@vex-chat/spire 3.0.1 → 4.0.0

package/dist/server/passkey.js

@@ -7,15 +7,14 @@ import express from "express";
 import { XUtils } from "@vex-chat/crypto";
 import { PasskeyAuthFinishPayloadSchema, PasskeyAuthStartPayloadSchema, PasskeyRegistrationFinishPayloadSchema, PasskeyRegistrationStartPayloadSchema, } from "@vex-chat/types";
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from "@simplewebauthn/server";
-import jwt from "jsonwebtoken";
 import { JWT_EXPIRY_PASSKEY } from "../Spire.js";
-import { getJwtSecret } from "../utils/jwtSecret.js";
+import { signAuthJwt } from "../utils/authJwt.js";
 import { AppError } from "./errors.js";
 import { authLimiter } from "./rateLimit.js";
 import { censorUser, getParam, getUser } from "./utils.js";
 import { buildAndroidApkKeyHashOrigins } from "./wellKnown.js";
 import { sendWireResponse } from "./wireResponse.js";
-import { protect } from "./index.js";
+import { protect, protectAnyAuth } from "./index.js";
 const REGISTRATION_TTL_MS = 5 * 60 * 1000; // 5 min
 const AUTHENTICATION_TTL_MS = 5 * 60 * 1000;
 // Cap each user's passkey count so a compromised JWT can't fill the
@@ -99,17 +98,17 @@ function sanitizeTransports(input) {
  * Issues a passkey-scoped JWT.
  *
  * Carries `scope: "passkey"` and the owning userID; deliberately
- * shorter-lived than a device JWT (5 min vs 7 days) because a
+ * shorter-lived than an account or device JWT (5 min vs 1 hour) because a
  * passkey JWT grants destructive admin powers (delete a device,
  * approve an enrollment) without further user verification. Callers
  * re-do the WebAuthn ceremony when this expires.
  */
 function signPasskeyToken(args) {
-    return jwt.sign({
+    return signAuthJwt({
         passkey: { passkeyID: args.passkeyID },
         scope: "passkey",
         user: args.user,
-    }, getJwtSecret(), { expiresIn: JWT_EXPIRY_PASSKEY });
+    }, JWT_EXPIRY_PASSKEY);
 }
 export const getPasskeyRouter = (db) => {
     const router = express.Router();
@@ -129,16 +128,13 @@ export const getPasskeyRouter = (db) => {
             });
             return;
         }
-        const existing = await db.retrievePasskeysByUser(userID);
-        // A freshly registered account may add its first passkey with
-        // the account bearer before finishing device connect. Every later
-        // passkey addition must come from an authenticated device session.
-        if (!req.device && existing.length > 0) {
+        if (!req.device || req.device.owner !== userID) {
             res.status(401).send({
-                error: "Adding another passkey requires an authenticated device.",
+                error: "Adding a passkey requires an authenticated device.",
             });
             return;
         }
+        const existing = await db.retrievePasskeysByUser(userID);
         if (existing.length >= MAX_PASSKEYS_PER_USER) {
             res.status(409).send({
                 error: `Each account is limited to ${MAX_PASSKEYS_PER_USER} passkeys.`,
@@ -156,7 +152,7 @@ export const getPasskeyRouter = (db) => {
             authenticatorSelection: {
                 requireResidentKey: false,
                 residentKey: "preferred",
-                userVerification: "preferred",
+                userVerification: "required",
             },
             excludeCredentials: [],
             rpID,
@@ -170,6 +166,7 @@ export const getPasskeyRouter = (db) => {
         pendingRegistrations.set(requestID, {
             challenge: options.challenge,
             createdAt: Date.now(),
+            deviceID: req.device.deviceID,
             name: parsed.data.name,
             userID,
         });
@@ -198,16 +195,17 @@ export const getPasskeyRouter = (db) => {
             });
             return;
         }
-        const existing = await db.retrievePasskeysByUser(userID);
-        if (!req.device && existing.length > 0) {
+        if (!req.device || req.device.owner !== userID) {
             res.status(401).send({
-                error: "Adding another passkey requires an authenticated device.",
+                error: "Adding a passkey requires an authenticated device.",
             });
             return;
         }
         pruneRegistrations();
         const pending = pendingRegistrations.get(parsed.data.requestID);
-        if (!pending || pending.userID !== userID) {
+        if (!pending ||
+            pending.userID !== userID ||
+            pending.deviceID !== req.device.deviceID) {
             res.status(404).send({
                 error: "Registration request not found or expired.",
             });
@@ -229,15 +227,15 @@ export const getPasskeyRouter = (db) => {
                 expectedChallenge: pending.challenge,
                 expectedOrigin,
                 expectedRPID: rpID,
-                requireUserVerification: false,
+                requireUserVerification: true,
                 // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- structurally validated by simplewebauthn below
                 response: rawResponse,
             });
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
+            logWebAuthnFailure("registration", err);
             res.status(400).send({
-                error: "Passkey attestation invalid: " + message,
+                error: "Passkey attestation could not be verified.",
             });
             return;
         }
@@ -275,7 +273,7 @@ export const getPasskeyRouter = (db) => {
         0, transports);
         sendWireResponse(req, res, created);
     });
-    router.get("/user/:id/passkeys", protect, async (req, res) => {
+    router.get("/user/:id/passkeys", protectAnyAuth, async (req, res) => {
         const userDetails = getUser(req);
         const userID = getParam(req, "id");
         if (userDetails.userID !== userID) {
@@ -293,6 +291,12 @@ export const getPasskeyRouter = (db) => {
             res.sendStatus(401);
             return;
         }
+        if (!req.device || req.device.owner !== userID) {
+            res.status(401).send({
+                error: "Removing a passkey requires an authenticated device.",
+            });
+            return;
+        }
         const row = await db.retrievePasskeyInternal(passkeyID);
         if (!row || row.userID !== userID) {
             res.sendStatus(404);
@@ -337,7 +341,7 @@ export const getPasskeyRouter = (db) => {
         const options = await generateAuthenticationOptions({
             allowCredentials: allowCredentials.filter((c) => c.id.length > 0),
             rpID,
-            userVerification: "preferred",
+            userVerification: "required",
         });
         pruneAuthentications();
         const requestID = crypto.randomUUID();
@@ -410,14 +414,14 @@ export const getPasskeyRouter = (db) => {
                 expectedChallenge: pending.challenge,
                 expectedOrigin,
                 expectedRPID: rpID,
-                requireUserVerification: false,
+                requireUserVerification: true,
                 response: assertion,
             });
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
+            logWebAuthnFailure("authentication", err);
             res.status(401).send({
-                error: "Passkey assertion invalid: " + message,
+                error: "Passkey assertion could not be verified.",
             });
             return;
         }
@@ -437,7 +441,13 @@ export const getPasskeyRouter = (db) => {
             });
             return;
         }
-        await db.markPasskeyUsed(passkeyRow.passkeyID, newCounter);
+        const counterUpdated = await db.markPasskeyUsed(passkeyRow.passkeyID, passkeyRow.signCount, newCounter);
+        if (!counterUpdated) {
+            res.status(401).send({
+                error: "Passkey assertion was already used.",
+            });
+            return;
+        }
         const user = await db.retrieveUser(pending.userID);
         if (!user) {
             res.status(404).send({ error: "Account not found." });
@@ -456,4 +466,9 @@ export const getPasskeyRouter = (db) => {
     });
     return router;
 };
+function logWebAuthnFailure(ceremony, err) {
+    const requestId = crypto.randomUUID();
+    const message = err instanceof Error ? err.message : String(err);
+    console.warn(`[spire] WebAuthn ${ceremony} verification failed requestId=${requestId} message=${message}`);
+}
 //# sourceMappingURL=passkey.js.map

