@webda/auth 0.0.0-stage → 4.0.0-beta.11

package/lib/authentication.service.js

@@ -0,0 +1,978 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { Command, Counter, Ident, InvalidMfaCode, MFA, useBehaviorParameters, registerLoginMfa, Operation, registerUserResolver, runAsSystem, Service, ServiceParameters, useContext, useCore, useModel, useModelMetadata, useService, V3_PASSWORD_MAPPED, WebdaError } from "@webda/core";
+import { AccountExists, IdentConflict, IdentLinkedElsewhere, LastLoginMethod, MfaNotEnabled, MfaNotPending, RegistrationDisabled } from "./errors.js";
+import { isLegacyIdent, legacyIdents, legacyKey, splitLegacyKey, upgradeIdent } from "./compat/upgrade.js";
+import { applyEmailPolicy, isAuthProvider } from "./provider.js";
+/** Authentication methods (amr) that are a primary factor: a second factor only counts on top of one of them */
+export const PRIMARY_FACTORS = ["pwd", "oauth"];
+/**
+ * @param identity - resolved identity
+ * @returns the identity without its provider tokens
+ */
+function withoutTokens(identity) {
+    if (!identity || identity.tokens === undefined)
+        return identity;
+    const { tokens, ...rest } = identity;
+    return rest;
+}
+/** Maximum ident passes of one migration */
+const MIGRATION_MAX_PASSES = 100;
+/** Authentication parameters */
+export class AuthenticationParameters extends ServiceParameters {
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params = {}) {
+        super.load(params);
+        this.userModel ?? (this.userModel = "Webda/User");
+        this.identModel ?? (this.identModel = "Webda/Ident");
+        this.linking ?? (this.linking = "verified");
+        this.registration ?? (this.registration = true);
+        this.compatibility ?? (this.compatibility = { v3: true });
+        return this;
+    }
+}
+/**
+ * Shared authentication logic: providers hand a ResolvedIdentity to complete()
+ * @WebdaModda Authentication
+ */
+let Authentication = (() => {
+    var _a;
+    let _classSuper = Service;
+    let _instanceExtraInitializers = [];
+    let _providers_decorators;
+    let _me_decorators;
+    let _logout_decorators;
+    let _refresh_decorators;
+    let _idents_decorators;
+    let _unlink_decorators;
+    let _migrate_decorators;
+    return _a = class Authentication extends _classSuper {
+            constructor() {
+                super(...arguments);
+                this.providerMap = (__runInitializers(this, _instanceExtraInitializers), new Map());
+            }
+            /**
+             * @returns the configured user model
+             */
+            getUserModel() {
+                return useModel(this.parameters.userModel);
+            }
+            /**
+             * @returns the configured ident model
+             */
+            getIdentModel() {
+                return useModel(this.parameters.identModel);
+            }
+            /** @override */
+            resolve() {
+                super.resolve();
+                this.discoverProviders();
+                const userModel = this.getUserModel();
+                const metadata = useModelMetadata(userModel);
+                const loginAttributes = (metadata.Relations?.behaviors ?? []).filter(relation => relation.behavior === "Webda/MFA" &&
+                    useBehaviorParameters(userModel, relation.attribute, MFA).purpose === "login");
+                if (loginAttributes.length > 1) {
+                    throw new WebdaError.CodeError("MULTIPLE_LOGIN_MFA", `${metadata.Identifier} declares more than one login MFA attribute`);
+                }
+                this.loginMfaAttribute = loginAttributes[0]?.attribute;
+                registerLoginMfa(this.loginMfaAttribute
+                    ? {
+                        model: metadata.Identifier,
+                        attribute: this.loginMfaAttribute,
+                        run: (mfa, action, method, next) => this.runLoginMfa(mfa, action, method, next)
+                    }
+                    : undefined);
+                registerUserResolver({
+                    resolve: async (id) => {
+                        const ref = this.getUserModel().ref(id);
+                        return (await ref.exists()) ? await ref.get() : undefined;
+                    }
+                });
+                return this;
+            }
+            /** @override */
+            async init() {
+                await super.init();
+                // Providers may be created after this service was resolved
+                this.discoverProviders();
+                return this;
+            }
+            /**
+             * Collect every service implementing {@link AuthProvider}
+             * @throws Error when two providers share the same name
+             */
+            discoverProviders() {
+                // The resolve() pass is best-effort (later services may not exist yet), the init() pass is authoritative
+                const providers = new Map();
+                for (const service of Object.values(useCore().getServices())) {
+                    if (!isAuthProvider(service))
+                        continue;
+                    if (providers.has(service.providerName)) {
+                        throw new Error(`Duplicate auth provider '${service.providerName}'`);
+                    }
+                    providers.set(service.providerName, service);
+                }
+                this.providerMap = providers;
+            }
+            /** @override */
+            async stop() {
+                registerUserResolver(undefined);
+                await super.stop();
+            }
+            /**
+             * @param name - provider name
+             * @returns the provider
+             */
+            getProvider(name) {
+                return this.providerMap.get(name);
+            }
+            /**
+             * @param name - provider name
+             * @returns the email policy of that provider, undefined for unknown providers or without policy
+             */
+            emailPolicyFor(name) {
+                const provider = this.getProvider(name);
+                if (!provider)
+                    return undefined;
+                if (typeof provider.getEmailPolicy === "function")
+                    return provider.getEmailPolicy();
+                const params = provider.getParameters?.();
+                if (!params)
+                    return undefined;
+                const { allowedEmailDomains, trustEmailVerification } = params;
+                const strings = (v) => Array.isArray(v) && v.every(d => typeof d === "string");
+                if (allowedEmailDomains !== undefined && !strings(allowedEmailDomains)) {
+                    throw new Error(`Invalid email policy for provider '${name}': allowedEmailDomains must be a string[]`);
