@tinyrack/issuary-server 0.31.0 → 0.32.2

package/dist/routes/api/user/totp/confirm/post.js

@@ -1,11 +1,12 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { OPENAPI_SECURITY } from '../../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../../lib/openapi.js';
 import { TAGS } from '../../../../../lib/swagger-tags.js';
 import { verifyAuth, verifyPending2FASetupUser, } from '../../../../../middleware/auth.js';
 import { e } from '../../../../../schemas/error.js';
 import { r } from '../../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../../services/browser-security.service.js';
 /**
  * POST /api/user/totp/confirm
  *
@@ -52,22 +53,36 @@ export const userTotpConfirmPost = new Hono().post('/user/totp/confirm', describ
             description: 'TOTP already enabled',
         },
     },
-}), validator('json', z.object({}).optional().nullable()), verifyAuth({ optional: true }), verifyPending2FASetupUser({ optional: true }), async (c) => {
-    const session = c.var.session;
-    const { mikro, totpService, userService } = c.var.services;
-    // Allow both full user session and pending 2FA setup session
-    const userSub = c.var.verifiedPending2FASetupUser?.user.sub ??
-        c.var.verifiedUser?.user.sub;
-    if (!userSub) {
-        throw new e.Unauthorized.Error();
-    }
-    await totpService.confirmSetup(userSub);
-    // Convert pending 2FA setup session to full user session
-    if (c.var.verifiedPending2FASetupUser) {
-        session.setUserSession(userSub);
-    }
-    const userEntity = await mikro.user.verifyBySub(userSub);
-    const user = await userService.userEntityToSessionUser(userEntity);
-    return c.json({ user }, 200);
+}), validator('json', z.object({}).optional().nullable()), verifyAuth({ optional: true }), verifyPending2FASetupUser({ optional: true }), securityMutationDocumentation, async (c) => {
+    return withBrowserSecurity(c, async () => {
+        const session = c.var.session;
+        const { mikro, totpService, userService } = c.var.services;
+        // Allow both full user session and pending 2FA setup session
+        const userSub = c.var.verifiedPending2FASetupUser?.user.sub ??
+            c.var.verifiedUser?.user.sub;
+        if (!userSub) {
+            throw new e.Unauthorized.Error();
+        }
+        const totp = await mikro.userTotp.findVerifiedByUserSub(userSub);
+        if (!totp)
+            throw new e.TotpNotSetup.Error();
+        if (totp.recovery_confirmed)
+            throw new e.TotpAlreadyEnabled.Error();
+        const proof = session.get('totpSetupVerification');
+        if (!proof ||
+            proof.sub !== userSub ||
+            proof.totpId !== totp.id ||
+            proof.step !== totp.last_used_step)
+            throw new e.Unauthorized.Error();
+        await totpService.confirmSetup(userSub);
+        session.set('totpSetupVerification', undefined);
+        // Convert pending 2FA setup session to full user session
+        if (c.var.verifiedPending2FASetupUser) {
+            session.setUserSession(userSub, session.get('security')?.grants[userSub] ?? '');
+        }
+        const userEntity = await mikro.user.verifyBySub(userSub);
+        const user = await userService.userEntityToSessionUser(userEntity);
+        return c.json({ user }, 200);
+    }, { stage: 'setup' });
 });
 //# sourceMappingURL=post.js.map

