routes/api/auth/login/post.js

@@ -55,6 +55,7 @@ export const authLoginPost = new Hono().post('/auth/login', describeRoute({
         email: body.email,
         password: body.password,
     });
+    const authenticationEpoch = userEntity.token_epoch;
     const user = await services.userService.userEntityToSessionUser(userEntity);
     if (services.userService.userEmailVerificationRequired(user) &&
         !user.email_verified) {
@@ -62,13 +63,13 @@ export const authLoginPost = new Hono().post('/auth/login', describeRoute({
     }
     const registered2FAMethods = await services.userService.userRegistered2FAMethods(user.sub);
     if (registered2FAMethods.length > 0) {
-        session.setPending2FASession(user.sub);
+        session.setPending2FASession(user.sub, authenticationEpoch);
     }
     else if (user.second_factor_required) {
-        session.setPending2FASetupSession(user.sub);
+        session.setPending2FASetupSession(user.sub, authenticationEpoch);
     }
     else {
-        session.setUserSession(user.sub);
+        session.setUserSession(user.sub, authenticationEpoch);
     }
     return c.json({ user }, 200);
 });

package/dist/routes/api/auth/login/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../src/routes/api/auth/login/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAClD,aAAa,EACb,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,OAAO;IACpB,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;aACzD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,kBAAkB;SAChC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC;iBAClD;aACF;YACD,WAAW,EAAE,2BAA2B;SACzC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC;iBACrD;aACF;YACD,WAAW,EAAE,6BAA6B;SAC3C;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,SAAS;IAClB,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GACd,MAAM,QAAQ,CAAC,mBAAmB,CAAC,8BAA8B,CAAC;QAChE,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IACL,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAE5E,IACE,QAAQ,CAAC,WAAW,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACxD,CAAC,IAAI,CAAC,cAAc,EACpB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,oBAAoB,GACxB,MAAM,QAAQ,CAAC,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../src/routes/api/auth/login/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAClD,aAAa,EACb,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,OAAO;IACpB,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;aACzD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,kBAAkB;SAChC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC;iBAClD;aACF;YACD,WAAW,EAAE,2BAA2B;SACzC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC;iBACrD;aACF;YACD,WAAW,EAAE,6BAA6B;SAC3C;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,SAAS;IAClB,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GACd,MAAM,QAAQ,CAAC,mBAAmB,CAAC,8BAA8B,CAAC;QAChE,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IACL,MAAM,mBAAmB,GAAG,UAAU,CAAC,WAAW,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAE5E,IACE,QAAQ,CAAC,WAAW,CAAC,6BAA6B,CAAC,IAAI,CAAC;QACxD,CAAC,IAAI,CAAC,cAAc,EACpB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,oBAAoB,GACxB,MAAM,QAAQ,CAAC,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC,CACF,CAAC"}

package/dist/routes/api/auth/passkey/verify/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/passkey/verify/post.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAU5D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA0FjC,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/passkey/verify/post.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAe5D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BAmHjC,CAAC"}

