badmfck-api-server 5.0.7 → 5.0.9

package/dist/apiServer/monitor/Monitor.js

@@ -9,7 +9,6 @@ const APIService_1 = require("../APIService");
 const BaseEndpoint_1 = require("../BaseEndpoint");
 const BaseService_1 = require("../BaseService");
 const LogService_1 = require("../LogService");
-const crypto_1 = __importDefault(require("crypto"));
 const DefaultErrors_1 = __importDefault(require("../structures/DefaultErrors"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -19,6 +18,7 @@ const DBService_1 = require("../DBService");
 const SystemInfo_1 = require("./SystemInfo");
 const ProcessMonitor_1 = require("./ProcessMonitor");
 const LogFiles_1 = require("./LogFiles");
+const MonitorAuth_1 = require("./MonitorAuth");
 exports.S_MONITOR_REGISTRATE_ACTION = new badmfck_signal_1.Signal();
 exports.S_MONITOR_RESTART_REQUESTED = new badmfck_signal_1.Signal();
 const logMap = {
@@ -40,6 +40,7 @@ class Monitor extends BaseEndpoint_1.BaseEndpoint {
     constructor(options) {
         super("sm");
         this.apiServiceOptions = options;
+        MonitorAuth_1.MonitorAuth.configure(options.monitorAuthFile, options.projectName);
         this.registerEndpoints([
             { ignoreInterceptor: true, endpoint: "html", handler: this.html },
             { ignoreInterceptor: true, endpoint: "log", handler: this.logs },
@@ -48,8 +49,22 @@ class Monitor extends BaseEndpoint_1.BaseEndpoint {
             { ignoreInterceptor: true, endpoint: "sysinfo", handler: this.sysinfo },
             { ignoreInterceptor: true, endpoint: "procinfo", handler: this.procinfo },
             { ignoreInterceptor: true, endpoint: "fdreport", handler: this.fdreport },
+            { ignoreInterceptor: true, endpoint: "login", handler: this.login, validationModel: {
+                    login: "",
+                    password: "",
+                    totp: "",
+                    $__totp_optional: true
+                } },
+            { ignoreInterceptor: true, endpoint: "enroll2fa", handler: this.enroll2fa, validationModel: {
+                    enrollmentToken: "",
+                    totp: ""
+                } },
+            { ignoreInterceptor: true, endpoint: "logout", handler: this.logout },
             { ignoreInterceptor: true, endpoint: "restart", handler: this.restart, validationModel: {
-                    confirm: ""
+                    confirm: "",
+                    password: "",
+                    totp: "",
+                    $__totp_optional: true
                 } },
             { ignoreInterceptor: true, endpoint: "inventory", handler: this.inventory },
             { ignoreInterceptor: true, endpoint: "httpstats", handler: this.httpstats },
@@ -120,11 +135,11 @@ class Monitor extends BaseEndpoint_1.BaseEndpoint {
         };
     }
     async controllers(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         return {};
     }
     async changeLogLevel(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "admin");
         const val = logMap[req.data.level];
         if (!val)
             throw { ...DefaultErrors_1.default.BAD_REQUEST, details: "bad log level" };
@@ -132,7 +147,7 @@ class Monitor extends BaseEndpoint_1.BaseEndpoint {
         return { data: (await LogService_1.REQ_CURRENT_LOG_LEVEL.request()) };
     }
     async logs(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "logs");
         const services = await LogService_1.REQ_LOG_UNIQUE_SERVICES.request();
         const log = await LogService_1.REQ_LOG.request({
             lastID: req.data.lastID ?? 0
@@ -145,28 +160,89 @@ class Monitor extends BaseEndpoint_1.BaseEndpoint {
         };
     }
     async netlog(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "logs");
         const log = await APIService_1.REQ_HTTP_LOG.request(req.data);
         return { data: log };
     }
     async outgoingNetlog(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "logs");
         return { data: Http_1.Http.getOutgoingLogSnapshot() };
     }
     async sysinfo(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         return { data: await (0, SystemInfo_1.collectSystemInfo)() };
