@trokky/trokky 2.0.3

package/dist/core/security/mfa/totp.js

@@ -0,0 +1,293 @@
+/**
+ * TOTP (Time-based One-Time Password) Service
+ *
+ * Implements RFC 6238 TOTP for authenticator app-based MFA.
+ * Uses the otpauth library for TOTP generation/verification.
+ */
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createLogger } from '../../utils/logger.js';
+const logger = createLogger('security', 'TOTP');
+// =============================================================================
+// CONSTANTS
+// =============================================================================
+const DEFAULT_ALGORITHM = 'SHA1';
+const DEFAULT_DIGITS = 6;
+const DEFAULT_PERIOD = 30;
+const SECRET_LENGTH = 20; // 160 bits, recommended for SHA1
+const BACKUP_CODE_LENGTH = 8; // 8 character backup codes
+const BACKUP_CODE_COUNT = 10; // Number of backup codes to generate
+// Base32 alphabet for secret encoding
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+// =============================================================================
+// TOTP SERVICE
+// =============================================================================
+export class TOTPService {
+    config;
+    constructor(config) {
+        this.config = {
+            issuer: config.issuer,
+            algorithm: config.algorithm || DEFAULT_ALGORITHM,
+            digits: config.digits || DEFAULT_DIGITS,
+            period: config.period || DEFAULT_PERIOD,
+        };
+        logger.debug('TOTPService initialized', { issuer: config.issuer });
+    }
+    /**
+     * Generate a new TOTP secret for a user
+     * Returns the secret, URI for QR code generation, and a data URL for the QR code
+     */
+    async generateSecret(accountName) {
+        // Generate cryptographically secure random bytes
+        const secretBytes = randomBytes(SECRET_LENGTH);
+        // Encode as base32
+        const secret = this.base32Encode(secretBytes);
+        // Build otpauth URI
+        const uri = this.buildTOTPUri(secret, accountName);
+        // Generate QR code data URL
+        const qrCodeDataUrl = await this.generateQRCode(uri);
+        // Format secret for manual entry (groups of 4 for readability)
+        const manualEntryKey = secret.match(/.{1,4}/g)?.join(' ') || secret;
+        logger.info('Generated TOTP secret', { accountName });
+        return {
+            secret,
+            uri,
+            qrCodeDataUrl,
+            manualEntryKey,
+        };
+    }
+    /**
+     * Verify a TOTP code against a secret
+     * Allows for time drift by checking adjacent time windows
+     */
+    verifyCode(secret, code, window = 1) {
+        if (!code || code.length !== this.config.digits) {
+            return false;
+        }
+        // Clean the code (remove spaces, ensure digits only)
+        const cleanCode = code.replace(/\s/g, '');
+        if (!/^\d+$/.test(cleanCode)) {
+            return false;
+        }
+        const currentTime = Math.floor(Date.now() / 1000);
+        // Check current time step and adjacent windows
+        for (let i = -window; i <= window; i++) {
+            const timeStep = Math.floor((currentTime + i * this.config.period) / this.config.period);
+            const expectedCode = this.generateTOTP(secret, timeStep);
+            if (this.timingSafeCompare(cleanCode, expectedCode)) {
+                logger.debug('TOTP code verified', { window: i });
+                return true;
+            }
+        }
+        logger.debug('TOTP code verification failed');
+        return false;
+    }
+    /**
+     * Generate backup codes for account recovery
+     * These are one-time use codes stored hashed
+     */
+    generateBackupCodes(count = BACKUP_CODE_COUNT) {
+        const codes = [];
+        for (let i = 0; i < count; i++) {
+            // Generate random bytes and convert to alphanumeric
+            const bytes = randomBytes(BACKUP_CODE_LENGTH);
+            let code = '';
+            for (const byte of bytes) {
+                // Map to alphanumeric (0-9, A-Z)
+                const char = byte % 36;
+                code += char < 10 ? char.toString() : String.fromCharCode(55 + char); // A=65, but we start at 10
+            }
+            // Format with dash for readability: XXXX-XXXX
+            codes.push(`${code.slice(0, 4)}-${code.slice(4, 8)}`);
+        }
+        logger.info('Generated backup codes', { count });
+        return codes;
+    }
+    /**
+     * Hash a backup code for secure storage
+     * Uses SHA-256 for fast comparison while still being secure
+     */
+    hashBackupCode(code) {
+        // Normalize: remove dashes, uppercase
+        const normalized = code.replace(/-/g, '').toUpperCase();
+        return createHash('sha256').update(normalized).digest('hex');
+    }
+    /**
+     * Verify a backup code against stored hashed codes
+     * Returns the updated list with the used code removed (consumed)
+     */