package/dist/routes/api/user/totp/confirm/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/confirm/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACxD,oBAAoB,EACpB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,oBAAoB;IAC7B,WAAW,EACT,sEAAsE;QACtE,yDAAyD;QACzD,yDAAyD;IAC3D,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,gBAAgB;SAC9B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,EACrD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC7C,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE3D,6DAA6D;IAC7D,MAAM,OAAO,GACX,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG;QAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC;IAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAExC,yDAAyD;IACzD,IAAI,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;QACtC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAEnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/confirm/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACxD,oBAAoB,EACpB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,oBAAoB;IAC7B,WAAW,EACT,sEAAsE;QACtE,yDAAyD;QACzD,yDAAyD;IAC3D,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,gBAAgB;SAC9B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,EACrD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC7C,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,OAAO,mBAAmB,CACxB,CAAC,EACD,KAAK,IAAI,EAAE;QACT,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAC9B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAE3D,6DAA6D;QAC7D,MAAM,OAAO,GACX,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG;YAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC;QAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,kBAAkB;YAAE,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACnD,IACE,CAAC,KAAK;YACN,KAAK,CAAC,GAAG,KAAK,OAAO;YACrB,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE;YACxB,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,cAAc;YAElC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;QAEhD,yDAAyD;QACzD,IAAI,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;YACtC,OAAO,CAAC,cAAc,CACpB,OAAO,EACP,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAEnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC,EACD,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/routes/api/user/totp/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/totp/delete.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAQzD;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;qBA2E1B,CAAC"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/totp/delete.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAYzD;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;qBAmE1B,CAAC"}

package/dist/routes/api/user/totp/delete.js

@@ -1,12 +1,13 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { OPENAPI_SECURITY } from '../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../lib/openapi.js';
 import { TAGS } from '../../../../lib/swagger-tags.js';
 import { verifyAuth } from '../../../../middleware/auth.js';
 import { e } from '../../../../schemas/error.js';
 import { f } from '../../../../schemas/field.js';
 import { r } from '../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../services/browser-security.service.js';
 /**
  * DELETE /api/user/totp
  *
@@ -52,23 +53,17 @@ export const userTotpDelete = new Hono().delete('/user/totp', describeRoute({
     },
 }), validator('json', z.object({
     code: f.totpCode,
-})), verifyAuth(), async (c) => {
-    const body = c.req.valid('json');
-    const { user: userEntity } = c.var.verifiedUser;
-    const { config, mikro, totpService } = c.var.services;
-    // Config users cannot manage 2FA
-    if (userEntity.managed_by === 'config') {
-        throw new e.SecondFactorNotAllowedForConfigUser.Error();
-    }
-    // Check if 2FA is required
-    const secondFactorRequired = config.auth.password.two_factor.enrollment_required;
-    // Check if user has other 2FA method (passkey)
-    const passkeyCount = await mikro.userPasskey.countByUserSub(userEntity.sub);
-    const hasOtherSecondFactor = passkeyCount > 0;
-    await totpService.disable(userEntity.sub, body.code, {
-        secondFactorRequired,
-        hasOtherSecondFactor,
+})), verifyAuth(), securityMutationDocumentation, async (c) => {
+    return withBrowserSecurity(c, async () => {
+        const body = c.req.valid('json');
+        const { user: userEntity } = c.var.verifiedUser;
+        const { totpService } = c.var.services;
+        // Config users cannot manage 2FA
+        if (userEntity.managed_by === 'config') {
+            throw new e.SecondFactorNotAllowedForConfigUser.Error();
+        }
+        await totpService.disable(userEntity.sub, body.code);
+        return c.json({ ok: true }, 200);
     });
-    return c.json({ ok: true }, 200);
 });
 //# sourceMappingURL=delete.js.map

