@tinyrack/tinyauth-server 0.0.7

package/dist/routes/api/user/password/post.js

@@ -0,0 +1,81 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { OPENAPI_SECURITY } from "../../../../lib/openapi.js";
+import { TAGS } from "../../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../../middleware/auth.js";
+import { e } from "../../../../schemas/error.js";
+import { f } from "../../../../schemas/field.js";
+import { r } from "../../../../schemas/response.js";
+/**
+ * POST /api/user/password
+ *
+ * Set password for OAuth-only users.
+ */
+export const userPasswordPost = new Hono().post('/user/password', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Set Password',
+    description: 'Set a password for users who signed up via OAuth. ' +
+        'Only works if no password is currently set.',
+    responses: {
+        200: {
+            content: {
+                'application/json': { schema: resolver(r.OkResponse) },
+            },
+            description: 'Success',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.Unauthorized.Schema),
+                },
+            },
+            description: 'Unauthorized',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.ValidationError.Schema),
+                },
+            },
+            description: 'Password authentication disabled or validation error',
+        },
+        403: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.UserNotEditable.Schema),
+                },
+            },
+            description: 'User not editable',
+        },
+        404: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.UserNotFound.Schema),
+                },
+            },
+            description: 'User not found',
+        },
+        409: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.PasswordAlreadySet.Schema),
+                },
+            },
+            description: 'Password already set',
+        },
+    },
+}), validator('json', z.object({
+    password: f.newUserPassword,
+})), verifyAuth(), async (c) => {
+    const body = c.req.valid('json');
+    const { config, passwordAuthService } = c.var.services;
+    const { user } = c.var.verifiedUser;
+    if (!config.auth.password.enabled) {
+        throw new e.ValidationError.Error('Password authentication is disabled');
+    }
+    await passwordAuthService.setPasswordForUser(user, body.password);
+    return c.json({ ok: true }, 200);
+});
+//# sourceMappingURL=post.js.map

package/dist/routes/api/user/password/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../src/routes/api/user/password/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACrD,gBAAgB,EAChB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,cAAc;IACvB,WAAW,EACT,oDAAoD;QACpD,6CAA6C;IAC/C,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,sDAAsD;SACpE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,mBAAmB;SACjC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,gBAAgB;SAC9B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,eAAe;CAC5B,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAEpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAElE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/api/user/password/put.d.ts

@@ -0,0 +1,24 @@
+import type { AppEnv } from '../../../../lib/app-env.ts';
+/**
+ * PUT /api/user/password
+ *
+ * Change password for users who already have a password set.
+ */
+export declare const userPasswordPut: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/password": {
+        $put: {
+            input: {
+                json: {
+                    current_password: string;
+                    new_password: string;
+                };
+            };
+            output: {
+                ok: true;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/password">;
+//# sourceMappingURL=put.d.ts.map

package/dist/routes/api/user/password/put.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"put.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/password/put.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAQzD;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;yBA+E3B,CAAC"}

package/dist/routes/api/user/password/put.js

@@ -0,0 +1,74 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { OPENAPI_SECURITY } from "../../../../lib/openapi.js";
+import { TAGS } from "../../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../../middleware/auth.js";
+import { e } from "../../../../schemas/error.js";
+import { f } from "../../../../schemas/field.js";
+import { r } from "../../../../schemas/response.js";
+/**
+ * PUT /api/user/password
+ *
+ * Change password for users who already have a password set.
+ */
+export const userPasswordPut = new Hono().put('/user/password', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Change Password',
+    description: 'Change password for users who already have a password set. ' +
+        'Requires current password verification.',
+    responses: {
+        200: {
+            content: {
+                'application/json': { schema: resolver(r.OkResponse) },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(z.union([e.PasswordNotSet.Schema, e.ValidationError.Schema])),
+                },
+            },
+            description: 'Password not set or password auth disabled',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(z.union([e.Unauthorized.Schema, e.InvalidCurrentPassword.Schema])),
+                },
+            },
+            description: 'Unauthorized or invalid current password',
+        },
+        403: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.UserNotEditable.Schema),
+                },
+            },
+            description: 'User not editable',
+        },
+        404: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.UserNotFound.Schema),
+                },
+            },
+            description: 'User not found',
+        },
+    },
+}), validator('json', z.object({
+    current_password: f.userPassword,
+    new_password: f.newUserPassword,
+})), verifyAuth(), async (c) => {
+    const body = c.req.valid('json');
+    const { config, passwordAuthService } = c.var.services;
+    const { user } = c.var.verifiedUser;
+    if (!config.auth.password.enabled) {
+        throw new e.ValidationError.Error('Password authentication is disabled');
+    }
+    await passwordAuthService.changePassword(user, body.current_password, body.new_password);
+    return c.json({ ok: true }, 200);
+});
+//# sourceMappingURL=put.js.map