     }
     async procinfo(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         return { data: await ProcessMonitor_1.ProcessMonitor.getSnapshot() };
     }
     async fdreport(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         return { data: await ProcessMonitor_1.ProcessMonitor.getFdReport() };
     }
+    async login(req) {
+        const users = await APIService_1.REQ_MONITOR_USERS.request();
+        if (!users || users.length === 0)
+            throw { ...DefaultErrors_1.default.UNAUTHORIZED, details: "No users found for monitor access, please set up users first." };
+        const { user, error, enrollmentRequired } = MonitorAuth_1.MonitorAuth.authenticate(users, req.data.login, req.data.password, req.data.totp);
+        if (!user || error) {
+            (0, LogService_1.logWarn)(`Monitor login failed for "${req.data.login}": ${error}`);
+            throw { ...DefaultErrors_1.default.UNAUTHORIZED, details: error ?? "Invalid user" };
+        }
+        if (enrollmentRequired) {
+            const issuer = this.apiServiceOptions.projectName || "Monitor";
+            const { token, secret, uri } = MonitorAuth_1.MonitorAuth.beginEnrollment(user.login, issuer);
+            (0, LogService_1.logInfo)(`Monitor 2FA enrollment started for "${user.login}"`, "Monitor");
+            return { data: {
+                    enrollmentRequired: true,
+                    enrollmentToken: token,
+                    secret,
+                    otpauthUri: uri,
+                    expiresInMs: MonitorAuth_1.MonitorAuth.ENROLLMENT_TTL_MS,
+                } };
+        }
+        const session = MonitorAuth_1.MonitorAuth.createSession(user.login);
+        (0, LogService_1.logInfo)(`Monitor login: "${user.login}"`, "Monitor");
+        return { data: {
+                token: session.token,
+                login: user.login,
+                idleTimeoutMs: MonitorAuth_1.MonitorAuth.SESSION_IDLE_MS,
+                maxLifetimeMs: MonitorAuth_1.MonitorAuth.SESSION_MAX_MS,
+                twoFactor: true,
+                ...MonitorAuth_1.MonitorAuth.describeRole(user.role),
+            } };
+    }
+    async enroll2fa(req) {
+        const { login, error } = MonitorAuth_1.MonitorAuth.completeEnrollment(req.data.enrollmentToken, req.data.totp);
+        if (!login || error) {
+            (0, LogService_1.logWarn)(`Monitor 2FA enrollment failed: ${error}`);
+            throw { ...DefaultErrors_1.default.UNAUTHORIZED, details: error ?? "Enrollment failed" };
+        }
+        const users = await APIService_1.REQ_MONITOR_USERS.request();
+        const user = users?.find(u => u?.login === login);
+        const session = MonitorAuth_1.MonitorAuth.createSession(login);
+        return { data: {
+                token: session.token,
+                login,
+                idleTimeoutMs: MonitorAuth_1.MonitorAuth.SESSION_IDLE_MS,
+                maxLifetimeMs: MonitorAuth_1.MonitorAuth.SESSION_MAX_MS,
+                twoFactor: true,
+                ...MonitorAuth_1.MonitorAuth.describeRole(user?.role),
+            } };
+    }
+    async logout(req) {
+        const token = (req.headers['authorization'] ?? "").split(" ").pop() ?? "";
+        MonitorAuth_1.MonitorAuth.revokeSession(token);
+        return { data: { ok: true } };
+    }
     async restart(req) {
-        const login = await this.checkAuthentication(req);
+        const login = await this.requireAccess(req, "admin");
+        const users = await APIService_1.REQ_MONITOR_USERS.request();
+        const stepUp = MonitorAuth_1.MonitorAuth.authenticate(users ?? [], login, req.data.password, req.data.totp);
+        if (!stepUp.user) {
+            (0, LogService_1.logWarn)(`Monitor restart re-auth failed for "${login}": ${stepUp.error}`);
+            throw { ...DefaultErrors_1.default.UNAUTHORIZED, details: "Re-authentication required: " + (stepUp.error ?? "invalid credentials") };
+        }
         const id = ProcessMonitor_1.ProcessMonitor.getPm2Identity();
         if (!id.managed)