+    verifyBackupCode(hashedCodes, code) {
+        // Hash the provided code
+        const hashedInput = this.hashBackupCode(code);
+        // Find and remove matching code
+        const index = hashedCodes.findIndex((stored) => this.timingSafeCompareHex(stored, hashedInput));
+        if (index === -1) {
+            logger.debug('Backup code verification failed');
+            return {
+                valid: false,
+                remainingCodes: hashedCodes,
+            };
+        }
+        // Remove the used code
+        const remainingCodes = [...hashedCodes];
+        remainingCodes.splice(index, 1);
+        logger.info('Backup code verified and consumed', {
+            remainingCount: remainingCodes.length,
+        });
+        return {
+            valid: true,
+            remainingCodes,
+        };
+    }
+    // ===========================================================================
+    // PRIVATE METHODS
+    // ===========================================================================
+    /**
+     * Build otpauth:// URI for QR code
+     */
+    buildTOTPUri(secret, accountName) {
+        const params = new URLSearchParams({
+            secret,
+            issuer: this.config.issuer,
+            algorithm: this.config.algorithm,
+            digits: this.config.digits.toString(),
+            period: this.config.period.toString(),
+        });
+        // Encode account name and issuer for the label
+        const label = encodeURIComponent(`${this.config.issuer}:${accountName}`);
+        return `otpauth://totp/${label}?${params.toString()}`;
+    }
+    /**
+     * Generate QR code as data URL
+     * Uses dynamic import to handle optional qrcode dependency
+     * If qrcode is not installed, returns the URI as base64 for client-side QR generation
+     */
+    async generateQRCode(data) {
+        try {
+            // Dynamic import to handle optional dependency
+            const QRCode = await import('qrcode').catch(() => null);
+            if (QRCode && typeof QRCode.toDataURL === 'function') {
+                return await QRCode.toDataURL(data, {
+                    width: 256,
+                    margin: 2,
+                    color: {
+                        dark: '#000000',
+                        light: '#FFFFFF',
+                    },
+                });
+            }
+            // Fallback: return URI as base64 encoded data URL
+            // The frontend can generate the QR code using a client-side library
+            logger.debug('QR code package not available, returning URI as fallback');
+            return `data:text/plain;base64,${Buffer.from(data).toString('base64')}`;
+        }
+        catch (error) {
+            // If qrcode package is not available, return the URI
+            logger.debug('QR code generation failed, returning URI as fallback', { error });
+            return `data:text/plain;base64,${Buffer.from(data).toString('base64')}`;
+        }
+    }
+    /**
+     * Generate TOTP code for a given time step
+     * Implements RFC 6238
+     */
+    generateTOTP(secret, timeStep) {
+        // Decode base32 secret
+        const secretBytes = this.base32Decode(secret);
+        // Convert time step to 8-byte big-endian buffer
+        const timeBuffer = Buffer.alloc(8);
+        timeBuffer.writeBigInt64BE(BigInt(timeStep));
+        // Generate HMAC using the configured algorithm
+        const algorithm = this.config.algorithm.toLowerCase();
+        const hmacResult = createHmac(algorithm, secretBytes)
+            .update(timeBuffer)
+            .digest();
+        // Dynamic truncation (RFC 4226)
+        const offset = hmacResult[hmacResult.length - 1] & 0x0f;
+        const binary = ((hmacResult[offset] & 0x7f) << 24) |
+            ((hmacResult[offset + 1] & 0xff) << 16) |
+            ((hmacResult[offset + 2] & 0xff) << 8) |
+            (hmacResult[offset + 3] & 0xff);
+        // Generate code with specified number of digits
+        const code = binary % Math.pow(10, this.config.digits);
+        return code.toString().padStart(this.config.digits, '0');
+    }
+    /**
+     * Base32 encode bytes
+     */
+    base32Encode(buffer) {
+        let result = '';
+        let bits = 0;
+        let value = 0;
+        for (const byte of buffer) {
+            value = (value << 8) | byte;
+            bits += 8;
+            while (bits >= 5) {
+                result += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
+                bits -= 5;
+            }
+        }
+        if (bits > 0) {
+            result += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+        }
+        return result;
+    }
+    /**
+     * Base32 decode string to bytes
+     */
+    base32Decode(encoded) {
+        // Remove padding and convert to uppercase
+        const input = encoded.replace(/=+$/, '').toUpperCase();
+        const bytes = [];
