@tinyrack/tinyauth-server 0.0.7

package/dist/routes/api/user/passkeys/_id/patch.js

@@ -0,0 +1,64 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { OPENAPI_SECURITY } from "../../../../../lib/openapi.js";
+import { TAGS } from "../../../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../../../middleware/auth.js";
+import { e } from "../../../../../schemas/error.js";
+import { f } from "../../../../../schemas/field.js";
+import { r } from "../../../../../schemas/response.js";
+export const userPasskeyIdPatch = new Hono().patch('/user/passkeys/:id', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Rename Passkey',
+    description: 'Rename a passkey',
+    responses: {
+        200: {
+            content: {
+                'application/json': { schema: resolver(r.OkResponse) },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.PasskeyNotEnabled.Schema),
+                },
+            },
+            description: 'Passkey not enabled',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.Unauthorized.Schema),
+                },
+            },
+            description: 'Unauthorized',
+        },
+        404: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.PasskeyNotFound.Schema),
+                },
+            },
+            description: 'Passkey not found',
+        },
+    },
+}), validator('param', z.object({
+    id: f.uuid,
+})), validator('json', z.object({
+    name: f.passkeyName,
+})), verifyAuth(), async (c) => {
+    const config = c.var.services.config;
+    if (!config.auth.passkey.enabled) {
+        throw new e.PasskeyNotEnabled.Error();
+    }
+    const params = c.req.valid('param');
+    const body = c.req.valid('json');
+    const { user: userEntity } = c.var.verifiedUser;
+    const { passkeyService } = c.var.services;
+    // Rename passkey
+    await passkeyService.renamePasskey(userEntity.sub, params.id, body.name);
+    return c.json({ ok: true }, 200);
+});
+//# sourceMappingURL=patch.js.map

package/dist/routes/api/user/passkeys/_id/patch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch.js","sourceRoot":"","sources":["../../../../../../src/routes/api/user/passkeys/_id/patch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,IAAI,EAAU,CAAC,KAAK,CACxD,oBAAoB,EACpB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,gBAAgB;IACzB,WAAW,EAAE,kBAAkB;IAC/B,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EAAE,qBAAqB;SACnC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,mBAAmB;SACjC;KACF;CACF,CAAC,EACF,SAAS,CACP,OAAO,EACP,CAAC,CAAC,MAAM,CAAC;IACP,EAAE,EAAE,CAAC,CAAC,IAAI;CACX,CAAC,CACH,EACD,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,WAAW;CACpB,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAChD,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE1C,iBAAiB;IACjB,MAAM,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/api/user/passkeys/get.d.ts

@@ -0,0 +1,21 @@
+import type { AppEnv } from '../../../../lib/app-env.ts';
+export declare const userPasskeysGet: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/passkeys": {
+        $get: {
+            input: {};
+            output: {
+                passkeys: {
+                    id: string;
+                    credential_id: string;
+                    name: string | null;
+                    device_type: "singleDevice" | "multiDevice";
+                    backed_up: boolean;
+                    created_at: string;
+                }[];
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/passkeys">;
+//# sourceMappingURL=get.d.ts.map

package/dist/routes/api/user/passkeys/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/passkeys/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAOzD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;yBAmD3B,CAAC"}

package/dist/routes/api/user/passkeys/get.js

@@ -0,0 +1,52 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver } from 'hono-openapi';
+import { z } from 'zod';
+import { OPENAPI_SECURITY } from "../../../../lib/openapi.js";
+import { TAGS } from "../../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../../middleware/auth.js";
+import { e } from "../../../../schemas/error.js";
+import { r } from "../../../../schemas/response.js";
+export const userPasskeysGet = new Hono().get('/user/passkeys', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Get Passkeys',
+    description: 'Get all passkeys for the current user',
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: resolver(z.object({
+                        passkeys: z.array(r.PasskeyInfo),
+                    })),
+                },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.PasskeyNotEnabled.Schema),
+                },
+            },
+            description: 'Passkey authentication is disabled',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.Unauthorized.Schema),
+                },
+            },
+            description: 'Unauthorized',
+        },
+    },
+}), verifyAuth(), async (c) => {
+    const config = c.var.services.config;
+    if (!config.auth.passkey.enabled) {
+        throw new e.PasskeyNotEnabled.Error();
+    }
+    const { user: userEntity } = c.var.verifiedUser;
+    const { passkeyService } = c.var.services;
+    const passkeys = await passkeyService.getUserPasskeys(userEntity.sub);
+    return c.json({ passkeys }, 200);
+});
+//# sourceMappingURL=get.js.map