package/dist/routes/api/user/password/put.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put.js","sourceRoot":"","sources":["../../../../../src/routes/api/user/password/put.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CACnD,gBAAgB,EAChB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,iBAAiB;IAC1B,WAAW,EACT,6DAA6D;QAC7D,yCAAyC;IAC3C,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAC7D;iBACF;aACF;YACD,WAAW,EAAE,4CAA4C;SAC1D;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAClE;iBACF;aACF;YACD,WAAW,EAAE,0CAA0C;SACxD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC3C;aACF;YACD,WAAW,EAAE,mBAAmB;SACjC;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,gBAAgB;SAC9B;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,gBAAgB,EAAE,CAAC,CAAC,YAAY;IAChC,YAAY,EAAE,CAAC,CAAC,eAAe;CAChC,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAEpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,mBAAmB,CAAC,cAAc,CACtC,IAAI,EACJ,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,YAAY,CAClB,CAAC;IAEF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/api/user/session/get.d.ts

@@ -0,0 +1,32 @@
+import type { AppEnv } from '../../../../lib/app-env.ts';
+export declare const userSessionGet: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/session": {
+        $get: {
+            input: {};
+            output: {
+                user: null;
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {};
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/session">;
+//# sourceMappingURL=get.d.ts.map

package/dist/routes/api/user/session/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/session/get.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAMzD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAqC1B,CAAC"}

package/dist/routes/api/user/session/get.js

@@ -0,0 +1,36 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver } from 'hono-openapi';
+import { z } from 'zod';
+import { OPENAPI_SECURITY } from "../../../../lib/openapi.js";
+import { TAGS } from "../../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../../middleware/auth.js";
+import { r } from "../../../../schemas/response.js";
+export const userSessionGet = new Hono().get('/user/session', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.optionalCookieSession,
+    summary: 'Get Session',
+    description: 'Get Session',
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: resolver(z.object({
+                        user: r.UserSession.optional(),
+                    })),
+                },
+            },
+            description: 'Success',
+        },
+    },
+}), verifyAuth({ optional: true }), async (c) => {
+    const verifiedAuth = c.var.verifiedUser;
+    const { mikro, userService } = c.var.services;
+    if (!verifiedAuth) {
+        return c.json({ user: null }, 200);
+    }
+    // Load full user data with relations for complete session response
+    const fullUser = await mikro.user.verifyBySub(verifiedAuth.user.sub);
+    const userSession = await userService.userEntityToSessionUser(fullUser);
+    return c.json({ user: userSession }, 200);
+});
+//# sourceMappingURL=get.js.map

package/dist/routes/api/user/session/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../../src/routes/api/user/session/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CAClD,eAAe,EACf,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,qBAAqB;IAChD,OAAO,EAAE,aAAa;IACtB,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,MAAM,CAAC;wBACP,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE;qBAC/B,CAAC,CACH;iBACF;aACF;YACD,WAAW,EAAE,SAAS;SACvB;KACF;CACF,CAAC,EACF,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IACxC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAExE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/api/user/totp/confirm/post.d.ts