+                }
+                if (trustEmailVerification !== undefined &&
+                    typeof trustEmailVerification !== "boolean" &&
+                    !strings(trustEmailVerification)) {
+                    throw new Error(`Invalid email policy for provider '${name}': trustEmailVerification must be a boolean or string[]`);
+                }
+                return allowedEmailDomains === undefined && trustEmailVerification === undefined
+                    ? undefined
+                    : { allowedEmailDomains, trustEmailVerification };
+            }
+            /**
+             * @returns public info of every provider
+             */
+            getProviders() {
+                return [...this.providerMap.values()].map(p => p.getPublicInfo());
+            }
+            /**
+             * List available login methods
+             * @returns providers
+             */
+            providers() {
+                return this.getProviders();
+            }
+            /**
+             * Current user
+             * @returns public entry of the logged user
+             */
+            async me() {
+                const ctx = useContext();
+                const user = ctx.getSession()?.isLogged() ? await ctx.getCurrentUser() : undefined;
+                if (!user) {
+                    throw new WebdaError.NotFound("No user found");
+                }
+                await this.emit("Authentication.GetMe", { context: ctx, user });
+                return user.toPublicEntry();
+            }
+            /** @override */
+            initMetrics() {
+                super.initMetrics();
+                this.metrics ?? (this.metrics = {});
+                this.metrics.login = this.getMetric(Counter, {
+                    name: "auth_login",
+                    help: "Counter number of login per provider",
+                    labelNames: ["provider"]
+                });
+                this.metrics.logout = this.getMetric(Counter, {
+                    name: "auth_logout",
+                    help: "Counter number of logout"
+                });
+                this.metrics.registration = this.getMetric(Counter, {
+                    name: "auth_registration",
+                    help: "Counter number of registration per provider",
+                    labelNames: ["provider"]
+                });
+            }
+            /**
+             * Find an ident; with `compatibility.v3`, a miss falls back to the v3 record `"<uid>_<provider>"`, upgraded on
+             * the fly
+             * @param provider - provider
+             * @param providerUid - uid
+             * @returns the ident when it exists
+             */
+            async findIdent(provider, providerUid) {
+                const IdentModel = this.getIdentModel();
+                const ref = IdentModel.ref(Ident.key(providerUid, provider));
+                if (await ref.exists()) {
+                    return ref.get();
+                }
+                if (!this.parameters.compatibility?.v3) {
+                    return undefined;
+                }
+                const legacy = IdentModel.ref(legacyKey(providerUid, provider));
+                if (!(await legacy.exists())) {
+                    return undefined;
+                }
+                // The v3-looking key of a shared store may hold another model's row: only a v3 ident is upgraded
+                const v3 = await legacy.get().catch(() => undefined);
+                if (!isLegacyIdent(v3, IdentModel)) {
+                    this.log("WARN", `Ignoring a non-ident row stored under a v3 '${provider}' ident key`);
+                    return undefined;
+                }
+                const ident = await runAsSystem(() => upgradeIdent(v3, IdentModel));
+                if (ident.provider !== provider || ident.providerUid !== providerUid) {
+                    this.log("WARN", `v3 '${provider}' ident upgraded under another key: ignored`);
+                    return undefined;
+                }
+                return ident;
+            }
+            /**
+             * MFA methods enabled for a user
+             * @param user - user
+             * @returns enabled methods, empty when MFA is off
+             */
+            mfaMethods(user) {
+                const mfa = this.loginMfaAttribute ? user?.[this.loginMfaAttribute] : undefined;
+                return mfa?.isEnabled?.() ? mfa.methods() : [];
+            }
+            /**
+             * Create and save a user for an identity
+             * @param identity - resolved identity
+             * @param data - extra profile data
+             * @param ctx - request context (complete() runs as system, so it passes the real one)
+             * @returns the user
+             */
+            async registerUser(identity, data = {}, ctx = useContext()) {
+                const user = await this.getUserModel().create({
+                    ...data,
+                    email: identity.email,
+                    displayName: data.displayName ?? identity.profile?.name,
+                    locale: ctx?.getLocale?.()
+                }, false);
+                await this.emit("Authentication.Register", {
+                    context: ctx,
+                    user,
+                    data,
+                    identId: `${identity.providerUid}:${identity.provider}`,
+                    identity: withoutTokens(identity)
+                });
+                await user.save();
+                this.metrics?.registration?.inc({ provider: identity.provider });
+                return user;
+            }
+            /**
+             * Complete a login for an identity proven by a provider
+             * @param identity - resolved identity
+             * @param options - complete options
+             * @param options.newUser - identity.user was just created by the provider: its first ident is not a "link"
+             * @returns the result
+             * @throws IdentLinkedElsewhere when the ident belongs to another user than the logged one
+             * @throws AccountExists when the email matches an account the linking policy does not allow
+             * @throws RegistrationDisabled when a new user is needed but registration is off
+             * @throws WebdaError.BadRequest when `identity.provider` is not a registered AuthProvider
+             */
+            async complete(identity, options = {}) {
+                identity = this.applyPolicy(identity);
+                const ctx = useContext();
+                return runAsSystem(() => this.completeAs(identity, ctx, false, !!options.newUser));
+            }
+            /**
+             * Link an identity to the logged user without replacing their session or issuing credentials.
