ldap-rest 0.0.1 → 0.1.0

package/static/browser/shared/utils/hmac.js

@@ -0,0 +1,202 @@
+/**
+ * HMAC-SHA256 request signing utility for browser
+ * For backend services authentication
+ * @module browser/shared/utils/hmac
+ */
+/**
+ * Calculate SHA-256 hash of data
+ */
+async function sha256(data) {
+    const encoder = new TextEncoder();
+    const dataBuffer = encoder.encode(data);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', dataBuffer);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Calculate HMAC-SHA256 signature
+ */
+async function hmacSha256(secret, message) {
+    const encoder = new TextEncoder();
+    const keyData = encoder.encode(secret);
+    const messageData = encoder.encode(message);
+    // Import secret as HMAC key
+    const cryptoKey = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    // Calculate HMAC
+    const signature = await crypto.subtle.sign('HMAC', cryptoKey, messageData);
+    const signatureArray = Array.from(new Uint8Array(signature));
+    return signatureArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Generate HMAC signature for a request
+ *
+ * Signature = HMAC-SHA256(secret, "METHOD|PATH|timestamp|body-hash")
+ */
+async function generateHmacSignature(secret, method, path, timestamp, body) {
+    // Calculate body hash for POST/PATCH/PUT methods
+    let bodyHash = '';
+    const methodUpper = method.toUpperCase();
+    if (body &&
+        (methodUpper === 'POST' || methodUpper === 'PATCH' || methodUpper === 'PUT')) {
+        const bodyString = typeof body === 'string' ? body : JSON.stringify(body);
+        bodyHash = await sha256(bodyString);
+    }
+    // Create signing string: METHOD|PATH|timestamp|body-hash
+    const signingString = `${methodUpper}|${path}|${timestamp}|${bodyHash}`;
+    // Calculate HMAC-SHA256 signature
+    return await hmacSha256(secret, signingString);
+}
+/**
+ * HMAC Authentication Client
+ * Provides HTTP client with HMAC-SHA256 request signing
+ */
+class HmacAuthClient {
+    constructor(config) {
+        this.config = config;
+        if (!this.config.serviceId) {
+            throw new Error('Service ID is required');
+        }
+        if (!this.config.secret || this.config.secret.length < 32) {
+            throw new Error('Secret must be at least 32 characters long');
+        }
+    }
+    /**
+     * Generate Authorization header for a request
+     *
+     * Format: HMAC-SHA256 service-id:timestamp:signature
+     */
+    async getAuthHeader(method, path, body) {
+        const timestamp = Date.now();
+        const signature = await generateHmacSignature(this.config.secret, method, path, timestamp, body);
+        return `HMAC-SHA256 ${this.config.serviceId}:${timestamp}:${signature}`;
+    }
+    /**
+     * Extract path with query string from URL
+     */
+    extractPath(url) {
+        try {
+            const urlObj = new URL(url, window.location.origin);
+            return urlObj.pathname + urlObj.search;
+        }
+        catch {
+            // If URL parsing fails, assume it's already a path
+            return url;
+        }
+    }
+    /**
+     * Perform an authenticated fetch request
+     */
+    async fetch(url, options = {}) {
+        const method = options.method || 'GET';
+        const path = this.extractPath(url);
+        // Get body for signature calculation
+        let body = undefined;
+        if (options.body) {
+            if (typeof options.body === 'string') {
+                body = options.body;
+            }
+            else if (options.body instanceof FormData) {
+                // For FormData, we can't easily sign it, so skip body hash
+                body = undefined;
+            }
+            else {
+                body = options.body;
+            }
+        }
+        const authHeader = await this.getAuthHeader(method, path, body);
+        const headers = new Headers(options.headers);
+        headers.set('Authorization', authHeader);
+        return fetch(url, {
+            ...options,
+            headers,
+        });
+    }
+    /**
+     * Prepare request body and headers for methods with body
+     */
+    prepareRequestBody(body, headers) {
