feedkeeper 0.0.0-stage → 0.23.1

package/server/dist/api/v1/serialize.js

@@ -0,0 +1,48 @@
+import { contentMetadata } from "../../feeds/articleContent.js";
+import { db } from "../../db/index.js";
+import { serializeSubscription } from "../../sync/changeLog.js";
+/** A subscription as the list shows it: the synced fields plus counts and polling health. */
+export function serializeSubscriptionDetail(subscription) {
+    return {
+        ...serializeSubscription(subscription),
+        folderName: subscription.folder_name,
+        unreadCount: subscription.unread_count,
+        lastPolledAt: subscription.last_polled_at,
+        lastSuccessAt: subscription.last_success_at,
+        lastError: subscription.last_error,
+        consecutiveErrors: subscription.consecutive_errors,
+    };
+}
+export function readingPositions(userId, itemIds) {
+    if (itemIds.length === 0)
+        return new Map();
+    const rows = db
+        .prepare(`SELECT item_id, position FROM item_progress WHERE user_id = ? AND item_id IN (${itemIds.map(() => "?").join(",")})`)
+        .all(userId, ...itemIds);
+    return new Map(rows.map((row) => [row.item_id, row.position]));
+}
+export function serializeItem(row, progress, withContent, hasNote = false) {
+    return {
+        id: row.id,
+        subscriptionId: row.feed_id,
+        subscriptionTitle: row.feed_title,
+        title: row.title,
+        url: row.link,
+        publishedAt: row.published_at,
+        addedAt: row.created_at,
+        snippet: row.content_snippet,
+        imageUrl: row.image_url,
+        hasFullText: Boolean(row.full_content_html),
+        content: contentMetadata(row),
+        ...(withContent ? { contentHtml: row.content_html, fullTextHtml: row.full_content_html } : {}),
+        state: {
+            read: Boolean(row.read),
+            saved: Boolean(row.bookmarked),
+            savedAt: row.bookmarked_at ?? null,
+            archivedAt: row.archived_at ?? null,
+            progress: progress.get(row.id) ?? null,
+            hasNote,
+        },
+    };
+}
+//# sourceMappingURL=serialize.js.map

package/server/dist/auth/avatar.js

@@ -0,0 +1,13 @@
+export const AVATAR_MAX_BYTES = 512 * 1024;
+/** Identify an uploaded image by its signature instead of trusting the declared type. */
+export function detectAvatarType(data) {
+    if (data.length >= 3 && data[0] === 0xff && data[1] === 0xd8 && data[2] === 0xff)
+        return "image/jpeg";
+    if (data.length >= 8 && [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a].every((byte, index) => data[index] === byte))
+        return "image/png";
+    const ascii = (start, end) => String.fromCharCode(...data.subarray(start, end));
+    if (data.length >= 12 && ascii(0, 4) === "RIFF" && ascii(8, 12) === "WEBP")
+        return "image/webp";
+    return null;
+}
+//# sourceMappingURL=avatar.js.map

package/server/dist/auth/capabilities.js

@@ -0,0 +1,53 @@
+class DefaultCapabilitiesProvider {
+    getCapabilitiesForUser(_userId) {
+        return {
+            type: "selfhosted",
+            features: {
+                mcp: true,
+                sync: true,
+                notes: true,
+                editions: true,
+                fulltext: true,
+                "search.fts": true,
+                inbox: true,
+            },
+            manageUrl: null,
+        };
+    }
+}
+let activeCapabilitiesProvider = new DefaultCapabilitiesProvider();
+export function setCapabilitiesProvider(provider) {
+    activeCapabilitiesProvider = provider;
+}
+export function getCapabilitiesProvider() {
+    return activeCapabilitiesProvider;
+}
+export function getUserCapabilities(userId) {
+    return activeCapabilitiesProvider.getCapabilitiesForUser(userId);
+}
+/** The advertised feature map is also the authority for enforcement. Missing keys deny access. */
+export function hasUserCapability(userId, capability) {
+    return getUserCapabilities(userId).features[capability] === true;
+}
+export function capabilityDenial(userId, capability) {
+    return {
+        error: "capability_not_available",
+        capability,
+        manageUrl: getUserCapabilities(userId).manageUrl ?? null,
+    };
+}
+export function requireCapability(capability) {
+    return (req, res, next) => {
+        const userId = req.user?.id;
+        if (!userId) {
+            res.status(401).json({ error: "not_authenticated" });
+            return;
+        }
+        if (!hasUserCapability(userId, capability)) {
+            res.status(403).json(capabilityDenial(userId, capability));
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=capabilities.js.map