package/dist/server/passkey.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/server/passkey.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACH,8BAA8B,EAC9B,6BAA6B,EAC7B,sCAAsC,EACtC,qCAAqC,GACxC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACH,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ;AACnD,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAejC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA+B,CAAC;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAiC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,WAAW;IAKhB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,4EAA4E,CAC/E,CAAC;IACN,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,8EAA8E,CACjF,CAAC;IACN,CAAC;IACD,MAAM,eAAe,GAAG,UAAU;SAC7B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAC7B,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,EAAE,GAAG,6BAA6B,EAAE,CAAC,CAAC,CACpE,CAAC;IACF,OAAO;QACH,cAAc;QACd,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK;KAChE,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,qBAAqB,EAAE,CAAC;YAClD,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YAChD,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,gBAAgB,GAAG;IACrB,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,YAAY;IACZ,KAAK;CACmD,CAAC;AAE7D,SAAS,gBAAgB,CAAC,CAAS;IAC/B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAGzB;IACG,OAAO,GAAG,CAAC,IAAI,CACX;QACI,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;QACtC,KAAK,EAAE,SAAkB;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAClB,EACD,YAAY,EAAE,EACd,EAAE,SAAS,EAAE,kBAAkB,EAAE,CACpC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAY,EAAE,EAAE;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IAEvE,MAAM,CAAC,IAAI,CACP,mCAAmC,EACnC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAC1D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B;gBACrC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACzD,8DAA8D;QAC9D,kEAAkE;QAClE,mEAAmE;QACnE,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,0DAA0D;aACpE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACvC,yDAAyD;QACzD,yDAAyD;QACzD,0DAA0D;QAC1D,uDAAuD;QACvD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC9C,eAAe,EAAE,MAAM;YACvB,sBAAsB,EAAE;gBACpB,kBAAkB,EAAE,KAAK;gBACzB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,WAAW;aAChC;YACD,kBAAkB,EAAE,EAAE;YACtB,IAAI;YACJ,MAAM;YACN,eAAe,EAAE,WAAW,CAAC,QAAQ;YACrC,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,kBAAkB,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,MAAM;SACT,CAAC,CAAC;QAEH,uDAAuD;QACvD,wDAAwD;QACxD,qDAAqD;QACrD,sDAAsD;QACtD,yDAAyD;QACzD,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,OAAO;YACP,SAAS;SACZ,CAAC,CAAC;IACP,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,oCAAoC,EACpC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,sCAAsC,CAAC,SAAS,CAC3D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,0DAA0D;aACpE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,kBAAkB,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,4CAA4C;aACtD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,4DAA4D;QAC5D,2CAA2C;QAC3C,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnD,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,sDAAsD;YACtD,kDAAkD;YAClD,oDAAoD;YACpD,uDAAuD;YACvD,6CAA6C;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;YACpD,YAAY,GAAG,MAAM,0BAA0B,CAAC;gBAC5C,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,KAAK;gBAC9B,yHAAyH;gBACzH,QAAQ,EAAE,WAAuC;aACpD,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,OAAO,GACT,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,+BAA+B,GAAG,OAAO;aACnD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC/D,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAE5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,2CAA2C;aACrD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAEnE,2DAA2D;QAC3D,wDAAwD;QACxD,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAClC,MAAM,EACN,OAAO,CAAC,IAAI,EACZ,UAAU,CAAC,EAAE,EACb,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QACtC,uDAAuD;QACvD,qDAAqD;QACrD,sDAAsD;QACtD,gDAAgD;QAChD,uDAAuD;QACvD,mDAAmD;QACnD,gCAAgC;QAChC,CAAC,EACD,UAAU,CACb,CAAC;QAEF,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAChE,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CACT,+BAA+B,EAC/B,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,sEAAsE;IAEtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,sDAAsD;YACtD,wDAAwD;YACxD,wDAAwD;YACxD,oBAAoB;YACpB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAChE,OAAO;gBACH,EAAE,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE;gBAChC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBAClD,IAAI,EAAE,YAAqB;aAC9B,CAAC;QACN,CAAC,CAAC,CACL,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAChD,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACjE,IAAI;YACJ,gBAAgB,EAAE,WAAW;SAChC,CAAC,CAAC;QAEH,oBAAoB,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,OAAO;YACP,SAAS;SACZ,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,oBAAoB,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,gDAAgD;aAC1D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,cAAc;QACd,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAErD,8DAA8D;QAC9D,0DAA0D;QAC1D,2DAA2D;QAC3D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;QACrD,yHAAyH;QACzH,MAAM,SAAS,GAAG,YAA0C,CAAC;QAC7D,MAAM,YAAY,GACd,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,6DAA6D;QAC7D,0DAA0D;QAC1D,mCAAmC;QACnC,MAAM,mBAAmB,GAAG,IAAI,UAAU,CACtC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CACzC,CAAC;QAEF,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,YAAY,GAAG,MAAM,4BAA4B,CAAC;gBAC9C,UAAU,EAAE;oBACR,OAAO,EAAE,UAAU,CAAC,SAAS;oBAC7B,EAAE,EAAE,UAAU,CAAC,YAAY;oBAC3B,SAAS,EAAE,mBAAmB;oBAC9B,UAAU,EAAE,UAAU,CAAC,UAAU;yBAC5B,KAAK,CAAC,GAAG,CAAC;yBACV,MAAM,CAAC,gBAAgB,CAAC;iBAChC;gBACD,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,KAAK;gBAC9B,QAAQ,EAAE,SAAS;aACtB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,6BAA6B,GAAG,OAAO;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACX,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IACI,UAAU,KAAK,CAAC;YAChB,UAAU,CAAC,SAAS,KAAK,CAAC;YAC1B,UAAU,IAAI,UAAU,CAAC,SAAS,EACpC,CAAC;YACC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,+DAA+D;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK;YACL,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/server/passkey.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACH,8BAA8B,EAC9B,6BAA6B,EAC7B,sCAAsC,EACtC,qCAAqC,GACxC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACH,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,GAC7B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ;AACnD,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAgBjC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA+B,CAAC;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAiC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,WAAW;IAKhB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,4EAA4E,CAC/E,CAAC;IACN,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,8EAA8E,CACjF,CAAC;IACN,CAAC;IACD,MAAM,eAAe,GAAG,UAAU;SAC7B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAC7B,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,EAAE,GAAG,6BAA6B,EAAE,CAAC,CAAC,CACpE,CAAC;IACF,OAAO;QACH,cAAc;QACd,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK;KAChE,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,qBAAqB,EAAE,CAAC;YAClD,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;YAChD,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,gBAAgB,GAAG;IACrB,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,YAAY;IACZ,KAAK;CACmD,CAAC;AAE7D,SAAS,gBAAgB,CAAC,CAAS;IAC/B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAe;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAGzB;IACG,OAAO,WAAW,CACd;QACI,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;QACtC,KAAK,EAAE,SAAkB;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAClB,EACD,kBAAkB,CACrB,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAY,EAAE,EAAE;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IAEvE,MAAM,CAAC,IAAI,CACP,mCAAmC,EACnC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAC1D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B;gBACrC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACvC,yDAAyD;QACzD,yDAAyD;QACzD,0DAA0D;QAC1D,uDAAuD;QACvD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC9C,eAAe,EAAE,MAAM;YACvB,sBAAsB,EAAE;gBACpB,kBAAkB,EAAE,KAAK;gBACzB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,UAAU;aAC/B;YACD,kBAAkB,EAAE,EAAE;YACtB,IAAI;YACJ,MAAM;YACN,eAAe,EAAE,WAAW,CAAC,QAAQ;YACrC,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,kBAAkB,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ;YAC7B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,MAAM;SACT,CAAC,CAAC;QAEH,uDAAuD;QACvD,wDAAwD;QACxD,qDAAqD;QACrD,sDAAsD;QACtD,yDAAyD;QACzD,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,OAAO;YACP,SAAS;SACZ,CAAC,CAAC;IACP,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,oCAAoC,EACpC,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