package/dist/routes/api/auth/passkey/verify/post.js

@@ -1,11 +1,13 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { OPENAPI_SECURITY } from '../../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../../lib/openapi.js';
 import { TAGS } from '../../../../../lib/swagger-tags.js';
 import { verifyPasskeyChallenge, verifyPending2FAUser, } from '../../../../../middleware/auth.js';
 import { e } from '../../../../../schemas/error.js';
 import { r } from '../../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../../services/browser-security.service.js';
+import { withUserSecurity } from '../../../../../services/user-security.service.js';
 export const authPasskeyVerifyPost = new Hono().post('/auth/passkey/verify', describeRoute({
     tags: [TAGS.AUTH],
     security: OPENAPI_SECURITY.cookieSession,
@@ -48,7 +50,11 @@ export const authPasskeyVerifyPost = new Hono().post('/auth/passkey/verify', des
     },
 }), validator('json', z.object({
     response: r.AuthenticationResponseJSON,
-})), verifyPending2FAUser({ optional: true }), verifyPasskeyChallenge(), async (c) => {
+})), verifyPending2FAUser({ optional: true }), async (c, next) => {
+    if (!c.var.services.config.auth.passkey.enabled)
+        throw new e.PasskeyNotEnabled.Error();
+    await next();
+}, verifyPasskeyChallenge(), securityMutationDocumentation, async (c) => {
     const config = c.var.services.config;
     if (!config.auth.passkey.enabled) {
         throw new e.PasskeyNotEnabled.Error();
@@ -62,14 +68,22 @@ export const authPasskeyVerifyPost = new Hono().post('/auth/passkey/verify', des
     // differs from @simplewebauthn's AuthenticationResponseJSON due to
     // exactOptionalPropertyTypes (userHandle?: string | undefined vs string).
     const authResponse = body.response;
-    const passkeyUser = await passkeyService.verifyAuthentication(authResponse, challenge, pending2FA?.user.sub);
-    if (pending2FA && passkeyUser.sub !== pending2FA.user.sub) {
-        throw new e.PasskeyUserMismatch.Error();
-    }
-    const userEntity = await mikro.user.verifyBySub(passkeyUser.sub);
-    const sessionUser = await userService.userEntityToSessionUser(userEntity);
-    const authTime = pending2FA?.authenticatedAt ?? Math.floor(Date.now() / 1000);
-    session.setUserSession(passkeyUser.sub, authTime);
-    return c.json({ user: sessionUser }, 200);
+    const proof = await passkeyService.prepareAuthentication(authResponse, challenge, pending2FA?.user.sub);
+    const complete = async () => {
+        if ((session.authorization.security?.challengeExpiresAt ?? 0) <= Date.now())
+            throw new e.PasskeyChallengeNotFound.Error();
+        const passkeyUser = await passkeyService.verifyAuthentication(authResponse, challenge, pending2FA?.user.sub, proof);
+        if (pending2FA && passkeyUser.sub !== pending2FA.user.sub) {
+            throw new e.PasskeyUserMismatch.Error();
+        }
+        const userEntity = await mikro.user.verifyBySub(passkeyUser.sub);
+        const sessionUser = await userService.userEntityToSessionUser(userEntity);
+        const authTime = pending2FA?.authenticatedAt ?? Math.floor(Date.now() / 1000);
+        session.setUserSession(passkeyUser.sub, passkeyUser.token_epoch, authTime);
+        return c.json({ user: sessionUser }, 200);
+    };
+    return pending2FA
+        ? withBrowserSecurity(c, complete, { stage: 'mfa' })
+        : session.atomic(() => withUserSecurity(mikro, proof.userSub, complete));
 });
 //# sourceMappingURL=post.js.map

package/dist/routes/api/auth/passkey/verify/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/passkey/verify/post.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC1D,sBAAsB,EACtB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,+BAA+B;IACxC,WAAW,EACT,8DAA8D;QAC9D,4CAA4C;QAC5C,mEAAmE;QACnE,uCAAuC;IACzC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;aACzD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EACT,kEAAkE;SACrE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;iBAC/C;aACF;YACD,WAAW,EAAE,uBAAuB;SACrC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,mBAAmB;SACjC;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,0BAA0B;CACvC,CAAC,CACH,EACD,oBAAoB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EACxC,sBAAsB,EAAE,EACxB,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE9D,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAChD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAEjD,+DAA+D;IAC/D,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,QAAsC,CAAC;IAEjE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAC3D,YAAY,EACZ,SAAS,EACT,UAAU,EAAE,IAAI,CAAC,GAAG,CACrB,CAAC;IAEF,IAAI,UAAU,IAAI,WAAW,CAAC,GAAG,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,QAAQ,GACZ,UAAU,EAAE,eAAe,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE/D,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAElD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/passkey/verify/post.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AAEpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC1D,sBAAsB,EACtB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,+BAA+B;IACxC,WAAW,EACT,8DAA8D;QAC9D,4CAA4C;QAC5C,mEAAmE;QACnE,uCAAuC;IACzC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;aACzD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EACT,kEAAkE;SACrE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;iBAC/C;aACF;YACD,WAAW,EAAE,uBAAuB;SACrC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,mBAAmB;SACjC;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,0BAA0B;CACvC,CAAC,CACH,EACD,oBAAoB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EACxC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;QAC7C,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,EACD,sBAAsB,EAAE,EACxB,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE9D,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAChD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAEjD,+DAA+D;IAC/D,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,QAAsC,CAAC;IAEjE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,qBAAqB,CACtD,YAAY,EACZ,SAAS,EACT,UAAU,EAAE,IAAI,CAAC,GAAG,CACrB,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IACE,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,kBAAkB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAEvE,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAC3D,YAAY,EACZ,SAAS,EACT,UAAU,EAAE,IAAI,CAAC,GAAG,EACpB,KAAK,CACN,CAAC;QAEF,IAAI,UAAU,IAAI,WAAW,CAAC,GAAG,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC1E,MAAM,QAAQ,GACZ,UAAU,EAAE,eAAe,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE/D,OAAO,CAAC,cAAc,CACpB,WAAW,CAAC,GAAG,EACf,WAAW,CAAC,WAAW,EACvB,QAAQ,CACT,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,OAAO,UAAU;QACf,CAAC,CAAC,mBAAmB,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACpD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC7E,CAAC,CACF,CAAC"}

