@trokky/trokky 2.0.3

package/dist/routes/handlers/auth.d.ts

@@ -0,0 +1,150 @@
+/**
+ * AuthRoutes - Authentication, OAuth, passkey, MFA and OAuth2 server route handlers
+ */
+import type { RouteDefinition } from '../types.js';
+import { BaseRoutes } from './base.js';
+export declare class AuthRoutes extends BaseRoutes {
+    getRoutes(): RouteDefinition[];
+    private login;
+    private logout;
+    private getMe;
+    private validateToken;
+    private refreshToken;
+    /**
+     * Request password reset
+     * POST /auth/request-reset
+     */
+    private requestPasswordReset;
+    /**
+     * Reset password with token
+     * POST /auth/reset-password
+     */
+    private resetPassword;
+    /**
+     * Verify reset token validity
+     * POST /auth/verify-reset-token
+     */
+    private verifyResetToken;
+    /**
+     * Change password (authenticated users)
+     * POST /auth/change-password
+     */
+    private changePassword;
+    /**
+     * Initialize Google OAuth flow
+     * POST /auth/oauth/google/init
+     */
+    private initGoogleOAuth;
+    /**
+     * Handle Google OAuth callback
+     * POST /auth/oauth/google/callback
+     */
+    private handleGoogleOAuthCallback;
+    /**
+     * Unlink Google account
+     * DELETE /auth/oauth/google/unlink
+     */
+    private unlinkGoogleAccount;
+    /**
+     * Get OAuth status
+     * GET /auth/oauth/status
+     */
+    private getOAuthStatus;
+    /**
+     * Get passkey status
+     * GET /auth/passkey/status
+     */
+    private getPasskeyStatus;
+    /**
+     * Get passkey registration options
+     * POST /auth/passkey/register/options
+     */
+    private getPasskeyRegistrationOptions;
+    /**
+     * Verify passkey registration
+     * POST /auth/passkey/register/verify
+     */
+    private verifyPasskeyRegistration;
+    /**
+     * Get passkey login options
+     * POST /auth/passkey/login/options
+     */
+    private getPasskeyLoginOptions;
+    /**
+     * Verify passkey login
+     * POST /auth/passkey/login/verify
+     */
+    private verifyPasskeyLogin;
+    /**
+     * List passkey credentials
+     * GET /auth/passkey/credentials
+     */
+    private listPasskeyCredentials;
+    /**
+     * Update passkey credential
+     * PATCH /auth/passkey/credentials/:credentialId
+     */
+    private updatePasskeyCredential;
+    /**
+     * Delete passkey credential
+     * DELETE /auth/passkey/credentials/:credentialId
+     */
+    private deletePasskeyCredential;
+    /**
+     * Get CAPTCHA status and configuration
+     * GET /auth/captcha/status
+     */
+    private getCaptchaStatus;
+    private verifyMFA;
+    private verifyMFABackup;
+    private sendMFACode;
+    private initTOTPSetup;
+    private verifyTOTPSetup;
+    private initEmailOTPSetup;
+    private verifyEmailOTPSetup;
+    private disableMFA;
+    private disableAllMFA;
+    private regenerateBackupCodes;
+    private getMFAStatus;
+    private getTrustedDevices;
+    private revokeTrustedDevice;
+    private revokeAllTrustedDevices;
+    private adminResetUserMFA;
+    /**
+     * Start Device Authorization Flow
+     * POST /auth/device
+     * No authentication required - called by CLI
+     */
+    private startDeviceAuthorization;
+    /**
+     * Get Device Code Info (for verification page)
+     * GET /auth/device/verify?code=XXXX-XXXX
+     * Authentication required - called by Studio
+     */
+    private getDeviceCodeInfo;
+    /**
+     * Verify (Authorize/Deny) Device Code
+     * POST /auth/device/verify
+     * Authentication required - called by Studio
+     */
+    private verifyDeviceCode;
+    /**
+     * OAuth2 Token Endpoint
+     * POST /auth/token
+     * Handles device code exchange, authorization code exchange, and token refresh
+     */
+    private handleOAuth2TokenRequest;
+    /**
+     * Validate Authorization Request (for consent page)
+     * GET /auth/authorize
+     * Authentication optional - if authenticated, checks for existing consent
+     */
+    private validateAuthorizationRequest;
+    /**
+     * Handle Authorization Decision (approve/deny)
+     * POST /auth/authorize
+     * Authentication required - called when user approves/denies
+     */