package/dist/routes/api/user/totp/delete.js.map

@@ -1 +1 @@
-{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../../../src/routes/api/user/totp/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,IAAI,EAAU,CAAC,MAAM,CACrD,YAAY,EACZ,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,cAAc;IACvB,WAAW,EACT,+DAA+D;QAC/D,wDAAwD;IAC1D,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;iBAC1C;aACF;YACD,WAAW,EACT,qEAAqE;SACxE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mCAAmC,CAAC,MAAM,CAAC;iBAC/D;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEtD,iCAAiC;IACjC,IAAI,UAAU,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,CAAC,CAAC,mCAAmC,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,2BAA2B;IAC3B,MAAM,oBAAoB,GACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAEtD,+CAA+C;IAC/C,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,oBAAoB,GAAG,YAAY,GAAG,CAAC,CAAC;IAE9C,MAAM,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;QACnD,oBAAoB;QACpB,oBAAoB;KACrB,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../../../src/routes/api/user/totp/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAEvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,IAAI,EAAU,CAAC,MAAM,CACrD,YAAY,EACZ,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,cAAc;IACvB,WAAW,EACT,+DAA+D;QAC/D,wDAAwD;IAC1D,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;iBAC1C;aACF;YACD,WAAW,EACT,qEAAqE;SACxE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mCAAmC,CAAC,MAAM,CAAC;iBAC/D;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,UAAU,EAAE,EACZ,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,OAAO,mBAAmB,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAChD,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAEvC,iCAAiC;QACjC,IAAI,UAAU,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,CAAC,mCAAmC,CAAC,KAAK,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAErD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/dist/routes/api/user/totp/recovery/regenerate/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/totp/recovery/regenerate/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAQ/D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;yCA6D1C,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/totp/recovery/regenerate/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAY/D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;yCAgE1C,CAAC"}

package/dist/routes/api/user/totp/recovery/regenerate/post.js

@@ -1,12 +1,13 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { OPENAPI_SECURITY } from '../../../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../../../lib/openapi.js';
 import { TAGS } from '../../../../../../lib/swagger-tags.js';
 import { verifyAuth } from '../../../../../../middleware/auth.js';
 import { e } from '../../../../../../schemas/error.js';
 import { f } from '../../../../../../schemas/field.js';
 import { r } from '../../../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../../../services/browser-security.service.js';
 export const userTotpRecoveryRegeneratePost = new Hono().post('/user/totp/recovery/regenerate', describeRoute({
     tags: [TAGS.USER],
     security: OPENAPI_SECURITY.cookieSession,
@@ -41,14 +42,16 @@ export const userTotpRecoveryRegeneratePost = new Hono().post('/user/totp/recove
     },
 }), validator('json', z.object({
     code: f.totpCode,
-})), verifyAuth(), async (c) => {
-    const { config, totpService } = c.var.services;
-    const { user } = c.var.verifiedUser;
-    const body = c.req.valid('json');
-    if (!config.auth.password.enabled || !config.auth.password.totp.enabled) {
-        throw new e.ValidationError.Error('TOTP authentication is disabled');
-    }
-    const recoveryCodes = await totpService.regenerateRecoveryCodes(user.sub, body.code);
-    return c.json({ recovery_codes: recoveryCodes }, 200);
+})), verifyAuth(), securityMutationDocumentation, async (c) => {
+    return withBrowserSecurity(c, async () => {
+        const { config, totpService } = c.var.services;
+        const { user } = c.var.verifiedUser;
+        const body = c.req.valid('json');
+        if (!config.auth.password.enabled || !config.auth.password.totp.enabled) {
+            throw new e.ValidationError.Error('TOTP authentication is disabled');
+        }
+        const recoveryCodes = await totpService.regenerateRecoveryCodes(user.sub, body.code);
+        return c.json({ recovery_codes: recoveryCodes }, 200);
+    });
 });
 //# sourceMappingURL=post.js.map

package/dist/routes/api/user/totp/recovery/regenerate/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/totp/recovery/regenerate/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,uCAAuC,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,uCAAuC,CAAC;AAE1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACnE,gCAAgC,EAChC,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,gCAAgC;IACzC,WAAW,EACT,kEAAkE;QAClE,0BAA0B;IAC5B,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC;iBAC1C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAC7D;iBACF;aACF;YACD,WAAW,EAAE,uCAAuC;SACrD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAC7D,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,IAAI,CACV,CAAC;IAEF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/totp/recovery/regenerate/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,uCAAuC,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,uCAAuC,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAE7F,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACnE,gCAAgC,EAChC,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,gCAAgC;IACzC,WAAW,EACT,kEAAkE;QAClE,0BAA0B;IAC5B,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC;iBAC1C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAC7D;iBACF;aACF;YACD,WAAW,EAAE,uCAAuC;SACrD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,UAAU,EAAE,EACZ,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,OAAO,mBAAmB,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAC7D,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,IAAI,CACV,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/dist/routes/api/user/totp/setup/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/setup/post.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAU5D;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;2BAoF7B,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/setup/post.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAc5D;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;2BA6F7B,CAAC"}