,sCAAsC,CAAC,SAAS,CAC3D,GAAG,CAAC,IAAI,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,oDAAoD;aAC9D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,kBAAkB,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,IACI,CAAC,OAAO;YACR,OAAO,CAAC,MAAM,KAAK,MAAM;YACzB,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,EAC1C,CAAC;YACC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,4CAA4C;aACtD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,4DAA4D;QAC5D,2CAA2C;QAC3C,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnD,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,sDAAsD;YACtD,kDAAkD;YAClD,oDAAoD;YACpD,uDAAuD;YACvD,6CAA6C;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;YACpD,YAAY,GAAG,MAAM,0BAA0B,CAAC;gBAC5C,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,IAAI;gBAC7B,yHAAyH;gBACzH,QAAQ,EAAE,WAAuC;aACpD,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,kBAAkB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,4CAA4C;aACtD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC/D,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAE5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,2CAA2C;aACrD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAEnE,2DAA2D;QAC3D,wDAAwD;QACxD,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,8BAA8B,qBAAqB,YAAY;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAClC,MAAM,EACN,OAAO,CAAC,IAAI,EACZ,UAAU,CAAC,EAAE,EACb,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QACtC,uDAAuD;QACvD,qDAAqD;QACrD,sDAAsD;QACtD,gDAAgD;QAChD,uDAAuD;QACvD,mDAAmD;QACnD,gCAAgC;QAChC,CAAC,EACD,UAAU,CACb,CAAC;QAEF,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAChE,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CACT,+BAA+B,EAC/B,OAAO,EACP,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,sDAAsD;aAChE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,sEAAsE;IAEtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,sDAAsD;YACtD,wDAAwD;YACxD,wDAAwD;YACxD,oBAAoB;YACpB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAChE,OAAO;gBACH,EAAE,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE;gBAChC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBAClD,IAAI,EAAE,YAAqB;aAC9B,CAAC;QACN,CAAC,CAAC,CACL,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAChD,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACjE,IAAI;YACJ,gBAAgB,EAAE,UAAU;SAC/B,CAAC,CAAC;QAEH,oBAAoB,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,OAAO;YACP,SAAS;SACZ,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,oBAAoB,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,gDAAgD;aAC1D,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,cAAc;QACd,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAErD,8DAA8D;QAC9D,0DAA0D;QAC1D,2DAA2D;QAC3D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAmB,CAAC;QACrD,yHAAyH;QACzH,MAAM,SAAS,GAAG,YAA0C,CAAC;QAC7D,MAAM,YAAY,GACd,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,uCAAuC;aACjD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QAE/C,6DAA6D;QAC7D,0DAA0D;QAC1D,mCAAmC;QACnC,MAAM,mBAAmB,GAAG,IAAI,UAAU,CACtC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CACzC,CAAC;QAEF,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACD,YAAY,GAAG,MAAM,4BAA4B,CAAC;gBAC9C,UAAU,EAAE;oBACR,OAAO,EAAE,UAAU,CAAC,SAAS;oBAC7B,EAAE,EAAE,UAAU,CAAC,YAAY;oBAC3B,SAAS,EAAE,mBAAmB;oBAC9B,UAAU,EAAE,UAAU,CAAC,UAAU;yBAC5B,KAAK,CAAC,GAAG,CAAC;yBACV,MAAM,CAAC,gBAAgB,CAAC;iBAChC;gBACD,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc;gBACd,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,IAAI;gBAC7B,QAAQ,EAAE,SAAS;aACtB,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,kBAAkB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,0CAA0C;aACpD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACX,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IACI,UAAU,KAAK,CAAC;YAChB,UAAU,CAAC,SAAS,KAAK,CAAC;YAC1B,UAAU,IAAI,UAAU,CAAC,SAAS,EACpC,CAAC;YACC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,+DAA+D;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,eAAe,CAC3C,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,SAAS,EACpB,UAAU,CACb,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,qCAAqC;aAC/C,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE;YACvB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK;YACL,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,SAAS,kBAAkB,CAAC,QAAgB,EAAE,GAAY;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,CACR,oBAAoB,QAAQ,kCAAkC,SAAS,YAAY,OAAO,EAAE,CAC/F,CAAC;AACN,CAAC"}

