libre-webui 0.25.0 → 0.27.0

package/backend/dist/services/mfaService.js

@@ -0,0 +1,263 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * TOTP multi-factor authentication: enrollment, activation, verification,
+ * one-time recovery codes, the admin step-up policy, and short-lived login
+ * challenge tokens.
+ *
+ * Secrets are AES-GCM encrypted at rest; recovery codes are stored only as
+ * keyed one-way lookup tokens. Challenge tokens are signed with a secret
+ * derived from (but distinct from) the session JWT secret, so a challenge
+ * can never authenticate a request, and each token is one-use through the
+ * coordinator cache.
+ */
+import jwt from 'jsonwebtoken';
+import { createHmac, randomBytes, randomUUID } from 'node:crypto';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { JWT_SECRET } from './authService.js';
+import { getCoordinator } from '../platform/coordination/service.js';
+import { getSystemSetting, setSystemSetting } from './systemSettingsService.js';
+import { buildOtpauthUrl, generateTotpSecret, verifyTotpCode, } from '../utils/totp.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('services:mfa');
+const mfaRepository = () => getPersistence(encryptionService).repositories.security.mfa;
+const RECOVERY_CODE_COUNT = 10;
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+const RECOVERY_ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
+/** Challenge tokens use a derived secret so they can never pass as session JWTs. */
+const CHALLENGE_SECRET = createHmac('sha256', JWT_SECRET)
+    .update('libre:mfa-challenge:v1')
+    .digest();
+export class MfaError extends Error {
+    constructor(message, statusCode = 400) {
+        super(message);
+        this.statusCode = statusCode;
+    }
+}
+const normalizeRecoveryCode = (code) => code.toUpperCase().replace(/[\s-]/g, '');
+const recoveryCodeLookup = (userId, code) => encryptionService.purposeLookupToken('mfa-recovery-code', `${userId}:${normalizeRecoveryCode(code)}`);
+const generateRecoveryCode = () => {
+    const bytes = randomBytes(10);
+    let code = '';
+    for (let index = 0; index < 10; index++) {
+        code += RECOVERY_ALPHABET[bytes[index] % RECOVERY_ALPHABET.length];
+        if (index === 4)
+            code += '-';
+    }
+    return code;
+};
+const parseMode = (value) => value === 'optional' || value === 'required' ? value : null;
+/** Whether the step-up policy is pinned by environment configuration. */
+export const mfaRequiredModeLockedByEnv = () => parseMode(process.env.MFA_REQUIRED_MODE) !== null;
+export const getMfaRequiredMode = async () => {
+    const pinned = parseMode(process.env.MFA_REQUIRED_MODE);
+    if (pinned)
+        return pinned;
+    try {
+        return parseMode(await getSystemSetting('mfa_required_mode')) ?? 'optional';
+    }
+    catch (error) {
+        logger.warn('Failed to read MFA policy; defaulting to optional', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return 'optional';
+    }
+};
+export const setMfaRequiredMode = async (mode) => {
+    if (mfaRequiredModeLockedByEnv()) {
+        throw new MfaError('The MFA policy is pinned by MFA_REQUIRED_MODE', 409);
+    }
+    await setSystemSetting('mfa_required_mode', mode);
+};
+export const getMfaStatus = async (userId) => {
+    const record = await mfaRepository().find(userId);
+    const totpEnabled = record?.activated_at != null;
+    return {
+        totpEnabled,
+        totpPending: record !== null && record.activated_at == null,
+        recoveryCodesRemaining: totpEnabled
+            ? await mfaRepository().countUnusedRecoveryCodes(userId)
+            : 0,
+        required: (await getMfaRequiredMode()) === 'required',
+        requiredModeLocked: mfaRequiredModeLockedByEnv(),
+    };
+};
+/** Whether password login for this user must complete a second factor. */
+export const loginRequirement = async (userId) => {
+    const record = await mfaRepository().find(userId);
+    if (record?.activated_at != null)
+        return 'verify';
+    if ((await getMfaRequiredMode()) === 'required')
+        return 'enroll';
+    return 'none';
+};
+/** Begin (or restart) TOTP enrollment. Refused while TOTP is already active. */
+export const beginTotpEnrollment = async (userId, accountName) => {
+    const existing = await mfaRepository().find(userId);
+    if (existing?.activated_at != null) {
+        throw new MfaError('Two-factor authentication is already enabled; disable it first', 409);
+    }
+    const secret = generateTotpSecret();
+    const now = Date.now();
+    await mfaRepository().upsert({
+        user_id: userId,
+        totp_secret: encryptionService.encrypt(secret),
+        activated_at: null,
+        last_used_step: null,
+        created_at: existing?.created_at ?? now,
+        updated_at: now,
+    });
+    return {
+        secret,
+        otpauthUrl: buildOtpauthUrl(secret, accountName, 'Libre WebUI'),
+    };
+};
+const decryptSecret = (encrypted) => encryptionService.decryptAuthenticated(encrypted);
+/**
+ * Confirm enrollment with a first valid code. Activates TOTP and returns the
+ * one-time recovery codes; they are never readable again.
