pico-auth 0.0.33 → 0.0.34

package/dist/pico-auth.d.ts

@@ -24,6 +24,10 @@ declare module "core/auth" {
         blocked?: boolean;
         [key: string]: any;
     }
+    export const issueJwtToken: (user: BaseUser, userProvider: UserProvider, jwtSpecs: JWTSpecs, issueRefreshToken: boolean) => Promise<{
+        token: any;
+        clearedUser: BaseUser;
+    }>;
     /**
      * When mfaToken is provided
      */
@@ -43,6 +47,7 @@ declare module "core/auth" {
      */
     export const authenticateWithScratchCard: (cardCode: string, userProvider: UserProvider, scratchCardProvider: ScratchCardProvider, jwtSpecs: JWTSpecs, requesterLogin?: string) => Promise<{
         token: any;
+        refreshToken: any;
         user: any;
     }>;
     /**
@@ -68,6 +73,6 @@ declare module "core/auth" {
     export const mfaEnabled: (login: string, userProvider: UserProvider) => Promise<any>;
 }
 declare module "pico-auth" {
-    export { mfaRegister, mfaVerify, mfaEnabled, authenticate, authenticateWithScratchCard, refreshToken } from "core/auth";
+    export { mfaRegister, mfaVerify, mfaEnabled, authenticate, authenticateWithScratchCard, refreshToken, issueJwtToken } from "core/auth";
     export type { UserProvider, ImpersonateProvider, JWTSpecs, ScratchCardProvider, BaseUser } from "core/auth";
 }

package/dist/pico-auth.esm.js

@@ -2,6 +2,26 @@ const speakeasy = require('speakeasy');
 const qrcode = require('qrcode');
 const md5 = require("md5");
 const jwt = require('jsonwebtoken');
+const issueJwtToken = async (user, userProvider, jwtSpecs, issueRefreshToken) => {
+    let jwtSecretKey = jwtSpecs.secretKey;
+    let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(user) : user;
+    clearedUser = userProvider.getUserPostAuthenticate ? await userProvider.getUserPostAuthenticate(clearedUser) : clearedUser;
+    let data = {
+        time: Date.now(),
+        user: clearedUser
+    };
+    let token;
+    if (issueRefreshToken && jwtSpecs.refreshExpiryTimeMs) {
+        token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.refreshExpiryTimeMs });
+    }
+    else if (jwtSpecs.expiryTimeMs) {
+        token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });
+    }
+    return {
+        token,
+        clearedUser
+    };
+};
 /**
  * When mfaToken is provided
  */
@@ -66,19 +86,10 @@ const authenticate = async (login, password, mfaToken, impersonateEntity, userPr
             }
             console.info(`Impersonate success. From: ${originalUser.login} into ${target}`);
         }
-        // let jwtSecretKey = process.env.JWT_SECRET_KEY;
-        let jwtSecretKey = jwtSpecs.secretKey;
-        let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(user) : user;
-        clearedUser = userProvider.getUserPostAuthenticate ? await userProvider.getUserPostAuthenticate(clearedUser) : clearedUser;
-        let data = {
-            time: Date.now(),
-            user: clearedUser
-        };
-        // const token = jwt.sign(data, jwtSecretKey, {expiresIn: process.env.JWT_EXPIRY_TIME});
-        const token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });
+        const token = (await issueJwtToken(user, userProvider, jwtSpecs, false)).token;
         let refreshToken;
         if (jwtSpecs.refreshExpiryTimeMs)
-            refreshToken = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.refreshExpiryTimeMs });
+            refreshToken = (await issueJwtToken(user, userProvider, jwtSpecs, true)).token;
         console.log(`Successful login: ${user.id}`);
         return {
             token,
@@ -121,19 +132,15 @@ const authenticateWithScratchCard = async (cardCode, userProvider, scratchCardPr
             throw new Error(`Failed card authentication attempt ${requesterLogin} (Blocked as Target)`);
         // ok so we will use targetUser as a user that will be actually logged in
         // in impersonation scenario targetUser may be different then the user.
-        let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(targetUser) : targetUser;
-        clearedUser = userProvider.getUserPostAuthenticate ? await userProvider.getUserPostAuthenticate(clearedUser) : clearedUser;
-        let jwtSecretKey = jwtSpecs.secretKey;
-        let data = {
-            time: Date.now(),
-            user: clearedUser
-        };
-        // const token = jwt.sign(data, jwtSecretKey, {expiresIn: process.env.JWT_EXPIRY_TIME});
-        const token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });
+        const token = (await issueJwtToken(targetUser, userProvider, jwtSpecs, false)).token;
+        let refreshToken;
+        if (jwtSpecs.refreshExpiryTimeMs)
+            refreshToken = (await issueJwtToken(targetUser, userProvider, jwtSpecs, true)).token;
         console.info(`Card authentication success. Requester:${requesterLogin} Target:${targetUser.id}`);
         return {
             token,
-            user: clearedUser // just in case its impersonation so the actual resultin user will be different that the requester login user
+            refreshToken,
+            user: token.clearedUser // just in case its impersonation so the actual resulting user will be different that the requester login user
         };
     }
     catch (error) {
@@ -164,15 +171,9 @@ const refreshToken = async (login, refreshToken, userProvider, jwtSpecs) => {
         if (!refreshTokenUser || refreshTokenUser.id != user.id) {
             throw new Error(`Failed refresh token attempt ${login} (Invalid Token)`);
         }
-        let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(user) : user;
-        clearedUser = userProvider.getUserPostAuthenticate ? await userProvider.getUserPostAuthenticate(clearedUser) : clearedUser;
-        let data = {
-            time: Date.now(),
-            user: clearedUser
-        };
-        const token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });
+        const token = (await issueJwtToken(user, userProvider, jwtSpecs, false)).token;
         console.log(`Successful token refresh: ${user.id}`);
-        return { token: token };
+        return { token };
     }
     else {
         throw new Error(`Failed refresh token attempt ${login}`);
@@ -252,4 +253,4 @@ const mfaEnabled = async (login, userProvider) => {
     return (mfaInfo === null || mfaInfo === void 0 ? void 0 : mfaInfo.enabled) || false;
 };
 