package/dist/routes/api/auth/password/forgot/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/password/forgot/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAM5D,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;gCAoFlC,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/password/forgot/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAM5D,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;gCAmElC,CAAC"}

package/dist/routes/api/auth/password/forgot/post.js

@@ -49,24 +49,7 @@ export const authPasswordForgotPost = new Hono().post('/auth/password/forgot', d
     const body = c.req.valid('json');
     const headers = c.req.valid('header');
     const { email } = body;
-    try {
-        const resetEntity = await services.passwordResetService.requestPasswordReset(email);
-        if (resetEntity) {
-            services.emailService.sendPasswordResetEmailAsync({
-                email,
-                token: resetEntity.token,
-                locale: headers['accept-language'],
-            });
-        }
-        return c.json({ ok: true }, 200);
-    }
-    catch (error) {
-        // Always return success to prevent email enumeration
-        if (error instanceof e.UserNotEditable.Error ||
-            error instanceof e.UserNotFound.Error) {
-            return c.json({ ok: true }, 200);
-        }
-        throw error;
-    }
+    await services.mailQueue.enqueue('password-reset', email, headers['accept-language']);
+    return c.json({ ok: true }, 200);
 });
 //# sourceMappingURL=post.js.map

package/dist/routes/api/auth/password/forgot/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/password/forgot/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC3D,uBAAuB,EACvB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,wBAAwB;IACjC,WAAW,EACT,gGAAgG;IAClG,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,kBAAkB;SAChC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EAAE,6BAA6B;SAC3C;KACF;CACF,CAAC,EACF,SAAS,CACP,QAAQ,EACR,CAAC,CAAC,MAAM,CAAC;IACP,iBAAiB,EAAE,CAAC,CAAC,cAAc;CACpC,CAAC,CACH,EACD,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,SAAS;CACnB,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEhC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,WAAW,GACf,MAAM,QAAQ,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAElE,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,YAAY,CAAC,2BAA2B,CAAC;gBAChD,KAAK;gBACL,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qDAAqD;QACrD,IACE,KAAK,YAAY,CAAC,CAAC,eAAe,CAAC,KAAK;YACxC,KAAK,YAAY,CAAC,CAAC,YAAY,CAAC,KAAK,EACrC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/password/forgot/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC3D,uBAAuB,EACvB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,wBAAwB;IACjC,WAAW,EACT,gGAAgG;IAClG,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,kBAAkB;SAChC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EAAE,6BAA6B;SAC3C;KACF;CACF,CAAC,EACF,SAAS,CACP,QAAQ,EACR,CAAC,CAAC,MAAM,CAAC;IACP,iBAAiB,EAAE,CAAC,CAAC,cAAc;CACpC,CAAC,CACH,EACD,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,SAAS;CACnB,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEhC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAEvB,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,CAC9B,gBAAgB,EAChB,KAAK,EACL,OAAO,CAAC,iBAAiB,CAAC,CAC3B,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC,CACF,CAAC"}

package/dist/routes/api/auth/register/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/auth/register/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAQzD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA4G5B,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/auth/register/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAQzD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA8G5B,CAAC"}