package/dist/server/passkeyDevices.js

@@ -58,6 +58,7 @@ export const getPasskeyDeviceRouter = (db, notify, disconnectDevices) => {
         // "I lost my phone, sign in with the passkey, wipe the
         // old device, then recover onto a new one."
         await db.deleteDevice(deviceID);
+        disconnectDevices?.([deviceID]);
         // Tell whoever's online that the device-list shape
         // changed; clients use this to refresh the Settings →
         // Devices view in real time.

package/dist/server/passkeyDevices.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkeyDevices.js","sourceRoot":"","sources":["../../src/server/passkeyDevices.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACH,8BAA8B,EAC9B,8BAA8B,GACjC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAClC,EAAY,EACZ,MAMS,EACT,iBAAiD,EACnD,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACN,2BAA2B,EAC3B,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,MAAM,CACT,qCAAqC,EACrC,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACrC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,uDAAuD;QACvD,qDAAqD;QACrD,uDAAuD;QACvD,yDAAyD;QACzD,uDAAuD;QACvD,4CAA4C;QAC5C,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,mDAAmD;QACnD,sDAAsD;QACtD,6BAA6B;QAC7B,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,uDAAuD,EACvD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,oDAAoD;QACpD,0DAA0D;QAC1D,4DAA4D;QAC5D,yDAAyD;QACzD,yDAAyD;QACzD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,mBAAmB,EAAE,SAAS;YAC9B,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACzD,iBAAiB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7C,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,sDAAsD,EACtD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,MAAM,EAAE,QAAQ;YAChB,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
+{"version":3,"file":"passkeyDevices.js","sourceRoot":"","sources":["../../src/server/passkeyDevices.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACH,8BAA8B,EAC9B,8BAA8B,GACjC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAClC,EAAY,EACZ,MAMS,EACT,iBAAiD,EACnD,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACN,2BAA2B,EAC3B,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,MAAM,CACT,qCAAqC,EACrC,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACrC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,uDAAuD;QACvD,qDAAqD;QACrD,uDAAuD;QACvD,yDAAyD;QACzD,uDAAuD;QACvD,4CAA4C;QAC5C,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,mDAAmD;QACnD,sDAAsD;QACtD,6BAA6B;QAC7B,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,uDAAuD,EACvD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,oDAAoD;QACpD,0DAA0D;QAC1D,4DAA4D;QAC5D,yDAAyD;QACzD,yDAAyD;QACzD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,mBAAmB,EAAE,SAAS;YAC9B,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACzD,iBAAiB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7C,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,sDAAsD,EACtD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,MAAM,EAAE,QAAQ;YAChB,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/server/password.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import type { Database } from "../Database.ts";
+export declare const getPasswordRouter: (db: Database) => import("express-serve-static-core").Router;

