@voltro/plugin-auth 0.85.0 → 0.87.0

package/dist/schema.js

@@ -1,105 +1,108 @@
-import { id as e, integer as t, table as n, text as r, timestamp as i } from "@voltro/database";
+import { authGuestDevicesTable as e, authGuestsTable as t, guestTables as n } from "./guestSchema.js";
+import { id as r, integer as i, table as a, text as o, timestamp as s } from "@voltro/database";
 //#region src/schema/index.ts
-var a = n("users", {
-	id: e(),
-	email: r().unique(),
-	passwordHash: r().nullable(),
-	tenantId: r(),
-	mfaSecret: r().nullable(),
-	mfaEnrolledAt: i().nullable(),
-	emailVerifiedAt: i().nullable(),
-	createdAt: i().default("now"),
-	updatedAt: i().default("now").onUpdate("now")
-}).index(["tenantId"]), o = n("sessions", {
-	id: e(),
-	userId: r(),
-	tenantId: r(),
-	expiresAt: i(),
-	ipAddress: r().nullable(),
-	userAgent: r().nullable(),
-	createdAt: i().default("now"),
-	lastSeenAt: i().default("now").onUpdate("now")
-}).index(["userId"]).index(["tenantId"]), s = n("memberships", {
-	id: e(),
-	userId: r(),
-	tenantId: r(),
-	role: r(),
-	joinedAt: i().default("now")
-}).unique("byUserTenant", ["userId", "tenantId"]).index(["tenantId"]), c = n("authTokens", {
-	id: e(),
-	tokenHash: r().unique(),
-	userId: r(),
-	purpose: r(),
-	expiresAt: i(),
-	consumedAt: i().nullable(),
-	createdAt: i().default("now")
-}).index(["userId"]).index(["purpose"]), l = n("passkeys", {
-	id: e(),
-	credentialId: r().unique(),
-	userId: r(),
-	publicKey: r(),
-	counter: t().default(0),
-	transports: r().nullable(),
-	createdAt: i().default("now"),
-	lastUsedAt: i().nullable()
-}).index(["userId"]), u = n("recoveryCodes", {
-	id: e(),
-	userId: r(),
-	codeHash: r(),
-	consumedAt: i().nullable(),
-	createdAt: i().default("now")
-}).index(["userId"]), d = n("passkeyChallenges", {
-	id: e(),
-	key: r().unique(),
-	challenge: r(),
-	expiresAt: i(),
-	createdAt: i().default("now")
-}), f = n("loginAttempts", {
-	id: e(),
-	email: r().unique(),
-	failedCount: t().default(0),
-	windowStartedAt: i().nullable(),
-	lockedUntil: i().nullable(),
-	createdAt: i().default("now"),
-	updatedAt: i().default("now").onUpdate("now")
-}), p = n("invitations", {
-	id: e({ prefix: "inv" }),
-	tokenHash: r().unique(),
-	email: r(),
-	tenantId: r(),
-	role: r(),
-	invitedByUserId: r(),
-	expiresAt: i(),
-	acceptedAt: i().nullable(),
-	acceptedByUserId: r().nullable(),
-	revokedAt: i().nullable(),
-	revokedByUserId: r().nullable(),
-	createdAt: i().default("now")
-}).index(["tenantId"]).index(["email"]), m = n("impersonationGrants", {
-	id: e({ prefix: "imp" }),
-	sessionId: r().unique(),
-	actorUserId: r(),
-	actorSessionId: r(),
-	targetUserId: r(),
-	tenantId: r(),
-	reason: r().nullable(),
-	startedAt: i().default("now"),
-	expiresAt: i(),
-	endedAt: i().nullable(),
-	endedReason: r().nullable(),
-	ipAddress: r().nullable(),
-	userAgent: r().nullable()
-}).index(["actorUserId"]).index(["targetUserId"]), h = [
-	a,
-	o,
-	s,
+var c = a("users", {
+	id: r(),
+	email: o().nullable(),
+	passwordHash: o().nullable(),
+	tenantId: o(),
+	mfaSecret: o().nullable(),
+	mfaEnrolledAt: s().nullable(),
+	emailVerifiedAt: s().nullable(),