             throw { ...DefaultErrors_1.default.BAD_REQUEST, details: "Process is not managed by pm2 (no pm_id in env) — refusing to exit, nothing would restart it." };
@@ -183,11 +259,11 @@ class Monitor extends BaseEndpoint_1.BaseEndpoint {
         return { data: { restarting: true, name: id.name, pmId: id.pmId, by: login, graceMs } };
     }
     async httpstats(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         return { data: Http_1.Http.getHttpStats() };
     }
     async inventory(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         const now = Date.now();
         const services = BaseService_1.BaseService.allInstances.map(s => ({
             className: s.constructor.name,
@@ -213,16 +289,16 @@ class Monitor extends BaseEndpoint_1.BaseEndpoint {
         };
     }
     async metrics(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         const result = await MonitorService_1.REQ_STAT.request(req.data);
         return { data: result };
     }
     async logfiles(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "logs");
         return { data: await (0, LogFiles_1.listLogSources)(this.apiServiceOptions.logFiles) };
     }
     async logtail(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "logs");
         const num = (v) => (v === undefined || v === null || v === "" ? undefined : Number(v));
         try {
             return { data: await (0, LogFiles_1.tailLog)(req.data.source, this.apiServiceOptions.logFiles, {
@@ -239,38 +315,46 @@ class Monitor extends BaseEndpoint_1.BaseEndpoint {
         }
     }
     async metricsWeeks(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         return { data: await MonitorService_1.REQ_STAT_WEEKS.request() };
     }
     async metricsWeek(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         return { data: await MonitorService_1.REQ_STAT_WEEK.request({ weekKey: req.data.weekKey }) };
     }
     async connections(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         return { data: Http_1.Http.getActiveConnectionsSnapshot() };
     }
     async db(req) {
-        await this.checkAuthentication(req);
+        await this.requireAccess(req, "dashboard");
         return { data: DBService_1.DBService.healthcheck(req.data.range) };
     }
+    async requireAccess(req, capability) {
+        const login = await this.checkAuthentication(req);
+        const users = await APIService_1.REQ_MONITOR_USERS.request();
+        const user = users?.find(u => u?.login === login);
+        if (!MonitorAuth_1.MonitorAuth.roleAllows(user?.role, capability)) {
+            const { role } = MonitorAuth_1.MonitorAuth.describeRole(user?.role);
+            (0, LogService_1.logWarn)(`Monitor access denied: "${login}" (role ${role}) tried a "${capability}" endpoint`);
+            throw { ...DefaultErrors_1.default.FORBIDDEN, details: `Role "${role}" is not allowed to access ${capability} endpoints` };
+        }
+        return login;
+    }
     async checkAuthentication(req) {
         const users = await APIService_1.REQ_MONITOR_USERS.request();
         if (!users || users.length == 0)
             throw { ...DefaultErrors_1.default.UNAUTHORIZED, details: "No users found for monitor access, please set up users first." };
-        let header = req.headers['authorization'];
+        const header = req.headers['authorization'];
         if (!header)
             throw { ...DefaultErrors_1.default.UNAUTHORIZED, details: "No authorization header found" };
-        header = header.split(" ").pop() ?? "";
-        if (!header || header.length < 32)
+        const token = header.split(" ").pop() ?? "";
+        if (!token || token.length < 32)
             throw { ...DefaultErrors_1.default.UNAUTHORIZED, details: "Wrong authorization header" };
-        for (let i of users) {
-            const hash = crypto_1.default.createHash("sha256").update(i.login + ":" + i.password).digest("hex");
-            if (hash === header) {
-                return i.login;
-            }
-        }
-        throw { ...DefaultErrors_1.default.UNAUTHORIZED, details: "Invalid user" };
+        const session = MonitorAuth_1.MonitorAuth.touchSession(token);
+        if (!session)