-export { authenticate, authenticateWithScratchCard, mfaEnabled, mfaRegister, mfaVerify, refreshToken };
+export { authenticate, authenticateWithScratchCard, issueJwtToken, mfaEnabled, mfaRegister, mfaVerify, refreshToken };

package/dist/pico-auth.esm.min.js

@@ -1 +1 @@
-const speakeasy=require("speakeasy"),qrcode=require("qrcode"),md5=require("md5"),jwt=require("jsonwebtoken"),authenticate=async(e,t,r,a,i,s,o)=>{var n;let c=await i.getUser(e);const l=i.userSecretPath?c[i.userSecretPath]:c.mfa,d=i.userPasswordPath?c[i.userPasswordPath]:c.password;if(null==l?void 0:l.enabled){if(!speakeasy.totp.verify({secret:null===(n=null==l?void 0:l.secret)||void 0===n?void 0:n.actual,encoding:"base32",token:r,window:1}))throw new Error(`Failed authentication attempt ${e} (MFA Enabled)`)}if(c.blocked)throw new Error(`Failed authentication attempt ${e} (Blocked)`);if(md5(t||"")==d){const e=a,t=c;if(e){let r=!1;if(e.startsWith("@")){if(r=r||await s.canImpersonate(c,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);await s.impersonateOrg(c,e)}else{const a=await i.getUser(e);if(r=r||await s.canImpersonate(c,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);c=a}console.info(`Impersonate success. From: ${t.login} into ${e}`)}let r=o.secretKey,n=i.getSafeUser?await i.getSafeUser(c):c;n=i.getUserPostAuthenticate?await i.getUserPostAuthenticate(n):n;let l={time:Date.now(),user:n};const d=jwt.sign(l,r,{expiresIn:o.expiryTimeMs});let u;return o.refreshExpiryTimeMs&&(u=jwt.sign(l,r,{expiresIn:o.refreshExpiryTimeMs})),console.log(`Successful login: ${c.id}`),{token:d,refreshToken:u}}throw new Error(`Failed authentication attempt ${e}`)},authenticateWithScratchCard=async(e,t,r,a,i)=>{let s,o=i?await t.getUser(i):void 0;if(o&&o.blocked)throw new Error(`Failed card authentication attempt ${i} (Blocked)`);if(i&&!o)throw new Error(`Failed card authentication attempt ${i} (Missing user)`);try{s=await r.consume(e,o)}catch(e){throw new Error(`Failed card authentication attempt ${i} (Consume Failed)`)}try{if(!s)throw new Error(`Failed card authentication attempt ${i} (Consume Failed)`);if(s.blocked)throw new Error(`Failed card authentication attempt ${i} (Blocked as Target)`);let e=t.getSafeUser?await t.getSafeUser(s):s;e=t.getUserPostAuthenticate?await t.getUserPostAuthenticate(e):e;let r=a.secretKey,o={time:Date.now(),user:e};const n=jwt.sign(o,r,{expiresIn:a.expiryTimeMs});return console.info(`Card authentication success. Requester:${i} Target:${s.id}`),{token:n,user:e}}catch(e){throw new Error(`Failed card authentication attempt ${i}`)}},refreshToken=async(e,t,r,a)=>{let i=await r.getUser(e);if(i.blocked)throw new Error(`Failed refresh token attempt ${e} (Blocked)`);if(t){let s=a.secretKey;const o=jwt.verify(t,s).user;if(!o||o.id!