+ */
+export const activateTotp = async (userId, code) => {
+    const record = await mfaRepository().find(userId);
+    if (!record) {
+        throw new MfaError('No pending two-factor enrollment', 409);
+    }
+    if (record.activated_at != null) {
+        throw new MfaError('Two-factor authentication is already enabled', 409);
+    }
+    const step = verifyTotpCode(decryptSecret(record.totp_secret), code);
+    if (step === null) {
+        throw new MfaError('That code is not valid', 401);
+    }
+    const now = Date.now();
+    await mfaRepository().activate(userId, now, now);
+    await mfaRepository().markStepUsed(userId, step, now);
+    return regenerateRecoveryCodesUnchecked(userId);
+};
+const regenerateRecoveryCodesUnchecked = async (userId) => {
+    const now = Date.now();
+    const codes = [];
+    const records = [];
+    for (let index = 0; index < RECOVERY_CODE_COUNT; index++) {
+        const code = generateRecoveryCode();
+        codes.push(code);
+        records.push({
+            id: randomUUID(),
+            user_id: userId,
+            code_lookup: recoveryCodeLookup(userId, code),
+            created_at: now,
+            used_at: null,
+        });
+    }
+    await mfaRepository().replaceRecoveryCodes(userId, records);
+    return codes;
+};
+/**
+ * Verify a TOTP code for an active enrollment. The matched timestep is
+ * persisted forward-only, so an intercepted code cannot be replayed.
+ */
+export const verifyActiveTotp = async (userId, code) => {
+    const record = await mfaRepository().find(userId);
+    if (!record || record.activated_at == null)
+        return false;
+    const step = verifyTotpCode(decryptSecret(record.totp_secret), code);
+    if (step === null)
+        return false;
+    // A false return means this (or a later) step was already accepted once.