@@ -0,0 +1,32 @@
+import type { AppEnv } from '../../../../../lib/app-env.ts';
+/**
+ * POST /api/user/totp/confirm
+ *
+ * Confirm TOTP setup after user acknowledges saving recovery codes.
+ */
+export declare const userTotpConfirmPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/totp/confirm": {
+        $post: {
+            input: {
+                json?: Record<string, never> | null | undefined;
+            };
+            output: {
+                user: {
+                    managed_by: "database" | "config";
+                    sub: string;
+                    email: string;
+                    email_verified: boolean;
+                    email_verification_required: boolean;
+                    has_password: boolean;
+                    totp_registered: boolean;
+                    totp_recovery_codes_missing: boolean;
+                    second_factor_required: boolean;
+                    passkey_count: number;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/totp/confirm">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/user/totp/confirm/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/confirm/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAU5D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;6BAyE/B,CAAC"}

package/dist/routes/api/user/totp/confirm/post.js

@@ -0,0 +1,73 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { OPENAPI_SECURITY } from "../../../../../lib/openapi.js";
+import { TAGS } from "../../../../../lib/swagger-tags.js";
+import { verifyAuth, verifyPending2FASetupUser, } from "../../../../../middleware/auth.js";
+import { e } from "../../../../../schemas/error.js";
+import { r } from "../../../../../schemas/response.js";
+/**
+ * POST /api/user/totp/confirm
+ *
+ * Confirm TOTP setup after user acknowledges saving recovery codes.
+ */
+export const userTotpConfirmPost = new Hono().post('/user/totp/confirm', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Confirm TOTP Setup',
+    description: 'Confirm that recovery codes have been saved to complete TOTP setup. ' +
+        'Must call verify endpoint first to get recovery codes. ' +
+        'This endpoint completes the TOTP setup and enables 2FA.',
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: resolver(r.UserSessionResponse),
+                },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.TotpNotSetup.Schema),
+                },
+            },
+            description: 'TOTP not setup',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.Unauthorized.Schema),
+                },
+            },
+            description: 'Unauthorized',
+        },
+        409: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.TotpAlreadyEnabled.Schema),
+                },
+            },
+            description: 'TOTP already enabled',
+        },
+    },
+}), validator('json', z.object({}).optional().nullable()), verifyAuth({ optional: true }), verifyPending2FASetupUser({ optional: true }), async (c) => {
+    const session = c.var.session;
+    const { mikro, totpService, userService } = c.var.services;
+    // Allow both full user session and pending 2FA setup session
+    const userSub = c.var.verifiedUser?.user.sub ??
+        c.var.verifiedPending2FASetupUser?.user.sub;
+    if (!userSub) {
+        throw new e.Unauthorized.Error();
+    }
+    await totpService.confirmSetup(userSub);
+    // Convert pending 2FA setup session to full user session
+    if (c.var.verifiedPending2FASetupUser) {
+        session.setUserSession(userSub);
+    }
+    const userEntity = await mikro.user.verifyBySub(userSub);
+    const user = await userService.userEntityToSessionUser(userEntity);
+    return c.json({ user }, 200);
+});
+//# sourceMappingURL=post.js.map

package/dist/routes/api/user/totp/confirm/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/confirm/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACxD,oBAAoB,EACpB,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,oBAAoB;IAC7B,WAAW,EACT,sEAAsE;QACtE,yDAAyD;QACzD,yDAAyD;IAC3D,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,gBAAgB;SAC9B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;iBAC9C;aACF;YACD,WAAW,EAAE,sBAAsB;SACpC;KACF;CACF,CAAC,EACF,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,EACrD,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC9B,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAC7C,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAE3D,6DAA6D;IAC7D,MAAM,OAAO,GACX,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG;QAC5B,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,GAAG,CAAC;IAE9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAExC,yDAAyD;IACzD,IAAI,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;QACtC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAEnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC,CACF,CAAC"}

package/dist/routes/api/user/totp/delete.d.ts

@@ -0,0 +1,23 @@
+import type { AppEnv } from '../../../../lib/app-env.ts';
+/**
+ * DELETE /api/user/totp
+ *
+ * Disable TOTP two-factor authentication.
+ */
+export declare const userTotpDelete: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/totp": {
+        $delete: {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                ok: true;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/totp">;
+//# sourceMappingURL=delete.d.ts.map

