@tstdl/base 0.93.182 → 0.93.183

package/api/server/api-request-token.provider.js

@@ -19,7 +19,7 @@ export class ApiRequestTokenProvider {
 }
 let NoopApiRequestTokenProvider = class NoopApiRequestTokenProvider extends ApiRequestTokenProvider {
     tryGetToken(_requestData) {
-        throw new Error('No RequestInfoProvider registered');
+        throw new Error('No ApiRequestTokenProvider registered');
     }
 };
 NoopApiRequestTokenProvider = __decorate([

package/api/server/gateway.js

@@ -246,7 +246,12 @@ let ApiGateway = ApiGateway_1 = class ApiGateway {
         else {
             const endpointDefinitionResult = context.endpoint.definition.result;
             if (isDevMode() && isDefined(endpointDefinitionResult) && (endpointDefinitionResult != DataStream) && (endpointDefinitionResult != ServerSentEvents)) {
-                Schema.assert(endpointDefinitionResult, result);
+                try {
+                    Schema.assert(endpointDefinitionResult, result);
+                }
+                catch (error) {
+                    throw new Error(`Result of endpoint ${context.request.method} ${context.api.resource} (${context.endpoint.implementation.name}) did not match schema.`, { cause: error });
+                }
             }
             context.response.body = match(result)
                 .when(isUint8Array, (buffer) => ({ buffer }))

package/authentication/authentication.api.d.ts

@@ -2,7 +2,7 @@ import { type ApiDefinition, type ApiEndpointsDefinition } from '../api/types.js
 import { type ObjectSchema, type ObjectSchemaOrType } from '../schema/index.js';
 import type { SchemaTestable } from '../schema/schema.js';
 import type { Record } from '../types/index.js';
-import { type TokenPayload } from './models/index.js';
+import { TotpEnrollmentInitResult, TotpRecoveryCodesResult, TotpStatusResult, type TokenPayload } from './models/index.js';
 import { PasswordCheckResult } from './models/password-check-result.model.js';
 /**
  * Can be provided in {@link ApiEndpointDefinition} data property to signal that the request does not need a valid token.
@@ -83,10 +83,7 @@ export declare const authenticationApiDefinition: {
         initEnrollTotp: {
             resource: string;
             method: "POST";
-            result: ObjectSchema<{
-                secret: string;
-                uri: string;
-            }>;
+            result: typeof TotpEnrollmentInitResult;
             credentials: true;
         };
         completeEnrollTotp: {
@@ -95,9 +92,7 @@ export declare const authenticationApiDefinition: {
             parameters: ObjectSchema<{
                 token: string;
             }>;
-            result: ObjectSchema<{
-                recoveryCodes: string[];
-            }>;
+            result: typeof TotpRecoveryCodesResult;
             credentials: true;
         };
         disableTotp: {
@@ -125,17 +120,13 @@ export declare const authenticationApiDefinition: {
                 token: string;
                 invalidateOtherSessions?: boolean | undefined;
             }>;
-            result: ObjectSchema<{
-                recoveryCodes: string[];
-            }>;
+            result: typeof TotpRecoveryCodesResult;
             credentials: true;
         };
         getTotpStatus: {
             resource: string;
             method: "GET";
-            result: ObjectSchema<{
-                active: boolean;
-            }>;
+            result: typeof TotpStatusResult;
             credentials: true;
         };
         refresh: {
@@ -322,10 +313,7 @@ export declare function getAuthenticationApiDefinition<AdditionalTokenPayload ex
         initEnrollTotp: {
             resource: string;
             method: "POST";
-            result: ObjectSchema<{
-                secret: string;
-                uri: string;
-            }>;
+            result: typeof TotpEnrollmentInitResult;
             credentials: true;
         };
         completeEnrollTotp: {
@@ -334,9 +322,7 @@ export declare function getAuthenticationApiDefinition<AdditionalTokenPayload ex
             parameters: ObjectSchema<{
                 token: string;
             }>;
-            result: ObjectSchema<{
-                recoveryCodes: string[];
-            }>;
+            result: typeof TotpRecoveryCodesResult;
             credentials: true;
         };
         disableTotp: {
@@ -364,17 +350,13 @@ export declare function getAuthenticationApiDefinition<AdditionalTokenPayload ex
                 token: string;
                 invalidateOtherSessions?: boolean | undefined;
             }>;
-            result: ObjectSchema<{
-                recoveryCodes: string[];
-            }>;
+            result: typeof TotpRecoveryCodesResult;
             credentials: true;
         };
         getTotpStatus: {
             resource: string;
             method: "GET";
-            result: ObjectSchema<{
-                active: boolean;
-            }>;
+            result: typeof TotpStatusResult;
             credentials: true;
         };
         refresh: {
@@ -556,10 +538,7 @@ export declare function getAuthenticationApiEndpointsDefinition<AdditionalTokenP
     initEnrollTotp: {
         resource: string;
         method: "POST";
-        result: ObjectSchema<{
-            secret: string;
-            uri: string;
-        }>;
+        result: typeof TotpEnrollmentInitResult;
         credentials: true;
     };
     completeEnrollTotp: {
@@ -568,9 +547,7 @@ export declare function getAuthenticationApiEndpointsDefinition<AdditionalTokenP
         parameters: ObjectSchema<{
             token: string;
         }>;
-        result: ObjectSchema<{
-            recoveryCodes: string[];
-        }>;
+        result: typeof TotpRecoveryCodesResult;
         credentials: true;
     };
     disableTotp: {
@@ -598,17 +575,13 @@ export declare function getAuthenticationApiEndpointsDefinition<AdditionalTokenP
             token: string;
             invalidateOtherSessions?: boolean | undefined;
         }>;
-        result: ObjectSchema<{
-            recoveryCodes: string[];
-        }>;
+        result: typeof TotpRecoveryCodesResult;
         credentials: true;
     };
     getTotpStatus: {
         resource: string;
         method: "GET";
-        result: ObjectSchema<{
-            active: boolean;
-        }>;
+        result: typeof TotpStatusResult;
         credentials: true;
     };
     refresh: {