+    return mfaRepository().markStepUsed(userId, step, Date.now());
+};
+/** Consume a one-time recovery code. */
+export const consumeRecoveryCode = async (userId, code) => {
+    const normalized = normalizeRecoveryCode(code);
+    if (normalized.length !== 10) {
+        return {
+            consumed: false,
+            remaining: await mfaRepository().countUnusedRecoveryCodes(userId),
+        };
+    }
+    const record = await mfaRepository().findRecoveryCode(recoveryCodeLookup(userId, normalized));
+    const consumed = record !== null &&
+        record.user_id === userId &&
+        (await mfaRepository().consumeRecoveryCode(record.id, Date.now()));
+    return {
+        consumed,
+        remaining: await mfaRepository().countUnusedRecoveryCodes(userId),
+    };
+};
+/** A submitted second factor: a 6-digit TOTP code or a recovery code. */
+export const verifySecondFactor = async (userId, code) => {
+    const trimmed = code.trim();
+    if (/^\d{6}$/.test(trimmed.replace(/\s/g, ''))) {
+        const verified = await verifyActiveTotp(userId, trimmed);
+        return { verified, method: verified ? 'totp' : null };
+    }
+    const { consumed } = await consumeRecoveryCode(userId, trimmed);
+    return { verified: consumed, method: consumed ? 'recovery' : null };
+};
+/** Regenerate recovery codes after re-proving the second factor. */
+export const regenerateRecoveryCodes = async (userId, code) => {
+    const { verified } = await verifySecondFactor(userId, code);
+    if (!verified) {
+        throw new MfaError('That code is not valid', 401);
+    }
+    return regenerateRecoveryCodesUnchecked(userId);
+};
+/** Disable TOTP after re-proving the second factor. */
+export const disableTotp = async (userId, code) => {
+    const record = await mfaRepository().find(userId);
+    if (!record) {
+        throw new MfaError('Two-factor authentication is not enabled', 409);
+    }
+    if (record.activated_at != null) {
+        const { verified } = await verifySecondFactor(userId, code);
+        if (!verified) {
+            throw new MfaError('That code is not valid', 401);
+        }
+    }
+    await mfaRepository().delete(userId);
+};
+/** Administrator account recovery: removes TOTP state and recovery codes. */
+export const adminResetMfa = async (userId) => mfaRepository().delete(userId);
+/**
+ * Issue a short-lived, one-use challenge token after password verification.
+ * It authorizes exactly one MFA step for one user and nothing else.
+ */
+export const issueMfaChallenge = async (userId, purpose) => {
+    const jti = randomUUID();
+    await getCoordinator().setCache(`mfa-challenge:${jti}`, { userId, purpose }, CHALLENGE_TTL_MS);
+    return jwt.sign({ sub: userId, purpose, jti }, CHALLENGE_SECRET, {
+        expiresIn: Math.floor(CHALLENGE_TTL_MS / 1000),
+    });
+};
+/** Validate a challenge token without consuming it (for retryable attempts). */
+export const peekMfaChallenge = (token, purpose) => {
+    let claims;
+    try {
+        claims = jwt.verify(token, CHALLENGE_SECRET);
+    }
+    catch {
+        throw new MfaError('This sign-in challenge has expired; sign in again', 401);
+    }
+    if (claims.purpose !== purpose || !claims.sub || !claims.jti) {
+        throw new MfaError('This sign-in challenge is not valid', 401);
+    }
+    return { userId: claims.sub, jti: claims.jti };
+};
+/** Burn a challenge after a successful step; false when already used. */
+export const consumeMfaChallenge = async (jti) => (await getCoordinator().consumeCache(`mfa-challenge:${jti}`)) !== null;
+//# sourceMappingURL=mfaService.js.map

package/backend/dist/services/mfaService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfaService.js","sourceRoot":"","sources":["../../src/services/mfaService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAE5C,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;AAE9D,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAE5D,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;KACtD,MAAM,CAAC,wBAAwB,CAAC;KAChC,MAAM,EAAE,CAAC;AAIZ,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YACE,OAAe,EACC,UAAU,GAAG,GAAG;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;0BAFC,UAAU;IAG5B,CAAC;CACF;AAED,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAU,EAAE,CACrD,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3C,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE,CAClE,iBAAiB,CAAC,kBAAkB,CAClC,mBAAmB,EACnB,GAAG,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAC3C,CAAC;AAEJ,MAAM,oBAAoB,GAAG,GAAW,EAAE;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,IAAI,IAAI,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,CAAC;YAAE,IAAI,IAAI,GAAG,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAIF,MAAM,SAAS,GAAG,CAAC,KAAgC,EAA0B,EAAE,CAC7E,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAE9D,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAY,EAAE,CACtD,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAC;AAEpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAA8B,EAAE;IACrE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,IAAI,UAAU,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;YAC/D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAqB,EACN,EAAE;IACjB,IAAI,0BAA0B,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,QAAQ,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,gBAAgB,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAc,EAAsB,EAAE;IACvE,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC;IACjD,OAAO;QACL,WAAW;QACX,WAAW,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI;QAC3D,sBAAsB,EAAE,WAAW;YACjC,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,CAAC;QACL,QAAQ,EAAE,CAAC,MAAM,kBAAkB,EAAE,CAAC,KAAK,UAAU;QACrD,kBAAkB,EAAE,0BAA0B,EAAE;KACjD,CAAC;AACJ,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAc,EACyB,EAAE;IACzC,