package/dist/routes/api/user/totp/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../src/routes/api/user/totp/delete.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAQzD;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;qBA2E1B,CAAC"}

package/dist/routes/api/user/totp/delete.js

@@ -0,0 +1,74 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { OPENAPI_SECURITY } from "../../../../lib/openapi.js";
+import { TAGS } from "../../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../../middleware/auth.js";
+import { e } from "../../../../schemas/error.js";
+import { f } from "../../../../schemas/field.js";
+import { r } from "../../../../schemas/response.js";
+/**
+ * DELETE /api/user/totp
+ *
+ * Disable TOTP two-factor authentication.
+ */
+export const userTotpDelete = new Hono().delete('/user/totp', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Disable TOTP',
+    description: 'Disable TOTP two-factor authentication for the current user. ' +
+        'Requires a valid TOTP code from the authenticator app.',
+    responses: {
+        200: {
+            content: {
+                'application/json': { schema: resolver(r.OkResponse) },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.TotpNotEnabled.Schema),
+                },
+            },
+            description: 'TOTP not enabled, invalid code, or cannot remove last second factor',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.Unauthorized.Schema),
+                },
+            },
+            description: 'Unauthorized',
+        },
+        403: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.SecondFactorNotAllowedForConfigUser.Schema),
+                },
+            },
+            description: 'Second factor not allowed for config user',
+        },
+    },
+}), validator('json', z.object({
+    code: f.totpCode,
+})), verifyAuth(), async (c) => {
+    const body = c.req.valid('json');
+    const { user: userEntity } = c.var.verifiedUser;
+    const { config, mikro, totpService } = c.var.services;
+    // Config users cannot manage 2FA
+    if (userEntity.managed_by === 'config') {
+        throw new e.SecondFactorNotAllowedForConfigUser.Error();
+    }
+    // Check if 2FA is required
+    const secondFactorRequired = config.auth.password.two_factor.enrollment_required;
+    // Check if user has other 2FA method (passkey)
+    const passkeyCount = await mikro.userPasskey.countByUserSub(userEntity.sub);
+    const hasOtherSecondFactor = passkeyCount > 0;
+    await totpService.disable(userEntity.sub, body.code, {
+        secondFactorRequired,
+        hasOtherSecondFactor,
+    });
+    return c.json({ ok: true }, 200);
+});
+//# sourceMappingURL=delete.js.map

package/dist/routes/api/user/totp/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../../../src/routes/api/user/totp/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,8BAA8B,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,iCAAiC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,IAAI,EAAU,CAAC,MAAM,CACrD,YAAY,EACZ,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,cAAc;IACvB,WAAW,EACT,+DAA+D;QAC/D,wDAAwD;IAC1D,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;aACvD;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;iBAC1C;aACF;YACD,WAAW,EACT,qEAAqE;SACxE;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mCAAmC,CAAC,MAAM,CAAC;iBAC/D;aACF;YACD,WAAW,EAAE,2CAA2C;SACzD;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAEtD,iCAAiC;IACjC,IAAI,UAAU,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,CAAC,CAAC,mCAAmC,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,2BAA2B;IAC3B,MAAM,oBAAoB,GACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAEtD,+CAA+C;IAC/C,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,oBAAoB,GAAG,YAAY,GAAG,CAAC,CAAC;IAE9C,MAAM,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;QACnD,oBAAoB;QACpB,oBAAoB;KACrB,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC"}

package/dist/routes/api/user/totp/recovery/regenerate/post.d.ts

@@ -0,0 +1,18 @@
+import type { AppEnv } from '../../../../../../lib/app-env.ts';
+export declare const userTotpRecoveryRegeneratePost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/totp/recovery/regenerate": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                recovery_codes: string[];
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/totp/recovery/regenerate">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/user/totp/recovery/regenerate/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/totp/recovery/regenerate/post.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAQ/D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;yCA6D1C,CAAC"}