+            throw { ...DefaultErrors_1.default.UNAUTHORIZED, details: "Session is invalid or expired — authenticate via sm/login" };
+        return session.login;
     }
 }
 exports.Monitor = Monitor;

package/dist/apiServer/monitor/MonitorAuth.d.ts

@@ -0,0 +1,69 @@
+import { IMonitorUser } from "../APIService";
+export interface IMonitorSession {
+    token: string;
+    login: string;
+    createdAt: number;
+    lastSeenAt: number;
+}
+export type TMonitorRole = "admin" | "it" | "analytic";
+export type TMonitorCapability = "dashboard" | "logs" | "admin";
+export declare class MonitorAuth {
+    private static readonly ROLE_CAPS;
+    static roleAllows(role: string | undefined | null, capability: TMonitorCapability): boolean;
+    static describeRole(role: string | undefined | null): {
+        role: string;
+        capabilities: TMonitorCapability[];
+    };
+    private static authFile;
+    private static projectKey;
+    private static enrolled;
+    private static storeLoaded;
+    static configure(authFile?: string | null, projectName?: string): void;
+    private static loadStore;
+    private static saveStore;
+    static secretFor(user: IMonitorUser): string | null;
+    static isEnrolled(user: IMonitorUser): boolean;
+    static MIN_PASSWORD_LENGTH: number;
+    static SESSION_IDLE_MS: number;
+    static SESSION_MAX_MS: number;
+    static MAX_FAILED_ATTEMPTS: number;
+    static LOCKOUT_MS: number;
+    private static sessions;
+    private static failures;
+    private static usedTotpCounter;
+    static passwordPolicyError(password: string | undefined | null): string | null;
+    static compliantUsers(users: IMonitorUser[]): IMonitorUser[];
+    static policyReportFor(users: IMonitorUser[]): string[];
+    private static base32Decode;
+    private static hotp;
+    static verifyTotp(login: string, secretBase32: string, code: string): string | null;
+    static generateTotpSecret(login: string, issuer?: string): {
+        secret: string;
+        uri: string;
+    };
+    static lockoutRemainingMs(login: string): number;
+    private static registerFailure;
+    private static clearFailures;
+    private static sameSecret;
+    static authenticate(users: IMonitorUser[], login: string, password: string, totp?: string): {
+        user?: IMonitorUser;
+        error?: string;
+        enrollmentRequired?: boolean;
+    };
+    private static pendingEnrollments;
+    static ENROLLMENT_TTL_MS: number;
+    static beginEnrollment(login: string, issuer?: string): {
+        token: string;
+        secret: string;
+        uri: string;
+    };
+    static completeEnrollment(token: string, code: string): {
+        login?: string;
+        error?: string;
+    };
+    private static purgeSessions;
+    static createSession(login: string): IMonitorSession;
+    static touchSession(token: string): IMonitorSession | null;
+    static revokeSession(token: string): void;
+    static revokeAllFor(login: string): void;
+}

package/dist/apiServer/monitor/MonitorAuth.js

@@ -0,0 +1,310 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MonitorAuth = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const LogService_1 = require("../LogService");
+class MonitorAuth {
+    static ROLE_CAPS = {
+        admin: ["dashboard", "logs", "admin"],
+        it: ["dashboard", "logs"],
+        analytic: ["dashboard"],
+    };
+    static roleAllows(role, capability) {
+        const caps = MonitorAuth.ROLE_CAPS[role] ?? MonitorAuth.ROLE_CAPS.admin;
+        return caps.includes(capability);
+    }
+    static describeRole(role) {
+        const r = role;
+        return { role: MonitorAuth.ROLE_CAPS[r] ? r : "admin",
+            capabilities: MonitorAuth.ROLE_CAPS[r] ?? MonitorAuth.ROLE_CAPS.admin };
+    }
+    static authFile = null;
+    static projectKey = "default";
+    static enrolled = new Map();
+    static storeLoaded = false;
+    static configure(authFile, projectName) {
+        MonitorAuth.authFile = authFile && authFile.length > 0 ? authFile : null;
+        MonitorAuth.projectKey = (projectName && projectName.length > 0 ? projectName : "default");