package/dist/routes/api/user/totp/setup/post.js

@@ -1,10 +1,11 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver } from 'hono-openapi';
-import { OPENAPI_SECURITY } from '../../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../../lib/openapi.js';
 import { TAGS } from '../../../../../lib/swagger-tags.js';
 import { verifyAuth, verifyPending2FASetupUser, } from '../../../../../middleware/auth.js';
 import { e } from '../../../../../schemas/error.js';
 import { r } from '../../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../../services/browser-security.service.js';
 /**
  * POST /api/user/totp/setup
  *
@@ -59,7 +60,7 @@ export const userTotpSetupPost = new Hono().post('/user/totp/setup', describeRou
             description: 'TOTP already enabled',
         },
     },
-}), verifyAuth({ optional: true }), verifyPending2FASetupUser({ optional: true }), async (c) => {
+}), verifyAuth({ optional: true }), verifyPending2FASetupUser({ optional: true }), securityMutationDocumentation, async (c) => {
     const { config, totpService } = c.var.services;
     if (!config.auth.password.totp?.enabled) {
         throw new e.ValidationError.Error('TOTP is disabled');
@@ -72,11 +73,15 @@ export const userTotpSetupPost = new Hono().post('/user/totp/setup', describeRou
     if (user.managed_by === 'config') {
         throw new e.SecondFactorNotAllowedForConfigUser.Error();
     }
-    const setupData = await totpService.startSetup(user);
-    return c.json({
-        secret: setupData.secret,
-        otpauth_url: setupData.otpauthUrl,
-        qr_code: setupData.qrCodeDataUrl,
-    }, 200);
+    const prepared = await totpService.prepareSetup(user);
+    return withBrowserSecurity(c, async () => {
+        const setupData = await totpService.startSetup(user, prepared);
+        c.var.session.set('totpSetupVerification', undefined);
+        return c.json({
+            secret: setupData.secret,
+            otpauth_url: setupData.otpauthUrl,
+            qr_code: setupData.qrCodeDataUrl,
+        }, 200);
+    }, { stage: 'setup' });
 });
 //# sourceMappingURL=post.js.map

package/dist/routes/api/user/totp/setup/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/setup/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACtD,kBAAkB,EAClB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EACT,sEAAsE;QACtE,sEAAsE;IACxE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;iBACtC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,sDAAsD;SACpE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mCAAmC,CAAC,MAAM,CAAC;iBAC/D;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC7C,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,IAAI,GACR,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC;IAEtE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,gCAAgC;IAChC,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,mCAAmC,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAErD,OAAO,CAAC,CAAC,IAAI,CACX;QACE,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,WAAW,EAAE,SAAS,CAAC,UAAU;QACjC,OAAO,EAAE,SAAS,CAAC,aAAa;KACjC,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/setup/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACtD,kBAAkB,EAClB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,kBAAkB;IAC3B,WAAW,EACT,sEAAsE;QACtE,sEAAsE;IACxE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;iBACtC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,sDAAsD;SACpE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mCAAmC,CAAC,MAAM,CAAC;iBAC/D;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC7C,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,IAAI,GACR,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC;IAEtE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,gCAAgC;IAChC,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,mCAAmC,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,mBAAmB,CACxB,CAAC,EACD,KAAK,IAAI,EAAE;QACT,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;QAEtD,OAAO,CAAC,CAAC,IAAI,CACX;YACE,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,WAAW,EAAE,SAAS,CAAC,UAAU;YACjC,OAAO,EAAE,SAAS,CAAC,aAAa;SACjC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,EACD,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/routes/api/user/totp/verify/post.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/verify/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAW5D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;4BAuE9B,CAAC"}
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/verify/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAe5D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;4BAsF9B,CAAC"}

