@vsaas/loopback 12.1.1 → 12.2.1

package/dist/common/models/user.cjs

@@ -143,16 +143,17 @@ var require_user = /* @__PURE__ */ require_runtime$1.__commonJSMin(((exports, mo
 					if (err) {
 						debug("An error is reported from User.hasPassword: %j", err);
 						fn(defaultError);
-					} else if (isMatch) if (self.settings.emailVerificationRequired && !user.emailVerified) {
-						debug("User email has not been verified");
-						err = new Error(g.f("login failed as the email has not been verified"));
-						err.statusCode = 401;
-						err.code = "LOGIN_FAILED_EMAIL_NOT_VERIFIED";
-						err.details = { userId: user.id };
-						fn(err);
-					} else if (user.createAccessToken.length === 2) user.createAccessToken(credentials.ttl, tokenHandler);
-					else user.createAccessToken(credentials.ttl, credentials, tokenHandler);
-					else {
+					} else if (isMatch) {
+						if (self.settings.emailVerificationRequired && !user.emailVerified) {
+							debug("User email has not been verified");
+							err = new Error(g.f("login failed as the email has not been verified"));
+							err.statusCode = 401;
+							err.code = "LOGIN_FAILED_EMAIL_NOT_VERIFIED";
+							err.details = { userId: user.id };
+							fn(err);
+						} else if (user.createAccessToken.length === 2) user.createAccessToken(credentials.ttl, tokenHandler);
+						else user.createAccessToken(credentials.ttl, credentials, tokenHandler);
+					} else {
 						debug("The password is invalid for user %s", query.email || query.username);
 						fn(defaultError);
 					}
@@ -164,6 +165,102 @@ var require_user = /* @__PURE__ */ require_runtime$1.__commonJSMin(((exports, mo
 			});
 			return fn.promise;
 		};
+		User._legacyLogin = User.login;
+		User.login = function(credentials, include, options, fn) {
+			if (typeof include === "function") {
+				fn = include;
+				include = void 0;
+				options = void 0;
+			} else if (typeof options === "function") {
+				fn = options;
+				options = void 0;
+			}
+			if (!(this.settings.twoFactor != null || this.settings.authenticationRateLimit?.enabled === true)) return this._legacyLogin(credentials, include, fn);
+			if (!this._authenticationSecurityReady || !this._authenticationSecurity) {
+				fn = fn || utils.createPromiseCallback();
+				const error = /* @__PURE__ */ new Error("Authentication security is not ready");
+				error.statusCode = 503;
+				error.code = "AUTHENTICATION_SECURITY_UNAVAILABLE";
+				process.nextTick(fn, error);
+				return fn.promise;
+			}
+			return this._authenticationSecurity.login(credentials, include, options || {}, fn);
+		};
+		User.getTwoFactorPrincipalBindingMaterial = function(user, options, fn) {
+			if (typeof options === "function") {
+				fn = options;
+				options = void 0;
+			}
+			fn = fn || utils.createPromiseCallback();
+			process.nextTick(function() {
+				if (!user || typeof user.password !== "string" || !user.password) {
+					const error = /* @__PURE__ */ new Error("Two-factor principal binding is unavailable");
+					error.code = "AUTHENTICATION_SECURITY_UNAVAILABLE";
+					error.statusCode = 503;
+					return fn(error);
+				}
+				fn(null, user.password);
+			});
+			return fn.promise;
+		};
+		User.validateTwoFactorLoginPrincipal = function(user, options, fn) {
+			if (typeof options === "function") fn = options;
+			fn = fn || utils.createPromiseCallback();
+			process.nextTick(fn, null, true);
+			return fn.promise;
+		};
+		User.buildTwoFactorLoginContext = function(credentials, options, fn) {
+			if (typeof options === "function") fn = options;