package/dist/routes/api/user/passkeys/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../src/routes/api/user/passkeys/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CACnD,gBAAgB,EAChB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,cAAc;IACvB,WAAW,EAAE,uCAAuC;IACpD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,MAAM,CAAC;wBACP,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;qBACjC,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EAAE,oCAAoC;SAClD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;KACF;CACF,CAAC,EACF,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAChD,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAEtE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC,CACF,CAAC"}

package/dist/routes/api/user/passkeys/register/options/post.d.ts

@@ -0,0 +1,55 @@
+import type { AppEnv } from '../../../../../../lib/app-env.ts';
+/**
+ * POST /api/user/passkeys/register/options
+ *
+ * Generate WebAuthn registration options for registering a new passkey.
+ */
+export declare const userPasskeyRegisterOptionsPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/passkeys/register/options": {
+        $post: {
+            input: {};
+            output: {
+                options: {
+                    rp: {
+                        id?: string | undefined;
+                        name: string;
+                    };
+                    user: {
+                        id: string;
+                        name: string;
+                        displayName: string;
+                    };
+                    challenge: import("@simplewebauthn/server").Base64URLString;
+                    pubKeyCredParams: {
+                        alg: import("@simplewebauthn/server").COSEAlgorithmIdentifier;
+                        type: import("@simplewebauthn/server").PublicKeyCredentialType;
+                    }[];
+                    timeout?: number | undefined;
+                    excludeCredentials?: {
+                        id: import("@simplewebauthn/server").Base64URLString;
+                        type: import("@simplewebauthn/server").PublicKeyCredentialType;
+                        transports?: import("@simplewebauthn/server").AuthenticatorTransportFuture[] | undefined;
+                    }[] | undefined;
+                    authenticatorSelection?: {
+                        authenticatorAttachment?: import("@simplewebauthn/server").AuthenticatorAttachment | undefined;
+                        requireResidentKey?: boolean | undefined;
+                        residentKey?: import("@simplewebauthn/server").ResidentKeyRequirement | undefined;
+                        userVerification?: import("@simplewebauthn/server").UserVerificationRequirement | undefined;
+                    } | undefined;
+                    hints?: import("@simplewebauthn/server").PublicKeyCredentialHint[] | undefined;
+                    attestation?: import("@simplewebauthn/server").AttestationConveyancePreference | undefined;
+                    attestationFormats?: import("@simplewebauthn/server").AttestationFormat[] | undefined;
+                    extensions?: {
+                        appid?: string | undefined;
+                        credProps?: boolean | undefined;
+                        hmacCreateSecret?: boolean | undefined;
+                        minPinLength?: boolean | undefined;
+                    } | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/passkeys/register/options">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/user/passkeys/register/options/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/passkeys/register/options/post.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAU/D;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0CA2E1C,CAAC"}