+        if (!body) {
+            return undefined;
+        }
+        if (typeof body === 'string') {
+            return body;
+        }
+        if (body instanceof FormData) {
+            return body;
+        }
+        if (typeof body === 'object') {
+            headers.set('Content-Type', 'application/json');
+            return JSON.stringify(body);
+        }
+        return undefined;
+    }
+    /**
+     * Perform an authenticated GET request
+     */
+    async get(url, options = {}) {
+        return this.fetch(url, { ...options, method: 'GET' });
+    }
+    /**
+     * Perform an authenticated POST request
+     */
+    async post(url, body, options = {}) {
+        const headers = new Headers(options.headers);
+        const requestBody = this.prepareRequestBody(body, headers);
+        return this.fetch(url, {
+            ...options,
+            method: 'POST',
+            headers,
+            body: requestBody,
+        });
+    }
+    /**
+     * Perform an authenticated PUT request
+     */
+    async put(url, body, options = {}) {
+        const headers = new Headers(options.headers);
+        const requestBody = this.prepareRequestBody(body, headers);
+        return this.fetch(url, {
+            ...options,
+            method: 'PUT',
+            headers,
+            body: requestBody,
+        });
+    }
+    /**
+     * Perform an authenticated DELETE request
+     */
+    async delete(url, options = {}) {
+        return this.fetch(url, { ...options, method: 'DELETE' });
+    }
+    /**
+     * Perform an authenticated PATCH request
+     */
+    async patch(url, body, options = {}) {
+        const headers = new Headers(options.headers);
+        const requestBody = this.prepareRequestBody(body, headers);
+        return this.fetch(url, {
+            ...options,
+            method: 'PATCH',
+            headers,
+            body: requestBody,
+        });
+    }
+}
+/**
+ * Verify the minimum recommended secret length
+ */
+function isSecretSecure(secret) {
+    return secret.length >= 32;
+}
+/**
+ * Generate a random secure secret for HMAC (for testing/development)
+ * In production, secrets should be generated securely on the backend
+ */
+async function generateRandomSecret(length = 64) {
+    const array = new Uint8Array(length);
+    crypto.getRandomValues(array);
+    return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+
+export { HmacAuthClient, generateHmacSignature, generateRandomSecret, isSecretSecure };
+//# sourceMappingURL=hmac.js.map

package/static/browser/shared/utils/hmac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.js","sources":["../../../../../src/browser/shared/utils/hmac.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAA;;;;AAIG;AAUH;;AAEG;AACH,eAAe,MAAM,CAAC,IAAY,EAAA;AAChC,IAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;AACvC,IAAA,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC;AACpE,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;AACxD,IAAA,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACvE;AAEA;;AAEG;AACH,eAAe,UAAU,CAAC,MAAc,EAAE,OAAe,EAAA;AACvD,IAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;;AAG3C,IAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT;;AAGD,IAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC;AAC1E,IAAA,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AAC5D,IAAA,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5E;AAEA;;;;AAIG;AACI,eAAe,qBAAqB,CACzC,MAAc,EACd,MAAc,EACd,IAAY,EACZ,SAAiB,EACjB,IAAc,EAAA;;IAGd,IAAI,QAAQ,GAAG,EAAE;AACjB,IAAA,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE;AAExC,IAAA,IACE,IAAI;AACJ,SAAC,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,KAAK,CAAC,EAC5E;AACA,QAAA,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;AACzE,QAAA,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;IACrC;;IAGA,MAAM,aAAa,GAAG,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE;;AAGvE,IAAA,OAAO,MAAM,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC;AAChD;AAEA;;;AAGG;MACU,cAAc,CAAA;AAGzB,IAAA,WAAA,CAAY,MAAkB,EAAA;AAC5B,QAAA,IAAI,CAAC,MAAM,GAAG,MAAM;AAEpB,QAAA,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;