+	createdAt: s().default("now"),
+	updatedAt: s().default("now").onUpdate("now")
+}).index(["tenantId"]).uniqueActive("usersEmailUnique", ["email"], { where: "\"email\" IS NOT NULL" }), l = a("sessions", {
+	id: r(),
+	familyId: o().nullable(),
+	rotatedAt: s().nullable(),
+	userId: o(),
+	tenantId: o(),
+	expiresAt: s(),
+	ipAddress: o().nullable(),
+	userAgent: o().nullable(),
+	createdAt: s().default("now"),
+	lastSeenAt: s().default("now").onUpdate("now")
+}).index(["userId"]).index(["tenantId"]).index(["familyId"]), u = a("memberships", {
+	id: r(),
+	userId: o(),
+	tenantId: o(),
+	role: o(),
+	joinedAt: s().default("now")
+}).unique("byUserTenant", ["userId", "tenantId"]).index(["tenantId"]), d = a("authTokens", {
+	id: r(),
+	tokenHash: o().unique(),
+	userId: o(),
+	purpose: o(),
+	expiresAt: s(),
+	consumedAt: s().nullable(),
+	createdAt: s().default("now")
+}).index(["userId"]).index(["purpose"]), f = a("passkeys", {
+	id: r(),
+	credentialId: o().unique(),
+	userId: o(),
+	publicKey: o(),
+	counter: i().default(0),
+	transports: o().nullable(),
+	createdAt: s().default("now"),
+	lastUsedAt: s().nullable()
+}).index(["userId"]), p = a("recoveryCodes", {
+	id: r(),
+	userId: o(),
+	codeHash: o(),
+	consumedAt: s().nullable(),
+	createdAt: s().default("now")
+}).index(["userId"]), m = a("passkeyChallenges", {
+	id: r(),
+	key: o().unique(),
+	challenge: o(),
+	expiresAt: s(),
+	createdAt: s().default("now")
+}), h = a("loginAttempts", {
+	id: r(),
+	email: o().unique(),
+	failedCount: i().default(0),
+	windowStartedAt: s().nullable(),
+	lockedUntil: s().nullable(),
+	createdAt: s().default("now"),
+	updatedAt: s().default("now").onUpdate("now")
+}), g = a("invitations", {
+	id: r({ prefix: "inv" }),
+	tokenHash: o().unique(),
+	email: o(),
+	tenantId: o(),
+	role: o(),
+	invitedByUserId: o(),
+	expiresAt: s(),
+	acceptedAt: s().nullable(),
+	acceptedByUserId: o().nullable(),
+	revokedAt: s().nullable(),
+	revokedByUserId: o().nullable(),
+	createdAt: s().default("now")
+}).index(["tenantId"]).index(["email"]), _ = a("impersonationGrants", {
+	id: r({ prefix: "imp" }),
+	sessionId: o().unique(),
+	actorUserId: o(),
+	actorSessionId: o(),
+	targetUserId: o(),
+	tenantId: o(),
+	reason: o().nullable(),
+	startedAt: s().default("now"),
+	expiresAt: s(),
+	endedAt: s().nullable(),
+	endedReason: o().nullable(),
+	ipAddress: o().nullable(),
+	userAgent: o().nullable()
+}).index(["actorUserId"]).index(["targetUserId"]), v = [
 	c,
 	l,
 	u,
 	d,
 	f,
 	p,
-	m
+	m,
+	h,
+	g,
+	_
 ];
 //#endregion
-export { h as authTables, c as authTokensTable, m as impersonationGrantsTable, p as invitationsTable, f as loginAttemptsTable, s as membershipsTable, d as passkeyChallengesTable, l as passkeysTable, u as recoveryCodesTable, o as sessionsTable, a as usersTable };
+export { e as authGuestDevicesTable, t as authGuestsTable, v as authTables, d as authTokensTable, n as guestTables, _ as impersonationGrantsTable, g as invitationsTable, h as loginAttemptsTable, u as membershipsTable, m as passkeyChallengesTable, f as passkeysTable, p as recoveryCodesTable, l as sessionsTable, c as usersTable };

