@tinyrack/tinyauth-server 0.0.7

package/dist/routes/api/auth/index.d.ts

@@ -0,0 +1,275 @@
+import type { AppEnv } from '../../../lib/app-env.ts';
+export declare const authRoutes: import("hono/hono-base").HonoBase<AppEnv, import("hono/types").BlankSchema | import("hono/types").MergeSchemaPath<{
+    "/auth/login": {
+        $post: {
+            input: {
+                json: {
+                    email: string;
+                    password: string;
+                };
+            };
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/logout": {
+        $post: {
+            input: {};
+            output: {
+                ok: true;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/register": {
+        $post: {
+            input: {
+                header: {
+                    'accept-language'?: string;
+                };
+            } & {
+                json: {
+                    email: string;
+                    password: string;
+                    consents?: {
+                        termsId: string;
+                        agreed: boolean;
+                        consentType?: "explicit" | "implicit" | undefined;
+                    }[] | undefined;
+                };
+            };
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/password/forgot": {
+        $post: {
+            input: {
+                header: {
+                    'accept-language'?: string;
+                };
+            } & {
+                json: {
+                    email: string;
+                };
+            };
+            output: {
+                ok: true;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/password/reset": {
+        $post: {
+            input: {
+                json: {
+                    token: string;
+                    password: string;
+                };
+            };
+            output: {
+                message: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/email/verify": {
+        $post: {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/email/resend": {
+        $post: {
+            input: {
+                header: {
+                    'accept-language'?: string;
+                };
+            } & {
+                json: {
+                    email: string;
+                };
+            };
+            output: {
+                message: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/totp/verify": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/totp/recovery/verify": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/passkey/options": {
+        $post: {
+            input: {};
+            output: {
+                options: {
+                    challenge: import("@simplewebauthn/server").Base64URLString;
+                    timeout?: number | undefined;
+                    rpId?: string | undefined;
+                    allowCredentials?: {
+                        id: import("@simplewebauthn/server").Base64URLString;
+                        type: import("@simplewebauthn/server").PublicKeyCredentialType;
+                        transports?: import("@simplewebauthn/server").AuthenticatorTransportFuture[] | undefined;
+                    }[] | undefined;
+                    userVerification?: import("@simplewebauthn/server").UserVerificationRequirement | undefined;
+                    hints?: import("@simplewebauthn/server").PublicKeyCredentialHint[] | undefined;
+                    extensions?: {
+                        appid?: string | undefined;
+                        credProps?: boolean | undefined;
+                        hmacCreateSecret?: boolean | undefined;
+                        minPinLength?: boolean | undefined;
+                    } | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/"> | import("hono/types").MergeSchemaPath<{
+    "/auth/passkey/verify": {
+        $post: {
+            input: {
+                json: {
+                    response: {
+                        id: string;
+                        rawId: string;
+                        response: {
+                            clientDataJSON: string;
+                            authenticatorData: string;
+                            signature: string;
+                            userHandle?: string | undefined;
+                        };
+                        clientExtensionResults: Record<string, unknown>;
+                        type: "public-key";
+                        authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+                    };
+                };
+            };
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/">, "/", "/">;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/api/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/routes/api/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAatD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAWa,CAAC"}

package/dist/routes/api/auth/index.js

@@ -0,0 +1,25 @@
+import { Hono } from 'hono';
+import { authEmailResendPost } from "./email/resend/post.js";
+import { authEmailVerifyPost } from "./email/verify/post.js";
+import { authLoginPost } from "./login/post.js";
+import { authLogoutPost } from "./logout/post.js";
+import { authPasskeyOptionsPost } from "./passkey/options/post.js";
+import { authPasskeyVerifyPost } from "./passkey/verify/post.js";
+import { authPasswordForgotPost } from "./password/forgot/post.js";
+import { authPasswordResetPost } from "./password/reset/post.js";
+import { authRegisterPost } from "./register/post.js";
+import { authTotpRecoveryVerifyPost } from "./totp/recovery/verify/post.js";
+import { authTotpVerifyPost } from "./totp/verify/post.js";
+export const authRoutes = new Hono()
+    .route('/', authLoginPost)
+    .route('/', authLogoutPost)
+    .route('/', authRegisterPost)
+    .route('/', authPasswordForgotPost)
+    .route('/', authPasswordResetPost)
+    .route('/', authEmailVerifyPost)
+    .route('/', authEmailResendPost)
+    .route('/', authTotpVerifyPost)
+    .route('/', authTotpRecoveryVerifyPost)
+    .route('/', authPasskeyOptionsPost)
+    .route('/', authPasskeyVerifyPost);
+//# sourceMappingURL=index.js.map