+        let bits = 0;
+        let value = 0;
+        for (const char of input) {
+            const index = BASE32_ALPHABET.indexOf(char);
+            if (index === -1)
+                continue;
+            value = (value << 5) | index;
+            bits += 5;
+            if (bits >= 8) {
+                bytes.push((value >>> (bits - 8)) & 255);
+                bits -= 8;
+            }
+        }
+        return Buffer.from(bytes);
+    }
+    /**
+     * Timing-safe string comparison
+     */
+    timingSafeCompare(a, b) {
+        if (a.length !== b.length) {
+            return false;
+        }
+        const bufA = Buffer.from(a);
+        const bufB = Buffer.from(b);
+        return timingSafeEqual(bufA, bufB);
+    }
+    /**
+     * Timing-safe hex string comparison
+     */
+    timingSafeCompareHex(a, b) {
+        if (a.length !== b.length) {
+            return false;
+        }
+        try {
+            const bufA = Buffer.from(a, 'hex');
+            const bufB = Buffer.from(b, 'hex');
+            return timingSafeEqual(bufA, bufB);
+        }
+        catch {
+            return false;
+        }
+    }
+}
+// =============================================================================
+// FACTORY FUNCTION
+// =============================================================================
+/**
+ * Create a new TOTP service instance
+ */
+export function createTOTPService(config) {
+    return new TOTPService(config);
+}
+//# sourceMappingURL=totp.js.map

package/dist/core/security/mfa/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../../../src/core/security/mfa/totp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;AAyB/C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAChC,MAAM,cAAc,GAAG,CAAC,CAAA;AACxB,MAAM,cAAc,GAAG,EAAE,CAAA;AACzB,MAAM,aAAa,GAAG,EAAE,CAAA,CAAC,iCAAiC;AAC1D,MAAM,kBAAkB,GAAG,CAAC,CAAA,CAAC,2BAA2B;AACxD,MAAM,iBAAiB,GAAG,EAAE,CAAA,CAAC,qCAAqC;AAElE,sCAAsC;AACtC,MAAM,eAAe,GAAG,kCAAkC,CAAA;AAE1D,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,OAAO,WAAW;IACd,MAAM,CAAsB;IAEpC,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,iBAAiB;YAChD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,cAAc;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,cAAc;SACxC,CAAA;QACD,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IACpE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,iDAAiD;QACjD,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,CAAC,CAAA;QAE9C,mBAAmB;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAA;QAE7C,oBAAoB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAElD,4BAA4B;QAC5B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QAEpD,+DAA+D;QAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAA;QAEnE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;QAErD,OAAO;YACL,MAAM;YACN,GAAG;YACH,aAAa;YACb,cAAc;SACf,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,SAAiB,CAAC;QACzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,qDAAqD;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAEjD,+CAA+C;QAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACxF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YAExD,IAAI,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;gBACjD,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAC7C,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,QAAgB,iBAAiB;QACnD,MAAM,KAAK,GAAa,EAAE,CAAA;QAE1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,oDAAoD;YACpD,MAAM,KAAK,GAAG,WAAW,CAAC,kBAAkB,CAAC,CAAA;YAC7C,IAAI,IAAI,GAAG,EAAE,CAAA;YAEb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,iCAAiC;gBACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE,CAAA;gBACtB,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA,CAAC,2BAA2B;YAClG,CAAC;YAED,8CAA8C;YAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAChD,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,IAAY;QACzB,sCAAsC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9D,CAAC;IAED;;;OAGG;IACH,gBAAgB,CACd,WAAqB,EACrB,IAAY;QAEZ,yBAAyB;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QAE7C,gCAAgC;QAChC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAC/C,CAAA;QAED,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAA;YAC/C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,WAAW;aAC5B,CAAA;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,cAAc,GAAG,CAAC,GAAG,WAAW,CAAC,CAAA;QACvC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QAE/B,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAC/C,cAAc,EAAE,cAAc,CAAC,MAAM;SACtC,CAAC,CAAA;QAEF,OAAO;YACL,KAAK,EAAE,IAAI;YACX,cAAc;SACf,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;OAEG;IACK,YAAY,CAAC,MAAc,EAAE,WAAmB;QACtD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;SACtC,CAAC,CAAA;QAEF,+CAA+C;QAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC,CAAA;QAExE,OAAO,kBAAkB,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IACvD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,IAAI,CAAC