package/authentication/authentication.api.js

@@ -1,6 +1,6 @@
 import { defineApi } from '../api/types.js';
 import { array, assign, boolean, defaulted, emptyObjectSchema, explicitObject, literal, never, number, object, optional, pick, string, union } from '../schema/index.js';
-import { AuthenticationSession } from './models/index.js';
+import { AuthenticationSession, TotpEnrollmentInitResult, TotpRecoveryCodesResult, TotpStatusResult } from './models/index.js';
 import { PasswordCheckResult } from './models/password-check-result.model.js';
 import { TokenPayloadBase } from './models/token-payload-base.model.js';
 /**
@@ -100,10 +100,7 @@ export function getAuthenticationApiEndpointsDefinition(additionalTokenPayloadSc
         initEnrollTotp: {
             resource: 'totp/enroll/init',
             method: 'POST',
-            result: object({
-                secret: string(),
-                uri: string(),
-            }),
+            result: TotpEnrollmentInitResult,
             credentials: true,
         },
         completeEnrollTotp: {
@@ -112,9 +109,7 @@ export function getAuthenticationApiEndpointsDefinition(additionalTokenPayloadSc
             parameters: object({
                 token: string(),
             }),
-            result: object({
-                recoveryCodes: array(string()),
-            }),
+            result: TotpRecoveryCodesResult,
             credentials: true,
         },
         disableTotp: {
@@ -142,17 +137,13 @@ export function getAuthenticationApiEndpointsDefinition(additionalTokenPayloadSc
                 token: string(),
                 invalidateOtherSessions: optional(boolean()),
             }),
-            result: object({
-                recoveryCodes: array(string()),
-            }),
+            result: TotpRecoveryCodesResult,
             credentials: true,
         },
         getTotpStatus: {
             resource: 'totp/status',
             method: 'GET',
-            result: object({
-                active: boolean(),
-            }),
+            result: TotpStatusResult,
             credentials: true,
         },
         refresh: {