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,YAAY,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,MAAc,EACd,WAAmB,EAC8B,EAAE;IACnD,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,QAAQ,CAChB,gEAAgE,EAChE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,aAAa,EAAE,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9C,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,GAAG;QACvC,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,UAAU,EAAE,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC;KAChE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAU,EAAE,CAClD,iBAAiB,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,MAAc,EACd,IAAY,EACO,EAAE;IACrB,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,aAAa,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACjD,MAAM,aAAa,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,gCAAgC,GAAG,KAAK,EAC5C,MAAc,EACK,EAAE;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAkC,EAAE,CAAC;IAClD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,mBAAmB,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,UAAU,EAAE;YAChB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;YAC7C,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAc,EACd,IAAY,EACM,EAAE;IACpB,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,yEAAyE;IACzE,OAAO,aAAa,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,wCAAwC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,MAAc,EACd,IAAY,EACuC,EAAE;IACrD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,MAAM,aAAa,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC;SAClE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC,gBAAgB,CACnD,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CACvC,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,KAAK,IAAI;QACf,MAAM,CAAC,OAAO,KAAK,MAAM;QACzB,CAAC,MAAM,aAAa,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,MAAM,aAAa,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC;KAClE,CAAC;AACJ,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,MAAc,EACd,IAAY,EACwD,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC,CAAC;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAC1C,MAAc,EACd,IAAY,EACO,EAAE;IACrB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,MAAc,EACd,IAAY,EACG,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,MAAM,aAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE,CACtE,aAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAQjC;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,MAAc,EACd,OAA4B,EACX,EAAE;IACnB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,cAAc,EAAE,CAAC,QAAQ,CAC7B,iBAAiB,GAAG,EAAE,EACtB,EAAE,MAAM,EAAE,OAAO,EAAE,EACnB,gBAAgB,CACjB,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE;QAC/D,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;KAC/C,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAAa,EACb,OAA4B,EACK,EAAE;IACnC,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAoB,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAChB,mDAAmD,EACnD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;AACjD,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,GAAW,EAAoB,EAAE,CACzE,CAAC,MAAM,cAAc,EAAE,CAAC,YAAY,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC"}

package/backend/dist/services/noteService.d.ts

@@ -0,0 +1,71 @@
+import type { Note } from '../types/index.js';
+import { type AuthzActor } from './authorizationService.js';
+import type { BlobReadResult } from '../platform/storage/index.js';
+export declare class NoteError extends Error {
+    readonly statusCode: number;
+    constructor(message: string, statusCode: number);
+}
+export type NotePermission = 'read' | 'write';
+export interface SharedNoteMeta {
+    /** Owner of a note shared with the actor. */
+    ownerUserId: string;
+    permission: NotePermission;
+}
+export interface NoteWithAccess extends Note {
+    shared?: SharedNoteMeta;
+}
+export interface NoteRevisionView {
+    id: string;
+    noteId: string;
+    title: string;
+    content: string;
+    createdAt: number;
+}
+export interface NoteAttachmentView {
+    id: string;
+    noteId: string;
+    filename: string;
+    contentType: string;
+    size: number;
+    createdAt: number;
+}
+export declare const listNotes: (actor: AuthzActor) => Promise<NoteWithAccess[]>;
+export declare const getNote: (actor: AuthzActor, noteId: string) => Promise<NoteWithAccess>;
+export declare const createNote: (actor: AuthzActor, input: {
+    title: string;
+    content: string;
+}) => Promise<Note>;
+export declare const updateNote: (actor: AuthzActor, noteId: string, updates: {
+    title?: string;
+    content?: string;
+    pinned?: boolean;
+}) => Promise<NoteWithAccess>;
+export declare const deleteNote: (actor: AuthzActor, noteId: string) => Promise<void>;
+export declare const listRevisions: (actor: AuthzActor, noteId: string) => Promise<NoteRevisionView[]>;
+export declare const restoreRevision: (actor: AuthzActor, noteId: string, revisionId: string) => Promise<NoteWithAccess>;
+export declare const listAttachments: (actor: AuthzActor, noteId: string) => Promise<NoteAttachmentView[]>;
+export declare const addAttachment: (actor: AuthzActor, noteId: string, file: {
+    buffer: Buffer;
+    filename: string;
+    contentType: string;
+}) => Promise<NoteAttachmentView>;
+export declare const openAttachment: (actor: AuthzActor, noteId: string, attachmentId: string) => Promise<{
+    attachment: NoteAttachmentView;
+    body: BlobReadResult;
+}>;
+export declare const deleteAttachment: (actor: AuthzActor, noteId: string, attachmentId: string) => Promise<void>;
+/**
+ * Proposes an AI edit of the note. Nothing persists here: the client
+ * previews the proposal as a diff and applies it through the ordinary
+ * update path, which snapshots a revision first — that is what makes a
+ * model edit reversible.