package/dist/routes/api/auth/register/post.js

@@ -75,20 +75,21 @@ export const authRegisterPost = new Hono().post('/auth/register', describeRoute(
         throw new e.RegistrationEmailNotAllowed.Error();
     }
     // Register the user (terms consent validation and recording handled inside)
-    const userSession = await userService.register({
+    const registeredUser = await userService.register({
         email,
         password,
         locale: headers['accept-language'],
         ...(consents && { consents }),
     });
+    const { token_epoch, ...userSession } = registeredUser;
     if (userSession.email_verification_required) {
         return c.json({ user: userSession }, 200);
     }
     if (userSession.second_factor_required) {
-        session.setPending2FASetupSession(userSession.sub);
+        session.setPending2FASetupSession(userSession.sub, token_epoch);
     }
     else {
-        session.setUserSession(userSession.sub);
+        session.setUserSession(userSession.sub, token_epoch);
     }
     return c.json({ user: userSession }, 200);
 });

package/dist/routes/api/auth/register/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../src/routes/api/auth/register/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACrD,gBAAgB,EAChB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,WAAW,EACT,oEAAoE;IACtE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;aACzD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,kBAAkB;SAChC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,oBAAoB,CAAC,MAAM;wBAC7B,CAAC,CAAC,2BAA2B,CAAC,MAAM;qBACrC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,4CAA4C;SAC1D;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,SAAS,CACP,QAAQ,EACR,CAAC,CAAC,MAAM,CAAC;IACP,iBAAiB,EAAE,CAAC,CAAC,cAAc;CACpC,CAAC,CACH,EACD,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,SAAS;IAClB,QAAQ,EAAE,CAAC,CAAC,eAAe;IAC3B,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CAAC,yBAAyB,CAAC;CACvC,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAE9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IAEhE,uCAAuC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,8CAA8C;IAC9C,IACE,sBAAsB,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,cAAc,CAAC,KAAK,EAAE,sBAAsB,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,4EAA4E;IAC5E,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;QAC7C,KAAK;QACL,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC;QAClC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC9B,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,2BAA2B,EAAE,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,WAAW,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../src/routes/api/auth/register/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACrD,gBAAgB,EAChB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,UAAU;IACnB,WAAW,EACT,oEAAoE;IACtE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;aACzD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,kBAAkB;SAChC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,oBAAoB,CAAC,MAAM;wBAC7B,CAAC,CAAC,2BAA2B,CAAC,MAAM;qBACrC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,4CAA4C;SAC1D;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,SAAS,CACP,QAAQ,EACR,CAAC,CAAC,MAAM,CAAC;IACP,iBAAiB,EAAE,CAAC,CAAC,cAAc;CACpC,CAAC,CACH,EACD,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,SAAS;IAClB,QAAQ,EAAE,CAAC,CAAC,eAAe;IAC3B,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CAAC,yBAAyB,CAAC;CACvC,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAE9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IAEhE,uCAAuC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,8CAA8C;IAC9C,IACE,sBAAsB,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,cAAc,CAAC,KAAK,EAAE,sBAAsB,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,4EAA4E;IAC5E,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;QAChD,KAAK;QACL,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC;QAClC,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC9B,CAAC,CAAC;IAEH,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC;IAEvD,IAAI,WAAW,CAAC,2BAA2B,EAAE,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,WAAW,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/api/auth/totp/recovery/verify/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/auth/totp/recovery/verify/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAQ/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAmEtC,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/auth/totp/recovery/verify/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAY/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAgFtC,CAAC"}