package/dist/sessionFamily.js

@@ -0,0 +1,15 @@
+//#region src/sessionFamily.ts
+var e = (e) => {
+	if (typeof e.id != "string" || e.id.length === 0 || typeof e.userId != "string" || e.userId.length === 0) return null;
+	let t = e.familyId ?? e.id;
+	return typeof t == "string" && t.length > 0 ? t : null;
+}, t = (t, n) => {
+	let r = e(t);
+	return r !== null && n != null && n.id === r && n.userId === t.userId && e(n) === n.id;
+}, n = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) typeof n.id == "string" && n.id.length !== 0 && t.set(n.id, t.has(n.id) ? null : n);
+	return t;
+}, r = (e, t, n, r) => e !== null && typeof t == "string" && t.length > 0 && typeof n == "string" && n.length > 0 && Number.isFinite(r) && e.id === t && e.userId === n && e.rotatedAt == null && e.expiresAt instanceof Date && Number.isFinite(e.expiresAt.getTime()) && e.expiresAt.getTime() > r;
+//#endregion
+export { t as hasOwnedSessionFamily, n as indexSessionFamilies, r as isSessionCredentialLiveFor, e as sessionFamilyId };

package/dist/sessionRegistry.js

@@ -0,0 +1,133 @@
+import { issueSession as e } from "./session.js";
+import { hasOwnedSessionFamily as t, indexSessionFamilies as n, sessionFamilyId as r } from "./sessionFamily.js";
+import { newAuthId as i } from "./userStore.js";
+import { Effect as a } from "effect";
+import { and as o, columnRef as s, eq as c, isNull as l, or as u } from "@voltro/database";
+//#region src/sessionRegistry.ts
+var d = "sessions", f = 604800, p = (e) => ({
+	...e,
+	expiresAt: new Date(e.expiresAt),
+	createdAt: new Date(e.createdAt),
+	lastSeenAt: new Date(e.lastSeenAt),
+	rotatedAt: e.rotatedAt == null ? null : new Date(e.rotatedAt)
+}), m = async (e, t, n = !1) => await e.query({
+	table: d,
+	predicate: t,
+	order: n ? [{
+		column: "id",
+		direction: "asc"
+	}] : [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0,
+	...n ? { lock: "update" } : {}
+}), h = (e, t, n) => t.transaction === "existing" ? n(e) : e.transactional((e) => n(e)), g = (e) => e.familyId ?? e.id, _ = (e) => e.rotatedAt == null, v = async (e, t, n) => {
+	let r = (await m(e, c("id", n)))[0];
+	if (!r || r.userId !== t) return null;
+	let i = g(r), a = (await m(e, c("id", i), !0))[0];
+	if (!a || a.userId !== t || g(a) !== i) return null;
+	let o = n === a.id ? a : (await m(e, c("id", n), !0))[0];
+	return o && o.userId === t && g(o) === i ? {
+		root: a,
+		current: o
+	} : null;
+}, y = async (e, t, n) => {
+	let r = await v(e, t, n);
+	return r && _(r.current) ? p(r.current) : null;
+}, b = async (e, t, n) => {
+	if (n.userId !== t || g(n) !== n.id) throw Error("The locked session family requires reconciliation.");
+	let r = await m(e, o(c("userId", t), u(c("id", n.id), c("familyId", n.id))), !0), i = 0, a = !1;
+	for (let t of r) await e.delete(d, t.id) && (a = !0, _(t) && (i += 1));
+	return {
+		removed: a,
+		credentials: i
+	};
+}, x = async (e, t, n) => {
+	let r = await v(e, t, n);
+	return r === null ? {
+		removed: !1,
+		credentials: 0
+	} : b(e, t, r.root);
+}, S = (e, t) => m(e, o(c("userId", t), u(l("familyId"), c("familyId", s("id")))), !0), C = (e, i = {}) => ({
+	listSessions: (i) => a.promise(async () => {
+		let a = await m(e, c("userId", i)), o = n(a);