package/authentication/client/authentication.service.d.ts

@@ -1,7 +1,7 @@
 import type { AfterResolve } from '../../injector/index.js';
 import { afterResolve } from '../../injector/index.js';
 import type { Record } from '../../types/index.js';
-import type { AuthenticationSession, PasswordCheckResult, TokenPayload } from '../models/index.js';
+import type { AuthenticationSession, PasswordCheckResult, TokenPayload, TotpEnrollmentInitResult, TotpRecoveryCodesResult, TotpStatusResult } from '../models/index.js';
 import type { LoginTotpResult } from '../server/authentication.service.js';
 import type { SubjectInput } from '../types.js';
 /**
@@ -59,6 +59,7 @@ export declare class AuthenticationClientService<AdditionalTokenPayload extends
     readonly impersonator: import("../../signals/api.js").Signal<string | undefined>;
     /** Whether the user is impersonated */
     readonly impersonated: import("../../signals/api.js").Signal<boolean>;
+    readonly totpStatus: import("../../signals/api.js").Signal<TotpStatusResult | undefined>;
     /** Current token */
     readonly token$: import("rxjs").Observable<TokenPayload<AdditionalTokenPayload> | undefined>;
     /** Emits when token is available (not undefined) */
@@ -196,18 +197,13 @@ export declare class AuthenticationClientService<AdditionalTokenPayload extends
      * Initiate TOTP enrollment.
      * @returns The secret and URI for enrollment.
      */
-    initEnrollTotp(): Promise<{
-        secret: string;
-        uri: string;
-    }>;
+    initEnrollTotp(): Promise<TotpEnrollmentInitResult>;
     /**
      * Complete TOTP enrollment.
      * @param token The TOTP token to verify.
      * @returns The recovery codes.
      */
-    completeEnrollTotp(token: string): Promise<{
-        recoveryCodes: string[];
-    }>;
+    completeEnrollTotp(token: string): Promise<TotpRecoveryCodesResult>;
     /**
      * Disable TOTP.
      * @param token The TOTP token.
@@ -226,16 +222,12 @@ export declare class AuthenticationClientService<AdditionalTokenPayload extends
      */
     regenerateRecoveryCodes(token: string, options?: {
         invalidateOtherSessions?: boolean;
-    }): Promise<{
-        recoveryCodes: string[];
-    }>;
+    }): Promise<TotpRecoveryCodesResult>;
     /**
      * Get TOTP activation status.
      * @returns Whether TOTP is active.
      */
-    getTotpStatus(): Promise<{
-        active: boolean;
-    }>;
+    getTotpStatus(): Promise<TotpStatusResult>;
     /**
      * Check a password for requirements.
      * @param password The password to check

package/authentication/client/authentication.service.js

@@ -22,6 +22,7 @@ import { Lock } from '../../lock/index.js';
 import { Logger } from '../../logger/index.js';
 import { MessageBus } from '../../message-bus/index.js';
 import { computed, signal, toObservable } from '../../signals/api.js';
+import { deriveAsync } from '../../signals/index.js';
 import { currentTimestampSeconds } from '../../utils/date-time.js';
 import { clamp } from '../../utils/math.js';
 import { timeout } from '../../utils/timing.js';
@@ -38,6 +39,7 @@ const tokenUpdateBusName = 'AuthenticationService:tokenUpdate';
 const loggedOutBusName = 'AuthenticationService:loggedOut';
 const refreshLockResource = 'AuthenticationService:refresh';
 const minRefreshDelay = millisecondsPerMinute;
+const refreshLoopTightLoopDelay = 5 * millisecondsPerSecond;
 const maxRefreshDelay = 15 * millisecondsPerMinute;
 const lockTimeout = 10_000;
 const logoutTimeout = 150;
@@ -104,6 +106,19 @@ let AuthenticationClientService = class AuthenticationClientService {
     impersonator = computed(() => this.token()?.impersonator);
     /** Whether the user is impersonated */
     impersonated = computed(() => isDefined(this.impersonator()));
+    totpStatus = deriveAsync(async () => {
+        const token = this.token();
+        if (isUndefined(token)) {
+            return undefined;
+        }
+        try {
+            return await this.getTotpStatus();
+        }
+        catch (error) {
+            this.logger.error(error);
+            return undefined;
+        }
+    });
     /** Current token */
     token$ = toObservable(this.token);
     /** Emits when token is available (not undefined) */
@@ -269,6 +284,9 @@ let AuthenticationClientService = class AuthenticationClientService {
             await this.loggingOut;
             return;
         }
+        if (!this.isLoggedIn()) {
+            return;
+        }
         this.loggingOut = (async () => {
             try {
                 await Promise.race([
@@ -535,8 +553,8 @@ let AuthenticationClientService = class AuthenticationClientService {
                         const newBuffer = calculateRefreshBufferSeconds(newToken);
                         const stillNeedsRefresh = this.forceRefreshRequested() || (newNow >= newToken.exp - newBuffer);
                         if (stillNeedsRefresh) {
-                            this.logger.warn('Token still needs refresh after attempt. Waiting for minRefreshDelay to avoid tight loop.');
-                            await waitForNextAction(minRefreshDelay, newToken.exp);
+                            this.logger.warn('Token still needs refresh after attempt. Waiting briefly to avoid tight loop.');
+                            await waitForNextAction(refreshLoopTightLoopDelay, newToken.exp);
                         }
                     }
                     await waitForNextAction(100, newToken?.exp);
@@ -552,7 +570,7 @@ let AuthenticationClientService = class AuthenticationClientService {
             }
             catch (error) {
                 this.logger.error(error);
-                await waitForNextAction(2500, token.exp);
+                await waitForNextAction(refreshLoopTightLoopDelay, token.exp);
             }
         }
     }
@@ -560,7 +578,7 @@ let AuthenticationClientService = class AuthenticationClientService {
         this.logger.error(error);
         this.errorSubject.next(error);
         const isUnrecoverable = unrecoverableErrors.some((errorType) => isInstanceOf(error, errorType))
-            || (error instanceof HttpError && ((error.response?.statusCode == 401) || (error.response?.statusCode == 404)));
+            || (isInstanceOf(error, HttpError) && ((error.response?.statusCode == 400) || (error.response?.statusCode == 401) || (error.response?.statusCode == 404)));
         if (isUnrecoverable) {
             await this.logout();
         }