+             * @param identity - identity proved by a provider
+             * @returns a link acknowledgement
+             */
+            async linkIdentity(identity) {
+                identity = this.applyPolicy(identity);
+                const ctx = useContext();
+                const userId = ctx.getSession()?.isLogged() ? ctx.getCurrentUserId() : undefined;
+                if (!userId)
+                    throw new WebdaError.Unauthorized("Login required");
+                return runAsSystem(async () => {
+                    let ident = await this.findIdent(identity.provider, identity.providerUid);
+                    if (ident?.getUser()) {
+                        if (ident.getUser().toString() !== userId)
+                            throw new IdentLinkedElsewhere();
+                        return { status: "linked" };
+                    }
+                    if (ident) {
+                        ident.setUser(userId);
+                        await ident.save();
+                    }
+                    else {
+                        ident = new (this.getIdentModel())({
+                            ...Ident.key(identity.providerUid, identity.provider),
+                            email: identity.email ? Ident.normalizeEmail(identity.email) : undefined,
+                            __profile: identity.profile,
+                            verifiedAt: identity.emailVerified ? new Date() : undefined
+                        });
+                        ident.setUser(userId);
+                        try {
+                            await ident.getRepository().create(ident);
+                        }
+                        catch (err) {
+                            if (!/Already exists/.test(`${err instanceof Error ? err.message : err}`))
+                                throw err;
+                            const winner = await this.findIdent(identity.provider, identity.providerUid);
+                            if (winner?.getUser()?.toString() !== userId)
+                                throw new IdentLinkedElsewhere();
+                            return { status: "linked" };
+                        }
+                    }
+                    await this.emit("Authentication.Linked", {
+                        context: ctx,
+                        user: await this.loadUser(userId),
+                        ident
+                    });
+                    return { status: "linked" };
+                });
+            }
+            /**
+             * Apply the email policy of the identity provider (complete() does it too, idempotently)
+             * Lets a provider refuse an identity before creating anything
+             * @param identity - resolved identity
+             * @returns the identity to use
+             * @throws EmailDomainNotAllowed when the policy refuses it
+             * @throws WebdaError.BadRequest when `identity.provider` is not a registered AuthProvider: an unknown name would
+             * escape the email policy of the provider it impersonates
+             */
+            applyPolicy(identity) {
+                if (!this.getProvider(identity?.provider)) {
+                    throw new WebdaError.BadRequest(`Unknown auth provider '${identity?.provider}'`);
+                }
+                return applyEmailPolicy(identity, this.emailPolicyFor(identity.provider));
+            }
+            /**
+             * Body of {@link complete}, running as system with the request context passed explicitly
+             * @param identity - resolved identity
+             * @param ctx - request context
+             * @param retried - already retried after a concurrent creation
+             * @param newUser - identity.user was just created by the provider: its first ident is not a "link"
+             * @returns the result
+             */
+            async completeAs(identity, ctx, retried, newUser = false) {
+                const currentUserId = ctx.getSession()?.isLogged() ? ctx.getCurrentUserId() : undefined;
+                let ident = await this.findIdent(identity.provider, identity.providerUid);
+                if (ident?.getUser()) {
+                    if (currentUserId && ident.getUser().toString() !== currentUserId) {
+                        throw new IdentLinkedElsewhere();
+                    }
+                    // A provider handing another user than the owner (a registration that lost a race) must not become the owner
+                    if (identity.user && identity.user.getUUID() !== ident.getUser().toString()) {
+                        throw new AccountExists();
+                    }
+                    return this.establish(ident.getUser().toString(), ident, identity, ctx);
+                }
+                // An existing ident without owner is adopted by the resolved, current or newly registered user
+                const adopting = !!ident;
+                let user = identity.user;
+                let userId = currentUserId ?? user?.getUUID();
+                const email = identity.email ? Ident.normalizeEmail(identity.email) : undefined;
+                const emailIdent = email ? await this.findIdent("email", email) : undefined;
+                let linked = !!userId && !(newUser && !currentUserId);
+                let registered;
+                const policy = this.parameters.linking;
+                // never/verified: only a verified email ident is an owner, an unverified one is treated as absent
+                const owner = emailIdent?.getUser() && (policy === "always" || emailIdent.isVerified()) ? emailIdent.getUser() : undefined;
+                if (!userId && owner) {
+                    if (policy === "never" || (policy === "verified" && !identity.emailVerified)) {
+                        throw new AccountExists();
+                    }
+                    userId = owner.toString();
+                    linked = true;
+                }
+                if (!userId) {
+                    if (!this.parameters.registration) {