package/server/dist/auth/middleware.js

@@ -0,0 +1,77 @@
+import { resolveToken } from "./tokens.js";
+import { findUserById, toPublicUser } from "./users.js";
+import { sessionIsSecure } from "./security.js";
+import { RESOURCE_METADATA_URL } from "../oauth/constants.js";
+// Web UI auth: cookie session set at login.
+export function requireSession(req, res, next) {
+    const userId = req.session?.userId;
+    if (!userId || !sessionIsSecure(req, userId)) {
+        res.status(401).json({ error: "not_authenticated" });
+        return;
+    }
+    const user = findUserById(userId);
+    if (!user) {
+        res.status(401).json({ error: "not_authenticated" });
+        return;
+    }
+    req.user = toPublicUser(user);
+    next();
+}
+function bearerToken(req) {
+    const header = req.headers.authorization;
+    return header?.startsWith("Bearer ") ? header.slice("Bearer ".length) : undefined;
+}
+// MCP auth: Bearer personal access token or OAuth access token (not a paired device), scopes the request to its owner.
+export function requireBearerToken(req, res, next) {
+    authenticateBearer(["api", "oauth"], RESOURCE_METADATA_URL)(req, res, next);
+}
+// Native app API: a paired device token or a hand-made token; the web UI may call it with its session.
+export function requireSessionOrDevice(req, res, next) {
+    if (bearerToken(req))
+        authenticateBearer(["api", "device"])(req, res, next);
+    else
+        requireSession(req, res, next);
+}
+/** `resourceMetadata` adds the RFC 9728 challenge that tells OAuth clients where to sign in. */
+export function authenticateBearer(kinds, resourceMetadata) {
+    return (req, res, next) => {
+        bearerAuth(req, res, next, kinds, resourceMetadata);
+    };
+}
+function bearerAuth(req, res, next, kinds, resourceMetadata) {
+    const reject = (error) => {
+        if (resourceMetadata) {
+            const detail = error === "invalid_token" ? `error="invalid_token", ` : "";
+            res.setHeader("WWW-Authenticate", `Bearer ${detail}resource_metadata="${resourceMetadata}"`);
+        }
+        res.status(401).json({ error });
+    };
+    const token = bearerToken(req);
+    if (!token) {
+        reject("missing_token");
+        return;
+    }
+    const resolved = resolveToken(token);
+    if (!resolved || !kinds.includes(resolved.kind)) {
+        reject("invalid_token");
+        return;
+    }
+    const user = findUserById(resolved.userId);
+    if (!user) {
+        reject("invalid_token");
+        return;
+    }
+    req.user = toPublicUser(user);
+    req.tokenScope = resolved.scope;
+    req.tokenId = resolved.tokenId;
+    req.tokenKind = resolved.kind;
+    next();
+}
+export function requireAdmin(req, res, next) {
+    if (req.user?.role !== "admin") {
+        res.status(403).json({ error: "forbidden" });
+        return;
+    }
+    next();
+}
+//# sourceMappingURL=middleware.js.map

