quidproquo-webserver 0.1.7 → 0.1.8

package/lib/commonjs/actions/dns/DnsListActionTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"DnsListActionTypes.js","sourceRoot":"","sources":["../../../../src/actions/dns/DnsListActionTypes.ts"],"names":[],"mappings":"","sourcesContent":["import { Action, ActionProcessor, ActionRequester, ContextListAction, QpqContext } from 'quidproquo-core';\n\nimport { DnsActionType } from './DnsActionType';\n\n// Payload\nexport interface DnsListActionPayload {}\n\n// Action\nexport interface DnsListAction extends Action<DnsListActionPayload> {\n  type: DnsActionType.List;\n}\n\n// Function Types\nexport type DnsListActionProcessor = ActionProcessor<DnsListAction, string[]>;\nexport type DnsListActionRequester = ActionRequester<DnsListAction, string[]>;\n"]}
+{"version":3,"file":"DnsListActionTypes.js","sourceRoot":"","sources":["../../../../src/actions/dns/DnsListActionTypes.ts"],"names":[],"mappings":"","sourcesContent":["import { Action, ActionProcessor, ActionRequester } from 'quidproquo-core';\n\nimport { DnsActionType } from './DnsActionType';\n\n// Payload\nexport interface DnsListActionPayload {}\n\n// Action\nexport interface DnsListAction extends Action<DnsListActionPayload> {\n  type: DnsActionType.List;\n}\n\n// Function Types\nexport type DnsListActionProcessor = ActionProcessor<DnsListAction, string[]>;\nexport type DnsListActionRequester = ActionRequester<DnsListAction, string[]>;\n"]}

package/lib/commonjs/actions/index.d.ts

@@ -4,7 +4,6 @@ export * from './dns';
 export * from './genericDataResource';
 export * from './openApiSpec';
 export * from './routeAuthValidation';
-export * from './service';
 export * from './serviceFunction';
 export * from './webEntry';
 export * from './websocket';

package/lib/commonjs/actions/index.js

@@ -20,7 +20,6 @@ __exportStar(require("./dns"), exports);
 __exportStar(require("./genericDataResource"), exports);
 __exportStar(require("./openApiSpec"), exports);
 __exportStar(require("./routeAuthValidation"), exports);
-__exportStar(require("./service"), exports);
 __exportStar(require("./serviceFunction"), exports);
 __exportStar(require("./webEntry"), exports);
 __exportStar(require("./websocket"), exports);

package/lib/commonjs/actions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/actions/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,qDAAmC;AACnC,wCAAsB;AACtB,wDAAsC;AACtC,gDAA8B;AAC9B,wDAAsC;AACtC,4CAA0B;AAC1B,oDAAkC;AAClC,6CAA2B;AAC3B,8CAA4B","sourcesContent":["export * from './admin';\nexport * from './apiKeyValidation';\nexport * from './dns';\nexport * from './genericDataResource';\nexport * from './openApiSpec';\nexport * from './routeAuthValidation';\nexport * from './service';\nexport * from './serviceFunction';\nexport * from './webEntry';\nexport * from './websocket';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/actions/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,qDAAmC;AACnC,wCAAsB;AACtB,wDAAsC;AACtC,gDAA8B;AAC9B,wDAAsC;AACtC,oDAAkC;AAClC,6CAA2B;AAC3B,8CAA4B","sourcesContent":["export * from './admin';\nexport * from './apiKeyValidation';\nexport * from './dns';\nexport * from './genericDataResource';\nexport * from './openApiSpec';\nexport * from './routeAuthValidation';\nexport * from './serviceFunction';\nexport * from './webEntry';\nexport * from './websocket';\n"]}

package/lib/commonjs/config/settings/index.d.ts

@@ -13,9 +13,7 @@ export * from './route';
 export * from './seed';
 export * from './seo';
 export * from './serviceFunction';
-export * from './stateDispatchOverWebsockets';
 export * from './storageDriveCorsSettings';
 export * from './subdomainRedirect';
 export * from './webEntry';
 export * from './websocket';
-export * from './webSocketQueue';