;YACH,+CAA+C;YAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YAEvD,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBACrD,OAAO,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE;oBAClC,KAAK,EAAE,GAAG;oBACV,MAAM,EAAE,CAAC;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,SAAS;wBACf,KAAK,EAAE,SAAS;qBACjB;iBACF,CAAC,CAAA;YACJ,CAAC;YAED,kDAAkD;YAClD,oEAAoE;YACpE,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAA;YACxE,OAAO,0BAA0B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qDAAqD;YACrD,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/E,OAAO,0BAA0B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;QACzE,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,MAAc,EAAE,QAAgB;QACnD,uBAAuB;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QAE7C,gDAAgD;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClC,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QAE5C,+CAA+C;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,CAAA;QACrD,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;aAClD,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,EAAE,CAAA;QAEX,gCAAgC;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA;QACvD,MAAM,MAAM,GACV,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACnC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACvC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;QAEjC,gDAAgD;QAChD,MAAM,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACtD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1D,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAc;QACjC,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,IAAI,KAAK,GAAG,CAAC,CAAA;QAEb,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;YAC3B,IAAI,IAAI,CAAC,CAAA;YAET,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;gBACtD,IAAI,IAAI,CAAC,CAAA;YACX,CAAC;QACH,CAAC;QAED,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,OAAe;QAClC,0CAA0C;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACtD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,IAAI,KAAK,GAAG,CAAC,CAAA;QAEb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC3C,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,SAAQ;YAE1B,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAA;YAC5B,IAAI,IAAI,CAAC,CAAA;YAET,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;gBACxC,IAAI,IAAI,CAAC,CAAA;YACX,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,CAAS,EAAE,CAAS;QAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAE3B,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACpC,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,CAAS,EAAE,CAAS;QAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YAClC,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;CACF;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,OAAO,IAAI,WAAW,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC"}

package/dist/core/security/middleware.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Authentication and Authorization Middleware
+ *
+ * Provides Express middleware for protecting routes with authentication
+ * and permission-based authorization.
+ */
+import type { Request, Response, NextFunction } from 'express';
+import type { AuthContext, Permission } from '../types/user.js';
+import type { AuthenticationService } from './auth.js';
+declare global {
+    namespace Express {
+        interface Request {
+            auth?: AuthContext;
+        }
+    }
+}
+export interface AuthMiddlewareConfig {
+    authService: AuthenticationService;
+    getUserById?: (id: string) => Promise<any>;
+    getAppTokenByHash?: (hash: string) => Promise<any>;
+}
+export declare class AuthMiddleware {
+    private authService;
+    private getUserById?;
+    private getAppTokenByHash?;
+    constructor(config: AuthMiddlewareConfig);
+    /**
+     * Middleware to authenticate requests
+     * Supports both JWT tokens (Authorization: Bearer) and App tokens (X-API-Token)
+     */
+    authenticate(): (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
+    /**
+     * Middleware to require authentication
+     */
+    requireAuth(): (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    /**
+     * Middleware to require specific permissions
+     */
+    requirePermission(permission: Permission): (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    /**
+     * Middleware to require any of the specified permissions
+     */
+    requireAnyPermission(permissions: Permission[]): (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    /**
+     * Middleware to require all of the specified permissions
+     */
+    requireAllPermissions(permissions: Permission[]): (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    /**
+     * Middleware to require admin role (user authentication only)
+     */
+    requireAdmin(): (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    /**
+     * Middleware to require Studio access
+     */