+		return a.filter((e) => e.userId === i && _(e) && o.get(e.id) === e && t(e, o.get(r(e) ?? ""))).map(p).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime());
+	}),
+	insertSession: (t) => a.promise(async () => {
+		let n = /* @__PURE__ */ new Date(), r = {
+			...t,
+			familyId: t.familyId ?? t.id,
+			rotatedAt: t.rotatedAt ?? null,
+			createdAt: n,
+			lastSeenAt: n
+		};
+		return await e.insert(d, r), r;
+	}),
+	findSession: (n) => a.promise(async () => {
+		let i = await m(e, c("id", n)), a = i.length === 1 ? i[0] : void 0;
+		if (!a || a.id !== n || !_(a)) return null;
+		let o = r(a);
+		if (o === null) return null;
+		let s = o === a.id ? [a] : await m(e, c("id", o));
+		return s.length === 1 && t(a, s[0]) ? p(a) : null;
+	}),
+	touchSession: (t, n) => a.promise(() => h(e, i, async (e) => {
+		let r = (await m(e, c("id", t)))[0];
+		if (!r) return;
+		let i = await v(e, r.userId, t);
+		i && _(i.current) && (await e.update(d, t, {
+			expiresAt: n,
+			lastSeenAt: /* @__PURE__ */ new Date()
+		}), i.root.id !== t && new Date(i.root.expiresAt) < n && await e.update(d, i.root.id, { expiresAt: n }));
+	})),
+	revokeSession: (t, n) => a.promise(() => h(e, i, async (e) => (await x(e, t, n)).removed)),
+	revokeAllOtherSessions: (t, n) => a.promise(() => h(e, i, async (e) => {
+		let r = await S(e, t), i = (await m(e, o(c("userId", t), c("id", n)), !0))[0], a = i && r.some((e) => e.id === g(i)) ? g(i) : void 0, s = 0;
+		for (let n of r) n.id !== a && (s += (await b(e, t, n)).credentials);
+		return s;
+	})),
+	revokeAllSessions: (t) => a.promise(() => h(e, i, async (e) => {
+		let n = await S(e, t), r = 0;
+		for (let i of n) r += (await b(e, t, i)).credentials;
+		return r;
+	}))
+}), w = (e, t) => e.type === "user" ? {
+	...e,
+	metadata: {
+		...e.metadata ?? {},
+		sessionId: t
+	}
+} : e, T = async (t, n, r, o, s) => {
+	if (n.type !== "user") throw Error("issueRegisteredSession: only a user subject has a session row");
+	let c = i("sess"), l = o.ttlSeconds ?? f, u = (o.now ?? Date.now)();
+	await a.runPromise(t.insertSession({
+		id: c,
+		familyId: s ?? c,
+		rotatedAt: null,
+		userId: n.id,
+		tenantId: n.tenantId ?? "",
+		expiresAt: new Date(u + l * 1e3),
+		ipAddress: o.ipAddress ?? null,
+		userAgent: o.userAgent ?? null
+	}));
+	let { ipAddress: d, userAgent: p, ...m } = o;
+	return {
+		...e(w(n, c), r, m),
+		sessionId: c
+	};
+}, E = async (e, t, n, r = {}) => T(e, t, n, r), D = async (e, t, n, r, i = {}) => t.type === "user" ? h(e, i, async (e) => {
+	let a = await v(e, t.id, n), o = (i.now ?? Date.now)();
+	if (!a || !_(a.current) || new Date(a.current.expiresAt).getTime() <= o) return null;
+	let s = new Date(o + (i.ttlSeconds ?? f) * 1e3);
+	await e.update(d, a.current.id, {
+		familyId: a.root.id,
+		rotatedAt: new Date(o)
+	}), await e.update(d, a.root.id, {
+		familyId: a.root.id,
+		expiresAt: new Date(Math.max(new Date(a.root.expiresAt).getTime(), s.getTime()))
+	});
+	let { transaction: c, ...l } = i;
+	return T(C(e, { transaction: "existing" }), t, r, l, a.root.id);
+}) : null;
+//#endregion
+export { C as dataStoreSessionRegistry, E as issueRegisteredSession, y as lockRegisteredSession, D as rotateRegisteredSession, w as withSessionId };