package/lib/commonjs/config/settings/index.js

@@ -29,10 +29,8 @@ __exportStar(require("./route"), exports);
 __exportStar(require("./seed"), exports);
 __exportStar(require("./seo"), exports);
 __exportStar(require("./serviceFunction"), exports);
-__exportStar(require("./stateDispatchOverWebsockets"), exports);
 __exportStar(require("./storageDriveCorsSettings"), exports);
 __exportStar(require("./subdomainRedirect"), exports);
 __exportStar(require("./webEntry"), exports);
 __exportStar(require("./websocket"), exports);
-__exportStar(require("./webSocketQueue"), exports);
 //# sourceMappingURL=index.js.map

package/lib/commonjs/config/settings/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/config/settings/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wCAAsB;AACtB,2CAAyB;AACzB,0CAAwB;AACxB,gDAA8B;AAC9B,wDAAsC;AACtC,qDAAmC;AACnC,wCAAsB;AACtB,gDAA8B;AAC9B,uDAAqC;AACrC,8CAA4B;AAC5B,4CAA0B;AAC1B,0CAAwB;AACxB,yCAAuB;AACvB,wCAAsB;AACtB,oDAAkC;AAClC,gEAA8C;AAC9C,6DAA2C;AAC3C,sDAAoC;AACpC,6CAA2B;AAC3B,8CAA4B;AAC5B,mDAAiC","sourcesContent":["export * from './api';\nexport * from './apiKey';\nexport * from './cache';\nexport * from './certificate';\nexport * from './defaultRouteOptions';\nexport * from './defineAuthSystem';\nexport * from './dns';\nexport * from './domainProxy';\nexport * from './fileUploadSettings';\nexport * from './migration';\nexport * from './openApi';\nexport * from './route';\nexport * from './seed';\nexport * from './seo';\nexport * from './serviceFunction';\nexport * from './stateDispatchOverWebsockets';\nexport * from './storageDriveCorsSettings';\nexport * from './subdomainRedirect';\nexport * from './webEntry';\nexport * from './websocket';\nexport * from './webSocketQueue';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/config/settings/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wCAAsB;AACtB,2CAAyB;AACzB,0CAAwB;AACxB,gDAA8B;AAC9B,wDAAsC;AACtC,qDAAmC;AACnC,wCAAsB;AACtB,gDAA8B;AAC9B,uDAAqC;AACrC,8CAA4B;AAC5B,4CAA0B;AAC1B,0CAAwB;AACxB,yCAAuB;AACvB,wCAAsB;AACtB,oDAAkC;AAClC,6DAA2C;AAC3C,sDAAoC;AACpC,6CAA2B;AAC3B,8CAA4B","sourcesContent":["export * from './api';\nexport * from './apiKey';\nexport * from './cache';\nexport * from './certificate';\nexport * from './defaultRouteOptions';\nexport * from './defineAuthSystem';\nexport * from './dns';\nexport * from './domainProxy';\nexport * from './fileUploadSettings';\nexport * from './migration';\nexport * from './openApi';\nexport * from './route';\nexport * from './seed';\nexport * from './seo';\nexport * from './serviceFunction';\nexport * from './storageDriveCorsSettings';\nexport * from './subdomainRedirect';\nexport * from './webEntry';\nexport * from './websocket';\n"]}

package/lib/commonjs/index.d.ts

@@ -1,7 +1,6 @@
 export * from './actionProcessor';
 export * from './actions';
 export * from './config';
-export * from './context';
 export * from './qpqWebServerUtils';
 export * from './services';
 export * from './stories';

package/lib/commonjs/index.js

@@ -17,7 +17,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./actionProcessor"), exports);
 __exportStar(require("./actions"), exports);
 __exportStar(require("./config"), exports);
-__exportStar(require("./context"), exports);
 __exportStar(require("./qpqWebServerUtils"), exports);
 __exportStar(require("./services"), exports);
 __exportStar(require("./stories"), exports);