package/dist/server/password.js

@@ -0,0 +1,58 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import express from "express";
+import { PasswordUpdatePayloadSchema } from "@vex-chat/types";
+import { hashPasswordArgon2, validateAccountPassword, verifyPassword, } from "../Database.js";
+import { AppError } from "./errors.js";
+import { passwordUpdateLimiter } from "./rateLimit.js";
+import { getParam, getUser } from "./utils.js";
+import { protectAnyAuth } from "./index.js";
+export const getPasswordRouter = (db) => {
+    const router = express.Router();
+    router.patch("/user/:id/password", protectAnyAuth, passwordUpdateLimiter, async (req, res) => {
+        const authenticatedUser = getUser(req);
+        const userID = getParam(req, "id");
+        if (authenticatedUser.userID !== userID) {
+            throw new AppError(403, "Not authorized for this account");
+        }
+        const payload = PasswordUpdatePayloadSchema.parse(req.body);
+        const user = await db.retrieveUser(userID);
+        if (!user) {
+            throw new AppError(404, "Account not found");
+        }
+        const passwordError = validateAccountPassword(payload.newPassword, user.username);
+        if (passwordError) {
+            throw new AppError(400, passwordError);
+        }
+        if (req.passkey) {
+            const passkey = await db.retrievePasskeyInternal(req.passkey.passkeyID);
+            if (!passkey || passkey.userID !== userID) {
+                throw new AppError(401, "Passkey authentication required");
+            }
+        }
+        else {
+            if (!req.device ||
+                req.device.owner !== userID ||
+                !payload.currentPassword) {
+                throw new AppError(401, "Current-password authentication required");
+            }
+            const current = await verifyPassword(payload.currentPassword, user);
+            if (!current.valid) {
+                throw new AppError(401, "Current password is incorrect");
+            }
+        }
+        const reused = await verifyPassword(payload.newPassword, user);
+        if (reused.valid) {
+            throw new AppError(409, "New password must be different from the current password");
+        }
+        const passwordHash = await hashPasswordArgon2(payload.newPassword);
+        await db.rehashPassword(userID, passwordHash);
+        res.setHeader("Cache-Control", "no-store");
+        res.sendStatus(204);
+    });
+    return router;
+};
+//# sourceMappingURL=password.js.map

package/dist/server/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/server/password.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,OAAO,EACH,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAY,EAAE,EAAE;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,KAAK,CACR,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,iBAAiB,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,aAAa,GAAG,uBAAuB,CACzC,OAAO,CAAC,WAAW,EACnB,IAAI,CAAC,QAAQ,CAChB,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAC5C,GAAG,CAAC,OAAO,CAAC,SAAS,CACxB,CAAC;YACF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACxC,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;YAC/D,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IACI,CAAC,GAAG,CAAC,MAAM;gBACX,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM;gBAC3B,CAAC,OAAO,CAAC,eAAe,EAC1B,CAAC;gBACC,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,0CAA0C,CAC7C,CAAC;YACN,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAChC,OAAO,CAAC,eAAe,EACvB,IAAI,CACP,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YAC7D,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,0DAA0D,CAC7D,CAAC;QACN,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC9C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/server/permissions.d.ts