package/dist/signedClaims.js

@@ -0,0 +1,24 @@
+import { createHmac as e, timingSafeEqual as t } from "node:crypto";
+//#region src/signedClaims.ts
+var n = (t, n, r) => e("sha256", n).update(`${r}:${t}`).digest(), r = (e, t, r) => {
+	if (t.length < 32 || typeof e.exp != "number" || !Number.isSafeInteger(e.exp)) throw Error("Auth handoff requires a project signing key and whole-second expiry");
+	let i = Buffer.from(JSON.stringify(e), "utf8").toString("base64url");
+	if (i.length > 8192) throw Error("Auth handoff exceeds its payload budget");
+	return `${i}.${n(i, t, r).toString("base64url")}`;
+}, i = (e, r, i, a = Date.now) => {
+	if (!e || e.length > 8256 || r.length < 32) return null;
+	let o = e.split("."), [s, c] = o;
+	if (o.length !== 2 || !s || !c || !/^[A-Za-z0-9_-]+$/.test(s) || !/^[A-Za-z0-9_-]{43}$/.test(c)) return null;
+	let l = Buffer.from(c, "base64url"), u = n(s, r, i);
+	if (l.length !== u.length || !t(l, u)) return null;
+	try {
+		let e = JSON.parse(Buffer.from(s, "base64url").toString("utf8"));
+		if (typeof e != "object" || !e || Array.isArray(e)) return null;
+		let t = e, n = a();
+		return !Number.isFinite(n) || typeof t.exp != "number" || !Number.isSafeInteger(t.exp) || t.exp * 1e3 <= n ? null : t;
+	} catch {
+		return null;
+	}
+};
+//#endregion
+export { r as signAuthClaims, i as verifyAuthClaims };

package/dist/strategy.d.ts

@@ -224,6 +224,10 @@ declare interface PasskeyStore {
 /** A server-side session row — enumerated so apps can list active
  *  devices + revoke them. Written on sign-in; deleted on revoke. */
 declare interface SessionRecord {
+    /** Stable device lineage. The original row is its transaction lock anchor. */
+    readonly familyId?: string | null;
+    /** A replaced credential remains an inert revocation alias until the device ends. */
+    readonly rotatedAt?: Date | null;
     readonly id: string;
     readonly userId: string;
     readonly tenantId: string;
@@ -239,10 +243,10 @@ declare interface SessionRecord {
 declare type SessionRegistry = SessionStore;
 
 declare interface SessionRevocationChecker {
-    /** Is this session still live? `false` means the row was revoked (or
-     *  is past its `expiresAt`) — the caller rejects the cookie. Verdicts
-     *  are cached for `ttlMs`. */
-    readonly isLive: (sessionId: string) => Effect.Effect<boolean>;
+    /** Is this exact session credential live for the signed subject's user ID?
+     * Refuse a missing/rotated/expired row or a different stored owner. Cache
+     * verdicts retain native owner identity, never the requested owner. */
+    readonly isLiveFor: (sessionId: string, userId: string) => Effect.Effect<boolean>;
     /** Drop the cached verdict for one session — called inline by
      *  sign-out / revoke handlers so the kill is immediate on THIS
      *  process (other replicas converge within `ttlMs`). */
@@ -272,13 +276,14 @@ declare type SessionSecretInput = string | SessionSecrets;
 
 /** Server-side sessions — enumeration + revocation. */
 declare interface SessionStore {
-    /** Active sessions for a user (most recent first). */
+    /** Unrotated credentials with an existing canonical root owned by the same user, most recent first. */
     readonly listSessions: (userId: string) => Effect.Effect<ReadonlyArray<SessionRecord>>;
     /** Record a session on sign-in. */
     readonly insertSession: (session: Omit<SessionRecord, 'createdAt' | 'lastSeenAt'>) => Effect.Effect<SessionRecord>;
-    /** Look up one session row by id. The request-time revocation check
-     *  (`makeSessionRevocationChecker`) calls this — a missing row means
-     *  the session was revoked. */
+    /** Look up an unrotated credential only while its canonical family root
+     * exists and belongs to the same user. A rotated root remains an anchor;
+     * its tenant does not replace the credential tenant. Custom stores must
+     * enforce this before returning a row to request-time revocation checks. */
     readonly findSession: (sessionId: string) => Effect.Effect<SessionRecord | null>;
     /** Slide a session row forward: bump `expiresAt` + `lastSeenAt`. Called
      *  when the sliding-window renewal re-issues the cookie, so the row
@@ -352,7 +357,7 @@ declare const UserNotFoundError_base: new <A extends Record<string, any> = {}>(a
 