+        MonitorAuth.enrolled.clear();
+        MonitorAuth.storeLoaded = false;
+        MonitorAuth.loadStore();
+        if (!MonitorAuth.authFile)
+            (0, LogService_1.logWarn)("Monitor 2FA: no monitorAuthFile configured — enrollments live in memory only and are LOST on restart");
+    }
+    static loadStore() {
+        if (MonitorAuth.storeLoaded)
+            return;
+        MonitorAuth.storeLoaded = true;
+        if (!MonitorAuth.authFile)
+            return;
+        try {
+            if (!fs_1.default.existsSync(MonitorAuth.authFile))
+                return;
+            const raw = JSON.parse(fs_1.default.readFileSync(MonitorAuth.authFile, "utf-8"));
+            const section = raw?.projects?.[MonitorAuth.projectKey]?.users ?? raw?.users ?? {};
+            for (const [login, rec] of Object.entries(section)) {
+                const r = rec;
+                if (r && typeof r.secret === "string" && r.secret.length > 0)
+                    MonitorAuth.enrolled.set(login, {
+                        secret: r.secret,
+                        enrolledAt: Number(r.enrolledAt) || 0,
+                        lastCounter: Number(r.lastCounter) || 0,
+                    });
+            }
+            (0, LogService_1.logInfo)(`Monitor 2FA: loaded ${MonitorAuth.enrolled.size} enrollment(s) for project "${MonitorAuth.projectKey}"`, "MonitorAuth");
+        }
+        catch (e) {
+            (0, LogService_1.logWarn)("Monitor 2FA: cannot read store, treating as empty: " + (e?.message ?? e));
+        }
+    }
+    static saveStore() {
+        if (!MonitorAuth.authFile)
+            return;
+        try {
+            const users = {};
+            for (const [login, rec] of MonitorAuth.enrolled)
+                users[login] = rec;
+            let doc = { version: 1, projects: {} };
+            try {
+                if (fs_1.default.existsSync(MonitorAuth.authFile)) {
+                    const existing = JSON.parse(fs_1.default.readFileSync(MonitorAuth.authFile, "utf-8"));
+                    if (existing && typeof existing === "object")
+                        doc = { version: 1, projects: existing.projects ?? {} };
+                }
+            }
+            catch { }
+            doc.projects[MonitorAuth.projectKey] = { users };
+            const tmp = MonitorAuth.authFile + ".tmp";
+            fs_1.default.mkdirSync(path_1.default.dirname(MonitorAuth.authFile), { recursive: true });
+            fs_1.default.writeFileSync(tmp, JSON.stringify(doc, null, 2), { encoding: "utf-8", mode: 0o600 });
+            fs_1.default.renameSync(tmp, MonitorAuth.authFile);
+        }
+        catch (e) {
+            (0, LogService_1.logWarn)("Monitor 2FA: cannot persist store: " + (e?.message ?? e));
+        }
+    }
+    static secretFor(user) {
+        MonitorAuth.loadStore();
+        if (user?.totpSecret)
+            return user.totpSecret;
+        return MonitorAuth.enrolled.get(user?.login)?.secret ?? null;
+    }
+    static isEnrolled(user) {
+        return !!MonitorAuth.secretFor(user);
+    }
+    static MIN_PASSWORD_LENGTH = 12;
+    static SESSION_IDLE_MS = 15 * 60 * 1000;
+    static SESSION_MAX_MS = 8 * 60 * 60 * 1000;
+    static MAX_FAILED_ATTEMPTS = 10;
+    static LOCKOUT_MS = 30 * 60 * 1000;
+    static sessions = new Map();
+    static failures = new Map();
+    static usedTotpCounter = new Map();
+    static passwordPolicyError(password) {
+        if (typeof password !== "string" || password.length === 0)
+            return "password is empty";
+        if (password.trim().length === 0)
+            return "password is whitespace only";
+        if (password.length < MonitorAuth.MIN_PASSWORD_LENGTH)
+            return `password must be at least ${MonitorAuth.MIN_PASSWORD_LENGTH} characters`;
+        return null;
+    }
+    static compliantUsers(users) {
+        return users.filter(u => u && typeof u.login === "string" && u.login.length > 0
+            && MonitorAuth.passwordPolicyError(u.password) === null);
+    }
+    static policyReportFor(users) {
+        const out = [];