package/lib/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,4CAA0B;AAC1B,2CAAyB;AACzB,4CAA0B;AAC1B,sDAAoC;AACpC,6CAA2B;AAC3B,4CAA0B;AAC1B,0CAAwB;AACxB,0CAAwB","sourcesContent":["export * from './actionProcessor';\nexport * from './actions';\nexport * from './config';\nexport * from './context';\nexport * from './qpqWebServerUtils';\nexport * from './services';\nexport * from './stories';\nexport * from './types';\nexport * from './utils';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,4CAA0B;AAC1B,2CAAyB;AACzB,sDAAoC;AACpC,6CAA2B;AAC3B,4CAA0B;AAC1B,0CAAwB;AACxB,0CAAwB","sourcesContent":["export * from './actionProcessor';\nexport * from './actions';\nexport * from './config';\nexport * from './qpqWebServerUtils';\nexport * from './services';\nexport * from './stories';\nexport * from './types';\nexport * from './utils';\n"]}

package/lib/commonjs/services/auth/entry/controller/authController.js

@@ -12,10 +12,23 @@ const quidproquo_core_1 = require("quidproquo-core");
 const index_1 = require("../../../../index");
 const logic_1 = require("../../logic");
 const types_1 = require("../../types");
+// Field-presence validator for askFromValidJsonEventRequest. The payload types
+// are just casts over whatever json the client sent, so each handler checks its
+// required fields are real non-empty strings before anything touches the user
+// directory. A miss comes back as a 422 Invalid instead of a downstream error.
+const requireStringFields = (...fields) => (data) => {
+    const record = (data !== null && data !== void 0 ? data : {});
+    const missing = fields.filter((field) => typeof record[field] !== 'string' || record[field] === '');
+    if (missing.length > 0) {
+        throw new Error(`Missing or invalid fields: ${missing.join(', ')}`);
+    }
+    return data;
+};
 // Maps the wire payload (discriminated by `challenge`) onto the core auth
 // challenge shape. The type guards narrow `payload`, so no manual casts are
-// needed. Add a branch here as new challenge types are supported.
-const challengePayloadToAuthChallenge = (payload) => {
+// needed. Add a branch here as new challenge types are supported. An unknown
+// or malformed challenge is a client error, so it surfaces as a 400.
+function* askChallengePayloadToAuthChallenge(payload) {
     if ((0, types_1.isNewPasswordChallengePayload)(payload)) {
         return {
             challenge: quidproquo_core_1.AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,
@@ -40,42 +53,47 @@ const challengePayloadToAuthChallenge = (payload) => {
             mfaCode: payload.mfaCode,
         };
     }
-    throw new Error(`Unsupported auth challenge: ${payload.challenge}`);
-};
+    return yield* (0, quidproquo_core_1.askThrowError)(quidproquo_core_1.ErrorTypeEnum.BadRequest, `Unsupported or malformed auth challenge: ${payload.challenge}`);
+}
 function* login(event) {
-    const { username, password } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { username, password } = yield* index_1.qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('username', 'password'));
     const authResponse = yield* logic_1.authLogic.askLogin(username, password);
     return index_1.qpqWebServerUtils.toJsonEventResponse(authResponse);