package/authentication/client/module.d.ts

@@ -26,4 +26,4 @@ export type AuthenticationClientModuleConfig = {
  * @param config Configuration
  * @param injector The injector to use. If not provided, the current injector is used.
  */
-export declare function configureAuthenticationClient(config: AuthenticationClientModuleConfig, injector?: Injector | null): void;
+export declare function configureAuthenticationClient(config?: AuthenticationClientModuleConfig | undefined, injector?: Injector | null): void;

package/authentication/client/module.js

@@ -9,14 +9,14 @@ import { AUTHENTICATION_API_CLIENT, INITIAL_AUTHENTICATION_DATA } from './tokens
  * @param config Configuration
  * @param injector The injector to use. If not provided, the current injector is used.
  */
-export function configureAuthenticationClient(config, injector = getCurrentInjector()) {
-    if (isDefined(config.authenticationApiClient)) {
+export function configureAuthenticationClient(config = undefined, injector = getCurrentInjector()) {
+    if (isDefined(config?.authenticationApiClient)) {
         (injector ?? Injector).registerSingleton(AUTHENTICATION_API_CLIENT, { useToken: config.authenticationApiClient });
     }
-    if (isDefined(config.initialAuthenticationData)) {
+    if (isDefined(config?.initialAuthenticationData)) {
         (injector ?? Injector).register(INITIAL_AUTHENTICATION_DATA, { useValue: config.initialAuthenticationData });
     }
-    if (config.registerMiddleware == true) {
+    if (config?.registerMiddleware == true) {
         (injector ?? Injector).register(HTTP_CLIENT_MIDDLEWARE, {
             useFactory(_, context) {
                 const authenticationService = context.resolve(forwardRef(() => AuthenticationClientService, 'object'));

package/authentication/models/index.d.ts

@@ -10,4 +10,5 @@ export * from './subject.model.js';
 export * from './system-account.model.js';
 export * from './token-payload-base.model.js';
 export * from './token.model.js';
+export * from './totp-results.model.js';
 export * from './user.model.js';

package/authentication/models/index.js

@@ -10,4 +10,5 @@ export * from './subject.model.js';
 export * from './system-account.model.js';
 export * from './token-payload-base.model.js';
 export * from './token.model.js';
+export * from './totp-results.model.js';
 export * from './user.model.js';

package/authentication/models/totp-results.model.d.ts

@@ -0,0 +1,11 @@
+/** biome-ignore-all lint/nursery/noExcessiveClassesPerFile: <explanation> */
+export declare class TotpEnrollmentInitResult {
+    secret: string;
+    uri: string;
+}
+export declare class TotpRecoveryCodesResult {
+    recoveryCodes: string[];
+}
+export declare class TotpStatusResult {
+    active: boolean;
+}