+        for (const u of users || []) {
+            const reason = !u?.login ? "login is empty" : MonitorAuth.passwordPolicyError(u.password);
+            if (reason)
+                out.push(`${u?.login || "<no login>"}: ${reason}`);
+        }
+        return out;
+    }
+    static base32Decode(input) {
+        const A = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+        let bits = 0, value = 0;
+        const out = [];
+        for (const ch of input.replace(/=+$/, "").replace(/\s+/g, "").toUpperCase()) {
+            const idx = A.indexOf(ch);
+            if (idx < 0)
+                throw new Error("invalid base32 in TOTP secret");
+            value = (value << 5) | idx;
+            bits += 5;
+            if (bits >= 8) {
+                out.push((value >>> (bits - 8)) & 0xff);
+                bits -= 8;
+            }
+        }
+        return Buffer.from(out);
+    }
+    static hotp(secret, counter) {
+        const buf = Buffer.alloc(8);
+        buf.writeUInt32BE(Math.floor(counter / 0x100000000), 0);
+        buf.writeUInt32BE(counter >>> 0, 4);
+        const h = crypto_1.default.createHmac("sha1", secret).update(buf).digest();
+        const off = h[h.length - 1] & 0x0f;
+        const code = ((h[off] & 0x7f) << 24) | ((h[off + 1] & 0xff) << 16)
+            | ((h[off + 2] & 0xff) << 8) | (h[off + 3] & 0xff);
+        return String(code % 1000000).padStart(6, "0");
+    }
+    static verifyTotp(login, secretBase32, code) {
+        if (!/^\d{6}$/.test(String(code || "").trim()))
+            return "TOTP code must be 6 digits";
+        let secret;
+        try {
+            secret = MonitorAuth.base32Decode(secretBase32);
+        }
+        catch {
+            return "TOTP secret is not valid base32";
+        }
+        const counter = Math.floor(Date.now() / 1000 / 30);
+        const given = String(code).trim();
+        for (const c of [counter, counter - 1, counter + 1]) {
+            const expected = MonitorAuth.hotp(secret, c);
+            const a = Buffer.from(expected), b = Buffer.from(given);
+            if (a.length === b.length && crypto_1.default.timingSafeEqual(a, b)) {
+                const last = MonitorAuth.usedTotpCounter.get(login);
+                if (last !== undefined && c <= last)
+                    return "TOTP code already used";
+                MonitorAuth.usedTotpCounter.set(login, c);
+                return null;
+            }
+        }
+        return "TOTP code is invalid";
+    }
+    static generateTotpSecret(login, issuer = "Monitor") {
+        const A = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+        const raw = crypto_1.default.randomBytes(20);
+        let secret = "";
+        for (let i = 0; i < raw.length; i++)
+            secret += A[raw[i] % 32];
+        const safeIssuer = String(issuer || "").replace(/[:\u0000-\u001f]/g, " ").trim() || "Monitor";
+        const label = encodeURIComponent(`${safeIssuer}:${login}`);
+        const uri = `otpauth://totp/${label}?secret=${secret}&issuer=${encodeURIComponent(safeIssuer)}&algorithm=SHA1&digits=6&period=30`;
+        return { secret, uri };
+    }
+    static lockoutRemainingMs(login) {
+        const f = MonitorAuth.failures.get(login);
+        if (!f || f.lockedUntil <= Date.now())
+            return 0;
+        return f.lockedUntil - Date.now();
+    }
+    static registerFailure(login) {
+        const f = MonitorAuth.failures.get(login) ?? { count: 0, lockedUntil: 0 };
+        f.count++;
+        if (f.count >= MonitorAuth.MAX_FAILED_ATTEMPTS) {
+            f.lockedUntil = Date.now() + MonitorAuth.LOCKOUT_MS;
+            f.count = 0;
+        }
+        MonitorAuth.failures.set(login, f);
+    }
+    static clearFailures(login) {
+        MonitorAuth.failures.delete(login);
+    }
+    static sameSecret(a, b) {
+        const x = Buffer.from(String(a), "utf-8"), y = Buffer.from(String(b), "utf-8");
+        return x.length === y.length && crypto_1.default.timingSafeEqual(x, y);
+    }
+    static authenticate(users, login, password, totp) {
+        const locked = MonitorAuth.lockoutRemainingMs(login);