AAC1B,YAAA,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC;QAC3C;AAEA,QAAA,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE;AACzD,YAAA,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC;QAC/D;IACF;AAEA;;;;AAIG;AACH,IAAA,MAAM,aAAa,CACjB,MAAc,EACd,IAAY,EACZ,IAAc,EAAA;AAEd,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;AAC5B,QAAA,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,MAAM,EACN,IAAI,EACJ,SAAS,EACT,IAAI,CACL;QAED,OAAO,CAAA,YAAA,EAAe,IAAI,CAAC,MAAM,CAAC,SAAS,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE;IACzE;AAEA;;AAEG;AACK,IAAA,WAAW,CAAC,GAAW,EAAA;AAC7B,QAAA,IAAI;AACF,YAAA,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;AACnD,YAAA,OAAO,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;QACxC;AAAE,QAAA,MAAM;;AAEN,YAAA,OAAO,GAAG;QACZ;IACF;AAEA;;AAEG;AACH,IAAA,MAAM,KAAK,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AAChD,QAAA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;;QAGlC,IAAI,IAAI,GAAY,SAAS;AAC7B,QAAA,IAAI,OAAO,CAAC,IAAI,EAAE;AAChB,YAAA,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE;AACpC,gBAAA,IAAI,GAAG,OAAO,CAAC,IAAI;YACrB;AAAO,iBAAA,IAAI,OAAO,CAAC,IAAI,YAAY,QAAQ,EAAE;;gBAE3C,IAAI,GAAG,SAAS;YAClB;iBAAO;AACL,gBAAA,IAAI,GAAG,OAAO,CAAC,IAAI;YACrB;QACF;AAEA,QAAA,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAE/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;AAC5C,QAAA,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC;QAExC,OAAO,KAAK,CAAC,GAAG,EAAE;AAChB,YAAA,GAAG,OAAO;YACV,OAAO;AACR,SAAA,CAAC;IACJ;AAEA;;AAEG;IACK,kBAAkB,CACxB,IAAa,EACb,OAAgB,EAAA;QAEhB,IAAI,CAAC,IAAI,EAAE;AACT,YAAA,OAAO,SAAS;QAClB;AAEA,QAAA,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AAC5B,YAAA,OAAO,IAAI;QACb;AAEA,QAAA,IAAI,IAAI,YAAY,QAAQ,EAAE;AAC5B,YAAA,OAAO,IAAI;QACb;AAEA,QAAA,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AAC5B,YAAA,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;AAC/C,YAAA,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC7B;AAEA,QAAA,OAAO,SAAS;IAClB;AAEA;;AAEG;AACH,IAAA,MAAM,GAAG,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AAC9C,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvD;AAEA;;AAEG;IACH,MAAM,IAAI,CACR,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;AAE1D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,MAAM;YACd,OAAO;AACP,YAAA,IAAI,EAAE,WAAW;AAClB,SAAA,CAAC;IACJ;AAEA;;AAEG;IACH,MAAM,GAAG,CACP,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;AAE1D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,KAAK;YACb,OAAO;AACP,YAAA,IAAI,EAAE,WAAW;AAClB,SAAA,CAAC;IACJ;AAEA;;AAEG;AACH,IAAA,MAAM,MAAM,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AACjD,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC1D;AAEA;;AAEG;IACH,MAAM,KAAK,CACT,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC;AAE1D,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,OAAO;YACf,OAAO;AACP,YAAA,IAAI,EAAE,WAAW;AAClB,SAAA,CAAC;IACJ;AACD;AAED;;AAEG;AACG,SAAU,cAAc,CAAC,MAAc,EAAA;AAC3C,IAAA,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE;AAC5B;AAEA;;;AAGG;AACI,eAAe,oBAAoB,CAAC,SAAiB,EAAE,EAAA;AAC5D,IAAA,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC;AACpC,IAAA,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7B,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACjF;;;;"}

package/static/browser/shared/utils/totp.js

@@ -0,0 +1,182 @@
+/**
+ * TOTP (Time-based One-Time Password) utility for browser
+ * @module browser/shared/utils/totp
+ */
+/**
+ * Generate a TOTP code from a Base32 secret
+ */
+async function generateTotp(config) {
+    const digits = config.digits ?? 6;
+    const step = config.step ?? 30;
+    // Get current time counter
+    const now = Math.floor(Date.now() / 1000);
+    const counter = Math.floor(now / step);
+    return await generateTotpAtTime(config.secret, counter, digits);
+}
+/**
+ * Generate a TOTP code for a specific counter value
+ */
+async function generateTotpAtTime(secret, counter, digits) {
+    // Decode Base32 secret
+    const key = base32Decode(secret);
+    // Convert counter to 8-byte array (big-endian)
+    const counterBytes = new Uint8Array(8);
+    const view = new DataView(counterBytes.buffer);