 declare interface UserRecord {
     readonly id: string;
-    readonly email: string;
+    readonly email: string | null;
     /**
      * The stored scrypt hash — OPTIONAL, because not every identity has a
      * password. An SSO-only, magic-link-only, passkey-only, or provider-PAT
@@ -441,6 +446,9 @@ export declare interface VoltroPasswordStrategyOptions {
      *  (stateless); with it, nothing but a registered session authenticates,
      *  and every session can be revoked. */
     readonly requireSessionId?: boolean;
+    /** Verified user identity kinds owned by this carrier. Other verified kinds
+     * skip to their own carrier; malformed, forged or expired values still fail. */
+    readonly userKinds?: ReadonlyArray<'registered' | 'guest'>;
 }
 
 export { }

package/dist/strategy.js

@@ -1,3 +1,69 @@
-import "./session.js";
-import { t as e } from "./strategy-XaGjSicX.js";
-export { e as voltroPasswordStrategy };
+import { sessionSecretsOf as e } from "./session.js";
+import { makeSessionRevocationChecker as t, validateSessionRevocationOptions as n } from "./revocation.js";
+import { sessionIdOfSubject as r } from "./userStore.js";
+import { Effect as i } from "effect";
+import { readSessionValue as a, resolveSessionSecret as o, verifySessionKeyed as s } from "@voltro/protocol/session";
+//#region src/strategy.ts
+var c = (e) => typeof e == "object" && !!e && "isLiveFor" in e && typeof e.isLiveFor == "function" && "invalidate" in e && typeof e.invalidate == "function" && typeof e.ttlMs == "number" && Number.isFinite(e.ttlMs) && e.ttlMs >= 0, l = (e) => e.revocation && c(e.revocation) ? e.revocation : (e.revocation !== void 0 && n(e.revocation), e.store ? t(e.store, e.revocation ?? {}) : null), u = (n = {}) => {
+	let u = n.cookieName ?? "voltro:session", f = l(n), p = n.revocation && !c(n.revocation) ? n.revocation : {}, m = /* @__PURE__ */ new WeakMap(), h = (e) => {
+		if (f) return f;
+		let r = n.sessionRegistry;
+		if (r === void 0) return null;
+		if (typeof r != "function") return t(r, p);
+		if (e === void 0) return null;
+		let i = m.get(e);
+		if (i) return i;
+		let a = t(r(e), p);
+		return m.set(e, a), a;
+	};
+	return {
+		id: "voltro-password",
+		resolve: (t) => {
+			let c = a(t.headers, u);
+			if (!c) return { kind: "skip" };
+			let l = e(n.secret ?? o()), f = s(c, l);
+			if (!f) return {
+				kind: "failed",
+				reason: "voltro session cookie failed verification"
+			};
+			if (f.subject.type === "user" && n.userKinds && !n.userKinds.includes(f.subject.kind === "guest" ? "guest" : "registered")) return { kind: "skip" };
+			let p = d(f.subject, "voltro-password"), m = r(p);
+			if (!m) return n.requireSessionId === !0 ? {
+				kind: "failed",
+				reason: "voltro session cookie carries no session id"
+			} : {
+				kind: "matched",
+				subject: p
+			};
+			let g = h(t.store);
+			return g ? p.type === "user" ? i.runPromise(g.isLiveFor(m, p.id)).then((e) => e ? {
+				kind: "matched",
+				subject: p
+			} : {
+				kind: "failed",
+				reason: "voltro session revoked"
+			}) : {
+				kind: "failed",
+				reason: "registered session requires a user subject"
+			} : n.requireSessionId === !0 ? {
+				kind: "failed",
+				reason: "session registry not available yet"
+			} : {
+				kind: "matched",
+				subject: p
+			};
+		}
+	};
+}, d = (e, t) => {
+	if (e.type === "anonymous") return e;
+	let n = e.metadata ?? {};
+	return {
+		...e,
+		metadata: {
+			...n,
+			provider: t
+		}
+	};
+};
+//#endregion
+export { u as voltroPasswordStrategy };