package/authentication/models/totp-results.model.js

@@ -0,0 +1,37 @@
+/** biome-ignore-all lint/nursery/noExcessiveClassesPerFile: <explanation> */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Array, BooleanProperty, StringProperty } from '../../schema/index.js';
+export class TotpEnrollmentInitResult {
+    secret;
+    uri;
+}
+__decorate([
+    StringProperty(),
+    __metadata("design:type", String)
+], TotpEnrollmentInitResult.prototype, "secret", void 0);
+__decorate([
+    StringProperty(),
+    __metadata("design:type", String)
+], TotpEnrollmentInitResult.prototype, "uri", void 0);
+export class TotpRecoveryCodesResult {
+    recoveryCodes;
+}
+__decorate([
+    Array(String),
+    __metadata("design:type", Array)
+], TotpRecoveryCodesResult.prototype, "recoveryCodes", void 0);
+export class TotpStatusResult {
+    active;
+}
+__decorate([
+    BooleanProperty(),
+    __metadata("design:type", Boolean)
+], TotpStatusResult.prototype, "active", void 0);

package/authentication/server/authentication.api-controller.d.ts

@@ -26,9 +26,9 @@ export declare class AuthenticationApiController<AdditionalTokenPayload extends
      * @param parameters The parameters for the request.
      * @returns The token result.
      */
-    login({ request, parameters, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'login'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'login'>>;
-    loginVerifyTotp({ request, parameters, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'loginVerifyTotp'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'loginVerifyTotp'>>;
-    loginRecovery({ request, parameters, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'loginRecovery'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'loginRecovery'>>;
+    login({ request, parameters, tryGetToken, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'login'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'login'>>;
+    loginVerifyTotp({ request, parameters, tryGetToken, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'loginVerifyTotp'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'loginVerifyTotp'>>;
+    loginRecovery({ request, parameters, tryGetToken, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'loginRecovery'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'loginRecovery'>>;
     initEnrollTotp({ getToken, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'initEnrollTotp'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'initEnrollTotp'>>;
     completeEnrollTotp({ request, getToken, parameters, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'completeEnrollTotp'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'completeEnrollTotp'>>;
     disableTotp({ request, getToken, parameters, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'disableTotp'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'disableTotp'>>;

package/authentication/server/authentication.api-controller.js

@@ -16,7 +16,7 @@ import { inject } from '../../injector/index.js';
 import { Logger } from '../../logger/logger.js';
 import { RateLimiter } from '../../rate-limit/index.js';
 import { currentTimestampSeconds } from '../../utils/date-time.js';
-import { isDefined } from '../../utils/type-guards.js';
+import { isDefined, isNotNull } from '../../utils/type-guards.js';
 import { millisecondsPerMinute } from '../../utils/units.js';
 import { authenticationApiDefinition, getAuthenticationApiDefinition } from '../authentication.api.js';
 import { AuthenticationService, AuthenticationServiceOptions } from './authentication.service.js';
@@ -49,24 +49,51 @@ let AuthenticationApiController = AuthenticationApiController_1 = class Authenti
      * @param parameters The parameters for the request.
      * @returns The token result.
      */
-    async login({ request, parameters, getAuditor }) {
+    async login({ request, parameters, tryGetToken, getAuditor }) {
         const auditor = await getAuditor();
+        try {
+            const token = await tryGetToken();
+            if (isNotNull(token)) {
+                await this.authenticationService.endSession(token.payload.session, auditor);
+            }
+        }
+        catch (error) {
+            this.#logger.error('Error validating existing token during login:', error);
+        }
         const subjectResource = `${parameters.tenantId ?? NIL_UUID}:${parameters.subject}`;
         const actualSubject = await this.authenticationService.tryResolveSubject({ tenantId: parameters.tenantId, subject: parameters.subject });
         await this.enforceRateLimit(request.ip, subjectResource, auditor, actualSubject?.id ?? NIL_UUID, 'login');
         const result = await this.authenticationService.login({ tenantId: parameters.tenantId, subject: parameters.subject }, parameters.password, parameters.data, auditor, parameters.remember);
         return this.getLoginResponse(result);
     }
-    async loginVerifyTotp({ request, parameters, getAuditor }) {
+    async loginVerifyTotp({ request, parameters, tryGetToken, getAuditor }) {
         const auditor = await getAuditor();
+        try {
+            const token = await tryGetToken();
+            if (isNotNull(token)) {
+                await this.authenticationService.endSession(token.payload.session, auditor);
+            }
+        }
+        catch (error) {
+            this.#logger.error('Error validating existing token during login:', error);
+        }
         const validatedChallengeToken = await this.authenticationService.validateTotpChallengeToken(parameters.challengeToken);
         const subjectResource = `${validatedChallengeToken.payload.tenant}:${validatedChallengeToken.payload.subject}`;
         await this.enforceRateLimit(request.ip, subjectResource, auditor, validatedChallengeToken.payload.subject, 'login-verify-totp');
         const result = await this.authenticationService.loginVerifyTotp(parameters.challengeToken, parameters.token, auditor);
         return this.getLoginResponse(result);
     }
-    async loginRecovery({ request, parameters, getAuditor }) {
+    async loginRecovery({ request, parameters, tryGetToken, getAuditor }) {
         const auditor = await getAuditor();
+        try {
+            const token = await tryGetToken();
+            if (isNotNull(token)) {
+                await this.authenticationService.endSession(token.payload.session, auditor);
+            }
+        }
+        catch (error) {
+            this.#logger.error('Error validating existing token during login:', error);
+        }
         const validatedChallengeToken = await this.authenticationService.validateTotpChallengeToken(parameters.challengeToken);
         const subjectResource = `${validatedChallengeToken.payload.tenant}:${validatedChallengeToken.payload.subject}`;
         await this.enforceRateLimit(request.ip, subjectResource, auditor, validatedChallengeToken.payload.subject, 'login-recovery');

