pico-auth 0.0.22 → 0.0.25

package/dist/pico-auth.d.ts

@@ -4,15 +4,20 @@ declare module "core/auth" {
         expiryTimeMs: any;
     }
     export interface UserProvider {
-        getUser(login: string): Promise<any>;
+        getUser(login: string): Promise<BaseUser>;
         putUser(user: any): Promise<any>;
         userSecretPath?: string;
         userPasswordPath?: string;
+        getSafeUser?(user: any): Promise<BaseUser>;
     }
     export interface ImpersonateProvider {
         canImpersonate(user: any, target: string): Promise<any>;
         impersonateOrg(user: any, target: string): Promise<any>;
     }
+    export interface BaseUser {
+        blocked?: boolean;
+        [key: string]: any;
+    }
     /**
      * When mfaToken is provided
      */

package/dist/pico-auth.esm.js

@@ -22,6 +22,8 @@ const authenticate = async (login, password, mfaToken, impersonateEntity, userPr
         if (!validated)
             throw new Error(`Failed authentication attempt ${login} (MFA Enabled)`);
     }
+    if (user.blocked)
+        throw new Error(`Failed authentication attempt ${login} (Blocked)`);
     if (md5(password || '') == userPassword) {
         // check if impersonate mode - this is not yet implemented fully just copy pasta from GRM project
         const target = impersonateEntity; // either target user login or @organizationId
@@ -66,9 +68,10 @@ const authenticate = async (login, password, mfaToken, impersonateEntity, userPr
         }
         // let jwtSecretKey = process.env.JWT_SECRET_KEY;
         let jwtSecretKey = jwtSpecs.secretKey;
+        let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(user) : user;
         let data = {
             time: Date.now(),
-            user: user
+            user: clearedUser
         };
         // const token = jwt.sign(data, jwtSecretKey, {expiresIn: process.env.JWT_EXPIRY_TIME});
         const token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });

package/dist/pico-auth.esm.min.js

@@ -1 +1 @@
-const speakeasy=require("speakeasy"),qrcode=require("qrcode"),md5=require("md5"),jwt=require("jsonwebtoken"),authenticate=async(e,t,a,r,s,o,i)=>{var n;let c=await s.getUser(e);const l=s.userSecretPath?c[s.userSecretPath]:c.mfa,d=s.userPasswordPath?c[s.userPasswordPath]:c.password;if(null==l?void 0:l.enabled){if(!speakeasy.totp.verify({secret:null===(n=null==l?void 0:l.secret)||void 0===n?void 0:n.actual,encoding:"base32",token:a,window:1}))throw new Error(`Failed authentication attempt ${e} (MFA Enabled)`)}if(md5(t||"")==d){const e=r,t=c;if(e){let a=!1;if(e.startsWith("@")){if(a=a||await o.canImpersonate(c,e),!a)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);await o.impersonateOrg(c,e)}else{const r=await s.getUser(e);if(a=a||await o.canImpersonate(c,e),!a)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);c=r}console.info(`Impersonate success. From: ${t.login} into ${e}`)}let a=i.secretKey,n={time:Date.now(),user:c};const l=jwt.sign(n,a,{expiresIn:i.expiryTimeMs});return console.log(`Successful login: ${c.id}`),l}throw new Error(`Failed authentication attempt ${e}`)},mfaRegister=async(e,t,a)=>new Promise((async(r,s)=>{let o=await a.getUser(t),i=a.userSecretPath?o[a.userSecretPath]:o.mfa;const n=speakeasy.generateSecret({name:`${e}: ${t}`});if(!i){i={secret:{temp:void 0,actual:void 0},enabled:!1};o[a.userSecretPath?a.userSecretPath:"mfa"]=i}i.secret.temp=n.base32,i.secret.actual=void 0,await a.putUser(o),qrcode.toDataURL(n.otpauth_url,((e,t)=>{if(e)throw new Error("Error generating QR code");r({qr_code:t,secret:n.base32})}))})),mfaVerify=async(e,t,a)=>{var r,s;const o=t;let i=await a.getUser(e);const n=a.userSecretPath?i[a.userSecretPath]:i.mfa;return speakeasy.totp.verify({secret:null===(r=null==n?void 0:n.secret)||void 0===r?void 0:r.temp,encoding:"base32",token:o})?(n.secret.actual=null===(s=null==n?void 0:n.secret)||void 0===s?void 0:s.temp,n.enabled=!0,await a.putUser(i),!0):(console.log(`Failed mfa verification for ${e}`),!1)},mfaEnabled=async(e,t)=>{let a=await t.getUser(e);const r=t.userSecretPath?a[t.userSecretPath]:a.mfa;return(null==r?void 0:r.enabled)||!1};export{authenticate,mfaEnabled,mfaRegister,mfaVerify};
+const speakeasy=require("speakeasy"),qrcode=require("qrcode"),md5=require("md5"),jwt=require("jsonwebtoken"),authenticate=async(e,t,a,r,s,o,i)=>{var n;let c=await s.getUser(e);const l=s.userSecretPath?c[s.userSecretPath]:c.mfa,d=s.userPasswordPath?c[s.userPasswordPath]:c.password;if(null==l?void 0:l.enabled){if(!speakeasy.totp.verify({secret:null===(n=null==l?void 0:l.secret)||void 0===n?void 0:n.actual,encoding:"base32",token:a,window:1}))throw new Error(`Failed authentication attempt ${e} (MFA Enabled)`)}if(c.blocked)throw new Error(`Failed authentication attempt ${e} (Blocked)`);if(md5(t||"")==d){const e=r,t=c;if(e){let a=!1;if(e.startsWith("@")){if(a=a||await o.canImpersonate(c,e),!a)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);await o.impersonateOrg(c,e)}else{const r=await s.getUser(e);if(a=a||await o.canImpersonate(c,e),!a)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);c=r}console.info(`Impersonate success. From: ${t.login} into ${e}`)}let a=i.secretKey,n=s.getSafeUser?await s.getSafeUser(c):c,l={time:Date.now(),user:n};const d=jwt.sign(l,a,{expiresIn:i.expiryTimeMs});return console.log(`Successful login: ${c.id}`),d}throw new Error(`Failed authentication attempt ${e}`)},mfaRegister=async(e,t,a)=>new Promise((async(r,s)=>{let o=await a.getUser(t),i=a.userSecretPath?o[a.userSecretPath]:o.mfa;const n=speakeasy.generateSecret({name:`${e}: ${t}`});if(!i){i={secret:{temp:void 0,actual:void 0},enabled:!1};o[a.userSecretPath?a.userSecretPath:"mfa"]=i}i.secret.temp=n.base32,i.secret.actual=void 0,await a.putUser(o),qrcode.toDataURL(n.otpauth_url,((e,t)=>{if(e)throw new Error("Error generating QR code");r({qr_code:t,secret:n.base32})}))})),mfaVerify=async(e,t,a)=>{var r,s;const o=t;let i=await a.getUser(e);const n=a.userSecretPath?i[a.userSecretPath]:i.mfa;return speakeasy.totp.verify({secret:null===(r=null==n?void 0:n.secret)||void 0===r?void 0:r.temp,encoding:"base32",token:o})?(n.secret.actual=null===(s=null==n?void 0:n.secret)||void 0===s?void 0:s.temp,n.enabled=!0,await a.putUser(i),!0):(console.log(`Failed mfa verification for ${e}`),!1)},mfaEnabled=async(e,t)=>{let a=await t.getUser(e);const r=t.userSecretPath?a[t.userSecretPath]:a.mfa;return(null==r?void 0:r.enabled)||!1};export{authenticate,mfaEnabled,mfaRegister,mfaVerify};

package/dist/pico-auth.umd.js

@@ -28,6 +28,8 @@
             if (!validated)
                 throw new Error(`Failed authentication attempt ${login} (MFA Enabled)`);
         }
+        if (user.blocked)
+            throw new Error(`Failed authentication attempt ${login} (Blocked)`);
         if (md5(password || '') == userPassword) {
             // check if impersonate mode - this is not yet implemented fully just copy pasta from GRM project
             const target = impersonateEntity; // either target user login or @organizationId
@@ -72,9 +74,10 @@
             }
             // let jwtSecretKey = process.env.JWT_SECRET_KEY;
             let jwtSecretKey = jwtSpecs.secretKey;
+            let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(user) : user;
             let data = {
                 time: Date.now(),
-                user: user
+                user: clearedUser
             };
             // const token = jwt.sign(data, jwtSecretKey, {expiresIn: process.env.JWT_EXPIRY_TIME});
             const token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });

package/dist/pico-auth.umd.min.js

@@ -1 +1 @@
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).picoAuth={})}(this,(function(e){"use strict";const t=require("speakeasy"),r=require("qrcode"),a=require("md5"),o=require("jsonwebtoken");e.authenticate=async(e,r,i,n,s,c,l)=>{var u;let d=await s.getUser(e);const f=s.userSecretPath?d[s.userSecretPath]:d.mfa,m=s.userPasswordPath?d[s.userPasswordPath]:d.password;if(null==f?void 0:f.enabled){if(!t.totp.verify({secret:null===(u=null==f?void 0:f.secret)||void 0===u?void 0:u.actual,encoding:"base32",token:i,window:1}))throw new Error(`Failed authentication attempt ${e} (MFA Enabled)`)}if(a(r||"")==m){const e=n,t=d;if(e){let r=!1;if(e.startsWith("@")){if(r=r||await c.canImpersonate(d,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);await c.impersonateOrg(d,e)}else{const a=await s.getUser(e);if(r=r||await c.canImpersonate(d,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);d=a}console.info(`Impersonate success. From: ${t.login} into ${e}`)}let r=l.secretKey,a={time:Date.now(),user:d};const i=o.sign(a,r,{expiresIn:l.expiryTimeMs});return console.log(`Successful login: ${d.id}`),i}throw new Error(`Failed authentication attempt ${e}`)},e.mfaEnabled=async(e,t)=>{let r=await t.getUser(e);const a=t.userSecretPath?r[t.userSecretPath]:r.mfa;return(null==a?void 0:a.enabled)||!1},e.mfaRegister=async(e,a,o)=>new Promise((async(i,n)=>{let s=await o.getUser(a),c=o.userSecretPath?s[o.userSecretPath]:s.mfa;const l=t.generateSecret({name:`${e}: ${a}`});if(!c){c={secret:{temp:void 0,actual:void 0},enabled:!1};s[o.userSecretPath?o.userSecretPath:"mfa"]=c}c.secret.temp=l.base32,c.secret.actual=void 0,await o.putUser(s),r.toDataURL(l.otpauth_url,((e,t)=>{if(e)throw new Error("Error generating QR code");i({qr_code:t,secret:l.base32})}))})),e.mfaVerify=async(e,r,a)=>{var o,i;const n=r;let s=await a.getUser(e);const c=a.userSecretPath?s[a.userSecretPath]:s.mfa;return t.totp.verify({secret:null===(o=null==c?void 0:c.secret)||void 0===o?void 0:o.temp,encoding:"base32",token:n})?(c.secret.actual=null===(i=null==c?void 0:c.secret)||void 0===i?void 0:i.temp,c.enabled=!0,await a.putUser(s),!0):(console.log(`Failed mfa verification for ${e}`),!1)},Object.defineProperty(e,"__esModule",{value:!0})}));
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).picoAuth={})}(this,(function(e){"use strict";const t=require("speakeasy"),r=require("qrcode"),a=require("md5"),o=require("jsonwebtoken");e.authenticate=async(e,r,i,n,s,c,l)=>{var u;let d=await s.getUser(e);const f=s.userSecretPath?d[s.userSecretPath]:d.mfa,m=s.userPasswordPath?d[s.userPasswordPath]:d.password;if(null==f?void 0:f.enabled){if(!t.totp.verify({secret:null===(u=null==f?void 0:f.secret)||void 0===u?void 0:u.actual,encoding:"base32",token:i,window:1}))throw new Error(`Failed authentication attempt ${e} (MFA Enabled)`)}if(d.blocked)throw new Error(`Failed authentication attempt ${e} (Blocked)`);if(a(r||"")==m){const e=n,t=d;if(e){let r=!1;if(e.startsWith("@")){if(r=r||await c.canImpersonate(d,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);await c.impersonateOrg(d,e)}else{const a=await s.getUser(e);if(r=r||await c.canImpersonate(d,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);d=a}console.info(`Impersonate success. From: ${t.login} into ${e}`)}let r=l.secretKey,a=s.getSafeUser?await s.getSafeUser(d):d,i={time:Date.now(),user:a};const u=o.sign(i,r,{expiresIn:l.expiryTimeMs});return console.log(`Successful login: ${d.id}`),u}throw new Error(`Failed authentication attempt ${e}`)},e.mfaEnabled=async(e,t)=>{let r=await t.getUser(e);const a=t.userSecretPath?r[t.userSecretPath]:r.mfa;return(null==a?void 0:a.enabled)||!1},e.mfaRegister=async(e,a,o)=>new Promise((async(i,n)=>{let s=await o.getUser(a),c=o.userSecretPath?s[o.userSecretPath]:s.mfa;const l=t.generateSecret({name:`${e}: ${a}`});if(!c){c={secret:{temp:void 0,actual:void 0},enabled:!1};s[o.userSecretPath?o.userSecretPath:"mfa"]=c}c.secret.temp=l.base32,c.secret.actual=void 0,await o.putUser(s),r.toDataURL(l.otpauth_url,((e,t)=>{if(e)throw new Error("Error generating QR code");i({qr_code:t,secret:l.base32})}))})),e.mfaVerify=async(e,r,a)=>{var o,i;const n=r;let s=await a.getUser(e);const c=a.userSecretPath?s[a.userSecretPath]:s.mfa;return t.totp.verify({secret:null===(o=null==c?void 0:c.secret)||void 0===o?void 0:o.temp,encoding:"base32",token:n})?(c.secret.actual=null===(i=null==c?void 0:c.secret)||void 0===i?void 0:i.temp,c.enabled=!0,await a.putUser(s),!0):(console.log(`Failed mfa verification for ${e}`),!1)},Object.defineProperty(e,"__esModule",{value:!0})}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pico-auth",
-  "version": "0.0.22",
+  "version": "0.0.25",
   "description": "Minimal auth with user/pass, impersonation and mfa authentication",
   "main": "dist/pico-auth.umd.js",
   "types": "dist/pico-auth.d.ts",
@@ -37,7 +37,8 @@
     "build:types": "tsc -t esnext --moduleResolution node -d --emitDeclarationOnly --outFile dist/pico-auth.d.ts src/pico-auth.ts",
     "test": "env TS_NODE_PROJECT=\"tsconfig-test.json\" mocha -r ts-node/register --require source-map-support/register --recursive **/test/**/*.test.ts",
     "coverage": "nyc --reporter html --reporter text npm test",
-    "release-minor": "npm install && npm update && npm run build && npm run coverage && npm version minor && git push origin && git push origin --tags && npm publish"
+    "release-minor": "npm install && npm update && npm run build && npm run coverage && npm version minor && git push origin && git push origin --tags && npm publish",
+    "release-patch": "npm install && npm update && npm run build && npm version patch && npm publish"
   },
   "files": [
     "dist"