+    private handleAuthorizationDecision;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/routes/handlers/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/routes/handlers/auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAA6B,eAAe,EAA+B,MAAM,aAAa,CAAA;AAC1G,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEtC,qBAAa,UAAW,SAAQ,UAAU;IACjC,SAAS,IAAI,eAAe,EAAE;YAkDvB,KAAK;YAyEL,MAAM;YAUN,KAAK;YA0BL,aAAa;YA6Bb,YAAY;IAwB1B;;;OAGG;YACW,oBAAoB;IAMlC;;;OAGG;YACW,aAAa;IAM3B;;;OAGG;YACW,gBAAgB;IAM9B;;;OAGG;YACW,cAAc;IAS5B;;;OAGG;YACW,eAAe;IAW7B;;;OAGG;YACW,yBAAyB;IAevC;;;OAGG;YACW,mBAAmB;IAMjC;;;OAGG;YACW,cAAc;IAK5B;;;OAGG;YACW,gBAAgB;IAK9B;;;OAGG;YACW,6BAA6B;IAM3C;;;OAGG;YACW,yBAAyB;IAMvC;;;OAGG;YACW,sBAAsB;IAKpC;;;OAGG;YACW,kBAAkB;IAKhC;;;OAGG;YACW,sBAAsB;IAMpC;;;OAGG;YACW,uBAAuB;IAMrC;;;OAGG;YACW,uBAAuB;IAMrC;;;OAGG;YACW,gBAAgB;YAKhB,SAAS;YAKT,eAAe;YAKf,WAAW;YAKX,aAAa;YASb,eAAe;YASf,iBAAiB;YASjB,mBAAmB;YASnB,UAAU;YAMV,aAAa;YAMb,qBAAqB;YAMrB,YAAY;YAMZ,iBAAiB;YAMjB,mBAAmB;YAMnB,uBAAuB;YAMvB,iBAAiB;IAU/B;;;;OAIG;YACW,wBAAwB;IAKtC;;;;OAIG;YACW,iBAAiB;IAM/B;;;;OAIG;YACW,gBAAgB;IAM9B;;;;OAIG;YACW,wBAAwB;IAKtC;;;;OAIG;YACW,4BAA4B;IAY1C;;;;OAIG;YACW,2BAA2B;CAM1C"}

package/dist/routes/handlers/auth.js

@@ -0,0 +1,512 @@
+/**
+ * AuthRoutes - Authentication, OAuth, passkey, MFA and OAuth2 server route handlers
+ */
+import { SecurityValidator, InvalidInputError } from '../../core/index.js';
+import { BaseRoutes } from './base.js';
+export class AuthRoutes extends BaseRoutes {
+    getRoutes() {
+        const basePath = this.config.basePath || '';
+        return this.defineRoutes([
+            ['POST', `${basePath}/auth/login`, this.login.bind(this)],
+            ['POST', `${basePath}/auth/logout`, this.logout.bind(this)],
+            ['GET', `${basePath}/auth/me`, this.getMe.bind(this)],
+            ['POST', `${basePath}/auth/validate`, this.validateToken.bind(this)],
+            ['POST', `${basePath}/auth/refresh`, this.refreshToken.bind(this)],
+            ['POST', `${basePath}/auth/request-reset`, this.requestPasswordReset.bind(this)],
+            ['POST', `${basePath}/auth/reset-password`, this.resetPassword.bind(this)],
+            ['POST', `${basePath}/auth/verify-reset-token`, this.verifyResetToken.bind(this)],
+            ['POST', `${basePath}/auth/change-password`, this.changePassword.bind(this)],
+            ['POST', `${basePath}/auth/oauth/google/init`, this.initGoogleOAuth.bind(this)],
+            ['POST', `${basePath}/auth/oauth/google/callback`, this.handleGoogleOAuthCallback.bind(this)],
+            ['DELETE', `${basePath}/auth/oauth/google/unlink`, this.unlinkGoogleAccount.bind(this)],
+            ['GET', `${basePath}/auth/oauth/status`, this.getOAuthStatus.bind(this)],
+            ['GET', `${basePath}/auth/passkey/status`, this.getPasskeyStatus.bind(this)],
+            ['POST', `${basePath}/auth/passkey/register/options`, this.getPasskeyRegistrationOptions.bind(this)],
+            ['POST', `${basePath}/auth/passkey/register/verify`, this.verifyPasskeyRegistration.bind(this)],
+            ['POST', `${basePath}/auth/passkey/login/options`, this.getPasskeyLoginOptions.bind(this)],
+            ['POST', `${basePath}/auth/passkey/login/verify`, this.verifyPasskeyLogin.bind(this)],
+            ['GET', `${basePath}/auth/passkey/credentials`, this.listPasskeyCredentials.bind(this)],
+            ['PATCH', `${basePath}/auth/passkey/credentials/:credentialId`, this.updatePasskeyCredential.bind(this)],
+            ['DELETE', `${basePath}/auth/passkey/credentials/:credentialId`, this.deletePasskeyCredential.bind(this)],
+            ['GET', `${basePath}/auth/captcha/status`, this.getCaptchaStatus.bind(this)],
+            ['POST', `${basePath}/auth/mfa/verify`, this.verifyMFA.bind(this)],
+            ['POST', `${basePath}/auth/mfa/verify-backup`, this.verifyMFABackup.bind(this)],
+            ['POST', `${basePath}/auth/mfa/send-code`, this.sendMFACode.bind(this)],
+            ['POST', `${basePath}/auth/mfa/setup/totp`, this.initTOTPSetup.bind(this)],
+            ['POST', `${basePath}/auth/mfa/setup/totp/verify`, this.verifyTOTPSetup.bind(this)],
+            ['POST', `${basePath}/auth/mfa/setup/email`, this.initEmailOTPSetup.bind(this)],
+            ['POST', `${basePath}/auth/mfa/setup/email/verify`, this.verifyEmailOTPSetup.bind(this)],
+            ['POST', `${basePath}/auth/mfa/disable`, this.disableMFA.bind(this)],
+            ['POST', `${basePath}/auth/mfa/disable-all`, this.disableAllMFA.bind(this)],
+            ['POST', `${basePath}/auth/mfa/backup-codes/regenerate`, this.regenerateBackupCodes.bind(this)],
+            ['GET', `${basePath}/auth/mfa/status`, this.getMFAStatus.bind(this)],
+            ['GET', `${basePath}/auth/mfa/trusted-devices`, this.getTrustedDevices.bind(this)],
+            ['DELETE', `${basePath}/auth/mfa/trusted-devices/:deviceId`, this.revokeTrustedDevice.bind(this)],