+			fn = fn || utils.createPromiseCallback();
+			process.nextTick(fn, null, { ttl: credentials && credentials.ttl });
+			return fn.promise;
+		};
+		User.resolveAuthenticationRateLimitSource = function(options, fn) {
+			fn = fn || utils.createPromiseCallback();
+			process.nextTick(fn, null, options && (options.authenticationSource || options.req?.ip || options.req?.socket?.remoteAddress || null));
+			return fn.promise;
+		};
+		User.verifyTwoFactor = function(verification, options, fn) {
+			if (typeof options === "function") {
+				fn = options;
+				options = void 0;
+			}
+			if (!this._authenticationSecurityReady || !this._authenticationSecurity) {
+				fn = fn || utils.createPromiseCallback();
+				const error = /* @__PURE__ */ new Error("Two-factor authentication is not configured");
+				error.statusCode = this.settings.twoFactor == null ? 404 : 503;
+				error.code = this.settings.twoFactor == null ? "TWO_FACTOR_NOT_CONFIGURED" : "AUTHENTICATION_SECURITY_UNAVAILABLE";
+				process.nextTick(fn, error);
+				return fn.promise;
+			}
+			return this._authenticationSecurity.verifyTwoFactor(verification, options || {}, fn);
+		};
+		for (const method of [
+			"beginTwoFactorEnrollment",
+			"confirmTwoFactorEnrollment",
+			"regenerateTwoFactorRecoveryCodes",
+			"disableTwoFactor"
+		]) User[method] = function(userId, request, options, fn) {
+			if (typeof options === "function") {
+				fn = options;
+				options = void 0;
+			}
+			if (!this._authenticationSecurityReady || !this._authenticationSecurity) {
+				fn = fn || utils.createPromiseCallback();
+				const error = /* @__PURE__ */ new Error("Two-factor authentication is not configured");
+				error.statusCode = this.settings.twoFactor == null ? 404 : 503;
+				error.code = this.settings.twoFactor == null ? "TWO_FACTOR_NOT_CONFIGURED" : "AUTHENTICATION_SECURITY_UNAVAILABLE";
+				process.nextTick(fn, error);
+				return fn.promise;
+			}
+			const serviceMethod = {
+				beginTwoFactorEnrollment: "beginEnrollment",
+				confirmTwoFactorEnrollment: "confirmEnrollment",
+				regenerateTwoFactorRecoveryCodes: "regenerateRecoveryCodes",
+				disableTwoFactor: "disable"
+			}[method];
+			return this._authenticationSecurity[serviceMethod](userId, request, options || {}, fn);
+		};
 		User.logout = function(tokenId, fn) {
 			fn = fn || utils.createPromiseCallback();
 			let err;
@@ -184,8 +281,12 @@ var require_user = /* @__PURE__ */ require_runtime$1.__commonJSMin(((exports, mo
 			return fn.promise;
 		};
 		User.observe("before delete", function(ctx, next) {
-			if (!ctx.Model.relations.accessTokens) return next();
-			const AccessToken = ctx.Model.relations.accessTokens.modelTo;
+			if ((ctx.Model.settings.twoFactor != null || ctx.Model.settings.authenticationRateLimit?.enabled === true) && !ctx.Model._authenticationSecurity) {
+				const error = /* @__PURE__ */ new Error("Authentication security is not ready");
+				error.statusCode = 503;
+				error.code = "AUTHENTICATION_SECURITY_UNAVAILABLE";
+				return next(error);
+			}
 			const pkName = ctx.Model.definition.idName() || "id";
 			ctx.Model.find({
 				where: ctx.where,
@@ -196,7 +297,11 @@ var require_user = /* @__PURE__ */ require_runtime$1.__commonJSMin(((exports, mo
 				for (let i = 0; i < list.length; i++) ids[i] = list[i][pkName];
 				ctx.where = {};
 				ctx.where[pkName] = { inq: ids };
-				AccessToken.destroyAll({ userId: { inq: ids } }, next);
+				const cleanup = [];
+				const AccessToken = ctx.Model.relations.accessTokens?.modelTo;
+				if (AccessToken) cleanup.push(AccessToken.destroyAll({ userId: { inq: ids } }));