package/dist/routes/api/user/passkeys/register/options/post.js

@@ -0,0 +1,74 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver } from 'hono-openapi';
+import { OPENAPI_SECURITY } from "../../../../../../lib/openapi.js";
+import { TAGS } from "../../../../../../lib/swagger-tags.js";
+import { verifyAuth, verifyPending2FASetupUser, } from "../../../../../../middleware/auth.js";
+import { e } from "../../../../../../schemas/error.js";
+import { r } from "../../../../../../schemas/response.js";
+/**
+ * POST /api/user/passkeys/register/options
+ *
+ * Generate WebAuthn registration options for registering a new passkey.
+ */
+export const userPasskeyRegisterOptionsPost = new Hono().post('/user/passkeys/register/options', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Get Passkey Registration Options',
+    description: 'Generate WebAuthn registration options for registering a new passkey. ' +
+        'Accepts both full user session and pending 2FA setup session.',
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: resolver(r.PasskeyRegistrationOptionsResponse),
+                },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.PasskeyNotEnabled.Schema),
+                },
+            },
+            description: 'Passkey not enabled',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.Unauthorized.Schema),
+                },
+            },
+            description: 'Unauthorized',
+        },
+        403: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.SecondFactorNotAllowedForConfigUser.Schema),
+                },
+            },
+            description: 'Second factor not allowed for config user',
+        },
+    },
+}), verifyAuth({ optional: true }), verifyPending2FASetupUser({ optional: true }), async (c) => {
+    const config = c.var.services.config;
+    if (!config.auth.passkey.enabled) {
+        throw new e.PasskeyNotEnabled.Error();
+    }
+    const session = c.var.session;
+    const { passkeyService } = c.var.services;
+    const user = c.var.verifiedUser?.user ?? c.var.verifiedPending2FASetupUser?.user;
+    if (!user) {
+        throw new e.Unauthorized.Error();
+    }
+    // Config users cannot setup 2FA
+    if (user.managed_by === 'config') {
+        throw new e.SecondFactorNotAllowedForConfigUser.Error();
+    }
+    // Generate registration options
+    const options = await passkeyService.generateRegistrationOptions(user);
+    // Store challenge in session
+    session.set('passkey_challenge', options.challenge);
+    return c.json({ options }, 200);
+});
+//# sourceMappingURL=post.js.map

package/dist/routes/api/user/passkeys/register/options/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/passkeys/register/options/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,uCAAuC,CAAC;AAC7D,OAAO,EACL,UAAU,EACV,yBAAyB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,uCAAuC,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACnE,iCAAiC,EACjC,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,kCAAkC;IAC3C,WAAW,EACT,wEAAwE;QACxE,+DAA+D;IACjE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kCAAkC,CAAC;iBACvD;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EAAE,qBAAqB;SACnC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mCAAmC,CAAC,MAAM,CAAC;iBAC/D;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;KACF;CACF,CAAC,EACF,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC7C,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE1C,MAAM,IAAI,GACR,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC;IAEtE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,gCAAgC;IAChC,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,mCAAmC,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAEvE,6BAA6B;IAC7B,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC,CACF,CAAC"}

package/dist/routes/api/user/passkeys/register/verify/post.d.ts

@@ -0,0 +1,50 @@
+import type { AppEnv } from '../../../../../../lib/app-env.ts';
+/**
+ * POST /api/user/passkeys/register/verify
+ *
+ * Verify and complete passkey registration.
+ */
+export declare const userPasskeyRegisterVerifyPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/passkeys/register/verify": {
+        $post: {
+            input: {
+                json: {
+                    response: Record<string, any>;
+                    name?: string | undefined;
+                };
+            };
+            output: {
+                ok: true;
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+                second_factor_setup_completed: true;
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {
+                json: {
+                    response: Record<string, any>;
+                    name?: string | undefined;
+                };
+            };
+            output: {
+                ok: true;
+                second_factor_setup_completed: false;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/passkeys/register/verify">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/user/passkeys/register/verify/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/passkeys/register/verify/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAW/D;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCAoHzC,CAAC"}