+                        throw new RegistrationDisabled();
+                    }
+                    // Narrow the window of a phantom Register event when a concurrent login just created the ident
+                    if (!adopting && (await this.findIdent(identity.provider, identity.providerUid))) {
+                        return this.completeAs(identity, ctx, retried, newUser);
+                    }
+                    user = registered = await this.registerUser(identity, {}, ctx);
+                    userId = user.getUUID();
+                }
+                if (ident) {
+                    ident.setUser(userId);
+                    // Verification is only kept when this identity proves it
+                    if (identity.emailVerified) {
+                        ident.verifiedAt ?? (ident.verifiedAt = new Date());
+                    }
+                    else {
+                        // Use the model setter so the cleared value is persisted by its proxy.
+                        Reflect.set(ident, "verifiedAt", undefined);
+                    }
+                    await ident.save();
+                }
+                else {
+                    ident = new (this.getIdentModel())({
+                        ...Ident.key(identity.providerUid, identity.provider),
+                        email,
+                        __profile: identity.profile,
+                        verifiedAt: identity.emailVerified ? new Date() : undefined
+                    });
+                    ident.setUser(userId);
+                    // Provider tokens are only stored encrypted
+                    if (identity.tokens) {
+                        await ident.tokens.set(identity.tokens);
+                    }
+                    try {
+                        await ident.getRepository().create(ident);
+                    }
+                    catch (err) {
+                        if (!retried && /Already exists/.test(`${err instanceof Error ? err.message : err}`)) {
+                            // Lost a concurrent first login: drop the user created for nothing, the retry finds the winner's ident
+                            await registered?.delete();
+                            return this.completeAs(identity, ctx, true, newUser);
+                        }
+                        throw err;
+                    }
+                }
+                // Only an email asserted as verified by the provider may claim the email ident
+                if (email && !emailIdent && identity.emailVerified && identity.provider !== "email") {
+                    const extra = new (this.getIdentModel())({
+                        ...Ident.key(email, "email"),
+                        email,
+                        verifiedAt: new Date()
+                    });
+                    extra.setUser(userId);
+                    await extra
+                        .getRepository()
+                        .create(extra)
+                        .catch(err => {
+                        if (!/Already exists/.test(`${err instanceof Error ? err.message : err}`))
+                            throw err;
+                    });
+                }
+                if (linked) {
+                    await this.emit("Authentication.Linked", {
+                        context: ctx,
+                        user: user ?? (await this.loadUser(userId)),
+                        ident
+                    });
+                }
+                return this.establish(user ?? userId, ident, identity, ctx);
+            }
+            /**
+             * @param userId - uuid
+             * @returns the user
+             */
+            loadUser(userId) {
+                return this.getUserModel().ref(userId).get();
+            }
+            /**
+             * Write the session, issue tokens, emit Login
+             * @param user - user or uuid
+             * @param ident - ident used
+             * @param identity - resolved identity
+             * @param ctx - request context (complete() runs as system, so it passes the real one)
+             * @returns the result
+             */
+            async establish(user, ident, identity, ctx = useContext()) {
+                const userObj = typeof user === "string" ? await this.loadUser(user) : user;
+                const userId = userObj.getUUID();
+                const session = ctx.getSession();
+                const methods = this.mfaMethods(userObj);
+                // MFA is satisfied by one of the user's enabled methods on top of a primary factor
+                const amr = identity.amr ?? [];
+                const secondFactor = amr.some(m => methods.includes(m)) && amr.some(m => PRIMARY_FACTORS.includes(m));
+                const mfa = methods.length ? (secondFactor ? "verified" : "pending") : "none";
+                session.login(userId, ident.getUUID(), { provider: identity.provider, amr: identity.amr, mfa });
+                // A later password change of the user ends this session (checked by the session manager on load)
+                session.authAt = Date.now();
+                // Provider profile and tokens are kept even when MFA is pending
+                const update = {
+                    ...(identity.profile ? { __profile: identity.profile } : {}),
+                    ...(await this.tokensUpdate(ident, identity.tokens))
+                };
+                if (mfa === "pending") {
+                    if (Object.keys(update).length) {
+                        await ident.ref().patch(update);
+                    }
+                    return { status: "mfa_required", methods };
+                }
+                return this.finish(userObj, ident, session, ctx, identity.provider, identity, update);
+            }
+            /**
+             * Finalise login after factors are verified: patch ident lastUsedAt, issue tokens, emit events, inc metric
+             * @param userObj - user instance
+             * @param ident - ident instance