+            ['DELETE', `${basePath}/auth/mfa/trusted-devices`, this.revokeAllTrustedDevices.bind(this)],
+            ['POST', `${basePath}/admin/users/:userId/mfa/reset`, this.adminResetUserMFA.bind(this)],
+            ['POST', `${basePath}/auth/device`, this.startDeviceAuthorization.bind(this)],
+            ['GET', `${basePath}/auth/device/verify`, this.getDeviceCodeInfo.bind(this)],
+            ['POST', `${basePath}/auth/device/verify`, this.verifyDeviceCode.bind(this)],
+            ['POST', `${basePath}/auth/token`, this.handleOAuth2TokenRequest.bind(this)],
+            ['GET', `${basePath}/auth/authorize`, this.validateAuthorizationRequest.bind(this)],
+            ['POST', `${basePath}/auth/authorize`, this.handleAuthorizationDecision.bind(this)]
+        ]);
+    }
+    // Authentication handlers
+    async login(request) {
+        try {
+            // SECURITY: Validate request body structure
+            if (!request.body || typeof request.body !== 'object') {
+                throw new InvalidInputError('Request body is required', 'body');
+            }
+            const body = request.body;
+            // Validate required fields
+            if (!body.username || !body.password) {
+                throw new InvalidInputError('Username and password are required', 'body');
+            }
+            SecurityValidator.validateUsername(body.username);
+            // Validate CAPTCHA if required
+            const { validateCaptcha, getClientIp } = await import('../auth/captcha.js');
+            await validateCaptcha(this.core, body.captchaToken, getClientIp(request), 'login');
+            // Use core engine's authentication method (handles all validation internally)
+            const authResult = await this.core.authenticateUser(body.username, body.password, {
+                rememberMe: body.rememberMe,
+                deviceId: body.deviceId
+            });
+            if (!authResult) {
+                throw new InvalidInputError('Invalid credentials', 'credentials');
+            }
+            // Handle different authentication result types
+            if (authResult.type === 'mfa_required') {
+                // User has MFA configured - need to verify
+                return this.successResponse({
+                    success: true,
+                    requiresMFA: true,
+                    mfaToken: authResult.mfaToken,
+                    methods: authResult.methods,
+                    expiresIn: authResult.expiresIn
+                });
+            }
+            if (authResult.type === 'mfa_setup_required') {
+                // Organization requires MFA but user hasn't set it up
+                return this.successResponse({
+                    success: true,
+                    requiresMFASetup: true,
+                    setupToken: authResult.setupToken,
+                    allowedMethods: authResult.allowedMethods,
+                    message: authResult.message,
+                    expiresIn: authResult.expiresIn
+                });
+            }
+            // Normal successful authentication (type: 'success')
+            const { user: authenticatedUser, token, refreshToken } = authResult;
+            // Get token expiration time
+            const session = await this.core.verifyAuthToken(token);
+            const response = {
+                success: true,
+                token,
+                refreshToken,
+                user: authenticatedUser,
+                expiresAt: session?.expiresAt
+            };
+            return this.successResponse(response);
+        }
+        catch (error) {
+            return this.errorResponse(error);
+        }
+    }
+    async logout(request) {
+        try {
+            // For now, logout is client-side token removal
+            // In a full implementation, we'd invalidate the token server-side
+            return this.successResponse({ message: 'Logged out successfully' });
+        }
+        catch (error) {
+            return this.errorResponse(error);
+        }
+    }
+    async getMe(request) {
+        try {
+            // SECURITY: Validate authentication and get current user session
+            await this.validateAuthentication(request);
+            const sessionUser = await this.getCurrentUser(request);
+            if (!sessionUser) {
+                throw new Error('User session not found');
+            }
+            // Fetch full user data from storage using the user ID from session
+            const fullUser = await this.core.getUser(sessionUser.id);
+            if (!fullUser) {