@@ -4,6 +4,7 @@
  * Commercial licenses available at vex.wtf
  */
 import type { Permission } from "@vex-chat/types";
+export declare function canDeletePermission(permissions: Permission[], actorUserID: string, target: Permission, adminPowerLevel: number): boolean;
 /**
  * Check whether any permission in the list covers the given resource
  * (any power level).

package/dist/server/permissions.js

@@ -3,6 +3,15 @@
  * Licensed under AGPL-3.0. See LICENSE for details.
  * Commercial licenses available at vex.wtf
  */
+export function canDeletePermission(permissions, actorUserID, target, adminPowerLevel) {
+    if (target.userID === actorUserID) {
+        return true;
+    }
+    return permissions.some((permission) => permission.userID === actorUserID &&
+        permission.resourceID === target.resourceID &&
+        permission.powerLevel >= adminPowerLevel &&
+        permission.powerLevel > target.powerLevel);
+}
 /**
  * Check whether any permission in the list covers the given resource
  * (any power level).
@@ -15,13 +24,13 @@ export function hasAnyPermission(permissions, resourceID) {
  * on the given resource.
  */
 export function hasPermission(permissions, resourceID, minPowerLevel) {
-    return permissions.some((p) => p.resourceID === resourceID && p.powerLevel > minPowerLevel);
+    return permissions.some((p) => p.resourceID === resourceID && p.powerLevel >= minPowerLevel);
 }
 /**
  * Check whether any permission in the list grants at least `minPowerLevel`
  * on the given resource AND belongs to the specified user.
  */
 export function userHasPermission(permissions, userID, minPowerLevel) {
-    return permissions.some((p) => p.userID === userID && p.powerLevel > minPowerLevel);
+    return permissions.some((p) => p.userID === userID && p.powerLevel >= minPowerLevel);
 }
 //# sourceMappingURL=permissions.js.map

package/dist/server/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC5B,WAAyB,EACzB,UAAkB;IAElB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CACzB,WAAyB,EACzB,UAAkB,EAClB,aAAqB;IAErB,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,GAAG,aAAa,CACrE,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC7B,WAAyB,EACzB,MAAc,EACd,aAAqB;IAErB,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,GAAG,aAAa,CAC7D,CAAC;AACN,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,UAAU,mBAAmB,CAC/B,WAAyB,EACzB,WAAmB,EACnB,MAAkB,EAClB,eAAuB;IAEvB,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,UAAU,EAAE,EAAE,CACX,UAAU,CAAC,MAAM,KAAK,WAAW;QACjC,UAAU,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAC3C,UAAU,CAAC,UAAU,IAAI,eAAe;QACxC,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAChD,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC5B,WAAyB,EACzB,UAAkB;IAElB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CACzB,WAAyB,EACzB,UAAkB,EAClB,aAAqB;IAErB,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,aAAa,CACtE,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC7B,WAAyB,EACzB,MAAc,EACd,aAAqB;IAErB,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,IAAI,aAAa,CAC9D,CAAC;AACN,CAAC"}

package/dist/server/rateLimit.d.ts

@@ -34,6 +34,17 @@ export declare const globalLimiter: import("express-rate-limit").RateLimitReques
  * (CWE-307) without harming UX.
  */
 export declare const authLimiter: import("express-rate-limit").RateLimitRequestHandler;
+/**
+ * Cross-IP password defense. This account bucket complements the IP bucket so
+ * a distributed password spray cannot make unlimited guesses at one account.
+ */
+export declare const accountAuthLimiter: import("express-rate-limit").RateLimitRequestHandler;
+/**
+ * Limit repeated password replacement attempts per authenticated account.
+ * This is intentionally tighter than sign-in because each failed request has
+ * already passed bearer/device validation and still consumes an Argon2 check.
+ */
+export declare const passwordUpdateLimiter: import("express-rate-limit").RateLimitRequestHandler;
 /**
  * Upload endpoint limiter. Applied per-route to /file and /avatar
  * POSTs, BEFORE multer parses the multipart body. Caps the number of