+				if (ctx.Model._authenticationSecurity) cleanup.push(ctx.Model._authenticationSecurity.deletePrincipals(ids));
+				Promise.all(cleanup).then(() => next(), next);
 			});
 		});
 		User.prototype.hasPassword = function(plain, fn) {
@@ -475,6 +580,9 @@ var require_user = /* @__PURE__ */ require_runtime$1.__commonJSMin(((exports, mo
 		};
 		User.hashPassword = function(plain) {
 			this.validatePassword(plain);
+			return this._hashPasswordWithoutValidation(plain);
+		};
+		User._hashPasswordWithoutValidation = function(plain) {
 			const salt = bcrypt.genSaltSync(this.settings.saltWorkFactor || SALT_WORK_FACTOR);
 			return bcrypt.hashSync(plain, salt);
 		};
@@ -532,24 +640,118 @@ var require_user = /* @__PURE__ */ require_runtime$1.__commonJSMin(((exports, mo
 			});
 			UserModel.remoteMethod("login", {
 				description: "Login a user with username/email and password.",
+				accepts: [
+					{
+						arg: "credentials",
+						type: "object",
+						required: true,
+						http: { source: "body" }
+					},
+					{
+						arg: "include",
+						type: ["string"],
+						http: { source: "query" },
+						description: "Related objects to include in the response. See the description of return value for more details."
+					},
+					{
+						arg: "options",
+						type: "object",
+						http: buildAuthenticationOptions
+					}
+				],
+				returns: {
+					arg: "accessToken",
+					type: "object",
+					root: true,
+					description: g.f("The response body contains properties of the {{AccessToken}} created on login.\nDepending on the value of `include` parameter, the body may contain additional properties:\n\n  - `user` - `U+007BUserU+007D` - Data of the currently logged in user. {{(`include=user`)}}\n\n")
+				},
+				http: { verb: "post" }
+			});
+			UserModel.getTwoFactorAuthenticationOptions = buildAuthenticationOptions;
+			UserModel.remoteMethod("verifyTwoFactor", {
+				description: "Complete login by verifying a second factor.",
 				accepts: [{
-					arg: "credentials",
+					arg: "verification",
 					type: "object",
 					required: true,
 					http: { source: "body" }
 				}, {
-					arg: "include",
-					type: ["string"],
-					http: { source: "query" },
-					description: "Related objects to include in the response. See the description of return value for more details."
+					arg: "options",
+					type: "object",
+					http: buildAuthenticationOptions
 				}],
 				returns: {
 					arg: "accessToken",
 					type: "object",
-					root: true,
-					description: g.f("The response body contains properties of the {{AccessToken}} created on login.\nDepending on the value of `include` parameter, the body may contain additional properties:\n\n  - `user` - `U+007BUserU+007D` - Data of the currently logged in user. {{(`include=user`)}}\n\n")
+					root: true
 				},
-				http: { verb: "post" }
+				http: {
+					verb: "post",
+					path: "/two-factor/verify"
+				}
+			});
+			function registerTwoFactorManagementMethod(name, path, description) {
+				UserModel.remoteMethod(name, {
+					description,
+					accepts: [
+						{
+							arg: "userId",
+							type: "any",
+							http: getUserIdFromRequestContext
+						},
+						{
+							arg: "request",
+							type: "object",
+							required: true,
+							http: { source: "body" }
+						},
+						{
+							arg: "options",
+							type: "object",
+							http: buildAuthenticationOptions
+						}
+					],
+					returns: {
+						arg: "result",
+						type: "object",
+						root: true
+					},
+					http: {
+						verb: "post",