+                throw new Error('User not found in database');
+            }
+            // Remove password hash from response for security
+            const { passwordHash, ...safeUser } = fullUser;
+            return this.successResponse(safeUser);
+        }
+        catch (error) {
+            return this.errorResponse(error);
+        }
+    }
+    async validateToken(request) {
+        try {
+            // SECURITY: Validate request body structure
+            if (!request.body || typeof request.body !== 'object') {
+                throw new InvalidInputError('Request body is required', 'body');
+            }
+            const body = request.body;
+            if (!('token' in body) || !body.token || typeof body.token !== 'string') {
+                throw new InvalidInputError('Token is required', 'token');
+            }
+            const { token } = body;
+            // Validate token using core engine's JWT verification
+            const session = await this.core.verifyAuthToken(token);
+            const isValid = session !== null;
+            return this.successResponse({
+                valid: isValid,
+                message: isValid ? 'Token is valid' : 'Token is invalid',
+                session: isValid ? session : undefined
+            });
+        }
+        catch (error) {
+            return this.errorResponse(error);
+        }
+    }
+    // Authentication Routes
+    async refreshToken(request) {
+        try {
+            if (!request.body || typeof request.body !== 'object') {
+                return this.errorResponse(new InvalidInputError('Request body is required'));
+            }
+            const body = request.body;
+            const { refreshToken } = body;
+            if (!refreshToken) {
+                return this.errorResponse(new InvalidInputError('Refresh token is required'));
+            }
+            // TODO: Core method exists but may not be implemented yet
+            const result = await this.core.refreshAuthToken(refreshToken);
+            if (!result) {
+                return this.errorResponse(new Error('Invalid or expired refresh token'), 401);
+            }
+            return this.successResponse(result);
+        }
+        catch (error) {
+            return this.errorResponse(error);
+        }
+    }
+    /**
+     * Request password reset
+     * POST /auth/request-reset
+     */
+    async requestPasswordReset(request) {
+        // Import password reset handler dynamically
+        const { requestPasswordReset: handler } = await import('../auth/password-reset.js');
+        return handler(request, this.core);
+    }
+    /**
+     * Reset password with token
+     * POST /auth/reset-password
+     */
+    async resetPassword(request) {
+        // Import password reset handler dynamically
+        const { resetPassword: handler } = await import('../auth/password-reset.js');
+        return handler(request, this.core);
+    }
+    /**
+     * Verify reset token validity
+     * POST /auth/verify-reset-token
+     */
+    async verifyResetToken(request) {
+        // Import password reset handler dynamically
+        const { verifyResetToken: handler } = await import('../auth/password-reset.js');
+        return handler(request, this.core);
+    }
+    /**
+     * Change password (authenticated users)
+     * POST /auth/change-password
+     */
+    async changePassword(request) {
+        // SECURITY: Validate authentication and populate request.user
+        await this.validateAuthentication(request);
+        // Import change password handler dynamically
+        const { changePassword: handler } = await import('../auth/change-password.js');
+        return handler(request, this.core);
+    }
+    /**
+     * Initialize Google OAuth flow
+     * POST /auth/oauth/google/init
+     */
+    async initGoogleOAuth(request) {
+        // For link mode, validate authentication
+        const body = request.body;
+        if (body?.mode === 'link') {
+            await this.validateAuthentication(request);
+        }
+        const { initGoogleOAuth: handler } = await import('../auth/oauth.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Handle Google OAuth callback
+     * POST /auth/oauth/google/callback
+     */
+    async handleGoogleOAuthCallback(request) {
+        // For link mode, validate authentication
+        const body = request.body;
+        if (body?.mode === 'link') {
+            try {
+                await this.validateAuthentication(request);
+            }
+            catch {