+             * @param session - session
+             * @param ctx - operation context
+             * @param provider - provider name
+             * @param identity - optional resolved identity
+             * @param update - extra ident attributes to patch
+             * @returns auth result
+             */
+            async finish(userObj, ident, session, ctx, provider, identity, update = {}) {
+                const userId = userObj.getUUID();
+                await ident.ref().patch({ lastUsedAt: new Date(), ...update });
+                const tokens = await useService("TokenService").issue(session);
+                await this.emit("Authentication.Login", {
+                    context: ctx,
+                    userId,
+                    user: userObj,
+                    identId: ident.getUUID(),
+                    ident,
+                    provider,
+                    // Provider tokens never travel in Authentication events (providers emit their own)
+                    identity: identity ? withoutTokens(identity) : { provider, providerUid: ident.providerUid, amr: session.amr }
+                });
+                if (session.mfa === "verified") {
+                    await this.emit("Authentication.MfaVerified", {
+                        context: ctx,
+                        user: userObj,
+                        userId,
+                        method: session.amr?.find((m) => !PRIMARY_FACTORS.includes(m))
+                    });
+                }
+                this.metrics?.login?.inc({ provider });
+                return { status: "ok", user: userObj.toPublicEntry(), ...tokens };
+            }
+            /**
+             * Preserve login safeguards around the configured model attribute's actions.
+             * @param mfa - attached login MFA
+             * @param action - model behavior action
+             * @param method - requested factor method
+             * @param next - factor operation
+             * @returns model result, including tokens when authentication changes
+             */
+            async runLoginMfa(mfa, action, method, next) {
+                const ctx = useContext();
+                const session = ctx.getSession();
+                const user = mfa.getScope().owner;
+                const verification = action === "verify" || action === "recover";
+                if ((!session.isLogged() && !(verification && session.isPending())) || session.userId !== user.getUUID()) {
+                    throw new WebdaError.Unauthorized("Own login MFA required");
+                }
+                if ((action === "disable" || action === "recoveryCodes") && session.mfa !== "verified") {
+                    throw new WebdaError.Unauthorized("Verified login required");
+                }
+                if (action === "enroll" &&
+                    mfa.getParameters().reauthMaxAge &&
+                    (!session.authAt || Date.now() - session.authAt > mfa.getParameters().reauthMaxAge * 1000)) {
+                    throw new WebdaError.Unauthorized("Reauthentication required");
+                }
+                let result;
+                try {
+                    result = await next();
+                }
+                catch (err) {
+                    if (err instanceof InvalidMfaCode) {
+                        await this.emit("Authentication.MfaFailed", { context: ctx, user, userId: user.getUUID(), method });
+                    }
+                    throw err;
+                }
+                if (action === "confirm") {
+                    await this.emit("Authentication.MfaEnabled", { context: ctx, user, userId: user.getUUID(), method });
+                    const tokens = useService("TokenService");
+                    await runAsSystem(() => tokens.revokeUser(user.getUUID()));
+                    session.mfa = "verified";
+                    session.amr = [...(session.amr ?? []).filter((value) => value !== method), method];
+                    return { ...result, ...(await runAsSystem(() => tokens.issue(session))) };
+                }
+                if (verification && session.isPending()) {
+                    return { ...result, ...(await this.completeSecondFactor([result.method])) };
+                }
+                if (action === "disable") {
+                    await this.emit("Authentication.MfaDisabled", { context: ctx, user, userId: user.getUUID(), method });
+                }
+                return result;
+            }
+            /**
+             * Complete second-factor authentication for a pending session
+             * @param amr - second factor method(s) used (e.g. ["totp"], ["recovery"])
+             * @returns auth result with issued tokens
+             */
+            async completeSecondFactor(amr) {
+                const ctx = useContext();
+                const session = ctx.getSession();
+                if (!session?.isPending()) {
+                    throw new MfaNotPending();
+                }
+                const userId = session.userId;
+                const user = await runAsSystem(() => this.loadUser(userId));
+                const enabledMethods = this.mfaMethods(user);
+                const isRecovery = amr.includes("recovery");
+                if (isRecovery) {
+                    if (enabledMethods.length === 0) {
+                        throw new MfaNotEnabled();
+                    }
+                }
+                else if (!amr.some(m => enabledMethods.includes(m))) {
+                    throw new MfaNotEnabled();
+                }
+                const provider = session.provider;
+                const ident = await runAsSystem(() => this.getIdentModel().ref(session.identUsed).get());
+                const authAt = session.authAt;
+                session.login(userId, session.identUsed, {
+                    provider,
+                    amr: [...(session.amr ?? []), ...amr],
+                    mfa: "verified",
+                    mfaVerifications: session.mfaVerifications