+    requireStudioAccess(): (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    /**
+     * Middleware for optional authentication (sets context but doesn't require it)
+     */
+    optionalAuth(): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    /**
+     * Get current authentication context from request
+     */
+    static getAuthContext(req: Request): AuthContext;
+    /**
+     * Check if current request is from an authenticated user
+     */
+    static isAuthenticatedUser(req: Request): boolean;
+    /**
+     * Check if current request is from an app token
+     */
+    static isAppToken(req: Request): boolean;
+    /**
+     * Get user ID from authenticated request (if user auth)
+     */
+    static getUserId(req: Request): string | null;
+    /**
+     * Get app token ID from authenticated request (if app token auth)
+     */
+    static getAppTokenId(req: Request): string | null;
+}
+/**
+ * Helper function to create common middleware combinations
+ */
+export declare function createAuthMiddleware(config: AuthMiddlewareConfig): {
+    authenticate: (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
+    requireAuth: (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    optionalAuth: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    requirePermission: (permission: Permission) => (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    requireAnyPermission: (permissions: Permission[]) => (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    requireAllPermissions: (permissions: Permission[]) => (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    requireAdmin: (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    requireStudioAccess: (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
+    authAndPermission: (permission: Permission) => (((req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>) | ((req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined))[];
+    studioAuth: () => (((req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>) | ((req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined))[];
+    adminAuth: () => (((req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>) | ((req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined))[];
+    getAuthContext: typeof AuthMiddleware.getAuthContext;
+    isAuthenticatedUser: typeof AuthMiddleware.isAuthenticatedUser;
+    isAppToken: typeof AuthMiddleware.isAppToken;
+    getUserId: typeof AuthMiddleware.getUserId;
+    getAppTokenId: typeof AuthMiddleware.getAppTokenId;
+};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/core/security/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/core/security/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AAGtD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,WAAW,CAAA;SACnB;KACF;CACF;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,qBAAqB,CAAA;IAClC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1C,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CACnD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAC,CAA8B;IAClD,OAAO,CAAC,iBAAiB,CAAC,CAAgC;gBAE9C,MAAM,EAAE,oBAAoB;IAMxC;;;OAGG;IACH,YAAY,KACI,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAyE/D;;OAEG;IACH,WAAW,KACD,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAWzD;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,UAAU,IAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAgBzD;;OAEG;IACH,oBAAoB,CAAC,WAAW,EAAE,UAAU,EAAE,IACpC,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAgBzD;;OAEG;IACH,qBAAqB,CAAC,WAAW,EAAE,UAAU,EAAE,IACrC,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAgBzD;;OAEG;IACH,YAAY,KACF,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAgBzD;;OAEG;IACH,mBAAmB,UA/EJ,OAAO,OAAO,QAAQ,QAAQ,YAAY;IAmFzD;;OAEG;IACH,YAAY,KACI,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAY/D;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW;IAIhD;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO;IAIjD;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO;IAIxC;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAI7C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;CAGlD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB;wBAtO1C,OAAO,OAAO,QAAQ,QAAQ,YAAY;uBA6EhD,OAAO,OAAO,QAAQ,QAAQ,YAAY;wBAsGpC,OAAO,OAAO,QAAQ,QAAQ,YAAY;oCA6D7B,UAAU,WApJ7B,OAAO,OAAO,QAAQ,QAAQ,YAAY;wCAqJnB,UAAU,EAAE,WAjInC,OAAO,OAAO,QAAQ,QAAQ,YAAY;yCAkIlB,UAAU,EAAE,WA9GpC,OAAO,OAAO,QAAQ,QAAQ,YAAY;wBAoB1C,OAAO,OAAO,QAAQ,QAAQ,YAAY;+BA5D1C,OAAO,OAAO,QAAQ,QAAQ,YAAY;oCA6JvB,UAAU,aAzPvB,OAAO,OAAO,QAAQ,QAAQ,YAAY,kEA6EhD,OAAO,OAAO,QAAQ,QAAQ,YAAY;8BA7EpC,OAAO,OAAO,QAAQ,QAAQ,YAAY,kEA6EhD,OAAO,OAAO,QAAQ,QAAQ,YAAY;6BA7EpC,OAAO,OAAO,QAAQ,QAAQ,YAAY,kEA6EhD,OAAO,OAAO,QAAQ,QAAQ,YAAY;;;;;;EAqM1D"}

package/dist/core/security/middleware.js

@@ -0,0 +1,261 @@
+/**
+ * Authentication and Authorization Middleware
+ *
+ * Provides Express middleware for protecting routes with authentication
+ * and permission-based authorization.