=i.id)throw new Error(`Failed refresh token attempt ${e} (Invalid Token)`);let n=r.getSafeUser?await r.getSafeUser(i):i;n=r.getUserPostAuthenticate?await r.getUserPostAuthenticate(n):n;let c={time:Date.now(),user:n};const l=jwt.sign(c,s,{expiresIn:a.expiryTimeMs});return console.log(`Successful token refresh: ${i.id}`),{token:l}}throw new Error(`Failed refresh token attempt ${e}`)},mfaRegister=async(e,t,r)=>new Promise(async(a,i)=>{let s=await r.getUser(t),o=r.userSecretPath?s[r.userSecretPath]:s.mfa;const n=speakeasy.generateSecret({name:`${e}: ${t}`});if(!o){o={secret:{temp:void 0,actual:void 0},enabled:!1};s[r.userSecretPath?r.userSecretPath:"mfa"]=o}o.secret.temp=n.base32,o.secret.actual=void 0,await r.putUser(s),qrcode.toDataURL(n.otpauth_url,(e,t)=>{if(e)throw new Error("Error generating QR code");a({qr_code:t,secret:n.base32})})}),mfaVerify=async(e,t,r)=>{var a,i;const s=t;let o=await r.getUser(e);const n=r.userSecretPath?o[r.userSecretPath]:o.mfa;return speakeasy.totp.verify({secret:null===(a=null==n?void 0:n.secret)||void 0===a?void 0:a.temp,encoding:"base32",token:s})?(n.secret.actual=null===(i=null==n?void 0:n.secret)||void 0===i?void 0:i.temp,n.enabled=!0,await r.putUser(o),!0):(console.log(`Failed mfa verification for ${e}`),!1)},mfaEnabled=async(e,t)=>{let r=await t.getUser(e);const a=t.userSecretPath?r[t.userSecretPath]:r.mfa;return(null==a?void 0:a.enabled)||!1};export{authenticate,authenticateWithScratchCard,mfaEnabled,mfaRegister,mfaVerify,refreshToken};
+const speakeasy=require("speakeasy"),qrcode=require("qrcode"),md5=require("md5"),jwt=require("jsonwebtoken"),issueJwtToken=async(e,t,r,a)=>{let i=r.secretKey,o=t.getSafeUser?await t.getSafeUser(e):e;o=t.getUserPostAuthenticate?await t.getUserPostAuthenticate(o):o;let s,n={time:Date.now(),user:o};return a&&r.refreshExpiryTimeMs?s=jwt.sign(n,i,{expiresIn:r.refreshExpiryTimeMs}):r.expiryTimeMs&&(s=jwt.sign(n,i,{expiresIn:r.expiryTimeMs})),{token:s,clearedUser:o}},authenticate=async(e,t,r,a,i,o,s)=>{var n;let c=await i.getUser(e);const l=i.userSecretPath?c[i.userSecretPath]:c.mfa,d=i.userPasswordPath?c[i.userPasswordPath]:c.password;if(null==l?void 0:l.enabled){if(!speakeasy.totp.verify({secret:null===(n=null==l?void 0:l.secret)||void 0===n?void 0:n.actual,encoding:"base32",token:r,window:1}))throw new Error(`Failed authentication attempt ${e} (MFA Enabled)`)}if(c.blocked)throw new Error(`Failed authentication attempt ${e} (Blocked)`);if(md5(t||"")==d){const e=a,t=c;if(e){let r=!1;if(e.startsWith("@")){if(r=r||await o.canImpersonate(c,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);await o.impersonateOrg(c,e)}else{const a=await i.getUser(e);if(r=r||await o.canImpersonate(c,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);c=a}console.info(`Impersonate