package/server/dist/auth/pairing.js

@@ -0,0 +1,36 @@
+import { createHash, randomBytes } from "node:crypto";
+import { db } from "../db/index.js";
+import { createPersonalAccessToken } from "./tokens.js";
+const CODE_TTL_MS = 10 * 60 * 1000;
+// Without 0, O, 1, I and L, so a code can be read out or typed by hand.
+const ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+const CODE_LENGTH = 12;
+function normalize(code) {
+    return code.toUpperCase().replace(/[^A-Z0-9]/g, "");
+}
+function hashCode(code) {
+    return createHash("sha256").update(normalize(code)).digest("hex");
+}
+/** A fresh single-use code for the user (about 60 bits); it replaces any code they still had. */
+export function createPairingCode(userId) {
+    const bytes = randomBytes(CODE_LENGTH);
+    const raw = Array.from(bytes, (byte) => ALPHABET[byte % ALPHABET.length]).join("");
+    const code = raw.match(/.{4}/g).join("-");
+    const expiresAt = new Date(Date.now() + CODE_TTL_MS).toISOString();
+    db.prepare(`INSERT INTO pairing_codes (user_id, code_hash, expires_at) VALUES (?, ?, ?)
+     ON CONFLICT(user_id) DO UPDATE SET code_hash = excluded.code_hash, expires_at = excluded.expires_at, created_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`).run(userId, hashCode(code), expiresAt);
+    return { code, expiresAt };
+}
+/** Exchange a valid code for a device token. A code works once; expired and unknown codes give null. */
+export function redeemPairingCode(code, device) {
+    return db.transaction(() => {
+        db.prepare("DELETE FROM pairing_codes WHERE expires_at <= ?").run(new Date().toISOString());
+        const row = db.prepare("SELECT user_id FROM pairing_codes WHERE code_hash = ?").get(hashCode(code));
+        if (!row)
+            return null;
+        db.prepare("DELETE FROM pairing_codes WHERE user_id = ?").run(row.user_id);
+        const { id, token } = createPersonalAccessToken(row.user_id, device.name, "write", { platform: device.platform, appVersion: device.appVersion });
+        return { userId: row.user_id, deviceId: id, token };
+    })();
+}
+//# sourceMappingURL=pairing.js.map

package/server/dist/auth/password.js

@@ -0,0 +1,21 @@
+import { randomBytes } from "node:crypto";
+import bcrypt from "bcryptjs";
+const SALT_ROUNDS = process.env.NODE_ENV === "test" ? 4 : 12;
+export function hashPassword(plain) {
+    return bcrypt.hashSync(plain, SALT_ROUNDS);
+}
+export function verifyPassword(plain, hash) {
+    return bcrypt.compareSync(plain, hash);
+}
+// A hash nobody knows the password for. Checking it costs what checking a real one costs.
+let unknownAccountHash;
+/**
+ * Like verifyPassword for a sign-in, where the account may not exist: an unknown address takes as long as a known
+ * one, so the response time does not tell whether an account is registered.
+ */
+export function verifyPasswordOrDummy(plain, hash) {
+    unknownAccountHash ??= bcrypt.hashSync(randomBytes(16).toString("hex"), SALT_ROUNDS);
+    const matches = bcrypt.compareSync(plain, hash ?? unknownAccountHash);
+    return hash !== undefined && matches;
+}
+//# sourceMappingURL=password.js.map