+    view.setBigUint64(0, BigInt(counter), false); // false = big-endian
+    // Import key for HMAC-SHA1
+    const cryptoKey = await crypto.subtle.importKey('raw', key.buffer, { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']);
+    // Generate HMAC-SHA1
+    const signature = await crypto.subtle.sign('HMAC', cryptoKey, counterBytes);
+    const hash = new Uint8Array(signature);
+    // Dynamic truncation (RFC 4226)
+    const offset = hash[hash.length - 1] & 0x0f;
+    const truncatedHash = ((hash[offset] & 0x7f) << 24) |
+        ((hash[offset + 1] & 0xff) << 16) |
+        ((hash[offset + 2] & 0xff) << 8) |
+        (hash[offset + 3] & 0xff);
+    // Generate N-digit code
+    const code = truncatedHash % Math.pow(10, digits);
+    return code.toString().padStart(digits, '0');
+}
+/**
+ * Decode a Base32 string to Uint8Array
+ */
+function base32Decode(input) {
+    const base32Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+    // Remove trailing padding characters (avoid ReDoS by using simple loop instead of regex)
+    let cleanInput = input.toUpperCase();
+    while (cleanInput.endsWith('=')) {
+        cleanInput = cleanInput.slice(0, -1);
+    }
+    let bits = 0;
+    let value = 0;
+    const output = [];
+    for (let i = 0; i < cleanInput.length; i++) {
+        const idx = base32Chars.indexOf(cleanInput[i]);
+        if (idx === -1) {
+            throw new Error(`Invalid Base32 character: ${cleanInput[i]}`);
+        }
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            output.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return new Uint8Array(output);
+}
+/**
+ * Validate if a string is valid Base32
+ */
+function isValidBase32(input) {
+    const base32Regex = /^[A-Z2-7]+=*$/i;
+    return base32Regex.test(input);
+}
+/**
+ * Get remaining seconds until next TOTP code
+ */
+function getRemainingSeconds(step = 30) {
+    const now = Math.floor(Date.now() / 1000);
+    return step - (now % step);
+}
+/**
+ * TOTP Authentication Client
+ * Provides HTTP client with TOTP authentication header
+ */
+class TotpAuthClient {
+    constructor(config) {
+        this.config = {
+            secret: config.secret,
+            digits: config.digits ?? 6,
+            step: config.step ?? 30,
+        };
+        if (!isValidBase32(this.config.secret)) {
+            throw new Error('Invalid Base32 secret');
+        }
+    }
+    /**
+     * Get current TOTP code
+     */
+    async getCode() {
+        return await generateTotp(this.config);
+    }
+    /**
+     * Get Authorization header with Bearer token
+     */
+    async getAuthHeader() {
+        const code = await this.getCode();
+        return `Bearer ${code}`;
+    }
+    /**
+     * Perform an authenticated fetch request
+     */
+    async fetch(url, options = {}) {
+        const authHeader = await this.getAuthHeader();
+        const headers = new Headers(options.headers);
+        headers.set('Authorization', authHeader);
+        return fetch(url, {
+            ...options,
+            headers,
+        });
+    }
+    /**
+     * Perform an authenticated GET request
+     */
+    async get(url, options = {}) {
+        return this.fetch(url, { ...options, method: 'GET' });
+    }
+    /**
+     * Perform an authenticated POST request
+     */
+    async post(url, body, options = {}) {
+        const headers = new Headers(options.headers);
+        if (body && typeof body === 'object') {
+            headers.set('Content-Type', 'application/json');
+        }
+        return this.fetch(url, {
+            ...options,
+            method: 'POST',
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
+    /**
+     * Perform an authenticated PUT request
+     */
+    async put(url, body, options = {}) {
+        const headers = new Headers(options.headers);
+        if (body && typeof body === 'object') {
+            headers.set('Content-Type', 'application/json');
+        }
+        return this.fetch(url, {
+            ...options,
+            method: 'PUT',
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
+    /**
+     * Perform an authenticated DELETE request
+     */
+    async delete(url, options = {}) {