 }
 function* refreshToken(event) {
-    const { refreshToken } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { refreshToken } = yield* index_1.qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('refreshToken'));
     const refreshResponse = yield* logic_1.authLogic.askRefreshToken(refreshToken);
     return index_1.qpqWebServerUtils.toJsonEventResponse(refreshResponse);
 }
 function* respondToAuthChallenge(event) {
-    const payload = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
-    const response = yield* logic_1.authLogic.askRespondToAuthChallenge(challengePayloadToAuthChallenge(payload));
+    const payload = yield* index_1.qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('email', 'session', 'challenge'));
+    const authChallenge = yield* askChallengePayloadToAuthChallenge(payload);
+    const response = yield* logic_1.authLogic.askRespondToAuthChallenge(authChallenge);
     return index_1.qpqWebServerUtils.toJsonEventResponse(response);
 }
 function* associateSoftwareToken(event) {
-    const { session } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { session } = yield* index_1.qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('session'));
     const response = yield* logic_1.authLogic.askAssociateSoftwareToken(session);
     return index_1.qpqWebServerUtils.toJsonEventResponse(response);
 }
 function* forgotPassword(event) {
-    const { username } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { username } = yield* index_1.qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('username'));
     const deliveryDetails = yield* logic_1.authLogic.askForgotPassword(username);
     return index_1.qpqWebServerUtils.toJsonEventResponse(deliveryDetails);
 }
 function* confirmForgotPassword(event) {
-    const { username, code, password } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { username, code, password } = yield* index_1.qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('username', 'code', 'password'));
     const response = yield* logic_1.authLogic.askConfirmForgotPassword(username, code, password);
     return index_1.qpqWebServerUtils.toJsonEventResponse(response);
 }
 function* changePassword(event) {
-    const { oldPassword, newPassword } = yield* index_1.qpqWebServerUtils.askFromJsonEventRequest(event);
-    // The route is authenticated, so the access token is present on the request.
-    const accessToken = index_1.qpqWebServerUtils.getAccessTokenFromHeaders(event.headers) || '';
+    const { oldPassword, newPassword } = yield* index_1.qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('oldPassword', 'newPassword'));
+    // The route is authenticated, so the access token should always be present.
+    // Guard anyway so a misconfigured route fails as a 401, not a directory error.
+    const accessToken = index_1.qpqWebServerUtils.getAccessTokenFromHeaders(event.headers);
+    if (!accessToken) {
+        return yield* (0, quidproquo_core_1.askThrowError)(quidproquo_core_1.ErrorTypeEnum.Unauthorized, 'Missing access token.');
+    }
     yield* logic_1.authLogic.askChangePassword(oldPassword, newPassword, accessToken);
     return index_1.qpqWebServerUtils.toJsonEventResponse({ success: true });
 }