package/dist/routes/api/user/totp/verify/post.js

@@ -1,12 +1,13 @@
 import { Hono } from 'hono';
 import { describeRoute, resolver, validator } from 'hono-openapi';
 import { z } from 'zod';
-import { OPENAPI_SECURITY } from '../../../../../lib/openapi.js';
+import { OPENAPI_SECURITY, securityMutationDocumentation, } from '../../../../../lib/openapi.js';
 import { TAGS } from '../../../../../lib/swagger-tags.js';
 import { verifyAuth, verifyPending2FASetupUser, } from '../../../../../middleware/auth.js';
 import { e } from '../../../../../schemas/error.js';
 import { f } from '../../../../../schemas/field.js';
 import { r } from '../../../../../schemas/response.js';
+import { withBrowserSecurity } from '../../../../../services/browser-security.service.js';
 /**
  * POST /api/user/totp/verify
  *
@@ -56,16 +57,26 @@ export const userTotpVerifyPost = new Hono().post('/user/totp/verify', describeR
     },
 }), validator('json', z.object({
     code: f.totpCode,
-})), verifyAuth({ optional: true }), verifyPending2FASetupUser({ optional: true }), async (c) => {
-    const body = c.req.valid('json');
-    const { totpService } = c.var.services;
-    // Allow both full user session and pending 2FA setup session
-    const userSub = c.var.verifiedPending2FASetupUser?.user.sub ??
-        c.var.verifiedUser?.user.sub;
-    if (!userSub) {
-        throw new e.Unauthorized.Error();
-    }
-    const recoveryCodes = await totpService.verifySetup(userSub, body.code);
-    return c.json({ recovery_codes: recoveryCodes }, 200);
+})), verifyAuth({ optional: true }), verifyPending2FASetupUser({ optional: true }), securityMutationDocumentation, async (c) => {
+    return withBrowserSecurity(c, async () => {
+        const body = c.req.valid('json');
+        const { totpService, mikro } = c.var.services;
+        // Allow both full user session and pending 2FA setup session
+        const userSub = c.var.verifiedPending2FASetupUser?.user.sub ??
+            c.var.verifiedUser?.user.sub;
+        if (!userSub) {
+            throw new e.Unauthorized.Error();
+        }
+        const recoveryCodes = await totpService.verifySetup(userSub, body.code);
+        const totp = await mikro.userTotp.findByUserSub(userSub);
+        if (!totp || typeof totp.last_used_step !== 'number')
+            throw new e.TotpNotSetup.Error();
+        c.var.session.set('totpSetupVerification', {
+            sub: userSub,
+            totpId: totp.id,
+            step: totp.last_used_step,
+        });
+        return c.json({ recovery_codes: recoveryCodes }, 200);
+    }, { stage: 'setup' });
 });
 //# sourceMappingURL=post.js.map

package/dist/routes/api/user/totp/verify/post.js.map

@@ -1 +1 @@
-{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/verify/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACvD,mBAAmB,EACnB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,mBAAmB;IAC5B,WAAW,EACT,+CAA+C;QAC/C,qDAAqD;QACrD,+DAA+D;QAC/D,gEAAgE;IAClE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC;iBAC1C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,qCAAqC;SACnD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC7C,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEvC,6DAA6D;IAC7D,MAAM,OAAO,GACX,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG;QAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC;IAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAExE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC,CACF,CAAC"}
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/verify/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACvD,mBAAmB,EACnB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,mBAAmB;IAC5B,WAAW,EACT,+CAA+C;QAC/C,qDAAqD;QACrD,+DAA+D;QAC/D,gEAAgE;IAClE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC;iBAC1C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,qCAAqC;SACnD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC7C,6BAA6B,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,OAAO,mBAAmB,CACxB,CAAC,EACD,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAE9C,6DAA6D;QAC7D,MAAM,OAAO,GACX,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG;YAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC;QAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAExE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YAClD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE;YACzC,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,IAAI,CAAC,cAAc;SAC1B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC,EACD,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;AACJ,CAAC,CACF,CAAC"}