package/authentication/server/authentication.service.d.ts

@@ -2,7 +2,7 @@
 import { Auditor } from '../../audit/index.js';
 import { type Argon2Params, type TotpHashAlgorithm } from '../../cryptography/index.js';
 import type { Record, TypedOmit } from '../../types/index.js';
-import { AuthenticationSession, AuthenticationTotp, Subject, type PasswordCheckResult, type PasswordResetToken, type RefreshToken, type Token, type TotpChallengeToken } from '../models/index.js';
+import { AuthenticationSession, AuthenticationTotp, Subject, TotpEnrollmentInitResult, TotpRecoveryCodesResult, TotpStatusResult, type PasswordCheckResult, type PasswordResetToken, type RefreshToken, type Token, type TotpChallengeToken } from '../models/index.js';
 import type { SubjectInput } from '../types.js';
 import { type PasswordTestResult } from './authentication-password-requirements.validator.js';
 /**
@@ -456,23 +456,14 @@ export declare class AuthenticationService<AdditionalTokenPayload extends Record
     private createPasswordResetToken;
     private getHash;
     tryGetTotp(tenantId: string, subjectId: string): Promise<AuthenticationTotp | undefined>;
-    getTotpStatus(tenantId: string, subjectId: string): Promise<{
-        active: boolean;
-    }>;
-    initEnrollTotp(tenantId: string, subjectId: string, auditor: Auditor): Promise<{
-        secret: string;
-        uri: string;
-    }>;
-    completeEnrollTotp(tenantId: string, subjectId: string, token: string, auditor: Auditor): Promise<{
-        recoveryCodes: string[];
-    }>;
+    getTotpStatus(tenantId: string, subjectId: string): Promise<TotpStatusResult>;
+    initEnrollTotp(tenantId: string, subjectId: string, auditor: Auditor): Promise<TotpEnrollmentInitResult>;
+    completeEnrollTotp(tenantId: string, subjectId: string, token: string, auditor: Auditor): Promise<TotpRecoveryCodesResult>;
     disableTotp(tenantId: string, subjectId: string, token: string, auditor: Auditor): Promise<void>;
     disableTotpWithRecoveryCode(tenantId: string, subjectId: string, recoveryCode: string, auditor: Auditor): Promise<void>;
     regenerateRecoveryCodes(tenantId: string, subjectId: string, token: string, auditor: Auditor, options?: {
         invalidateOtherSessions?: boolean;
-    }): Promise<{
-        recoveryCodes: string[];
-    }>;
+    }): Promise<TotpRecoveryCodesResult>;
     loginVerifyTotp(challengeTokenString: string, token: string, auditor: Auditor): Promise<LoginSuccessResult<AdditionalTokenPayload>>;
     loginRecovery(challengeTokenString: string, recoveryCode: string, auditor: Auditor): Promise<LoginSuccessResult<AdditionalTokenPayload>>;
     validateTotpChallengeToken(tokenString: string): Promise<TotpChallengeToken<AuthenticationData>>;