package/dist/routes/api/user/passkeys/register/verify/post.js

@@ -0,0 +1,95 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { OPENAPI_SECURITY } from "../../../../../../lib/openapi.js";
+import { TAGS } from "../../../../../../lib/swagger-tags.js";
+import { verifyAuth, verifyPasskeyChallenge, verifyPending2FASetupUser, } from "../../../../../../middleware/auth.js";
+import { e } from "../../../../../../schemas/error.js";
+import { r } from "../../../../../../schemas/response.js";
+/**
+ * POST /api/user/passkeys/register/verify
+ *
+ * Verify and complete passkey registration.
+ */
+export const userPasskeyRegisterVerifyPost = new Hono().post('/user/passkeys/register/verify', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Verify Passkey Registration',
+    description: 'Verify and complete passkey registration. ' +
+        'Accepts both full user session and pending 2FA setup session.',
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: resolver(r.PasskeySetupVerifyResponse),
+                },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.PasskeyNotEnabled.Schema),
+                },
+            },
+            description: 'Passkey not enabled, challenge not found, or verification failed',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.Unauthorized.Schema),
+                },
+            },
+            description: 'Unauthorized',
+        },
+        409: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.PasskeyAlreadyExists.Schema),
+                },
+            },
+            description: 'Passkey already exists',
+        },
+    },
+}), validator('json', r.PasskeyRegistrationBody), verifyAuth({ optional: true }), verifyPending2FASetupUser({ optional: true }), verifyPasskeyChallenge(), async (c) => {
+    const config = c.var.services.config;
+    if (!config.auth.passkey.enabled) {
+        throw new e.PasskeyNotEnabled.Error();
+    }
+    const body = c.req.valid('json');
+    const session = c.var.session;
+    const { mikro, passkeyService, userService } = c.var.services;
+    // Allow both full user session and pending 2FA setup session
+    const verified = c.var.verifiedUser ?? c.var.verifiedPending2FASetupUser;
+    if (!verified) {
+        throw new e.Unauthorized.Error();
+    }
+    const user = verified.user;
+    const userSub = user.sub;
+    const challenge = c.var.verifiedPasskeyChallenge;
+    // Cast for @simplewebauthn compatibility - Zod's inferred type
+    // (Record<string, any>) is not structurally assignable to
+    // @simplewebauthn's RegistrationResponseJSON due to index signature
+    // differences. The refine() above validates the structure at runtime.
+    const registrationResponse = body.response;
+    // Verify registration
+    await passkeyService.verifyRegistration(user, registrationResponse, challenge, body.name);
+    // Check if this was from pending 2FA setup session
+    const wasPendingSetup = !!c.var.verifiedPending2FASetupUser;
+    if (wasPendingSetup) {
+        // Clear pending setup sessions and create full user session
+        session.setUserSession(userSub);
+        // Get user data for response
+        const userEntity = await mikro.user.verifyBySub(userSub);
+        const userSessionData = await userService.userEntityToSessionUser(userEntity);
+        return c.json({
+            ok: true,
+            user: userSessionData,
+            second_factor_setup_completed: true,
+        }, 200);
+    }
+    return c.json({
+        ok: true,
+        second_factor_setup_completed: false,
+    }, 200);
+});
+//# sourceMappingURL=post.js.map

package/dist/routes/api/user/passkeys/register/verify/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/passkeys/register/verify/post.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,uCAAuC,CAAC;AAC7D,OAAO,EACL,UAAU,EACV,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,uCAAuC,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CAClE,gCAAgC,EAChC,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,6BAA6B;IACtC,WAAW,EACT,4CAA4C;QAC5C,+DAA+D;IACjE,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC;iBAC/C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;iBAC7C;aACF;YACD,WAAW,EACT,kEAAkE;SACrE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC;iBAChD;aACF;YACD,WAAW,EAAE,wBAAwB;SACtC;KACF;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,uBAAuB,CAAC,EAC5C,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC7C,sBAAsB,EAAE,EACxB,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE9D,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAEzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;IAEzB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAEjD,+DAA+D;IAC/D,0DAA0D;IAC1D,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,oBAAoB,GACxB,IAAI,CAAC,QAA+C,CAAC;IAEvD,sBAAsB;IACtB,MAAM,cAAc,CAAC,kBAAkB,CACrC,IAAI,EACJ,oBAAoB,EACpB,SAAS,EACT,IAAI,CAAC,IAAI,CACV,CAAC;IAEF,mDAAmD;IACnD,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAE5D,IAAI,eAAe,EAAE,CAAC;QACpB,4DAA4D;QAC5D,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAEhC,6BAA6B;QAC7B,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,eAAe,GACnB,MAAM,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAExD,OAAO,CAAC,CAAC,IAAI,CACX;YACE,EAAE,EAAE,IAAa;YACjB,IAAI,EAAE,eAAe;YACrB,6BAA6B,EAAE,IAAI;SACpC,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CACX;QACE,EAAE,EAAE,IAAa;QACjB,6BAA6B,EAAE,KAAK;KACrC,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/routes/api/user/password/delete.d.ts