package/dist/server/rateLimit.js

@@ -59,14 +59,13 @@ function disableRateLimitsByEnv() {
  * versions silently collapsed all IPv4-mapped IPv6 addresses into
  * one bucket, which let attackers bypass the limiter).
  *
- * `trust proxy` must be set on the Express app (see Spire.ts) so
- * `req.ip` returns the real client address, not the immediate proxy.
+ * `trust proxy` must match the real deployment topology (see Spire.ts) so
+ * `req.ip` cannot be spoofed and does not collapse all traffic onto a proxy.
  */
 /**
  * Bucket requests by the real client IP, IPv6-safe.
  *
- * `req.ip` is already populated correctly because `trust proxy` is
- * set to `1` in Spire's constructor. We still run it through
+ * `req.ip` reflects the explicitly configured proxy hop count. We still run it through
  * `ipKeyGenerator` so IPv4-mapped IPv6 (`::ffff:1.2.3.4`) doesn't
  * collide with unrelated IPv6 addresses in the same /56.
  */
@@ -104,6 +103,46 @@ export const authLimiter = rateLimit({
     standardHeaders: "draft-7",
     windowMs: 15 * 60 * 1000,
 });
+/**
+ * Cross-IP password defense. This account bucket complements the IP bucket so
+ * a distributed password spray cannot make unlimited guesses at one account.
+ */
+export const accountAuthLimiter = rateLimit({
+    keyGenerator: (req) => {
+        const body = req.body;
+        const username = typeof body === "object" &&
+            body !== null &&
+            "username" in body &&
+            typeof body.username === "string"
+            ? body.username.trim().toLowerCase().slice(0, 64)
+            : "";
+        return username.length > 0
+            ? `account:${username}`
+            : `invalid:${keyByIp(req)}`;
+    },
+    legacyHeaders: false,
+    limit: 100,
+    skip: devApiKeySkipsRateLimits,
+    skipSuccessfulRequests: true,
+    standardHeaders: "draft-7",
+    windowMs: 15 * 60 * 1000,
+});
+/**
+ * Limit repeated password replacement attempts per authenticated account.
+ * This is intentionally tighter than sign-in because each failed request has
+ * already passed bearer/device validation and still consumes an Argon2 check.
+ */
+export const passwordUpdateLimiter = rateLimit({
+    keyGenerator: (req) => req.user?.userID
+        ? `password:${req.user.userID}`
+        : `invalid:${keyByIp(req)}`,
+    legacyHeaders: false,
+    limit: 10,
+    skip: devApiKeySkipsRateLimits,
+    skipSuccessfulRequests: true,
+    standardHeaders: "draft-7",
+    windowMs: 15 * 60 * 1000,
+});
 /**
  * Upload endpoint limiter. Applied per-route to /file and /avatar
  * POSTs, BEFORE multer parses the multipart body. Caps the number of

package/dist/server/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/server/rateLimit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE/D,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAMlD,MAAM,UAAU,gBAAgB,CAAC,GAAiB;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,eAAe,CAClB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAClC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAiB;IACtD,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,sBAAsB;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACtC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE;QAClB,MAAM,MAAM,GACR,GAAG,CAAC,IAAI,EAAE,MAAM;YAChB,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GACR,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;IACjC,CAAC;IACD,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC"}
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/server/rateLimit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE/D,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAMlD,MAAM,UAAU,gBAAgB,CAAC,GAAiB;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,eAAe,CAClB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAClC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAiB;IACtD,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,sBAAsB;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;IACxC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE;QAClB,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;QAC/B,MAAM,QAAQ,GACV,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACb,UAAU,IAAI,IAAI;YAClB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAC7B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACjD,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;YACtB,CAAC,CAAC,WAAW,QAAQ,EAAE;YACvB,CAAC,CAAC,WAAW,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IACD,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,wBAAwB;IAC9B,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;IAC3C,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAClB,GAAG,CAAC,IAAI,EAAE,MAAM;QACZ,CAAC,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE;QAC/B,CAAC,CAAC,WAAW,OAAO,CAAC,GAAG,CAAC,EAAE;IACnC,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACtC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE;QAClB,MAAM,MAAM,GACR,GAAG,CAAC,IAAI,EAAE,MAAM;YAChB,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GACR,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;IACjC,CAAC;IACD,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC"}

package/dist/server/user.d.ts

@@ -56,4 +56,4 @@ export declare function resolveDeviceEnrollmentRequest(args: {
     kind: "err";
     status: number;
 }>;
-export declare const getUserRouter: (db: Database, tokenValidator: (key: string, scope: TokenScopes) => boolean, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void) => import("express-serve-static-core").Router;
+export declare const getUserRouter: (db: Database, tokenValidator: (key: string, scope: TokenScopes) => boolean, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void, disconnectDevices?: (deviceIDs: string[]) => void) => import("express-serve-static-core").Router;