+        return this.fetch(url, { ...options, method: 'DELETE' });
+    }
+    /**
+     * Perform an authenticated PATCH request
+     */
+    async patch(url, body, options = {}) {
+        const headers = new Headers(options.headers);
+        if (body && typeof body === 'object') {
+            headers.set('Content-Type', 'application/json');
+        }
+        return this.fetch(url, {
+            ...options,
+            method: 'PATCH',
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
+}
+
+export { TotpAuthClient, generateTotp, getRemainingSeconds, isValidBase32 };
+//# sourceMappingURL=totp.js.map

package/static/browser/shared/utils/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sources":["../../../../../src/browser/shared/utils/totp.ts"],"sourcesContent":[null],"names":[],"mappings":"AAAA;;;AAGG;AAWH;;AAEG;AACI,eAAe,YAAY,CAAC,MAAkB,EAAA;AACnD,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC;AACjC,IAAA,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE;;AAG9B,IAAA,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;IAEtC,OAAO,MAAM,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;AACjE;AAEA;;AAEG;AACH,eAAe,kBAAkB,CAC/B,MAAc,EACd,OAAe,EACf,MAAc,EAAA;;AAGd,IAAA,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC;;AAGhC,IAAA,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC;AAC9C,IAAA,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;;AAG7C,IAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAAG,CAAC,MAAqB,EACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAC/B,KAAK,EACL,CAAC,MAAM,CAAC,CACT;;AAGD,IAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC;AAC3E,IAAA,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC;;AAGtC,IAAA,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI;AAC3C,IAAA,MAAM,aAAa,GACjB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,KAAK,EAAE;AAC5B,SAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC;AACjC,SAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;SAC/B,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;;AAG3B,IAAA,MAAM,IAAI,GAAG,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC;IACjD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;AAC9C;AAEA;;AAEG;AACH,SAAS,YAAY,CAAC,KAAa,EAAA;IACjC,MAAM,WAAW,GAAG,kCAAkC;;AAEtD,IAAA,IAAI,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE;AACpC,IAAA,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QAC/B,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;IACtC;IAEA,IAAI,IAAI,GAAG,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC;IACb,MAAM,MAAM,GAAa,EAAE;AAE3B,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9C,QAAA,IAAI,GAAG,KAAK,EAAE,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,CAAA,0BAAA,EAA6B,UAAU,CAAC,CAAC,CAAC,CAAA,CAAE,CAAC;QAC/D;QAEA,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG;QAC1B,IAAI,IAAI,CAAC;AAET,QAAA,IAAI,IAAI,IAAI,CAAC,EAAE;AACb,YAAA,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;YAC1C,IAAI,IAAI,CAAC;QACX;IACF;AAEA,IAAA,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC;AAC/B;AAEA;;AAEG;AACG,SAAU,aAAa,CAAC,KAAa,EAAA;IACzC,MAAM,WAAW,GAAG,gBAAgB;AACpC,IAAA,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;AAChC;AAEA;;AAEG;AACG,SAAU,mBAAmB,CAAC,IAAA,GAAe,EAAE,EAAA;AACnD,IAAA,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,IAAA,OAAO,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC;AAC5B;AAEA;;;AAGG;MACU,cAAc,CAAA;AAGzB,IAAA,WAAA,CAAY,MAAkB,EAAA;QAC5B,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;AACrB,YAAA,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;AAC1B,YAAA,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;SACxB;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;AACtC,YAAA,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;QAC1C;IACF;AAEA;;AAEG;AACH,IAAA,MAAM,OAAO,GAAA;AACX,QAAA,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;IACxC;AAEA;;AAEG;AACH,IAAA,MAAM,aAAa,GAAA;AACjB,QAAA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;QACjC,OAAO,CAAA,OAAA,EAAU,IAAI,CAAA,CAAE;IACzB;AAEA;;AAEG;AACH,IAAA,MAAM,KAAK,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AAChD,QAAA,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE;QAE7C