success. From: ${t.login} into ${e}`)}const r=(await issueJwtToken(c,i,s,!1)).token;let n;return s.refreshExpiryTimeMs&&(n=(await issueJwtToken(c,i,s,!0)).token),console.log(`Successful login: ${c.id}`),{token:r,refreshToken:n}}throw new Error(`Failed authentication attempt ${e}`)},authenticateWithScratchCard=async(e,t,r,a,i)=>{let o,s=i?await t.getUser(i):void 0;if(s&&s.blocked)throw new Error(`Failed card authentication attempt ${i} (Blocked)`);if(i&&!s)throw new Error(`Failed card authentication attempt ${i} (Missing user)`);try{o=await r.consume(e,s)}catch(e){throw new Error(`Failed card authentication attempt ${i} (Consume Failed)`)}try{if(!o)throw new Error(`Failed card authentication attempt ${i} (Consume Failed)`);if(o.blocked)throw new Error(`Failed card authentication attempt ${i} (Blocked as Target)`);const e=(await issueJwtToken(o,t,a,!1)).token;let r;return a.refreshExpiryTimeMs&&(r=(await issueJwtToken(o,t,a,!0)).token),console.info(`Card authentication success. Requester:${i} Target:${o.id}`),{token:e,refreshToken:r,user:e.clearedUser}}catch(e){throw new Error(`Failed card authentication attempt ${i}`)}},refreshToken=async(e,t,r,a)=>{let i=await r.getUser(e);if(i.blocked)throw new Error(`Failed refresh token attempt ${e} (Blocked)`);if(t){let o=a.secretKey;const s=jwt.verify(t,o).user;if(!s||s.id!=i.id)throw new Error(`Failed refresh token attempt ${e} (Invalid Token)`);const n=(await issueJwtToken(i,r,a,!1)).token;return console.log(`Successful token refresh: ${i.id}`),{token:n}}throw new Error(`Failed refresh token attempt ${e}`)},mfaRegister=async(e,t,r)=>new Promise(async(a,i)=>{let o=await r.getUser(t),s=r.userSecretPath?o[r.userSecretPath]:o.mfa;const n=speakeasy.generateSecret({name:`${e}: ${t}`});if(!s){s={secret:{temp:void 0,actual:void 0},enabled:!1};o[r.userSecretPath?r.userSecretPath:"mfa"]=s}s.secret.temp=n.base32,s.secret.actual=void 0,await r.putUser(o),qrcode.toDataURL(n.otpauth_url,(e,t)=>{if(e)throw new Error("Error generating QR code");a({qr_code:t,secret:n.base32})})}),mfaVerify=async(e,t,r)=>{var a,i;const o=t;let s=await r.getUser(e);const n=r.userSecretPath?s[r.userSecretPath]:s.mfa;return speakeasy.totp.verify({secret:null===(a=null==n?void 0:n.secret)||void 0===a?void 0:a.temp,encoding:"base32",token:o})?(n.secret.actual=null===(i=null==n?void 0:n.secret)||void 0===i?void 0:i.temp,n.enabled=!0,await r.putUser(s),!0):(console.log(`Failed mfa verification for ${e}`),!1)},mfaEnabled=async(e,t)=>{let r=await t.getUser(e);const a=t.userSecretPath?r[t.userSecretPath]:r.mfa;return(null==a?void 0:a.enabled)||!1};export{authenticate,authenticateWithScratchCard,issueJwtToken,mfaEnabled,mfaRegister,mfaVerify,refreshToken};