package/dist/routes/api/auth/totp/recovery/verify/post.js

@@ -1,12 +1,13 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { OPENAPI_SECURITY } from '../../../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../../../lib/openapi.js';
 import { TAGS } from '../../../../../../lib/swagger-tags.js';
 import { verifyPending2FAUser } from '../../../../../../middleware/auth.js';
 import { e } from '../../../../../../schemas/error.js';
 import { f } from '../../../../../../schemas/field.js';
 import { r } from '../../../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../../../services/browser-security.service.js';
 /**
  * POST /api/auth/totp/recovery/verify
  *
@@ -49,9 +50,10 @@ export const authTotpRecoveryVerifyPost = new Hono().post('/auth/totp/recovery/v
     },
 }), validator('json', z.object({
     code: f.recoveryCode,
-})), verifyPending2FAUser(), async (c) => {
+})), verifyPending2FAUser(), securityMutationDocumentation, async (c) => withBrowserSecurity(c, async () => {
     const config = c.var.services.config;
-    if (!config.auth.password.enabled || !config.auth.password.totp.enabled) {
+    if (!config.auth.password.enabled ||
+        !config.auth.password.totp.enabled) {
         throw new e.ValidationError.Error('TOTP authentication is disabled');
     }
     const body = c.req.valid('json');
@@ -59,10 +61,10 @@ export const authTotpRecoveryVerifyPost = new Hono().post('/auth/totp/recovery/v
     const { user: pending2FAUser, authenticatedAt } = c.var.verifiedPending2FAUser;
     const { mikro, userService, totpService } = c.var.services;
     await totpService.verifyRecoveryCode(pending2FAUser.sub, body.code);
-    session.setUserSession(pending2FAUser.sub, authenticatedAt);
+    session.setUserSession(pending2FAUser.sub, pending2FAUser.token_epoch, authenticatedAt);
     // Load full user data with relations for response
     const fullUser = await mikro.user.verifyBySub(pending2FAUser.sub);
     const userSession = await userService.userEntityToSessionUser(fullUser);
     return c.json({ user: userSession }, 200);
-});
+}, { stage: 'mfa' }));
 //# sourceMappingURL=post.js.map

package/dist/routes/api/auth/totp/recovery/verify/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../../src/routes/api/auth/totp/recovery/verify/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,uCAAuC,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,uCAAuC,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC/D,4BAA4B,EAC5B,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,qCAAqC;IAC9C,WAAW,EACT,6DAA6D;QAC7D,oDAAoD;QACpD,2CAA2C;IAC7C,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EACT,2FAA2F;SAC9F;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;iBACtD;aACF;YACD,WAAW,EAAE,+BAA+B;SAC7C;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,YAAY;CACrB,CAAC,CACH,EACD,oBAAoB,EAAE,EACtB,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,GAC7C,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE3D,MAAM,WAAW,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpE,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAE5D,kDAAkD;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAExE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../../src/routes/api/auth/totp/recovery/verify/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,uCAAuC,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,uCAAuC,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAE7F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC/D,4BAA4B,EAC5B,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,qCAAqC;IAC9C,WAAW,EACT,6DAA6D;QAC7D,oDAAoD;QACpD,2CAA2C;IAC7C,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EACT,2FAA2F;SAC9F;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;iBACtD;aACF;YACD,WAAW,EAAE,+BAA+B;SAC7C;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,YAAY;CACrB,CAAC,CACH,EACD,oBAAoB,EAAE,EACtB,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE,CACV,mBAAmB,CACjB,CAAC,EACD,KAAK,IAAI,EAAE;IACT,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC7B,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAClC,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,GAC7C,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE3D,MAAM,WAAW,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpE,OAAO,CAAC,cAAc,CACpB,cAAc,CAAC,GAAG,EAClB,cAAc,CAAC,WAAW,EAC1B,eAAe,CAChB,CAAC;IAEF,kDAAkD;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAExE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CACJ,CAAC"}

package/dist/routes/api/auth/totp/verify/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/totp/verify/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAQ5D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAgE9B,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/totp/verify/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAY5D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA6E9B,CAAC"}