package/server/dist/auth/security.js

@@ -0,0 +1,126 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { TOTP, Secret } from "otpauth";
+import { db } from "../db/index.js";
+import { config } from "../config.js";
+export const opaque = () => randomBytes(32).toString("base64url");
+const hash = (text) => createHash("sha256").update(text).digest("hex");
+const encryptionKey = () => createHash("sha256").update(`feedkeeper-totp:${config.sessionSecret}`).digest();
+export function seal(text) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", encryptionKey(), iv);
+    const ciphertext = Buffer.concat([cipher.update(text, "utf8"), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString("base64url");
+}
+function unseal(text) {
+    const data = Buffer.from(text, "base64url");
+    const decipher = createDecipheriv("aes-256-gcm", encryptionKey(), data.subarray(0, 12));
+    decipher.setAuthTag(data.subarray(12, 28));
+    return Buffer.concat([decipher.update(data.subarray(28)), decipher.final()]).toString("utf8");
+}
+export function securityAccount(userId) {
+    db.prepare("INSERT OR IGNORE INTO account_security (user_id, user_handle) VALUES (?, ?)").run(userId, opaque());
+    return db.prepare("SELECT * FROM account_security WHERE user_id = ?").get(userId);
+}
+export function securityVersion(userId) {
+    return db.prepare("SELECT version FROM account_security WHERE user_id = ?").get(userId)?.version ?? 0;
+}
+export function sessionIsSecure(req, userId) {
+    return (req.session?.securityVersion ?? 0) === securityVersion(userId);
+}
+export function hasTotp(userId) { return Boolean(securityAccount(userId).totp_secret); }
+export function securityBinding(req, channel) {
+    if (channel === "native-login")
+        return channel;
+    if (req.headers.authorization)
+        return hash(`${channel}:${req.headers.authorization}`);
+    req.session ??= {};
+    req.session.securityBinding ??= opaque();
+    return hash(`${channel}:${req.session.securityBinding}`);
+}
+export function issueSecurityChallenge(purpose, userId, binding, payload, ttl = 5 * 60_000) {
+    db.prepare("DELETE FROM security_challenges WHERE expires_at <= ?").run(Date.now());
+    const id = opaque();
+    db.prepare("INSERT INTO security_challenges (id_hash, purpose, user_id, binding, version, payload, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?)")
+        .run(hash(id), purpose, userId, binding, userId ? securityVersion(userId) : 0, JSON.stringify(payload), Date.now() + ttl);
+    return id;
+}
+/** Count attempts before checking the factor, including requests that end in an error. */
+export function readSecurityChallenge(id, purpose, binding, consume = false) {
+    if (typeof id !== "string" || !/^[\w-]{43}$/.test(id))
+        return null;
+    return db.transaction(() => {
+        const row = db.prepare("SELECT * FROM security_challenges WHERE id_hash = ?").get(hash(id));
+        if (!row || row.purpose !== purpose || row.binding !== binding || row.expires_at <= Date.now() || row.attempts >= 15 || (row.user_id && row.version !== securityVersion(row.user_id)))
+            return null;
+        if (consume)
+            db.prepare("DELETE FROM security_challenges WHERE id_hash = ?").run(hash(id));
+        else
+            db.prepare("UPDATE security_challenges SET attempts = attempts + 1 WHERE id_hash = ?").run(hash(id));
+        return row;
+    })();
+}