+						path
+					}
+				});
+			}
+			registerTwoFactorManagementMethod("beginTwoFactorEnrollment", "/two-factor/setup", "Begin two-factor enrollment.");
+			registerTwoFactorManagementMethod("confirmTwoFactorEnrollment", "/two-factor/confirm", "Confirm two-factor enrollment.");
+			registerTwoFactorManagementMethod("regenerateTwoFactorRecoveryCodes", "/two-factor/recovery-codes", "Regenerate two-factor recovery codes.");
+			registerTwoFactorManagementMethod("disableTwoFactor", "/two-factor/disable", "Disable two-factor authentication.");
+			for (const method of [
+				"login",
+				"verifyTwoFactor",
+				"beginTwoFactorEnrollment",
+				"confirmTwoFactorEnrollment",
+				"regenerateTwoFactorRecoveryCodes",
+				"disableTwoFactor"
+			]) UserModel.afterRemote(method, function(ctx, result, next) {
+				ctx.res.setHeader("Cache-Control", "no-store");
+				ctx.res.setHeader("Pragma", "no-cache");
+				next();
+			});
+			for (const method of [
+				"login",
+				"verifyTwoFactor",
+				"beginTwoFactorEnrollment",
+				"confirmTwoFactorEnrollment",
+				"regenerateTwoFactorRecoveryCodes",
+				"disableTwoFactor"
+			]) UserModel.afterRemoteError(method, function(ctx, next) {
+				if (ctx.error) {
+					ctx.res.setHeader("Cache-Control", "no-store");
+					ctx.res.setHeader("Pragma", "no-cache");
+				}
+				if (ctx.error && ctx.error.retryAfter) ctx.res.setHeader("Retry-After", String(ctx.error.retryAfter));
+				next();
 			});
 			UserModel.remoteMethod("logout", {
 				description: "Logout a user with access token.",
@@ -682,6 +884,13 @@ var require_user = /* @__PURE__ */ require_runtime$1.__commonJSMin(((exports, mo
 				}
 				return token.userId;
 			}
+			function buildAuthenticationOptions(ctx) {
+				const req = ctx && ctx.req;
+				return {
+					accessToken: req && req.accessToken,
+					authenticationSource: req && (req.ip || req.socket && req.socket.remoteAddress)
+				};
+			}
 			UserModel.afterRemote("confirm", function(ctx, inst, next) {
 				if (ctx.args.redirect !== void 0) {
 					if (!ctx.res) return next(new Error(g.f("The transport does not support HTTP redirects.")));
@@ -780,6 +989,37 @@ var require_user = /* @__PURE__ */ require_runtime$1.__commonJSMin(((exports, mo
 			}
 			ctx.Model._invalidateAccessTokensOfUsers(userIdsToExpire, ctx.options, next);
 		});
+		User.observe("after save", function invalidateTwoFactorChallenges(ctx, next) {
+			if (!ctx.hookState.originalUserData || !(ctx.instance || ctx.data).password) return next();
+			const Challenge = ctx.Model.app && ctx.Model.app.models.TwoFactorChallenge;
+			if (!Challenge) return next();
+			const pkName = ctx.Model.definition.idName() || "id";
+			const principalIds = ctx.hookState.originalUserData.map(function(user) {
+				return String(user[pkName]);
+			});
+			Challenge.updateAll({
+				principalType: ctx.Model.modelName,
+				principalId: { inq: principalIds },
+				status: { inq: ["pending", "verifying"] }
+			}, { status: "expired" }, function(err) {
+				if (err) {
+					debug("Unable to invalidate two-factor challenges: %j", err);
+					const event = {
+						error: err,
+						modelName: ctx.Model.modelName,
+						principalCount: principalIds.length,
+						timestamp: /* @__PURE__ */ new Date()
+					};
+					try {
+						ctx.Model.emit("twoFactorChallengeInvalidationError", event);
+					} catch {}
+					try {
+						ctx.Model.app.emit("authenticationSecurityCleanupError", err);
+					} catch {}
+				}
+				next();
+			});
+		});
 	}
 	function hasMoreThanOneOwnEnumerableKey(object) {
 		let count = 0;