package/dist/routes/api/auth/totp/verify/post.js

@@ -1,12 +1,13 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { OPENAPI_SECURITY } from '../../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../../lib/openapi.js';
 import { TAGS } from '../../../../../lib/swagger-tags.js';
 import { verifyPending2FAUser } from '../../../../../middleware/auth.js';
 import { e } from '../../../../../schemas/error.js';
 import { f } from '../../../../../schemas/field.js';
 import { r } from '../../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../../services/browser-security.service.js';
 export const authTotpVerifyPost = new Hono().post('/auth/totp/verify', describeRoute({
     tags: [TAGS.AUTH],
     security: OPENAPI_SECURITY.cookieSession,
@@ -40,9 +41,10 @@ export const authTotpVerifyPost = new Hono().post('/auth/totp/verify', describeR
     },
 }), validator('json', z.object({
     code: f.totpCode,
-})), verifyPending2FAUser(), async (c) => {
+})), verifyPending2FAUser(), securityMutationDocumentation, async (c) => withBrowserSecurity(c, async () => {
     const config = c.var.services.config;
-    if (!config.auth.password.enabled || !config.auth.password.totp.enabled) {
+    if (!config.auth.password.enabled ||
+        !config.auth.password.totp.enabled) {
         throw new e.ValidationError.Error('TOTP authentication is disabled');
     }
     const body = c.req.valid('json');
@@ -50,10 +52,10 @@ export const authTotpVerifyPost = new Hono().post('/auth/totp/verify', describeR
     const { user: pending2FAUser, authenticatedAt } = c.var.verifiedPending2FAUser;
     const { mikro, userService, totpService } = c.var.services;
     await totpService.verifyForAuth(pending2FAUser.sub, body.code);
-    session.setUserSession(pending2FAUser.sub, authenticatedAt);
+    session.setUserSession(pending2FAUser.sub, pending2FAUser.token_epoch, authenticatedAt);
     // Load full user data with relations for response
     const fullUser = await mikro.user.verifyBySub(pending2FAUser.sub);
     const userSession = await userService.userEntityToSessionUser(fullUser);
     return c.json({ user: userSession }, 200);
-});
+}, { stage: 'mfa' }));
 //# sourceMappingURL=post.js.map

package/dist/routes/api/auth/totp/verify/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/totp/verify/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACvD,mBAAmB,EACnB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,uBAAuB;IAChC,WAAW,EACT,0FAA0F;IAC5F,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,uCAAuC;SACrD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;iBACtD;aACF;YACD,WAAW,EAAE,+BAA+B;SAC7C;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,oBAAoB,EAAE,EACtB,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,GAC7C,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE3D,MAAM,WAAW,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/D,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAE5D,kDAAkD;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAExE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/totp/verify/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACvD,mBAAmB,EACnB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,uBAAuB;IAChC,WAAW,EACT,0FAA0F;IAC5F,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,uCAAuC;SACrD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC;iBACtD;aACF;YACD,WAAW,EAAE,+BAA+B;SAC7C;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,oBAAoB,EAAE,EACtB,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE,CACV,mBAAmB,CACjB,CAAC,EACD,KAAK,IAAI,EAAE;IACT,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC7B,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAClC,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,GAC7C,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE3D,MAAM,WAAW,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/D,OAAO,CAAC,cAAc,CACpB,cAAc,CAAC,GAAG,EAClB,cAAc,CAAC,WAAW,EAC1B,eAAe,CAChB,CAAC;IAEF,kDAAkD;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAExE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CACJ,CAAC"}

package/dist/routes/api/consent/get.d.ts

@@ -28,6 +28,9 @@ export declare const consentGet: import("hono/hono-base").HonoBase<AppEnv, {
             input: {
                 query: {
                     client_id: string | string[];
+                    redirect_uri: string | string[];
+                    response_type: string | string[];
+                    prompt?: string | undefined;
                     scope?: string | undefined;
                 };
             };

package/dist/routes/api/consent/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/api/consent/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAStD;;;;;GAKG;AACH,eAAO,MAAM,UAAU;;;;;oBA0Db,EAAE;oBACF,QAAQ;oBACR,IAAI;;;;;;;oBAIJ,GAAG;oBACH,KAAK;;;;;;;;;;;;;mBAMd,CAAC"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/api/consent/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAStD;;;;;GAKG;AACH,eAAO,MAAM,UAAU;;;;;oBAkFb,EAAE;oBACF,QAAQ;oBACR,IAAI;;;;;;;oBAIJ,GAAG;oBACH,KAAK;;;;;;;;;;;;;;;;mBAMd,CAAC"}