+export function discardSecurityChallenge(id) { db.prepare("DELETE FROM security_challenges WHERE id_hash = ?").run(hash(id)); }
+export function totpFor(secret, label = "FeedKeeper") {
+    return new TOTP({ issuer: "FeedKeeper", label, algorithm: "SHA1", digits: 6, period: 30, secret: secret ? Secret.fromBase32(secret) : new Secret({ size: 20 }) });
+}
+export function verifySecondFactor(userId, code) {
+    if (typeof code !== "string" || code.length > 80)
+        return false;
+    return db.transaction(() => {
+        const account = securityAccount(userId);
+        if (!account.totp_secret)
+            return false;
+        if (/^\d{6}$/.test(code)) {
+            let delta;
+            try {
+                delta = totpFor(unseal(account.totp_secret)).validate({ token: code, window: 1 });
+            }
+            catch {
+                return false;
+            }
+            if (delta === null)
+                return false;
+            const step = Math.floor(Date.now() / 30_000) + delta;
+            return db.prepare("UPDATE account_security SET totp_last_step = ? WHERE user_id = ? AND totp_last_step < ?").run(step, userId, step).changes === 1;
+        }
+        const normalized = code.toUpperCase().replace(/[ -]/g, "");
+        if (!/^[A-F0-9]{24}$/.test(normalized))
+            return false;
+        return db.prepare("DELETE FROM recovery_codes WHERE user_id = ? AND code_hash = ?").run(userId, hash(normalized)).changes === 1;
+    })();
+}
+export function newRecoveryCodes(userId) {
+    db.prepare("DELETE FROM recovery_codes WHERE user_id = ?").run(userId);
+    const codes = Array.from({ length: 10 }, () => randomBytes(12).toString("hex").toUpperCase());
+    for (const code of codes)
+        db.prepare("INSERT INTO recovery_codes (user_id, code_hash) VALUES (?, ?)").run(userId, hash(code));
+    return codes.map(code => code.match(/.{6}/g).join("-"));
+}
+/**
+ * A new password ends every browser session and pending sign-in that knew the old one. Access tokens, paired
+ * devices and connected apps are the person's own and keep working; they can be removed one by one.
+ */
+export function revokeBrowserSessions(userId) {
+    securityAccount(userId);
+    db.prepare("UPDATE account_security SET version = version + 1 WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM security_challenges WHERE user_id = ?").run(userId);
+}
+/** Enabling MFA invalidates older password-only sessions, tokens, pairing codes and pending logins. */
+export function revokeSecuritySessions(userId) {
+    db.prepare("UPDATE account_security SET version = version + 1 WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM personal_access_tokens WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM pairing_codes WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM security_challenges WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM oauth_grants WHERE user_id = ?").run(userId);
+    db.prepare("DELETE FROM oauth_codes WHERE user_id = ?").run(userId);
+}
+export function beginMfa(req, userId, channel, context) {
+    if (!hasTotp(userId))
+        return null;
+    const challengeId = issueSecurityChallenge("mfa", userId, securityBinding(req, `${channel}-login`), context);
+    if (channel === "web") {
+        req.session.pendingMfa = challengeId;
+    }
+    return { error: "mfa_required", challengeId, methods: ["totp", "recovery"], expiresAt: new Date(Date.now() + 5 * 60_000).toISOString() };
+}
+//# sourceMappingURL=security.js.map