package/dist/pico-auth.umd.js

@@ -8,6 +8,26 @@
     const qrcode = require('qrcode');
     const md5 = require("md5");
     const jwt = require('jsonwebtoken');
+    const issueJwtToken = async (user, userProvider, jwtSpecs, issueRefreshToken) => {
+        let jwtSecretKey = jwtSpecs.secretKey;
+        let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(user) : user;
+        clearedUser = userProvider.getUserPostAuthenticate ? await userProvider.getUserPostAuthenticate(clearedUser) : clearedUser;
+        let data = {
+            time: Date.now(),
+            user: clearedUser
+        };
+        let token;
+        if (issueRefreshToken && jwtSpecs.refreshExpiryTimeMs) {
+            token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.refreshExpiryTimeMs });
+        }
+        else if (jwtSpecs.expiryTimeMs) {
+            token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });
+        }
+        return {
+            token,
+            clearedUser
+        };
+    };
     /**
      * When mfaToken is provided
      */
@@ -72,19 +92,10 @@
                 }
                 console.info(`Impersonate success. From: ${originalUser.login} into ${target}`);
             }
-            // let jwtSecretKey = process.env.JWT_SECRET_KEY;
-            let jwtSecretKey = jwtSpecs.secretKey;
-            let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(user) : user;
-            clearedUser = userProvider.getUserPostAuthenticate ? await userProvider.getUserPostAuthenticate(clearedUser) : clearedUser;
-            let data = {
-                time: Date.now(),
-                user: clearedUser
-            };
-            // const token = jwt.sign(data, jwtSecretKey, {expiresIn: process.env.JWT_EXPIRY_TIME});
-            const token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });
+            const token = (await issueJwtToken(user, userProvider, jwtSpecs, false)).token;
             let refreshToken;
             if (jwtSpecs.refreshExpiryTimeMs)
-                refreshToken = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.refreshExpiryTimeMs });
+                refreshToken = (await issueJwtToken(user, userProvider, jwtSpecs, true)).token;
             console.log(`Successful login: ${user.id}`);
             return {
                 token,
@@ -127,19 +138,15 @@
                 throw new Error(`Failed card authentication attempt ${requesterLogin} (Blocked as Target)`);
             // ok so we will use targetUser as a user that will be actually logged in
             // in impersonation scenario targetUser may be different then the user.
-            let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(targetUser) : targetUser;
-            clearedUser = userProvider.getUserPostAuthenticate ? await userProvider.getUserPostAuthenticate(clearedUser) : clearedUser;
-            let jwtSecretKey = jwtSpecs.secretKey;
-            let data = {
-                time: Date.now(),
-                user: clearedUser
-            };
-            // const token = jwt.sign(data, jwtSecretKey, {expiresIn: process.env.JWT_EXPIRY_TIME});
-            const token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });
+            const token = (await issueJwtToken(targetUser, userProvider, jwtSpecs, false)).token;
+            let refreshToken;
+            if (jwtSpecs.refreshExpiryTimeMs)
+                refreshToken = (await issueJwtToken(targetUser, userProvider, jwtSpecs, true)).token;
             console.info(`Card authentication success. Requester:${requesterLogin} Target:${targetUser.id}`);
             return {
                 token,
-                user: clearedUser // just in case its impersonation so the actual resultin user will be different that the requester login user
+                refreshToken,
+                user: token.clearedUser // just in case its impersonation so the actual resulting user will be different that the requester login user
             };
         }
         catch (error) {
@@ -170,15 +177,9 @@
             if (!refreshTokenUser || refreshTokenUser.id != user.id) {
                 throw new Error(`Failed refresh token attempt ${login} (Invalid Token)`);
             }
-            let clearedUser = userProvider.getSafeUser ? await userProvider.getSafeUser(user) : user;
-            clearedUser = userProvider.getUserPostAuthenticate ? await userProvider.getUserPostAuthenticate(clearedUser) : clearedUser;
-            let data = {
-                time: Date.now(),
-                user: clearedUser
-            };
-            const token = jwt.sign(data, jwtSecretKey, { expiresIn: jwtSpecs.expiryTimeMs });
+            const token = (await issueJwtToken(user, userProvider, jwtSpecs, false)).token;
             console.log(`Successful token refresh: ${user.id}`);
-            return { token: token };
+            return { token };
         }
         else {
             throw new Error(`Failed refresh token attempt ${login}`);
@@ -260,6 +261,7 @@
 