package/lib/commonjs/services/auth/entry/controller/authController.js.map

@@ -1 +1 @@
-{"version":3,"file":"authController.js","sourceRoot":"","sources":["../../../../../../src/services/auth/entry/controller/authController.ts"],"names":[],"mappings":";;AAqDA,sBAMC;AAED,oCAMC;AAED,wDAMC;AAED,wDAMC;AAED,wCAMC;AAED,sDAMC;AAED,wCASC;AA9GD,qDAA2F;AAE3F,+CAA+C;AAC/C,6CAAsD;AAEtD,uCAAwC;AACxC,uCAWqB;AAErB,0EAA0E;AAC1E,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,+BAA+B,GAAG,CAAC,OAA4B,EAAoB,EAAE;IACzF,IAAI,IAAA,qCAA6B,EAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,2CAAyB,CAAC,qBAAqB;YAC1D,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,6BAAqB,EAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,SAAS,EAAE,2CAAyB,CAAC,kBAAkB;YACvD,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAA0B,EAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,SAAS,EAAE,2CAAyB,CAAC,SAAS;YAC9C,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,+BAAgC,OAA+B,CAAC,SAAS,EAAE,CAAC,CAAC;AAC/F,CAAC,CAAC;AAEF,QAAe,CAAC,CAAC,KAAK,CAAC,KAAgB;IACrC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,uBAAuB,CAAe,KAAK,CAAC,CAAC;IAErG,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEnE,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;AAC7D,CAAC;AAED,QAAe,CAAC,CAAC,YAAY,CAAC,KAAgB;IAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,uBAAuB,CAAiB,KAAK,CAAC,CAAC;IAEjG,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAEvE,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,QAAe,CAAC,CAAC,sBAAsB,CAAC,KAAgB;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,uBAAuB,CAAsB,KAAK,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,yBAAyB,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtG,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,QAAe,CAAC,CAAC,sBAAsB,CAAC,KAAgB;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,uBAAuB,CAAgC,KAAK,CAAC,CAAC;IAE3G,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAErE,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,QAAe,CAAC,CAAC,cAAc,CAAC,KAAgB;IAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,uBAAuB,CAAwB,KAAK,CAAC,CAAC;IAEpG,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,QAAe,CAAC,CAAC,qBAAqB,CAAC,KAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,uBAAuB,CAA+B,KAAK,CAAC,CAAC;IAE3H,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAErF,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,QAAe,CAAC,CAAC,cAAc,CAAC,KAAgB;IAC9C,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,uBAAuB,CAAwB,KAAK,CAAC,CAAC;IAEpH,6EAA6E;IAC7E,MAAM,WAAW,GAAG,yBAAiB,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAErF,KAAK,CAAC,CAAC,iBAAS,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAE1E,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import { AnyAuthChallenge, AskResponse, AuthenticateUserChallenge } from 'quidproquo-core';\n\n// TODO: Fix this import (name it up the chain)\nimport { qpqWebServerUtils } from '../../../../index';\nimport { HTTPEvent, HTTPEventResponse } from '../../../../types';\nimport { authLogic } from '../../logic';\nimport {\n  AnyChallengePayload,\n  AssociateSoftwareTokenPayload,\n  ChangePasswordPayload,\n  ConfirmForgotPasswordPayload,\n  ForgotPasswordPayload,\n  isMfaChallengePayload,\n  isMfaSetupChallengePayload,\n  isNewPasswordChallengePayload,\n  LoginPayload,\n  RefreshPayload,\n} from '../../types';\n\n// Maps the wire payload (discriminated by `challenge`) onto the core auth\n// challenge shape. The type guards narrow `payload`, so no manual casts are\n// needed. Add a branch here as new challenge types are supported.\nconst challengePayloadToAuthChallenge = (payload: AnyChallengePayload): AnyAuthChallenge => {\n  if (isNewPasswordChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,\n      username: payload.email,\n      session: payload.session,\n      newPassword: payload.newPassword,\n    };\n  }\n\n  if (isMfaChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA,\n      username: payload.email,\n      session: payload.session,\n      mfaCode: payload.mfaCode,\n    };\n  }\n\n  if (isMfaSetupChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.MFA_SETUP,\n      username: payload.email,\n      session: payload.session,\n      mfaCode: payload.mfaCode,\n    };\n  }\n\n  throw new Error(`Unsupported auth challenge: ${(payload as AnyChallengePayload).challenge}`);\n};\n\nexport function* login(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username, password } = yield* qpqWebServerUtils.askFromJsonEventRequest<LoginPayload>(event);\n\n  const authResponse = yield* authLogic.askLogin(username, password);\n\n  return qpqWebServerUtils.toJsonEventResponse(authResponse);\n}\n\nexport function* refreshToken(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { refreshToken } = yield* qpqWebServerUtils.askFromJsonEventRequest<RefreshPayload>(event);\n\n  const refreshResponse = yield* authLogic.askRefreshToken(refreshToken);\n\n  return qpqWebServerUtils.toJsonEventResponse(refreshResponse);\n}\n\nexport function* respondToAuthChallenge(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const