package/dist/common/models/user.d.cts

@@ -0,0 +1,3 @@
+//#region src/common/models/user.d.ts
+declare function configureUser(User: any): void;
+export = configureUser;

package/dist/common/models/user2.cjs

@@ -42,6 +42,36 @@ var require_user = /* @__PURE__ */ require("../../_virtual/_rolldown/runtime.cjs
 				"permission": "ALLOW",
 				"property": "login"
 			},
+			{
+				"principalType": "ROLE",
+				"principalId": "$everyone",
+				"permission": "ALLOW",
+				"property": "verifyTwoFactor"
+			},
+			{
+				"principalType": "ROLE",
+				"principalId": "$authenticated",
+				"permission": "ALLOW",
+				"property": "beginTwoFactorEnrollment"
+			},
+			{
+				"principalType": "ROLE",
+				"principalId": "$authenticated",
+				"permission": "ALLOW",
+				"property": "confirmTwoFactorEnrollment"
+			},
+			{
+				"principalType": "ROLE",
+				"principalId": "$authenticated",
+				"permission": "ALLOW",
+				"property": "regenerateTwoFactorRecoveryCodes"
+			},
+			{
+				"principalType": "ROLE",
+				"principalId": "$authenticated",
+				"permission": "ALLOW",
+				"property": "disableTwoFactor"
+			},
 			{
 				"principalType": "ROLE",
 				"principalId": "$everyone",

package/dist/index.cjs

@@ -2,6 +2,7 @@ const require_lib_loopback = require("./lib/loopback.cjs");
 const require_lib_connectors_base_connector = require("./lib/connectors/base-connector.cjs");
 const require_lib_connectors_memory = require("./lib/connectors/memory.cjs");
 const require_lib_connectors_mail = require("./lib/connectors/mail.cjs");
+const require_lib_rate_limit_index = require("./lib/rate-limit/index.cjs");
 //#region src/index.ts
 const loopback = require_lib_loopback;
 require("@vsaas/loopback-datasource-juggler");
@@ -12,5 +13,6 @@ loopback.Remote = require("@vsaas/loopback-connector-remote");
 loopback.GeoPoint = require("@vsaas/loopback-datasource-juggler/geo").GeoPoint;
 loopback.DateString = require("@vsaas/loopback-datasource-juggler/date-string");
 loopback.ValidationError = loopback.Model.ValidationError;
+loopback.rateLimit = require_lib_rate_limit_index;
 module.exports = loopback;
 //#endregion

package/dist/index.d.cts

@@ -0,0 +1,3 @@
+//#region src/index.d.ts
+declare const loopback: any;
+export = loopback;

package/dist/lib/access-context.d.cts

@@ -0,0 +1,33 @@
+//#region src/lib/access-context.d.ts
+declare const DEFAULT_SCOPES: string[];
+declare function AccessContext(context: any): any;
+declare namespace AccessContext {
+  var ALL: string;
+  var READ: string;
+  var REPLICATE: string;
+  var WRITE: string;
+  var EXECUTE: string;
+  var DEFAULT: string;
+  var ALLOW: string;
+  var ALARM: string;
+  var AUDIT: string;
+  var DENY: string;
+  var permissionOrder: {
+    DEFAULT: number;
+    ALLOW: number;
+    ALARM: number;
+    AUDIT: number;
+    DENY: number;
+  };
+}
+declare function Principal(type: any, id: any, name: any): any;
+declare namespace Principal {
+  var USER: string;
+  var APP: string;
+  var APPLICATION: string;
+  var ROLE: string;
+  var SCOPE: string;
+}
+declare function AccessRequest(model: any, property: any, accessType: any, permission: any, methodNames: any, registry: any): any;
+//#endregion
+export { AccessContext, AccessRequest, DEFAULT_SCOPES, Principal };

package/dist/lib/application.d.cts

@@ -0,0 +1 @@
+export {}