     exports.authenticate = authenticate;
     exports.authenticateWithScratchCard = authenticateWithScratchCard;
+    exports.issueJwtToken = issueJwtToken;
     exports.mfaEnabled = mfaEnabled;
     exports.mfaRegister = mfaRegister;
     exports.mfaVerify = mfaVerify;

package/dist/pico-auth.umd.min.js

@@ -1 +1 @@
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).picoAuth={})}(this,function(e){"use strict";const t=require("speakeasy"),r=require("qrcode"),a=require("md5"),i=require("jsonwebtoken");e.authenticate=async(e,r,o,n,s,c,l)=>{var d;let u=await s.getUser(e);const f=s.userSecretPath?u[s.userSecretPath]:u.mfa,h=s.userPasswordPath?u[s.userPasswordPath]:u.password;if(null==f?void 0:f.enabled){if(!t.totp.verify({secret:null===(d=null==f?void 0:f.secret)||void 0===d?void 0:d.actual,encoding:"base32",token:o,window:1}))throw new Error(`Failed authentication attempt ${e} (MFA Enabled)`)}if(u.blocked)throw new Error(`Failed authentication attempt ${e} (Blocked)`);if(a(r||"")==h){const e=n,t=u;if(e){let r=!1;if(e.startsWith("@")){if(r=r||await c.canImpersonate(u,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);await c.impersonateOrg(u,e)}else{const a=await s.getUser(e);if(r=r||await c.canImpersonate(u,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);u=a}console.info(`Impersonate success. From: ${t.login} into ${e}`)}let r=l.secretKey,a=s.getSafeUser?await s.getSafeUser(u):u;a=s.getUserPostAuthenticate?await s.getUserPostAuthenticate(a):a;let o={time:Date.now(),user:a};const d=i.sign(o,r,{expiresIn:l.expiryTimeMs});let f;return l.refreshExpiryTimeMs&&(f=i.sign(o,r,{expiresIn:l.refreshExpiryTimeMs})),console.log(`Successful login: ${u.id}`),{token:d,refreshToken:f}}throw new Error(`Failed authentication attempt ${e}`)},e.authenticateWithScratchCard=async(e,t,r,a,o)=>{let n,s=o?await t.getUser(o):void 0;if(s&&s.blocked)throw new Error(`Failed card authentication attempt ${o} (Blocked)`);if(o&&!s)throw new Error(`Failed card authentication attempt ${o} (Missing user)`);try{n=await r.consume(e,s)}catch(e){throw new Error(`Failed card authentication attempt ${o} (Consume Failed)`)}try{if(!n)throw new Error(`Failed card authentication attempt ${o} (Consume Failed)`);if(n.blocked)throw new Error(`Failed card authentication attempt ${o} (Blocked as Target)`);let e=t.getSafeUser?await t.getSafeUser(n):n;e=t.getUserPostAuthenticate?await t.getUserPostAuthenticate(e):e;let r=a.secretKey,s={time:Date.now(),user:e};const c=i.sign(s,r,{expiresIn:a.expiryTimeMs});return console.info(`Card authentication success. Requester:${o} Target:${n.id}`),{token:c,user:e}}catch(e){throw new Error(`Failed card authentication attempt ${o}`)}},e.mfaEnabled=async(e,t)=>{let r=await t.getUser(e);const a=t.userSecretPath?r[t.userSecretPath]:r.mfa;return(null==a?void 0:a.enabled)||!1},e.mfaRegister=async(e,a,i)=>new Promise(async(o,n)=>{let s=await i.getUser(a),c=i.userSecretPath?s[i.userSecretPath]:s.mfa;const l=t.generateSecret({name:`${e}: ${a}`});if(!c){c={secret:{temp:void 0,actual:void 0},enabled:!1};s[i.userSecretPath?i.userSecretPath:"mfa"]=c}c.secret.temp=l.base32,c.secret.actual=void 0,await i.putUser(s),r.toDataURL(l.otpauth_url,(e,t)=>{if(e)throw new Error("Error generating QR code");o({qr_code:t,secret:l.base32})})}),e.mfaVerify=async(e,r,a)=>{var i,o;const n=r;let s=await a.getUser(e);const c=a.userSecretPath?s[a.userSecretPath]:s.mfa;return t.totp.verify({secret:null===(i=null==c?void 0:c.secret)||void 0===i?void 0:i.temp,encoding:"base32",token:n})?