package/dist/subjectGuard.js

@@ -0,0 +1,11 @@
+import { Effect as e } from "effect";
+//#region src/subjectGuard.ts
+var t = { ok: !0 }, n = (n, r) => e.gen(function* () {
+	for (let e of n) {
+		let t = yield* e(r);
+		if (!t.ok) return t;
+	}
+	return t;
+});
+//#endregion
+export { n as runSubjectGuards };

package/dist/totp.js

@@ -0,0 +1,55 @@
+import { createHmac as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
+import { Data as r, Effect as i } from "effect";
+//#region src/totp.ts
+var a = 30, o = 6, s = 20, c = "sha1", l = 1, u = class extends r.TaggedError("TotpVerifyError") {}, d = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", f = (e) => {
+	let t = 0, n = 0, r = "";
+	for (let i of e) for (n = n << 8 | i, t += 8; t >= 5;) r += d[n >>> t - 5 & 31], t -= 5;
+	return t > 0 && (r += d[n << 5 - t & 31]), r;
+}, p = (e) => {
+	let t = e.toUpperCase().replace(/[\s=]+/g, "");
+	if (!/^[A-Z2-7]+$/.test(t)) return null;
+	let n = new Uint8Array(Math.floor(t.length * 5 / 8)), r = 0, i = 0, a = 0;
+	for (let e of t) {
+		let t = d.indexOf(e);
+		if (t === -1) return null;
+		i = i << 5 | t, r += 5, r >= 8 && (n[a++] = i >>> r - 8 & 255, r -= 8);
+	}
+	return n.subarray(0, a);
+}, m = (e) => {
+	let t = Buffer.alloc(8);
+	return t.writeBigUInt64BE(BigInt(e), 0), t;
+}, h = (t, n) => {
+	let r = e(c, Buffer.from(t));
+	r.update(m(n));
+	let i = r.digest(), a = i[i.length - 1] & 15, s = (i[a] & 127) << 24 | (i[a + 1] & 255) << 16 | (i[a + 2] & 255) << 8 | i[a + 3] & 255;
+	return String(s % 10 ** o).padStart(o, "0");
+}, g = () => f(t(s)), _ = (e) => `otpauth://totp/${encodeURIComponent(`${e.issuer}:${e.accountName}`)}?${new URLSearchParams({
+	secret: e.secret,
+	issuer: e.issuer,
+	algorithm: "SHA1",
+	digits: String(o),
+	period: String(a)
+}).toString()}`, v = (e, t = Date.now()) => {
+	let n = p(e);
+	return n ? h(n, Math.floor(t / 1e3 / a)) : "000000";
+}, y = (e, t, r = Date.now()) => i.gen(function* () {
+	let o = p(e);
+	if (!o) return yield* i.fail(new u({ reason: "malformedSecret" }));
+	let s = t.replace(/\s+/g, "");
+	if (!/^[0-9]{6}$/.test(s)) return yield* i.fail(new u({ reason: "invalidCode" }));
+	let c = Math.floor(r / 1e3 / a), d = Buffer.from(s);
+	for (let e = -1; e <= l; e++) {
+		let t = h(o, c + e), r = Buffer.from(t);
+		if (r.length === d.length && n(r, d)) return !0;
+	}
+	return yield* i.fail(new u({ reason: "invalidCode" }));
+}), b = (e = 10) => {
+	let n = [];
+	for (let r = 0; r < e; r++) {
+		let e = f(t(16)).slice(0, 25).match(/.{1,5}/g) ?? [];
+		n.push(e.join("-"));
+	}
+	return n;
+};
+//#endregion
+export { u as TotpVerifyError, b as generateRecoveryCodes, v as generateTotpCode, g as generateTotpSecret, _ as otpauthUrl, y as verifyTotpCode };