+                // Ignore auth errors for link mode - the handler will check
+            }
+        }
+        const { handleGoogleOAuthCallback: handler } = await import('../auth/oauth.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Unlink Google account
+     * DELETE /auth/oauth/google/unlink
+     */
+    async unlinkGoogleAccount(request) {
+        await this.validateAuthentication(request);
+        const { unlinkGoogleAccount: handler } = await import('../auth/oauth.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Get OAuth status
+     * GET /auth/oauth/status
+     */
+    async getOAuthStatus(request) {
+        const { getOAuthStatus: handler } = await import('../auth/oauth.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Get passkey status
+     * GET /auth/passkey/status
+     */
+    async getPasskeyStatus(request) {
+        const { getPasskeyStatus: handler } = await import('../auth/passkey.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Get passkey registration options
+     * POST /auth/passkey/register/options
+     */
+    async getPasskeyRegistrationOptions(request) {
+        await this.validateAuthentication(request);
+        const { getPasskeyRegistrationOptions: handler } = await import('../auth/passkey.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Verify passkey registration
+     * POST /auth/passkey/register/verify
+     */
+    async verifyPasskeyRegistration(request) {
+        await this.validateAuthentication(request);
+        const { verifyPasskeyRegistration: handler } = await import('../auth/passkey.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Get passkey login options
+     * POST /auth/passkey/login/options
+     */
+    async getPasskeyLoginOptions(request) {
+        const { getPasskeyAuthenticationOptions: handler } = await import('../auth/passkey.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Verify passkey login
+     * POST /auth/passkey/login/verify
+     */
+    async verifyPasskeyLogin(request) {
+        const { verifyPasskeyAuthentication: handler } = await import('../auth/passkey.js');
+        return handler(this.core, request);
+    }
+    /**
+     * List passkey credentials
+     * GET /auth/passkey/credentials
+     */
+    async listPasskeyCredentials(request) {
+        await this.validateAuthentication(request);
+        const { listPasskeyCredentials: handler } = await import('../auth/passkey.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Update passkey credential
+     * PATCH /auth/passkey/credentials/:credentialId
+     */
+    async updatePasskeyCredential(request) {
+        await this.validateAuthentication(request);
+        const { updatePasskeyCredential: handler } = await import('../auth/passkey.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Delete passkey credential
+     * DELETE /auth/passkey/credentials/:credentialId
+     */
+    async deletePasskeyCredential(request) {
+        await this.validateAuthentication(request);
+        const { deletePasskeyCredential: handler } = await import('../auth/passkey.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Get CAPTCHA status and configuration
+     * GET /auth/captcha/status
+     */
+    async getCaptchaStatus(request) {
+        const { getCaptchaStatus: handler } = await import('../auth/captcha.js');
+        return handler(request, this.core);
+    }
+    async verifyMFA(request) {
+        const { verifyMFA: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async verifyMFABackup(request) {
+        const { verifyMFABackup: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async sendMFACode(request) {
+        const { sendMFACode: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async initTOTPSetup(request) {
+        // Allow either auth token or MFA setup token (for login flow)
+        if (!request.headers['x-mfa-setup-token']) {
+            await this.validateAuthentication(request);
+        }
+        const { initTOTPSetup: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async verifyTOTPSetup(request) {
+        // Allow either auth token or MFA setup token (for login flow)
+        if (!request.headers['x-mfa-setup-token']) {
+            await this.validateAuthentication(request);
+        }
+        const { verifyTOTPSetup: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async initEmailOTPSetup(request) {
+        // Allow either auth token or MFA setup token (for login flow)
+        if (!request.headers['x-mfa-setup-token']) {
+            await this.validateAuthentication(request);
+        }