+        if (locked > 0)
+            return { error: `account locked, try again in ${Math.ceil(locked / 60000)} min` };
+        const all = users || [];
+        const candidate = all.find(u => u?.login === login);
+        if (!candidate) {
+            MonitorAuth.registerFailure(login);
+            return { error: "Invalid user" };
+        }
+        const policy = MonitorAuth.passwordPolicyError(candidate.password);
+        if (policy)
+            return { error: `password policy violation for this account (${policy})` };
+        if (!MonitorAuth.sameSecret(candidate.password, password || "")) {
+            MonitorAuth.registerFailure(login);
+            return { error: "Invalid user" };
+        }
+        const secret = MonitorAuth.secretFor(candidate);
+        if (!secret) {
+            MonitorAuth.clearFailures(login);
+            return { user: candidate, enrollmentRequired: true };
+        }
+        const totpError = MonitorAuth.verifyTotp(login, secret, totp || "");
+        if (totpError) {
+            MonitorAuth.registerFailure(login);
+            return { error: totpError };
+        }
+        MonitorAuth.clearFailures(login);
+        return { user: candidate };
+    }
+    static pendingEnrollments = new Map();
+    static ENROLLMENT_TTL_MS = 10 * 60 * 1000;
+    static beginEnrollment(login, issuer = "Monitor") {
+        const now = Date.now();
+        for (const [t, p] of MonitorAuth.pendingEnrollments)
+            if (now - p.createdAt > MonitorAuth.ENROLLMENT_TTL_MS)
+                MonitorAuth.pendingEnrollments.delete(t);
+        const { secret, uri } = MonitorAuth.generateTotpSecret(login, issuer);
+        const token = crypto_1.default.randomBytes(32).toString("hex");
+        MonitorAuth.pendingEnrollments.set(token, { login, secret, createdAt: now });
+        return { token, secret, uri };
+    }
+    static completeEnrollment(token, code) {
+        const pending = MonitorAuth.pendingEnrollments.get(token);
+        if (!pending)
+            return { error: "enrollment session expired, start again" };
+        if (Date.now() - pending.createdAt > MonitorAuth.ENROLLMENT_TTL_MS) {
+            MonitorAuth.pendingEnrollments.delete(token);
+            return { error: "enrollment session expired, start again" };
+        }
+        if (MonitorAuth.enrolled.has(pending.login))
+            return { error: "already enrolled" };
+        const err = MonitorAuth.verifyTotp(pending.login, pending.secret, code);
+        if (err)
+            return { error: err };
+        MonitorAuth.enrolled.set(pending.login, { secret: pending.secret, enrolledAt: Date.now(), lastCounter: 0 });
+        MonitorAuth.pendingEnrollments.delete(token);
+        MonitorAuth.saveStore();
+        (0, LogService_1.logInfo)(`Monitor 2FA enrolled for "${pending.login}"`, "MonitorAuth");
+        return { login: pending.login };
+    }
+    static purgeSessions(now) {
+        for (const [token, s] of MonitorAuth.sessions) {
+            if (now - s.lastSeenAt > MonitorAuth.SESSION_IDLE_MS || now - s.createdAt > MonitorAuth.SESSION_MAX_MS)
+                MonitorAuth.sessions.delete(token);
+        }
+    }
+    static createSession(login) {
+        const now = Date.now();
+        MonitorAuth.purgeSessions(now);
+        const session = {
+            token: crypto_1.default.randomBytes(32).toString("hex"),
+            login, createdAt: now, lastSeenAt: now,
+        };
+        MonitorAuth.sessions.set(session.token, session);
+        return session;
+    }
+    static touchSession(token) {
+        const now = Date.now();
+        MonitorAuth.purgeSessions(now);
+        const s = MonitorAuth.sessions.get(token);
+        if (!s)
+            return null;
+        s.lastSeenAt = now;
+        return s;
+    }
+    static revokeSession(token) {
+        MonitorAuth.sessions.delete(token);
+    }
+    static revokeAllFor(login) {
+        for (const [token, s] of MonitorAuth.sessions)
+            if (s.login === login)
+                MonitorAuth.sessions.delete(token);
+    }
+}
+exports.MonitorAuth = MonitorAuth;