+ */
+export declare const assistNote: (actor: AuthzActor, noteId: string, input: {
+    instruction: string;
+    model: string;
+    providerType?: string | null;
+    providerId?: string | null;
+}, signal?: AbortSignal) => Promise<{
+    content: string;
+}>;
+//# sourceMappingURL=noteService.d.ts.map

package/backend/dist/services/noteService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"noteService.d.ts","sourceRoot":"","sources":["../../src/services/noteService.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAQ9C,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBnE,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAF7B,YACE,OAAO,EAAE,MAAM,EACN,UAAU,EAAE,MAAM,EAI5B;CACF;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,cAAe,SAAQ,IAAI;IAC1C,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AA+ED,eAAO,MAAM,SAAS,UACb,UAAU,KAChB,OAAO,CAAC,cAAc,EAAE,CAiB1B,CAAC;AAEF,eAAO,MAAM,OAAO,UACX,UAAU,UACT,MAAM,KACb,OAAO,CAAC,cAAc,CAGxB,CAAC;AAEF,eAAO,MAAM,UAAU,UACd,UAAU,SACV;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KACxC,OAAO,CAAC,IAAI,CAwBd,CAAC;AAEF,eAAO,MAAM,UAAU,UACd,UAAU,UACT,MAAM,WACL;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,KAC9D,OAAO,CAAC,cAAc,CAqBxB,CAAC;AAEF,eAAO,MAAM,UAAU,UACd,UAAU,UACT,MAAM,KACb,OAAO,CAAC,IAAI,CAsBd,CAAC;AAEF,eAAO,MAAM,aAAa,UACjB,UAAU,UACT,MAAM,KACb,OAAO,CAAC,gBAAgB,EAAE,CAW5B,CAAC;AAEF,eAAO,MAAM,eAAe,UACnB,UAAU,UACT,MAAM,cACF,MAAM,KACjB,OAAO,CAAC,cAAc,CAcxB,CAAC;AAEF,eAAO,MAAM,eAAe,UACnB,UAAU,UACT,MAAM,KACb,OAAO,CAAC,kBAAkB,EAAE,CAU9B,CAAC;AAEF,eAAO,MAAM,aAAa,UACjB,UAAU,UACT,MAAM,QACR;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,KAC9D,OAAO,CAAC,kBAAkB,CA6D5B,CAAC;AAEF,eAAO,MAAM,cAAc,UAClB,UAAU,UACT,MAAM,gBACA,MAAM,KACnB,OAAO,CAAC;IACT,UAAU,EAAE,kBAAkB,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC;CACtB,CAqBA,CAAC;AAEF,eAAO,MAAM,gBAAgB,UACpB,UAAU,UACT,MAAM,gBACA,MAAM,KACnB,OAAO,CAAC,IAAI,CAed,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,UACd,UAAU,UACT,MAAM,SACP;IACL,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,WACQ,WAAW,KACnB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CA4D7B,CAAC"}