+ */
+export class AuthMiddleware {
+    authService;
+    getUserById;
+    getAppTokenByHash;
+    constructor(config) {
+        this.authService = config.authService;
+        this.getUserById = config.getUserById;
+        this.getAppTokenByHash = config.getAppTokenByHash;
+    }
+    /**
+     * Middleware to authenticate requests
+     * Supports both JWT tokens (Authorization: Bearer) and App tokens (X-API-Token)
+     */
+    authenticate() {
+        return async (req, res, next) => {
+            try {
+                // Try JWT authentication first (Authorization header)
+                const authHeader = req.headers.authorization;
+                if (authHeader?.startsWith('Bearer ')) {
+                    const token = authHeader.substring(7);
+                    const result = await this.authService.validateToken(token);
+                    if (result.valid && result.context) {
+                        // For user tokens, verify user still exists and is active
+                        if (result.context.type === 'user' && this.getUserById) {
+                            const user = await this.getUserById(result.context.user.id);
+                            if (!user || !user.isActive) {
+                                return res.status(401).json({ error: 'User account is inactive' });
+                            }
+                            // Update context with fresh user data
+                            result.context.user = {
+                                ...result.context.user,
+                                email: user.email,
+                                firstName: user.firstName,
+                                lastName: user.lastName,
+                                isActive: user.isActive
+                            };
+                        }
+                        req.auth = result.context;
+                        return next();
+                    }
+                }
+                // Try app token authentication (X-API-Token header)
+                const apiToken = req.headers['x-api-token'];
+                if (apiToken && this.getAppTokenByHash) {
+                    const validation = await this.authService.validateAppToken(apiToken);
+                    if (validation.valid && validation.hash) {
+                        const appToken = await this.getAppTokenByHash(validation.hash);
+                        if (appToken && appToken.isActive) {
+                            // Check expiration
+                            if (appToken.expiresAt && new Date() > new Date(appToken.expiresAt)) {
+                                return res.status(401).json({ error: 'App token has expired' });
+                            }
+                            // Update usage tracking
+                            appToken.lastUsedAt = new Date().toISOString();
+                            appToken.usageCount = (appToken.usageCount || 0) + 1;
+                            req.auth = {
+                                type: 'app_token',
+                                token: {
+                                    id: appToken.id,
+                                    name: appToken.name,
+                                    permissions: appToken.permissions,
+                                    createdBy: appToken.createdBy,
+                                    isActive: appToken.isActive
+                                }
+                            };
+                            return next();
+                        }
+                    }
+                }
+                // No valid authentication found
+                req.auth = { type: 'anonymous' };
+                next();
+            }
+            catch (error) {
+                console.error('Authentication error:', error);
+                return res.status(500).json({ error: 'Authentication service error' });
+            }
+        };
+    }
+    /**
+     * Middleware to require authentication
+     */
+    requireAuth() {
+        return (req, res, next) => {
+            if (!req.auth || req.auth.type === 'anonymous') {
+                return res.status(401).json({
+                    error: 'Authentication required',
+                    message: 'Please provide a valid Bearer token or X-API-Token header'
+                });
+            }
+            next();
+        };
+    }
+    /**
+     * Middleware to require specific permissions
+     */
+    requirePermission(permission) {
+        return (req, res, next) => {
+            if (!req.auth || req.auth.type === 'anonymous') {
+                return res.status(401).json({ error: 'Authentication required' });
+            }
+            if (!this.authService.hasPermission(req.auth, permission)) {
+                return res.status(403).json({
+                    error: 'Insufficient permissions',
+                    required: permission
+                });
+            }
+            next();
+        };
+    }
+    /**
+     * Middleware to require any of the specified permissions
+     */