package/server/dist/auth/securityRoutes.js

@@ -0,0 +1,249 @@
+import { Router } from "express";
+import rateLimit from "express-rate-limit";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
+import { db } from "../db/index.js";
+import { config } from "../config.js";
+import { findUserById } from "./users.js";
+import { verifyPassword } from "./password.js";
+import { requireSessionOrDevice } from "./middleware.js";
+import { discardSecurityChallenge, hasTotp, issueSecurityChallenge, newRecoveryCodes, readSecurityChallenge, revokeSecuritySessions, seal, securityAccount, securityBinding, securityVersion, totpFor, verifySecondFactor } from "./security.js";
+export function createSecurityRouter(options) {
+    const router = Router();
+    const origin = new URL(options.publicUrl ?? config.publicUrl).origin;
+    const rpID = new URL(origin).hostname;
+    const passkeysEnabled = origin.startsWith("https:") || rpID === "localhost" || rpID === "127.0.0.1";
+    const channel = options.channel ?? "web";
+    const binding = (req) => securityBinding(req, `${channel}-login`);
+    const managementBinding = (req) => securityBinding(req, `${channel}-management`);
+    const invalid = (res) => { res.status(400).json({ error: "invalid_or_expired_code" }); };
+    const limiter = rateLimit({ windowMs: 5 * 60_000, limit: 120, standardHeaders: true, legacyHeaders: false, message: { error: "too_many_requests" } });
+    router.use((_req, res, next) => { res.setHeader("Cache-Control", "private, no-store"); next(); });
+    router.use((req, res, next) => {
+        if (req.method !== "GET" && (req.headers["sec-fetch-site"] === "cross-site" || (req.headers.origin && req.headers.origin !== origin))) {
+            res.status(403).json({ error: "invalid_origin" });
+            return;
+        }
+        next();
+    });
+    router.use(limiter);
+    const management = [options.authenticate ?? requireSessionOrDevice, (req, res, next) => {
+            if (req.tokenScope === "read" || (req.tokenKind && req.tokenKind !== "device")) {
+                res.status(403).json({ error: "forbidden" });
+                return;
+            }
+            next();
+        }];
+    const proof = (req) => {
+        const row = readSecurityChallenge(req.body?.reauthToken, "reauth", managementBinding(req), true);
+        return row?.user_id === req.user.id;
+    };
+    const issueProof = (req, res) => res.json({ reauthToken: issueSecurityChallenge("reauth", req.user.id, managementBinding(req), {}) });
+    const list = (userId) => db.prepare("SELECT id, name, created_at, last_used_at FROM passkeys WHERE user_id = ? ORDER BY created_at").all(userId);
+    router.get("/config", (_req, res) => res.json({ passkeys: passkeysEnabled, totp: true }));
+    router.get("/pending", (req, res) => res.json({ challengeId: req.session?.pendingMfa ?? null }));
+    router.post("/mfa", (req, res) => {
+        const row = readSecurityChallenge(req.body?.challengeId, "mfa", binding(req));
+        if (!row?.user_id || !verifySecondFactor(row.user_id, req.body?.code)) {
+            invalid(res);
+            return;
+        }
+        discardSecurityChallenge(req.body.challengeId);
+        options.completeLogin(req, res, row.user_id, JSON.parse(row.payload));
+    });
+    router.post("/passkeys/options", async (req, res) => {
+        if (!passkeysEnabled) {
+            res.status(503).json({ error: "https_required" });
+            return;
+        }
+        const context = options.loginContext?.(req) ?? (channel === "web" ? { remember: req.body?.remember === true } : null);
+        if (context === null) {
+            res.status(400).json({ error: "invalid_input" });
+            return;
+        }
+        const publicKey = await generateAuthenticationOptions({ rpID, userVerification: "required" });
+        const challengeId = issueSecurityChallenge("passkey-login", null, binding(req), { challenge: publicKey.challenge, context });
+        res.json({ challengeId, publicKey });
+    });
+    async function assertion(req, purpose, keyBinding) {
+        const row = readSecurityChallenge(req.body?.challengeId, purpose, keyBinding, true);
+        if (!row)
+            return null;
+        const credential = req.body?.credential;
+        if (typeof credential?.id !== "string")
+            return null;
+        const saved = db.prepare("SELECT * FROM passkeys WHERE id = ?").get(credential.id);
+        if (!saved || (row.user_id && saved.user_id !== row.user_id))
+            return null;
+        const handle = credential.response?.userHandle;
+        // Discoverable login must identify the account. A scoped reauthentication may omit the handle.
+        if ((!row.user_id && !handle) || (handle != null && handle !== securityAccount(saved.user_id).user_handle))