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;AAC5C,QAAA,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC;QAExC,OAAO,KAAK,CAAC,GAAG,EAAE;AAChB,YAAA,GAAG,OAAO;YACV,OAAO;AACR,SAAA,CAAC;IACJ;AAEA;;AAEG;AACH,IAAA,MAAM,GAAG,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AAC9C,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvD;AAEA;;AAEG;IACH,MAAM,IAAI,CACR,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;AAE5C,QAAA,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AACpC,YAAA,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;QACjD;AAEA,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,MAAM;YACd,OAAO;AACP,YAAA,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS;AAC9C,SAAA,CAAC;IACJ;AAEA;;AAEG;IACH,MAAM,GAAG,CACP,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;AAE5C,QAAA,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AACpC,YAAA,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;QACjD;AAEA,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,KAAK;YACb,OAAO;AACP,YAAA,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS;AAC9C,SAAA,CAAC;IACJ;AAEA;;AAEG;AACH,IAAA,MAAM,MAAM,CAAC,GAAW,EAAE,UAAuB,EAAE,EAAA;AACjD,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC1D;AAEA;;AAEG;IACH,MAAM,KAAK,CACT,GAAW,EACX,IAAc,EACd,UAAuB,EAAE,EAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;AAE5C,QAAA,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AACpC,YAAA,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;QACjD;AAEA,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;AACrB,YAAA,GAAG,OAAO;AACV,YAAA,MAAM,EAAE,OAAO;YACf,OAAO;AACP,YAAA,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS;AAC9C,SAAA,CAAC;IACJ;AACD;;;;"}

package/static/browser/shared.esm.js

@@ -423,6 +423,186 @@ async function loadSchema(schemaSource) {
     return schemaSource;
 }
 
+/**
+ * TOTP (Time-based One-Time Password) utility for browser
+ * @module browser/shared/utils/totp
+ */
+/**
+ * Generate a TOTP code from a Base32 secret
+ */
+async function generateTotp(config) {
+    const digits = config.digits ?? 6;
+    const step = config.step ?? 30;
+    // Get current time counter
+    const now = Math.floor(Date.now() / 1000);
+    const counter = Math.floor(now / step);
+    return await generateTotpAtTime(config.secret, counter, digits);
+}
+/**
+ * Generate a TOTP code for a specific counter value
+ */
+async function generateTotpAtTime(secret, counter, digits) {
+    // Decode Base32 secret
+    const key = base32Decode(secret);
+    // Convert counter to 8-byte array (big-endian)
+    const counterBytes = new Uint8Array(8);
+    const view = new DataView(counterBytes.buffer);
+    view.setBigUint64(0, BigInt(counter), false); // false = big-endian
+    // Import key for HMAC-SHA1
+    const cryptoKey = await crypto.subtle.importKey('raw', key.buffer, { name: 'HMAC', hash: 'SHA-1' }, false, ['sign']);
+    // Generate HMAC-SHA1
+    const signature = await crypto.subtle.sign('HMAC', cryptoKey, counterBytes);
+    const hash = new Uint8Array(signature);
+    // Dynamic truncation (RFC 4226)
+    const offset = hash[hash.length - 1] & 0x0f;
+    const truncatedHash = ((hash[offset] & 0x7f) << 24) |
+        ((hash[offset + 1] & 0xff) << 16) |
+        ((hash[offset + 2] & 0xff) << 8) |
+        (hash[offset + 3] & 0xff);
+    // Generate N-digit code
+    const code = truncatedHash % Math.pow(10, digits);
+    return code.toString().padStart(digits, '0');
+}
+/**
+ * Decode a Base32 string to Uint8Array
+ */
+function base32Decode(input) {
+    const base32Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+    // Remove trailing padding characters (avoid ReDoS by using simple loop instead of regex)
+    let cleanInput = input.toUpperCase();
+    while (cleanInput.endsWith('=')) {
+        cleanInput = cleanInput.slice(0, -1);
+    }
+    let bits = 0;
+    let value = 0;
+    const output = [];
+    for (let i = 0; i < cleanInput.length; i++) {
+        const idx = base32Chars.indexOf(cleanInput[i]);
+        if (idx === -1) {
+            throw new Error(`Invalid Base32 character: ${cleanInput[i]}`);
+        }
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            output.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return new Uint8Array(output);