+                });
+                session.authAt = authAt;
+                return this.finish(user, ident, session, ctx, provider);
+            }
+            /**
+             * Patch storing new provider tokens encrypted; also drops plaintext tokens left by an earlier v4 beta (`__tokens`)
+             * @param ident - the ident
+             * @param tokens - tokens from the provider, if any
+             * @returns the attributes to patch
+             */
+            async tokensUpdate(ident, tokens) {
+                if (!tokens)
+                    return {};
+                await ident.tokens.set(tokens);
+                return {
+                    tokens: { __ciphertext: ident.tokens.__ciphertext },
+                    ...(ident.__tokens !== undefined ? { __tokens: null } : {})
+                };
+            }
+            /**
+             * @returns the logged user id
+             * @throws WebdaError.Unauthorized when no fully logged session exists
+             */
+            requireUser() {
+                const ctx = useContext();
+                if (!ctx.getSession()?.isLogged()) {
+                    throw new WebdaError.Unauthorized("Login required");
+                }
+                return ctx.getCurrentUserId();
+            }
+            /**
+             * Logout and revoke the current refresh family; also abandons a pending MFA session
+             */
+            async logout() {
+                const ctx = useContext();
+                const session = ctx.getSession();
+                if (!session?.isLogged() && !session?.isPending()) {
+                    throw new WebdaError.Unauthorized("Login required");
+                }
+                const family = session.refreshFamily;
+                if (family) {
+                    await runAsSystem(() => useService("TokenService").revokeFamily(family));
+                }
+                await this.emit("Authentication.Logout", { context: ctx });
+                this.metrics?.logout?.inc();
+                ctx.newSession();
+            }
+            /**
+             * Exchange a refresh token
+             * @param refreshToken - refresh token
+             * @returns new tokens
+             */
+            async refresh(refreshToken) {
+                const { session, ...tokens } = await runAsSystem(() => useService("TokenService").refresh(refreshToken));
+                return tokens;
+            }
+            /**
+             * List the current user's idents; with `compatibility.v3`, listing upgrades the user's v3 ident records first
+             * @returns idents of the current user
+             */
+            async idents() {
+                const userId = this.requireUser();
+                return (await this.listIdents(userId)).map(i => ({
+                    provider: i.provider,
+                    providerUid: i.providerUid,
+                    email: i.email,
+                    verifiedAt: i.verifiedAt,
+                    lastUsedAt: i.lastUsedAt
+                }));
+            }
+            /**
+             * @param userId - user
+             * @returns all idents owned by the user
+             */
+            async listIdents(userId) {
+                return runAsSystem(async () => {
+                    const IdentModel = this.getIdentModel();
+                    const idents = (await IdentModel.query("_user = ?", [userId])).results;
+                    if (!idents.some(i => i.getLegacyUID())) {
+                        return idents;
+                    }
+                    // v3 records are upgraded before use, or ignored without v3 compatibility
+                    const result = new Map();
+                    for (const ident of idents) {
+                        if (!ident.getLegacyUID()) {
+                            result.set(ident.getUUID(), ident);
+                        }
+                        else if (this.parameters.compatibility?.v3) {
+                            if (!isLegacyIdent(ident, IdentModel))
+                                continue;
+                            let upgraded;
+                            try {
+                                upgraded = await upgradeIdent(ident, IdentModel);
+                            }
+                            catch (err) {
+                                if (!(err instanceof IdentConflict))
+                                    throw err;
+                                // Kept for the operator (`webda auth migrate` reports it): the account stays usable meanwhile
+                                this.log("WARN", `v3 ident ${ident.getLegacyUID()} conflicts with another user's ident: skipped`);
+                                continue;
+                            }
+                            // A crash-left duplicate resolves to the record already listed
+                            if (!result.has(upgraded.getUUID()))
+                                result.set(upgraded.getUUID(), upgraded);
+                        }
+                    }
+                    return [...result.values()];
+                });
+            }
+            /**
+             * Remove one of the current user's idents
+             * @param provider - provider
+             * @param providerUid - uid
+             * @throws LastLoginMethod when no usable login method would remain (non-email idents, plus email idents when the
+             * user has a password), or when it would remove the last email ident of a user with a password
+             */
+            async unlink(provider, providerUid) {
+                const userId = this.requireUser();
+                const idents = await this.listIdents(userId);
+                const target = idents.find(i => i.provider === provider && i.providerUid === providerUid);
+                if (!target) {
+                    throw new WebdaError.NotFound("Ident not found");
+                }
+                const remaining = idents.filter(i => i !== target);