package/dist/routes/api/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/routes/api/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAU;KACzC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC;KACzB,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;KAC1B,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC;KAC5B,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;KAClC,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC;KACjC,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC;KAC/B,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC;KAC/B,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC;KAC9B,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC;KACtC,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;KAClC,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC"}

package/dist/routes/api/auth/login/post.d.ts

@@ -0,0 +1,30 @@
+import type { AppEnv } from '../../../../lib/app-env.ts';
+export declare const authLoginPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/auth/login": {
+        $post: {
+            input: {
+                json: {
+                    email: string;
+                    password: string;
+                };
+            };
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/auth/login">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/auth/login/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/auth/login/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAMzD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAsFzB,CAAC"}

package/dist/routes/api/auth/login/post.js

@@ -0,0 +1,76 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { TAGS } from "../../../../lib/swagger-tags.js";
+import { e } from "../../../../schemas/error.js";
+import { f } from "../../../../schemas/field.js";
+import { r } from "../../../../schemas/response.js";
+export const authLoginPost = new Hono().post('/auth/login', describeRoute({
+    tags: [TAGS.AUTH],
+    summary: 'Login',
+    description: 'Login',
+    responses: {
+        200: {
+            content: {
+                'application/json': { schema: resolver(r.AuthResponse) },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.ValidationError.Schema),
+                },
+            },
+            description: 'Validation error',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.InvalidEmailOrPassword.Schema),
+                },
+            },
+            description: 'Invalid email or password',
+        },
+        403: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.EmailVerificationRequired.Schema),
+                },
+            },
+            description: 'Email verification required',
+        },
+    },
+}), validator('json', z.object({
+    email: f.userEmail,
+    password: f.userPassword,
+})), async (c) => {
+    const config = c.var.services.config;
+    if (!config.auth.password.enabled) {
+        throw new e.ValidationError.Error('Password authentication is disabled');
+    }
+    const body = c.req.valid('json');
+    const { passwordAuthService, userService } = c.var.services;
+    const session = c.var.session;
+    const userEntity = await passwordAuthService.authenticateByEmailAndPassword({
+        email: body.email,
+        password: body.password,
+    });
+    const userSession = await userService.userEntityToSessionUser(userEntity);
+    if (userService.userEmailVerificationRequired(userSession) &&
+        !userSession.email_verified) {
+        return c.json({ user: userSession }, 200);
+    }
+    const userRegistered2FAMethods = await userService.userRegistered2FAMethods(userSession.sub);
+    if (userRegistered2FAMethods.length > 0) {
+        session.setPending2FASession(userSession.sub);
+    }
+    else if (userSession.second_factor_required) {
+        session.setPending2FASetupSession(userSession.sub);
+    }
+    else {
+        session.setUserSession(userSession.sub);
+    }
+    return c.json({ user: userSession }, 200);
+});
+//# sourceMappingURL=post.js.map

package/dist/routes/api/auth/login/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../src/routes/api/auth/login/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAClD,aAAa,EACb,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,OAAO;IACpB,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;aACzD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,kBAAkB;SAChC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC;iBAClD;aACF;YACD,WAAW,EAAE,2BAA2B;SACzC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC;iBACrD;aACF;YACD,WAAW,EAAE,6BAA6B;SAC3C;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,SAAS;IAClB,QAAQ,EAAE,CAAC,CAAC,YAAY;CACzB,CAAC,CACH,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAE9B,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,8BAA8B,CACzE;QACE,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CACF,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAE1E,IACE,WAAW,CAAC,6BAA6B,CAAC,WAAW,CAAC;QACtD,CAAC,WAAW,CAAC,cAAc,EAC3B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,wBAAwB,GAAG,MAAM,WAAW,CAAC,wBAAwB,CACzE,WAAW,CAAC,GAAG,CAChB,CAAC;IAEF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC9C,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/api/auth/logout/post.d.ts

@@ -0,0 +1,14 @@
+import type { AppEnv } from '../../../../lib/app-env.ts';
+export declare const authLogoutPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/auth/logout": {
+        $post: {
+            input: {};
+            output: {
+                ok: true;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/auth/logout">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/auth/logout/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/auth/logout/post.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAIzD,eAAO,MAAM,cAAc;;;;;;;;;;;uBAmB1B,CAAC"}

package/dist/routes/api/auth/logout/post.js

@@ -0,0 +1,21 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver } from 'hono-openapi';
+import { TAGS } from "../../../../lib/swagger-tags.js";
+import { r } from "../../../../schemas/response.js";
+export const authLogoutPost = new Hono().post('/auth/logout', describeRoute({
+    tags: [TAGS.AUTH],
+    summary: 'Logout',
+    description: 'Logout the current user and purge the session',
+    responses: {
+        200: {
+            content: {
+                'application/json': { schema: resolver(r.OkResponse) },
+            },
+            description: 'Success',
+        },
+    },
+}), async (c) => {
+    c.var.session.delete();
+    return c.json({ ok: true }, 200);
+});
+//# sourceMappingURL=post.js.map

package/dist/routes/api/auth/logout/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../src/routes/api/auth/logout/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACnD,cAAc,EACd,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,+CAA+C;IAC5D,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;KACF;CACF,CAAC,EACF,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/api/auth/passkey/options/post.d.ts