package/authentication/server/authentication.service.js

@@ -23,7 +23,7 @@ import { isUuid } from '../../utils/patterns.js';
 import { getRandomBytes, getRandomString } from '../../utils/random.js';
 import { isDefined, isString, isUndefined } from '../../utils/type-guards.js';
 import { millisecondsPerDay, millisecondsPerHour, millisecondsPerMinute } from '../../utils/units.js';
-import { AuthenticationPassword, AuthenticationSession, AuthenticationTotp, AuthenticationTotpRecoveryCode, AuthenticationUsedTotpToken, Subject, SubjectStatus, TotpStatus, User } from '../models/index.js';
+import { AuthenticationPassword, AuthenticationSession, AuthenticationTotp, AuthenticationTotpRecoveryCode, AuthenticationUsedTotpToken, Subject, SubjectStatus, TotpEnrollmentInitResult, TotpRecoveryCodesResult, TotpStatus, TotpStatusResult, User } from '../models/index.js';
 import { AuthenticationAncillaryService, GetTokenPayloadContextAction } from './authentication-ancillary.service.js';
 import { AuthenticationPasswordRequirementsValidator } from './authentication-password-requirements.validator.js';
 import { getPasswordResetTokenFromString, getRefreshTokenFromString, getTokenFromString } from './helper.js';
@@ -88,11 +88,11 @@ const JWT_ID_LENGTH = 24;
 const REFRESH_TOKEN_SECRET_LENGTH = 64;
 const SALT_LENGTH = 32;
 export const DEFAULT_TOTP_OPTIONS = {
-    codeHashAlgorithm: 'SHA-512',
+    codeHashAlgorithm: 'SHA-1',
     recoveryCodeHashOptions: {
         algorithm: {
             name: 'Argon2id',
-            memory: 128 * 1024, // 128 MiB
+            memory: 256 * 1024, // 256 MiB
             parallelism: 4,
             passes: 3,
         },
@@ -861,7 +861,9 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
     }
     async getTotpStatus(tenantId, subjectId) {
         const totp = await this.tryGetTotp(tenantId, subjectId);
-        return { active: totp?.status == TotpStatus.Active };
+        return {
+            active: totp?.status == TotpStatus.Active,
+        };
     }
     async initEnrollTotp(tenantId, subjectId, auditor) {
         const authAuditor = auditor.fork(AuthenticationService_1.name);

package/core.d.ts

@@ -1,11 +1,6 @@
-import { Injector } from './injector/index.js';
 declare global {
     var tstdlLoaded: boolean | undefined;
 }
-/**
- * @deprecated Usage of `getGlobalInjector` should be avoided. Use `Application` scoped injector instead.
- */
-export declare function getGlobalInjector(): Injector;
 export declare function isDevMode(): boolean;
 export declare function isProdMode(): boolean;
 export declare function enableProdMode(): void;

package/core.js

@@ -1,16 +1,8 @@
-import { Injector } from './injector/index.js';
 if (globalThis.tstdlLoaded == true) {
     console.error(new Error('tstdl seems to be loaded multiple times. This is likely an error as some modules won\'t work as intended this way.'));
 }
 globalThis.tstdlLoaded = true;
-let globalInjector;
 let _isDevMode = true;
-/**
- * @deprecated Usage of `getGlobalInjector` should be avoided. Use `Application` scoped injector instead.
- */
-export function getGlobalInjector() {
-    return globalInjector ??= new Injector('GlobalInjector');
-}
 export function isDevMode() {
     return _isDevMode;
 }

package/document-management/api/document-management.api.d.ts

@@ -362,8 +362,8 @@ export declare const documentManagementApiDefinition: {
             resource: string;
             method: "POST";
             parameters: import("../../schema/index.js").ObjectSchema<{
-                id: string;
                 state: "error" | "pending" | "running" | "completed" | "review" | "failed";
+                id: string;
             }>;
             result: import("../../schema/index.js").LiteralSchema<"ok">;
             credentials: true;
@@ -772,8 +772,8 @@ declare const _DocumentManagementApi: import("../../api/client/index.js").ApiCli
             resource: string;
             method: "POST";
             parameters: import("../../schema/index.js").ObjectSchema<{
-                id: string;
                 state: "error" | "pending" | "running" | "completed" | "review" | "failed";
+                id: string;
             }>;
             result: import("../../schema/index.js").LiteralSchema<"ok">;
             credentials: true;