+                const user = await this.loadUser(userId);
+                const usesPassword = !!user.password?.hasPassword?.();
+                // An email ident is only a login method (and a recovery path) when the user has a password
+                const usable = remaining.filter(i => i.provider !== "email" || usesPassword);
+                const lastEmail = provider === "email" && !remaining.some(i => i.provider === "email");
+                if (usable.length === 0 || (usesPassword && lastEmail)) {
+                    throw new LastLoginMethod();
+                }
+                await runAsSystem(() => target.ref().delete());
+                // A projection: the provider tokens and profile of the removed ident never leave this service
+                const ident = {
+                    uuid: target.getUUID(),
+                    provider: target.provider,
+                    providerUid: target.providerUid,
+                    email: target.email,
+                    verifiedAt: target.verifiedAt,
+                    lastUsedAt: target.lastUsedAt,
+                    userId
+                };
+                await this.emit("Authentication.Unlinked", { context: useContext(), user, ident });
+            }
+            /**
+             * Migrate v3 authentication data to the v4 layout
+             *
+             * Idents: every v3 record (`"<providerUid>_<provider>"` key) is upgraded to its `"<providerUid>:<provider>"`
+             * record (emails normalised) then deleted; with a custom ident model, the v3 rows typed as the core
+             * `Webda/Ident` are found through its repository too. Upgrading shifts position-based paging, so passes run
+             * until one upgrades nothing. Users: a user whose stored record still has the v3 `__password` is saved again in
+             * the v4 `password` shape. Idempotent: a second run migrates nothing. Failures are reported by key and logged,
+             * the migration goes on.
+             *
+             * Operator notes:
+             * - A v3 ident whose upgraded key another user already holds (e.g. two v3 email keys differing only by case) is
+             *   reported in `idents.failed` (IDENT_CONFLICT) and kept: decide which user keeps the email, then delete or
+             *   rename the other v3 row and run the command again.
+             * - A malformed ident key in the store stops the scan: remove that row manually.
+             * - Re-running is always safe: migrated records are not touched again.
+             * @param dryRun - only count, write nothing
+             * @param batch - page size of the scans
+             * @returns the report
+             */
+            async migrate(
+            /** @description Only count the records to migrate, write nothing */
+            dryRun = false, 
+            /** @description Page size of the store scans */
+            batch = 100) {
+                const pageSize = Math.max(1, Math.floor(Number(batch)) || 100);
+                const report = {
+                    dryRun: !!dryRun,
+                    idents: { migrated: 0, skipped: 0, failed: [] },
+                    users: { migrated: 0, skipped: 0, failed: [] }
+                };
+                await runAsSystem(async () => {
+                    await this.migrateIdents(report, pageSize);
+                    await this.migrateUsers(report, pageSize);
+                });
+                this.log("INFO", "Authentication migration", report);
+                return report;
+            }
+            /**
+             * Enumerate the v3 ident rows: through the ident model, and through the core `Ident` repository when the
+             * ident model is a subclass (its queries only see rows typed as itself or its subclasses)
+             * @param pageSize - page size
+             * @returns the v3 keys found, each once per pass
+             */
+            async *legacyIdentKeys(pageSize) {
+                const IdentModel = this.getIdentModel();
+                const models = [IdentModel];
+                if (IdentModel !== Ident) {
+                    try {
+                        if (Ident.getRepository())
+                            models.push(Ident);
+                    }
+                    catch {
+                        // The core Ident model has no repository: no ancestor-typed rows to look for
+                    }
+                }
+                const seen = new Set();
+                for (const model of models) {
+                    const scan = legacyIdents(model, `LIMIT ${pageSize}`);
+                    while (true) {
+                        let next;
+                        try {
+                            next = await scan.next();
+                        }
+                        catch (err) {
+                            const identifier = model.Metadata?.Identifier ?? model.name;
+                            const error = new Error(`Cannot scan the ${identifier} records of the store: ${err instanceof Error ? err.message : err}. ` +
+                                "A malformed ident key must be removed from the store manually; the migration is safe to re-run.");
+                            error.cause = err;
+                            throw error;
+                        }
+                        if (next.done)
+                            break;
+                        const uid = next.value.getLegacyUID();
+                        if (uid === undefined || seen.has(uid))
+                            continue;
+                        seen.add(uid);
+                        yield uid;
+                    }
+                }
+            }
+            /**
+             * Upgrade the v3 idents
+             * @param report - report to fill
+             * @param pageSize - page size
+             */
+            async migrateIdents(report, pageSize) {
+                const IdentModel = this.getIdentModel();
+                const status = new Map();
+                let pass = 0;