@@ -0,0 +1,31 @@
+import type { AppEnv } from '../../../../../lib/app-env.ts';
+export declare const authPasskeyOptionsPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/auth/passkey/options": {
+        $post: {
+            input: {};
+            output: {
+                options: {
+                    challenge: import("@simplewebauthn/server").Base64URLString;
+                    timeout?: number | undefined;
+                    rpId?: string | undefined;
+                    allowCredentials?: {
+                        id: import("@simplewebauthn/server").Base64URLString;
+                        type: import("@simplewebauthn/server").PublicKeyCredentialType;
+                        transports?: import("@simplewebauthn/server").AuthenticatorTransportFuture[] | undefined;
+                    }[] | undefined;
+                    userVerification?: import("@simplewebauthn/server").UserVerificationRequirement | undefined;
+                    hints?: import("@simplewebauthn/server").PublicKeyCredentialHint[] | undefined;
+                    extensions?: {
+                        appid?: string | undefined;
+                        credProps?: boolean | undefined;
+                        hmacCreateSecret?: boolean | undefined;
+                        minPinLength?: boolean | undefined;
+                    } | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/auth/passkey/options">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/auth/passkey/options/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/passkey/options/post.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAM5D,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAgDlC,CAAC"}

package/dist/routes/api/auth/passkey/options/post.js

@@ -0,0 +1,43 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver } from 'hono-openapi';
+import { TAGS } from "../../../../../lib/swagger-tags.js";
+import { verifyPending2FAUser } from "../../../../../middleware/auth.js";
+import { e } from "../../../../../schemas/error.js";
+import { r } from "../../../../../schemas/response.js";
+export const authPasskeyOptionsPost = new Hono().post('/auth/passkey/options', describeRoute({
+    tags: [TAGS.AUTH],
+    summary: 'Get Passkey Authentication Options',
+    description: 'Generate WebAuthn authentication options for passkey login. ' +
+        'Supports both passwordless login and 2FA. ' +
+        'If a pending 2FA session exists, returns options for that user only.',
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: resolver(r.PasskeyAuthenticationOptionsResponse),
+                },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.PasskeyNotEnabled.Schema),
+                },
+            },
+            description: 'Passkey not enabled',
+        },
+    },
+}), verifyPending2FAUser({ optional: true }), async (c) => {
+    const config = c.var.services.config;
+    if (!config.auth.passkey.enabled) {
+        throw new e.PasskeyNotEnabled.Error();
+    }
+    const session = c.var.session;
+    const { passkeyService } = c.var.services;
+    const pending2FA = c.var.verifiedPending2FAUser;
+    const options = await passkeyService.generateAuthenticationOptions(pending2FA?.user.sub);
+    session.set('passkey_challenge', options.challenge);
+    return c.json({ options }, 200);
+});
+//# sourceMappingURL=post.js.map

package/dist/routes/api/auth/passkey/options/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/passkey/options/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAC3D,uBAAuB,EACvB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,EAAE,oCAAoC;IAC7C,WAAW,EACT,8DAA8D;QAC9D,4CAA4C;QAC5C,sEAAsE;IACxE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,oCAAoC,CAAC;iBACzD;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EAAE,qBAAqB;SACnC;KACF;CACF,CAAC,EACF,oBAAoB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EACxC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE1C,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAEhD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,6BAA6B,CAChE,UAAU,EAAE,IAAI,CAAC,GAAG,CACrB,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC,CACF,CAAC"}

package/dist/routes/api/auth/passkey/verify/post.d.ts

@@ -0,0 +1,41 @@
+import type { AppEnv } from '../../../../../lib/app-env.ts';
+export declare const authPasskeyVerifyPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/auth/passkey/verify": {
+        $post: {
+            input: {
+                json: {
+                    response: {
+                        id: string;
+                        rawId: string;
+                        response: {
+                            clientDataJSON: string;
+                            authenticatorData: string;
+                            signature: string;
+                            userHandle?: string | undefined;
+                        };
+                        clientExtensionResults: Record<string, unknown>;
+                        type: "public-key";
+                        authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+                    };
+                };
+            };
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/auth/passkey/verify">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/auth/passkey/verify/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/auth/passkey/verify/post.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAU5D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA0FjC,CAAC"}