+}
+/**
+ * Validate if a string is valid Base32
+ */
+function isValidBase32(input) {
+    const base32Regex = /^[A-Z2-7]+=*$/i;
+    return base32Regex.test(input);
+}
+/**
+ * Get remaining seconds until next TOTP code
+ */
+function getRemainingSeconds(step = 30) {
+    const now = Math.floor(Date.now() / 1000);
+    return step - (now % step);
+}
+/**
+ * TOTP Authentication Client
+ * Provides HTTP client with TOTP authentication header
+ */
+class TotpAuthClient {
+    constructor(config) {
+        this.config = {
+            secret: config.secret,
+            digits: config.digits ?? 6,
+            step: config.step ?? 30,
+        };
+        if (!isValidBase32(this.config.secret)) {
+            throw new Error('Invalid Base32 secret');
+        }
+    }
+    /**
+     * Get current TOTP code
+     */
+    async getCode() {
+        return await generateTotp(this.config);
+    }
+    /**
+     * Get Authorization header with Bearer token
+     */
+    async getAuthHeader() {
+        const code = await this.getCode();
+        return `Bearer ${code}`;
+    }
+    /**
+     * Perform an authenticated fetch request
+     */
+    async fetch(url, options = {}) {
+        const authHeader = await this.getAuthHeader();
+        const headers = new Headers(options.headers);
+        headers.set('Authorization', authHeader);
+        return fetch(url, {
+            ...options,
+            headers,
+        });
+    }
+    /**
+     * Perform an authenticated GET request
+     */
+    async get(url, options = {}) {
+        return this.fetch(url, { ...options, method: 'GET' });
+    }
+    /**
+     * Perform an authenticated POST request
+     */
+    async post(url, body, options = {}) {
+        const headers = new Headers(options.headers);
+        if (body && typeof body === 'object') {
+            headers.set('Content-Type', 'application/json');
+        }
+        return this.fetch(url, {
+            ...options,
+            method: 'POST',
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
+    /**
+     * Perform an authenticated PUT request
+     */
+    async put(url, body, options = {}) {
+        const headers = new Headers(options.headers);
+        if (body && typeof body === 'object') {
+            headers.set('Content-Type', 'application/json');
+        }
+        return this.fetch(url, {
+            ...options,
+            method: 'PUT',
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
+    /**
+     * Perform an authenticated DELETE request
+     */
+    async delete(url, options = {}) {
+        return this.fetch(url, { ...options, method: 'DELETE' });
+    }
+    /**
+     * Perform an authenticated PATCH request
+     */
+    async patch(url, body, options = {}) {
+        const headers = new Headers(options.headers);
+        if (body && typeof body === 'object') {
+            headers.set('Content-Type', 'application/json');
+        }
+        return this.fetch(url, {
+            ...options,
+            method: 'PATCH',
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
+}
+
 /**
  * Reusable Modal component
  * @module browser/shared/components/Modal
@@ -690,5 +870,5 @@ const THEMES = {
     },
 };
 
-export { Modal, StatusMessage, THEMES, clearPointerOptionsCache, collectPointerArrayValues, createElement, escapeHtml, generateFormField, getElementByIdSafe, getFieldLabel, getOrganizationPath, groupSchemaFields, loadPointerOptions, loadSchema, processFormData, querySelectorAllSafe, querySelectorSafe, replacePlaceholders, replaceSchemaPlaceholders, setInnerHTML, showStatus, toTitleCase };
+export { Modal, StatusMessage, THEMES, TotpAuthClient, clearPointerOptionsCache, collectPointerArrayValues, createElement, escapeHtml, generateFormField, generateTotp, getElementByIdSafe, getFieldLabel, getOrganizationPath, getRemainingSeconds, groupSchemaFields, isValidBase32, loadPointerOptions, loadSchema, processFormData, querySelectorAllSafe, querySelectorSafe, replacePlaceholders, replaceSchemaPlaceholders, setInnerHTML, showStatus, toTitleCase };
 //# sourceMappingURL=shared.esm.js.map