+        const { initEmailOTPSetup: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async verifyEmailOTPSetup(request) {
+        // Allow either auth token or MFA setup token (for login flow)
+        if (!request.headers['x-mfa-setup-token']) {
+            await this.validateAuthentication(request);
+        }
+        const { verifyEmailOTPSetup: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async disableMFA(request) {
+        await this.validateAuthentication(request);
+        const { disableMFA: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async disableAllMFA(request) {
+        await this.validateAuthentication(request);
+        const { disableAllMFA: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async regenerateBackupCodes(request) {
+        await this.validateAuthentication(request);
+        const { regenerateBackupCodes: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async getMFAStatus(request) {
+        await this.validateAuthentication(request);
+        const { getMFAStatus: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async getTrustedDevices(request) {
+        await this.validateAuthentication(request);
+        const { getTrustedDevices: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async revokeTrustedDevice(request) {
+        await this.validateAuthentication(request);
+        const { revokeTrustedDevice: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async revokeAllTrustedDevices(request) {
+        await this.validateAuthentication(request);
+        const { revokeAllTrustedDevices: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    async adminResetUserMFA(request) {
+        await this.validateAuthentication(request);
+        // Require admin role for MFA reset
+        if (request.user?.role !== 'admin') {
+            return this.errorResponse(new InvalidInputError('Admin access required', 'permissions'), 403);
+        }
+        const { adminResetUserMFA: handler } = await import('../auth/mfa.js');
+        return handler(request, this.core);
+    }
+    /**
+     * Start Device Authorization Flow
+     * POST /auth/device
+     * No authentication required - called by CLI
+     */
+    async startDeviceAuthorization(request) {
+        const { startDeviceAuthorization: handler } = await import('../auth/oauth2-server.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Get Device Code Info (for verification page)
+     * GET /auth/device/verify?code=XXXX-XXXX
+     * Authentication required - called by Studio
+     */
+    async getDeviceCodeInfo(request) {
+        await this.validateAuthentication(request);
+        const { getDeviceCodeInfo: handler } = await import('../auth/oauth2-server.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Verify (Authorize/Deny) Device Code
+     * POST /auth/device/verify
+     * Authentication required - called by Studio
+     */
+    async verifyDeviceCode(request) {
+        await this.validateAuthentication(request);
+        const { verifyDeviceCode: handler } = await import('../auth/oauth2-server.js');
+        return handler(this.core, request);
+    }
+    /**
+     * OAuth2 Token Endpoint
+     * POST /auth/token
+     * Handles device code exchange, authorization code exchange, and token refresh
+     */
+    async handleOAuth2TokenRequest(request) {
+        const { handleTokenRequest: handler } = await import('../auth/oauth2-server.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Validate Authorization Request (for consent page)
+     * GET /auth/authorize
+     * Authentication optional - if authenticated, checks for existing consent
+     */
+    async validateAuthorizationRequest(request) {
+        // Try to authenticate, but don't fail if no token present
+        // This allows consent checking for logged-in users
+        try {
+            await this.validateAuthentication(request);
+        }
+        catch {
+            // Ignore auth errors - user just won't get auto-approval
+        }
+        const { validateAuthorizationRequest: handler } = await import('../auth/oauth2-server.js');
+        return handler(this.core, request);
+    }
+    /**
+     * Handle Authorization Decision (approve/deny)
+     * POST /auth/authorize
+     * Authentication required - called when user approves/denies
+     */
+    async handleAuthorizationDecision(request) {
+        await this.validateAuthentication(request);
+        const { handleAuthorizationDecision: handler } = await import('../auth/oauth2-server.js');
+        return handler(this.core, request);
+    }
+}
+//# sourceMappingURL=auth.js.map