(c.secret.actual=null===(o=null==c?void 0:c.secret)||void 0===o?void 0:o.temp,c.enabled=!0,await a.putUser(s),!0):(console.log(`Failed mfa verification for ${e}`),!1)},e.refreshToken=async(e,t,r,a)=>{let o=await r.getUser(e);if(o.blocked)throw new Error(`Failed refresh token attempt ${e} (Blocked)`);if(t){let n=a.secretKey;const s=i.verify(t,n).user;if(!s||s.id!=o.id)throw new Error(`Failed refresh token attempt ${e} (Invalid Token)`);let c=r.getSafeUser?await r.getSafeUser(o):o;c=r.getUserPostAuthenticate?await r.getUserPostAuthenticate(c):c;let l={time:Date.now(),user:c};const d=i.sign(l,n,{expiresIn:a.expiryTimeMs});return console.log(`Successful token refresh: ${o.id}`),{token:d}}throw new Error(`Failed refresh token attempt ${e}`)},Object.defineProperty(e,"__esModule",{value:!0})});
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).picoAuth={})}(this,function(e){"use strict";const t=require("speakeasy"),r=require("qrcode"),a=require("md5"),o=require("jsonwebtoken"),i=async(e,t,r,a)=>{let i=r.secretKey,n=t.getSafeUser?await t.getSafeUser(e):e;n=t.getUserPostAuthenticate?await t.getUserPostAuthenticate(n):n;let s,c={time:Date.now(),user:n};return a&&r.refreshExpiryTimeMs?s=o.sign(c,i,{expiresIn:r.refreshExpiryTimeMs}):r.expiryTimeMs&&(s=o.sign(c,i,{expiresIn:r.expiryTimeMs})),{token:s,clearedUser:n}};e.authenticate=async(e,r,o,n,s,c,l)=>{var d;let u=await s.getUser(e);const f=s.userSecretPath?u[s.userSecretPath]:u.mfa,h=s.userPasswordPath?u[s.userPasswordPath]:u.password;if(null==f?void 0:f.enabled){if(!t.totp.verify({secret:null===(d=null==f?void 0:f.secret)||void 0===d?void 0:d.actual,encoding:"base32",token:o,window:1}))throw new Error(`Failed authentication attempt ${e} (MFA Enabled)`)}if(u.blocked)throw new Error(`Failed authentication attempt ${e} (Blocked)`);if(a(r||"")==h){const e=n,t=u;if(e){let r=!1;if(e.startsWith("@")){if(r=r||await c.canImpersonate(u,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);await c.impersonateOrg(u,e)}else{const a=await s.getUser(e);if(r=r||await c.canImpersonate(u,e),!r)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);u=a}console.info(`Impersonate success. From: ${t.login} into ${e}`)}const r=(await i(u,s,l,!1)).token;let a;return l.refreshExpiryTimeMs&&(a=(await i(u,s,l,!0)).token),console.log(`Successful login: ${u.id}`),{token:r,refreshToken:a}}throw new Error(`Failed authentication attempt ${e}`)},e.authenticateWithScratchCard=async(e,t,r,a,o)=>{let n,s=o?await t.getUser(o):void 0;if(s&&s.blocked)throw new Error(`Failed card authentication attempt ${o} (Blocked)`);if(o&&!s)throw new Error(`Failed card authentication attempt ${o} (Missing user)`);try{n=await r.consume(e,s)}catch(e){throw new Error(`Failed card authentication attempt ${o} (Consume Failed)`)}try{if(!n)throw new Error(`Failed card authentication attempt ${o} (Consume Failed)`);if(n.blocked)throw new Error(`Failed card authentication attempt ${o} (Blocked as Target)`);const e=(await i(n,t,a,!1)).token;let r;return a.refreshExpiryTimeMs&&(r=(await i(n,t,a,!0)).token),console.info(`Card authentication success. Requester:${o} Target:${n.id}`),{token:e,refreshToken:r,user:e.clearedUser}}catch(e){throw new Error(`Failed card authentication attempt ${o}`)}},e.issueJwtToken=i,e.mfaEnabled=async(e,t)=>{let r=await t.getUser(e);const a=t.userSecretPath?r[t.userSecretPath]:r.mfa;return(null==a?void 0:a.enabled)||!1},e.mfaRegister=async(e,a,o)=>new Promise(async(i,n)=>{let s=await o.getUser(a),c=o.userSecretPath?s[o.userSecretPath]:s.mfa;const l=t.generateSecret({name:`${e}: ${a}`});if(!c){c={secret:{temp:void 0,actual:void 0},enabled:!1};s[o.userSecretPath?o.userSecretPath:"mfa"]=c}c.secret.temp=l.base32,c.secret.actual=void 0,await o.putUser(s),r.toDataURL(l.otpauth_url,(e,t)=>{if(e)throw new Error("Error generating QR code");i({qr_code:t,secret:l.base32})})}),e.mfaVerify=async(e,r,a)=>{var o,i;const n=r;let s=await a.getUser(e);const c=a.userSecretPath?s[a.userSecretPath]:s.mfa;return t.totp.verify({secret:null===(o=null==c?void 0:c.secret)||void 0===o?void 0:o.temp,encoding:"base32",token:n})?(c.secret.actual=null===(i=null==c?void 0:c.secret)||void 0===i?void 0:i.temp,c.enabled=!0,await a.putUser(s),!0):(console.log(`Failed mfa verification for ${e}`),!1)},e.refreshToken=async(e,t,r,a)=>{let n=await r.getUser(e);if(n.blocked)throw new Error(`Failed refresh token attempt ${e} (Blocked)`);if(t){let s=a.secretKey;const c=o.verify(t,s).user;if(!c||c.id!=n.id)throw new Error(`Failed refresh token attempt ${e} (Invalid Token)`);const l=(await i(n,r,a,!1)).token;return console.log(`Successful token refresh: ${n.id}`),{token:l}}throw new Error(`Failed refresh token attempt ${e}`)},Object.defineProperty(e,"__esModule",{value:!0})});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pico-auth",
-  "version": "0.0.33",
+  "version": "0.0.34",
   "description": "Minimal auth with user/pass, impersonation and mfa authentication",
   "main": "dist/pico-auth.umd.js",
   "types": "dist/pico-auth.d.ts",

package/readme.MD

@@ -87,6 +87,21 @@ const isEnabled = await mfaEnabled(login, userProvider);
 - `login`: The user's login.
 - `userProvider`: An object implementing the `UserProvider` interface.
 
+#### `issueJwtToken`
+
+Issues JWT token (access-token or refresh-token) for given user under provided specs.
+```ts
+import { issueJwtToken } from 'pico-auth';
+
+const token = await issueJwtToken(user, userProvider, jwtSpecs, issueRefreshToken);
+```
+
+- `user`: The user object.
+- `userProvider`: An object implementing the `UserProvider` interface.
+- `jwtSpecs`: An object containing JWT specifications.
+- `issueRefreshToken`: Boolean value that controls wheter returned token should be created using base specs (false) or refresh specs (true). 
+- `token`: An returned object containing short lived `token` or long lived `refreshToken`
+
 ### Types
 
 #### `UserProvider`