+    requireAnyPermission(permissions) {
+        return (req, res, next) => {
+            if (!req.auth || req.auth.type === 'anonymous') {
+                return res.status(401).json({ error: 'Authentication required' });
+            }
+            if (!this.authService.hasAnyPermission(req.auth, permissions)) {
+                return res.status(403).json({
+                    error: 'Insufficient permissions',
+                    required: `One of: ${permissions.join(', ')}`
+                });
+            }
+            next();
+        };
+    }
+    /**
+     * Middleware to require all of the specified permissions
+     */
+    requireAllPermissions(permissions) {
+        return (req, res, next) => {
+            if (!req.auth || req.auth.type === 'anonymous') {
+                return res.status(401).json({ error: 'Authentication required' });
+            }
+            if (!this.authService.hasAllPermissions(req.auth, permissions)) {
+                return res.status(403).json({
+                    error: 'Insufficient permissions',
+                    required: `All of: ${permissions.join(', ')}`
+                });
+            }
+            next();
+        };
+    }
+    /**
+     * Middleware to require admin role (user authentication only)
+     */
+    requireAdmin() {
+        return (req, res, next) => {
+            if (!req.auth || req.auth.type !== 'user') {
+                return res.status(401).json({ error: 'User authentication required' });
+            }
+            if (req.auth.user.role !== 'admin') {
+                return res.status(403).json({
+                    error: 'Admin access required',
+                    currentRole: req.auth.user.role
+                });
+            }
+            next();
+        };
+    }
+    /**
+     * Middleware to require Studio access
+     */
+    requireStudioAccess() {
+        return this.requirePermission('studio:access');
+    }
+    /**
+     * Middleware for optional authentication (sets context but doesn't require it)
+     */
+    optionalAuth() {
+        return async (req, res, next) => {
+            // Use the authenticate middleware but don't fail on anonymous
+            await this.authenticate()(req, res, (error) => {
+                // Always continue, even if authentication failed
+                if (!req.auth) {
+                    req.auth = { type: 'anonymous' };
+                }
+                next(error);
+            });
+        };
+    }
+    /**
+     * Get current authentication context from request
+     */
+    static getAuthContext(req) {
+        return req.auth || { type: 'anonymous' };
+    }
+    /**
+     * Check if current request is from an authenticated user
+     */
+    static isAuthenticatedUser(req) {
+        return req.auth?.type === 'user';
+    }
+    /**
+     * Check if current request is from an app token
+     */
+    static isAppToken(req) {
+        return req.auth?.type === 'app_token';
+    }
+    /**
+     * Get user ID from authenticated request (if user auth)
+     */
+    static getUserId(req) {
+        return req.auth?.type === 'user' ? req.auth.user.id : null;
+    }
+    /**
+     * Get app token ID from authenticated request (if app token auth)
+     */
+    static getAppTokenId(req) {
+        return req.auth?.type === 'app_token' ? req.auth.token.id : null;
+    }
+}
+/**
+ * Helper function to create common middleware combinations
+ */
+export function createAuthMiddleware(config) {
+    const middleware = new AuthMiddleware(config);
+    return {
+        // Core middleware
+        authenticate: middleware.authenticate(),
+        requireAuth: middleware.requireAuth(),
+        optionalAuth: middleware.optionalAuth(),
+        // Permission-based middleware
+        requirePermission: (permission) => middleware.requirePermission(permission),
+        requireAnyPermission: (permissions) => middleware.requireAnyPermission(permissions),
+        requireAllPermissions: (permissions) => middleware.requireAllPermissions(permissions),
+        // Role-based middleware
+        requireAdmin: middleware.requireAdmin(),
+        requireStudioAccess: middleware.requireStudioAccess(),
+        // Common combinations
+        authAndPermission: (permission) => [
+            middleware.authenticate(),
+            middleware.requireAuth(),
+            middleware.requirePermission(permission)
+        ],
+        studioAuth: () => [
+            middleware.authenticate(),
+            middleware.requireAuth(),
+            middleware.requireStudioAccess()
+        ],
+        adminAuth: () => [
+            middleware.authenticate(),
+            middleware.requireAuth(),
+            middleware.requireAdmin()
+        ],
+        // Utility functions
+        getAuthContext: AuthMiddleware.getAuthContext,
+        isAuthenticatedUser: AuthMiddleware.isAuthenticatedUser,
+        isAppToken: AuthMiddleware.isAppToken,
+        getUserId: AuthMiddleware.getUserId,
+        getAppTokenId: AuthMiddleware.getAppTokenId
+    };
+}
+//# sourceMappingURL=middleware.js.map