@@ -0,0 +1,23 @@
+import type { AppEnv } from '../../../../lib/app-env.ts';
+/**
+ * DELETE /api/user/password
+ *
+ * Remove password for users who have at least one OAuth account linked.
+ */
+export declare const userPasswordDelete: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/password": {
+        $delete: {
+            input: {
+                json: {
+                    current_password: string;
+                };
+            };
+            output: {
+                ok: true;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/password">;
+//# sourceMappingURL=delete.d.ts.map

package/dist/routes/api/user/password/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/password/delete.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAQzD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;yBAgF9B,CAAC"}

package/dist/routes/api/user/password/delete.js

@@ -0,0 +1,78 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { OPENAPI_SECURITY } from "../../../../lib/openapi.js";
+import { TAGS } from "../../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../../middleware/auth.js";
+import { e } from "../../../../schemas/error.js";
+import { f } from "../../../../schemas/field.js";
+import { r } from "../../../../schemas/response.js";
+/**
+ * DELETE /api/user/password
+ *
+ * Remove password for users who have at least one OAuth account linked.
+ */
+export const userPasswordDelete = new Hono().delete('/user/password', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Remove Password',
+    description: 'Remove password for users who have at least one OAuth account linked. ' +
+        'Requires current password verification and at least one OAuth account.',
+    responses: {
+        200: {
+            content: {
+                'application/json': { schema: resolver(r.OkResponse) },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(z.union([
+                        e.PasswordNotSet.Schema,
+                        e.CannotRemoveLastAuthMethod.Schema,
+                        e.CannotRemovePasswordWithSecondFactorOnly.Schema,
+                        e.ValidationError.Schema,
+                    ])),
+                },
+            },
+            description: 'Password not set, password auth disabled, cannot remove last auth method, or cannot remove password with second factor only',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(z.union([e.Unauthorized.Schema, e.InvalidCurrentPassword.Schema])),
+                },
+            },
+            description: 'Unauthorized or invalid current password',
+        },
+        403: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.UserNotEditable.Schema),
+                },
+            },
+            description: 'User not editable',
+        },
+        404: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.UserNotFound.Schema),
+                },
+            },
+            description: 'User not found',
+        },
+    },
+}), validator('json', z.object({
+    current_password: f.userPassword,
+})), verifyAuth(), async (c) => {
+    const body = c.req.valid('json');
+    const { config, passwordAuthService } = c.var.services;
+    const { user } = c.var.verifiedUser;
+    if (!config.auth.password.enabled) {
+        throw new e.ValidationError.Error('Password authentication is disabled');
+    }
+    await passwordAuthService.removePassword(user, body.current_password);
+    return c.json({ ok: true }, 200);
+});
+//# sourceMappingURL=delete.js.map

package/dist/routes/api/user/password/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../../../src/routes/api/user/password/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,IAAI,EAAU,CAAC,MAAM,CACzD,gBAAgB,EAChB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,iBAAiB;IAC1B,WAAW,EACT,wEAAwE;QACxE,wEAAwE;IAC1E,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC;wBACN,CAAC,CAAC,cAAc,CAAC,MAAM;wBACvB,CAAC,CAAC,0BAA0B,CAAC,MAAM;wBACnC,CAAC,CAAC,wCAAwC,CAAC,MAAM;wBACjD,CAAC,CAAC,eAAe,CAAC,MAAM;qBACzB,CAAC,CACH;iBACF;aACF;YACD,WAAW,EACT,6HAA6H;SAChI;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAClE;iBACF;aACF;YACD,WAAW,EAAE,0CAA0C;SACxD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,mBAAmB;SACjC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,gBAAgB;SAC9B;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,gBAAgB,EAAE,CAAC,CAAC,YAAY;CACjC,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAEpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,mBAAmB,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEtE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/api/user/password/post.d.ts

@@ -0,0 +1,23 @@
+import type { AppEnv } from '../../../../lib/app-env.ts';
+/**
+ * POST /api/user/password
+ *
+ * Set password for OAuth-only users.
+ */
+export declare const userPasswordPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/password": {
+        $post: {
+            input: {
+                json: {
+                    password: string;
+                };
+            };
+            output: {
+                ok: true;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/password">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/user/password/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/password/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAQzD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;yBA8E5B,CAAC"}