package/readme.MD

@@ -1,3 +1,124 @@
+# Pico Auth
 
+Pico Auth is a minimal authentication library that provides user/password authentication, multi-factor authentication (MFA), and impersonation capabilities.
 
-# Pico Auth
+## Installation
+
+```sh
+npm install pico-auth
+```
+
+## Usage
+
+### Main Methods
+
+#### `authenticate`
+
+Authenticates a user with login, password, and optionally an MFA token and impersonation entity.
+
+```ts
+import { authenticate } from 'pico-auth';
+
+const token = await authenticate(login, password, mfaToken, impersonateEntity, userProvider, impersonateProvider, jwtSpecs);
+```
+
+- `login`: The user's login.
+- `password`: The user's password.
+- `mfaToken`: The MFA token (optional).
+- `impersonateEntity`: The entity to impersonate (optional).
+- `userProvider`: An object implementing the `UserProvider` interface.
+- `impersonateProvider`: An object implementing the `ImpersonateProvider` interface.
+- `jwtSpecs`: An object containing JWT specifications.
+
+#### `mfaRegister`
+
+Prepares a user for MFA activation by generating a secret and a QR code.
+
+```ts
+import { mfaRegister } from 'pico-auth';
+
+const { qr_code, secret } = await mfaRegister(appName, login, userProvider);
+```
+
+- `appName`: The name of the application.
+- `login`: The user's login.
+- `userProvider`: An object implementing the `UserProvider` interface.
+
+#### `mfaVerify`
+
+Verifies the MFA token and fully initializes MFA for the user if the token is valid.
+
+```ts
+import { mfaVerify } from 'pico-auth';
+
+const isVerified = await mfaVerify(login, mfaToken, userProvider);
+```
+
+- `login`: The user's login.
+- `mfaToken`: The MFA token.
+- `userProvider`: An object implementing the `UserProvider` interface.
+
+#### `mfaEnabled`
+
+Checks if MFA is enabled for a user.
+
+```ts
+import { mfaEnabled } from 'pico-auth';
+
+const isEnabled = await mfaEnabled(login, userProvider);
+```
+
+- `login`: The user's login.
+- `userProvider`: An object implementing the `UserProvider` interface.
+
+### Types
+
+#### `UserProvider`
+
+An interface for user-related operations.
+
+```ts
+interface UserProvider {
+    getUser(login: string): Promise<BaseUser>;
+    putUser(user: any): Promise<any>;
+    userSecretPath?: string;
+    userPasswordPath?: string;
+}
+```
+
+#### `ImpersonateProvider`
+
+An interface for impersonation-related operations.
+
+```ts
+interface ImpersonateProvider {
+    canImpersonate(user: any, target: string): Promise<any>;
+    impersonateOrg(user: any, target: string): Promise<any>;
+}
+```
+
+#### `JWTSpecs`
+
+An interface for JWT specifications.
+
+```ts
+interface JWTSpecs {
+    secretKey: string;
+    expiryTimeMs: any;
+}
+```
+
+#### `BaseUser`
+
+An interface representing a basic user.
+
+```ts
+interface BaseUser {
+    blocked?: boolean;
+    [key: string]: any;
+}
+```
+
+## License
+
+This project is licensed under the MIT License.