+            return null;
+        const version = securityVersion(saved.user_id);
+        try {
+            const result = await verifyAuthenticationResponse({ response: credential, expectedChallenge: JSON.parse(row.payload).challenge, expectedOrigin: origin, expectedRPID: rpID, requireUserVerification: true,
+                credential: { id: saved.id, publicKey: new Uint8Array(saved.public_key), counter: saved.counter, transports: JSON.parse(saved.transports) } });
+            if (!result.verified || version !== securityVersion(saved.user_id))
+                return null;
+            // Avoid accepting two assertions against the same older counter after asynchronous verification.
+            const updated = db.prepare("UPDATE passkeys SET counter = ?, last_used_at = ? WHERE id = ? AND counter = ?").run(result.authenticationInfo.newCounter, new Date().toISOString(), saved.id, saved.counter);
+            if (!updated.changes)
+                return null;
+            return { userId: saved.user_id, payload: JSON.parse(row.payload) };
+        }
+        catch {
+            return null;
+        }
+    }
+    router.post("/passkeys/verify", async (req, res) => {
+        const result = await assertion(req, "passkey-login", binding(req));
+        if (!result) {
+            invalid(res);
+            return;
+        }
+        options.completeLogin(req, res, result.userId, result.payload.context);
+    });
+    router.get("/", ...management, (req, res) => res.json({ totpEnabled: hasTotp(req.user.id), passkeysEnabled, emailReauthEnabled: options.emailReauthEnabled?.(req.user.id) === true, passkeys: list(req.user.id), recoveryCodesRemaining: db.prepare("SELECT COUNT(*) AS n FROM recovery_codes WHERE user_id = ?").get(req.user.id).n }));
+    router.post("/reauth", ...management, (req, res) => {
+        const user = findUserById(req.user.id);
+        if (typeof req.body?.password !== "string" || req.body.password.length > 1024 || !verifyPassword(req.body.password, user.password_hash) || (hasTotp(user.id) && !verifySecondFactor(user.id, req.body.code))) {
+            res.status(401).json({ error: "invalid_credentials" });
+            return;
+        }
+        issueProof(req, res);
+    });
+    router.post("/reauth/passkey/options", ...management, async (req, res) => {
+        if (!passkeysEnabled) {
+            res.status(503).json({ error: "https_required" });
+            return;
+        }
+        const publicKey = await generateAuthenticationOptions({ rpID, userVerification: "required", allowCredentials: list(req.user.id).map(key => ({ id: key.id })) });
+        res.json({ challengeId: issueSecurityChallenge("passkey-reauth", req.user.id, managementBinding(req), { challenge: publicKey.challenge }), publicKey });
+    });
+    router.post("/reauth/passkey/verify", ...management, async (req, res) => {
+        const result = await assertion(req, "passkey-reauth", managementBinding(req));
+        if (!result || result.userId !== req.user.id) {
+            invalid(res);
+            return;
+        }
+        issueProof(req, res);
+    });
+    router.post("/passkeys/register/options", ...management, async (req, res) => {
+        if (!passkeysEnabled) {
+            res.status(503).json({ error: "https_required" });
+            return;
+        }
+        if (!proof(req)) {
+            res.status(401).json({ error: "reauth_required" });
+            return;
+        }
+        const user = findUserById(req.user.id);
+        if (list(user.id).length >= 20) {
+            res.status(400).json({ error: "passkey_limit" });
+            return;
+        }
+        const publicKey = await generateRegistrationOptions({ rpID, rpName: "FeedKeeper", userName: user.email, userDisplayName: user.display_name, userID: Buffer.from(securityAccount(user.id).user_handle, "base64url"), attestationType: "none", excludeCredentials: list(user.id).map(key => ({ id: key.id })), authenticatorSelection: { residentKey: "required", userVerification: "required" } });
+        res.json({ challengeId: issueSecurityChallenge("passkey-register", user.id, managementBinding(req), { challenge: publicKey.challenge }), publicKey });
+    });
+    router.post("/passkeys/register/verify", ...management, async (req, res) => {
+        const row = readSecurityChallenge(req.body?.challengeId, "passkey-register", managementBinding(req), true);
+        if (row?.user_id !== req.user.id || typeof req.body?.name !== "string" || !req.body.name.trim() || req.body.name.length > 100) {
+            invalid(res);
+            return;
+        }
+        try {