package/dist/routes/api/consent/get.js

@@ -31,10 +31,16 @@ export const consentGet = new Hono().get('/consent', describeRoute({
         400: {
             content: {
                 'application/json': {
-                    schema: resolver(e.OAuthClientNotFound.Schema),
+                    schema: resolver(z.union([
+                        e.OAuthClientNotFound.Schema,
+                        e.OAuthClientDisabled.Schema,
+                        e.InvalidRedirectUri.Schema,
+                        e.UnsupportedResponseType.Schema,
+                        e.InvalidScope.Schema,
+                    ])),
                 },
             },
-            description: 'OAuth client not found',
+            description: 'Invalid authorization context',
         },
         401: {
             content: {
@@ -47,16 +53,32 @@ export const consentGet = new Hono().get('/consent', describeRoute({
     },
 }), validator('query', z.object({
     client_id: f.clientId,
+    redirect_uri: f.redirectUri,
+    response_type: f.responseType,
+    prompt: f.prompt.optional(),
     scope: f.scope.optional(),
 })), verifyAuth(), async (c) => {
     const query = c.req.valid('query');
     const { client_id, scope } = query;
     const { user: userEntity } = c.var.verifiedUser;
-    const { oauthClientService } = c.var.services;
+    const { oauthClientService, userConsentService } = c.var.services;
     // Fetch OAuth client information
     const client = await oauthClientService.findByClientId(client_id);
+    oauthClientService.validateEnabled(client);
+    oauthClientService.validateRedirectUri(client, query.redirect_uri);
+    oauthClientService.validateResponseType(client, query.response_type);
+    const requestedScopes = scope ? scope.split(' ') : [];
+    oauthClientService.validateScopes(client, requestedScopes);
+    const grantedScopes = await userConsentService.resolveScopes({
+        userSub: userEntity.sub,
+        clientId: client.id,
+        requestedScopes,
+        responseType: query.response_type,
+        prompt: query.prompt,
+        skipConsent: client.skipConsent,
+    });
     // Parse requested scopes with descriptions
-    const scopes = parseScopesWithDescriptions(scope);
+    const scopes = parseScopesWithDescriptions(grantedScopes.join(' '));
     return c.json({
         client: {
             id: client.id,

package/dist/routes/api/consent/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/api/consent/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAC9C,UAAU,EACV,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,yBAAyB;IAClC,WAAW,EACT,6EAA6E;IAC/E,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;iBAC/C;aACF;YACD,WAAW,EAAE,wBAAwB;SACtC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,SAAS,EAAE,CAAC,CAAC,QAAQ;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;CAC1B,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAChD,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE9C,iCAAiC;IACjC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAElE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAElD,OAAO,CAAC,CAAC,IAAI,CACX;QACE,MAAM,EAAE;YACN,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB;QACD,MAAM;QACN,IAAI,EAAE;YACJ,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB;KACF,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CACF,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/api/consent/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,2BAA2B,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAC9C,UAAU,EACV,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,yBAAyB;IAClC,WAAW,EACT,6EAA6E;IAC/E,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,mBAAmB,CAAC,MAAM;wBAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM;wBAC5B,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBAC3B,CAAC,CAAC,uBAAuB,CAAC,MAAM;wBAChC,CAAC,CAAC,YAAY,CAAC,MAAM;qBACtB,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,+BAA+B;SAC7C;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,SAAS,EAAE,CAAC,CAAC,QAAQ;IACrB,YAAY,EAAE,CAAC,CAAC,WAAW;IAC3B,aAAa,EAAE,CAAC,CAAC,YAAY;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;CAC1B,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAChD,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAElE,iCAAiC;IACjC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAClE,kBAAkB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,kBAAkB,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACnE,kBAAkB,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,kBAAkB,CAAC,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,UAAU,CAAC,GAAG;QACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,eAAe;QACf,YAAY,EAAE,KAAK,CAAC,aAAa;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,2CAA2C;IAC3C,MAAM,MAAM,GAAG,2BAA2B,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpE,OAAO,CAAC,CAAC,IAAI,CACX;QACE,MAAM,EAAE;YACN,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB;QACD,MAAM;QACN,IAAI,EAAE;YACJ,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB;KACF,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/routes/api/consent/index.d.ts

@@ -22,6 +22,9 @@ export declare const consentRoutes: import("hono/hono-base").HonoBase<AppEnv, im
             input: {
                 query: {
                     client_id: string | string[];
+                    redirect_uri: string | string[];
+                    response_type: string | string[];
+                    prompt?: string | undefined;
                     scope?: string | undefined;
                 };
             };

package/dist/routes/api/consent/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/routes/api/consent/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAEA,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/routes/api/consent/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAEA,CAAC"}

package/dist/routes/api/consent/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../src/routes/api/consent/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAmItD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAkQvB,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../src/routes/api/consent/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAwItD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAqSvB,CAAC"}