package/dist/routes/api/user/totp/recovery/regenerate/post.js

@@ -0,0 +1,54 @@
+import { Hono } from 'hono';
+import { describeRoute, resolver, validator } from 'hono-openapi';
+import { z } from 'zod';
+import { OPENAPI_SECURITY } from "../../../../../../lib/openapi.js";
+import { TAGS } from "../../../../../../lib/swagger-tags.js";
+import { verifyAuth } from "../../../../../../middleware/auth.js";
+import { e } from "../../../../../../schemas/error.js";
+import { f } from "../../../../../../schemas/field.js";
+import { r } from "../../../../../../schemas/response.js";
+export const userTotpRecoveryRegeneratePost = new Hono().post('/user/totp/recovery/regenerate', describeRoute({
+    tags: [TAGS.USER],
+    security: OPENAPI_SECURITY.cookieSession,
+    summary: 'Regenerate TOTP recovery codes',
+    description: 'Generate a new set of single-use TOTP recovery codes for a user ' +
+        'with fully enabled TOTP.',
+    responses: {
+        200: {
+            content: {
+                'application/json': {
+                    schema: resolver(r.RecoveryCodesResponse),
+                },
+            },
+            description: 'Success',
+        },
+        400: {
+            content: {
+                'application/json': {
+                    schema: resolver(z.union([e.InvalidTotpCode.Schema, e.TotpNotEnabled.Schema])),
+                },
+            },
+            description: 'TOTP not enabled or invalid TOTP code',
+        },
+        401: {
+            content: {
+                'application/json': {
+                    schema: resolver(e.Unauthorized.Schema),
+                },
+            },
+            description: 'Unauthorized',
+        },
+    },
+}), validator('json', z.object({
+    code: f.totpCode,
+})), verifyAuth(), async (c) => {
+    const { config, totpService } = c.var.services;
+    const { user } = c.var.verifiedUser;
+    const body = c.req.valid('json');
+    if (!config.auth.password.enabled || !config.auth.password.totp.enabled) {
+        throw new e.ValidationError.Error('TOTP authentication is disabled');
+    }
+    const recoveryCodes = await totpService.regenerateRecoveryCodes(user.sub, body.code);
+    return c.json({ recovery_codes: recoveryCodes }, 200);
+});
+//# sourceMappingURL=post.js.map

package/dist/routes/api/user/totp/recovery/regenerate/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../../../../../../src/routes/api/user/totp/recovery/regenerate/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,uCAAuC,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,oCAAoC,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,uCAAuC,CAAC;AAE1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,IAAI,EAAU,CAAC,IAAI,CACnE,gCAAgC,EAChC,aAAa,CAAC;IACZ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC,aAAa;IACxC,OAAO,EAAE,gCAAgC;IACzC,WAAW,EACT,kEAAkE;QAClE,0BAA0B;IAC5B,SAAS,EAAE;QACT,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC;iBAC1C;aACF;YACD,WAAW,EAAE,SAAS;SACvB;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CACd,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAC7D;iBACF;aACF;YACD,WAAW,EAAE,uCAAuC;SACrD;QACD,GAAG,EAAE;YACH,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;iBACxC;aACF;YACD,WAAW,EAAE,cAAc;SAC5B;KACF;CACF,CAAC,EACF,SAAS,CACP,MAAM,EACN,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,QAAQ;CACjB,CAAC,CACH,EACD,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAC7D,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,IAAI,CACV,CAAC;IAEF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC,CACF,CAAC"}

package/dist/routes/api/user/totp/setup/post.d.ts

@@ -0,0 +1,22 @@
+import type { AppEnv } from '../../../../../lib/app-env.ts';
+/**
+ * POST /api/user/totp/setup
+ *
+ * Start TOTP setup for the current user.
+ * Generates a new secret and returns QR code for authenticator app.
+ */
+export declare const userTotpSetupPost: import("hono/hono-base").HonoBase<AppEnv, {
+    "/user/totp/setup": {
+        $post: {
+            input: {};
+            output: {
+                secret: string;
+                otpauth_url: string;
+                qr_code: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/user/totp/setup">;
+//# sourceMappingURL=post.d.ts.map

package/dist/routes/api/user/totp/setup/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../../../../../src/routes/api/user/totp/setup/post.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAU5D;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;2BAoF7B,CAAC"}