+            const result = await verifyRegistrationResponse({ response: req.body.credential, expectedChallenge: JSON.parse(row.payload).challenge, expectedOrigin: origin, expectedRPID: rpID, requireUserVerification: true });
+            if (!result.verified || !result.registrationInfo || row.version !== securityVersion(req.user.id)) {
+                invalid(res);
+                return;
+            }
+            if (list(req.user.id).length >= 20) {
+                res.status(400).json({ error: "passkey_limit" });
+                return;
+            }
+            const key = result.registrationInfo.credential;
+            const transports = key.transports ?? [];
+            db.prepare("INSERT INTO passkeys (id, user_id, public_key, counter, transports, name, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)").run(key.id, req.user.id, Buffer.from(key.publicKey), key.counter, JSON.stringify(transports), req.body.name.trim(), new Date().toISOString());
+            res.status(201).json({ passkeys: list(req.user.id) });
+        }
+        catch {
+            invalid(res);
+        }
+    });
+    router.delete("/passkeys/:id", ...management, (req, res) => {
+        if (!proof(req)) {
+            res.status(401).json({ error: "reauth_required" });
+            return;
+        }
+        // A host may have passwordless accounts: never remove the final usable passkey through this endpoint.
+        if (list(req.user.id).length <= 1 && !(options.canRemoveLastPasskey?.(req.user.id) ?? true)) {
+            res.status(409).json({ error: "last_passkey" });
+            return;
+        }
+        db.prepare("DELETE FROM passkeys WHERE id = ? AND user_id = ?").run(String(req.params.id), req.user.id);
+        res.status(204).end();
+    });
+    router.post("/totp/setup", ...management, (req, res) => {
+        if (!proof(req)) {
+            res.status(401).json({ error: "reauth_required" });
+            return;
+        }
+        if (hasTotp(req.user.id)) {
+            res.status(409).json({ error: "totp_already_enabled" });
+            return;
+        }
+        const totp = totpFor(undefined, req.user.email);
+        res.json({ challengeId: issueSecurityChallenge("totp-setup", req.user.id, managementBinding(req), { secret: seal(totp.secret.base32) }), secret: totp.secret.base32, uri: totp.toString() });
+    });
+    router.post("/totp/confirm", ...management, (req, res) => {
+        const row = readSecurityChallenge(req.body?.challengeId, "totp-setup", managementBinding(req));
+        if (row?.user_id !== req.user.id || typeof req.body?.code !== "string" || !/^\d{6}$/.test(req.body.code) || hasTotp(req.user.id)) {
+            invalid(res);
+            return;
+        }
+        const result = db.transaction(() => {
+            db.prepare("UPDATE account_security SET totp_secret = ?, totp_last_step = -1 WHERE user_id = ?").run(JSON.parse(row.payload).secret, row.user_id);
+            if (!verifySecondFactor(row.user_id, req.body.code)) {
+                db.prepare("UPDATE account_security SET totp_secret = NULL WHERE user_id = ?").run(row.user_id);
+                return null;
+            }
+            const recoveryCodes = newRecoveryCodes(row.user_id);
+            revokeSecuritySessions(row.user_id);
+            // Keep this authenticated browser open so the recovery codes can be saved; other sessions are revoked.
+            if (!req.headers.authorization)
+                req.session.securityVersion = securityVersion(row.user_id);
+            return recoveryCodes;
+        })();
+        if (!result) {
+            invalid(res);
+            return;
+        }
+        res.json({ recoveryCodes: result });
+    });
+    router.post("/totp/disable", ...management, (req, res) => {
+        if (!proof(req)) {
+            res.status(401).json({ error: "reauth_required" });
+            return;
+        }
+        db.transaction(() => {
+            db.prepare("UPDATE account_security SET totp_secret = NULL, totp_last_step = -1 WHERE user_id = ?").run(req.user.id);
+            db.prepare("DELETE FROM recovery_codes WHERE user_id = ?").run(req.user.id);
+            revokeSecuritySessions(req.user.id);
+            if (!req.headers.authorization)
+                req.session.securityVersion = securityVersion(req.user.id);
+        })();
+        res.status(204).end();
+    });
+    router.post("/recovery-codes", ...management, (req, res) => {
+        if (!proof(req)) {
+            res.status(401).json({ error: "reauth_required" });
+            return;
+        }
+        if (!hasTotp(req.user.id)) {
+            res.status(400).json({ error: "totp_required" });
+            return;
+        }
+        res.json({ recoveryCodes: db.transaction(() => newRecoveryCodes(req.user.id))() });
+    });
+    return router;
+}
+//# sourceMappingURL=securityRoutes.js.map