+                let upgraded;
+                do {
+                    upgraded = 0;
+                    for await (const uid of this.legacyIdentKeys(pageSize)) {
+                        if (status.get(uid) === "migrated" || status.get(uid) === "skipped")
+                            continue;
+                        if (!splitLegacyKey(uid)) {
+                            status.set(uid, "skipped");
+                            continue;
+                        }
+                        // Load through the ident model: a row found via the core repository hydrates as the ident model, a row
+                        // its store cannot reach or refuses (another model's row) is not this application's v3 ident
+                        const ref = IdentModel.ref(uid);
+                        const row = await ref
+                            .get()
+                            .catch(err => this.log("WARN", `v3 ident ${uid} not readable through the ident model: ${err?.message}`));
+                        if (!isLegacyIdent(row, IdentModel)) {
+                            status.set(uid, "skipped");
+                            continue;
+                        }
+                        try {
+                            await upgradeIdent(row, IdentModel, { dryRun: report.dryRun });
+                            status.set(uid, "migrated");
+                            upgraded++;
+                        }
+                        catch (err) {
+                            status.set(uid, "failed");
+                            this.log("WARN", `v3 ident ${uid} not migrated: ${err instanceof Error ? err.message : err}`);
+                        }
+                    }
+                    pass++;
+                    // A dry run changes nothing: one pass sees every record
+                } while (!report.dryRun && upgraded > 0 && pass < MIGRATION_MAX_PASSES);
+                if (upgraded > 0 && pass >= MIGRATION_MAX_PASSES) {
+                    report.incomplete = true;
+                    this.log("WARN", `Ident migration stopped after ${pass} passes: run it again`);
+                }
+                for (const [uid, state] of status) {
+                    if (state === "failed")
+                        report.idents.failed.push(uid);
+                    else
+                        report.idents[state]++;
+                }
+            }
+            /**
+             * Save again the users whose stored record still has the v3 `__password`
+             * @param report - report to fill
+             * @param pageSize - page size
+             */
+            async migrateUsers(report, pageSize) {
+                for await (const user of this.getUserModel().iterate(`LIMIT ${pageSize}`)) {
+                    if (!user[V3_PASSWORD_MAPPED])
+                        continue;
+                    try {
+                        if (!report.dryRun) {
+                            await user.save();
+                        }
+                        report.users.migrated++;
+                    }
+                    catch (err) {
+                        report.users.failed.push(user.getUUID());
+                        this.log("WARN", `v3 user ${user.getUUID()} not migrated: ${err instanceof Error ? err.message : err}`);
+                    }
+                }
+            }
+        },
+        (() => {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _providers_decorators = [Operation({ id: "Auth.Providers", rest: { method: "get", path: "auth/providers" } })];
+            _me_decorators = [Operation({ id: "Auth.Me", rest: { method: "get", path: "auth/me" } })];
+            _logout_decorators = [Operation({ id: "Auth.Logout", rest: { method: "post", path: "auth/logout" } })];
+            _refresh_decorators = [Operation({ id: "Auth.Refresh", rest: { method: "post", path: "auth/refresh" } })];
+            _idents_decorators = [Operation({ id: "Auth.Idents", rest: { method: "get", path: "auth/idents" } })];
+            _unlink_decorators = [Operation({ id: "Auth.Unlink", rest: { method: "post", path: "auth/idents/unlink" } })];
+            _migrate_decorators = [Command("auth migrate", {
+                    description: "Migrate v3 authentication data (idents, users) to v4",
+                    phase: "initialized"
+                })];
+            __esDecorate(_a, null, _providers_decorators, { kind: "method", name: "providers", static: false, private: false, access: { has: obj => "providers" in obj, get: obj => obj.providers }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _me_decorators, { kind: "method", name: "me", static: false, private: false, access: { has: obj => "me" in obj, get: obj => obj.me }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _logout_decorators, { kind: "method", name: "logout", static: false, private: false, access: { has: obj => "logout" in obj, get: obj => obj.logout }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _refresh_decorators, { kind: "method", name: "refresh", static: false, private: false, access: { has: obj => "refresh" in obj, get: obj => obj.refresh }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _idents_decorators, { kind: "method", name: "idents", static: false, private: false, access: { has: obj => "idents" in obj, get: obj => obj.idents }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _unlink_decorators, { kind: "method", name: "unlink", static: false, private: false, access: { has: obj => "unlink" in obj, get: obj => obj.unlink }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(_a, null, _migrate_decorators, { kind: "method", name: "migrate", static: false, private: false, access: { has: obj => "migrate" in obj, get: obj => obj.migrate }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(_a, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        })(),
+        _a.Parameters = AuthenticationParameters,
+        _a;
+})();
+export { Authentication };
+//# sourceMappingURL=authentication.service.js.map