payload = yield* qpqWebServerUtils.askFromJsonEventRequest<AnyChallengePayload>(event);\n\n  const response = yield* authLogic.askRespondToAuthChallenge(challengePayloadToAuthChallenge(payload));\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* associateSoftwareToken(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { session } = yield* qpqWebServerUtils.askFromJsonEventRequest<AssociateSoftwareTokenPayload>(event);\n\n  const response = yield* authLogic.askAssociateSoftwareToken(session);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* forgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username } = yield* qpqWebServerUtils.askFromJsonEventRequest<ForgotPasswordPayload>(event);\n\n  const deliveryDetails = yield* authLogic.askForgotPassword(username);\n\n  return qpqWebServerUtils.toJsonEventResponse(deliveryDetails);\n}\n\nexport function* confirmForgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username, code, password } = yield* qpqWebServerUtils.askFromJsonEventRequest<ConfirmForgotPasswordPayload>(event);\n\n  const response = yield* authLogic.askConfirmForgotPassword(username, code, password);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* changePassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { oldPassword, newPassword } = yield* qpqWebServerUtils.askFromJsonEventRequest<ChangePasswordPayload>(event);\n\n  // The route is authenticated, so the access token is present on the request.\n  const accessToken = qpqWebServerUtils.getAccessTokenFromHeaders(event.headers) || '';\n\n  yield* authLogic.askChangePassword(oldPassword, newPassword, accessToken);\n\n  return qpqWebServerUtils.toJsonEventResponse({ success: true });\n}\n"]}
+{"version":3,"file":"authController.js","sourceRoot":"","sources":["../../../../../../src/services/auth/entry/controller/authController.ts"],"names":[],"mappings":";;AAwEA,sBASC;AAED,oCAMC;AAED,wDAWC;AAED,wDAMC;AAED,wCAMC;AAED,sDASC;AAED,wCAgBC;AAnJD,qDAAyH;AAEzH,+CAA+C;AAC/C,6CAAsD;AAEtD,uCAAwC;AACxC,uCAYqB;AAErB,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,mBAAmB,GACvB,CAAI,GAAG,MAAgB,EAAE,EAAE,CAC3B,CAAC,IAAa,EAAK,EAAE;IACnB,MAAM,MAAM,GAAG,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAA4B,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAEpG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,IAAS,CAAC;AACnB,CAAC,CAAC;AAEJ,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,qEAAqE;AACrE,QAAQ,CAAC,CAAC,kCAAkC,CAAC,OAA4B;IACvE,IAAI,IAAA,qCAA6B,EAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,2CAAyB,CAAC,qBAAqB;YAC1D,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,6BAAqB,EAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,SAAS,EAAE,2CAAyB,CAAC,kBAAkB;YACvD,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAA0B,EAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,SAAS,EAAE,2CAAyB,CAAC,SAAS;YAC9C,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,IAAA,+BAAa,EAAC,+BAAa,CAAC,UAAU,EAAE,4CAA6C,OAA4B,CAAC,SAAS,EAAE,CAAC,CAAC;AAC/I,CAAC;AAED,QAAe,CAAC,CAAC,KAAK,CAAC,KAAgB;IACrC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,4BAA4B,CAClF,KAAK,EACL,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAC5C,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEnE,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;AAC7D,CAAC;AAED,QAAe,CAAC,CAAC,YAAY,CAAC,KAAgB;IAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,4BAA4B,CAAiB,KAAK,EAAE,mBAAmB,CAAC,cAAc,CAAC,CAAC,CAAC;IAE3I,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAEvE,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,QAAe,CAAC,CAAC,sBAAsB,CAAC,KAAgB;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,4BAA4B,CACnE,KAAK,EACL,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CACrD,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAE3E,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,QAAe,CAAC,CAAC,sBAAsB,CAAC,KAAgB;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,4BAA4B,CAAgC,KAAK,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhJ,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAErE,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,QAAe,CAAC,CAAC,cAAc,CAAC,KAAgB;IAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,4BAA4B,CAAwB,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;IAE1I,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,QAAe,CAAC,CAAC,qBAAqB,CAAC,KAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,4BAA4B,CACxF,KAAK,EACL,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CACpD,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAS,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAErF,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,QAAe,CAAC,CAAC,cAAc,CAAC,KAAgB;IAC9C,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAiB,CAAC,4BAA4B,CACxF,KAAK,EACL,mBAAmB,CAAC,aAAa,EAAE,aAAa,CAAC,CAClD,CAAC;IAEF,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,WAAW,GAAG,yBAAiB,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,CAAC,IAAA,+BAAa,EAAC,+BAAa,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,CAAC,iBAAS,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAE1E,OAAO,yBAAiB,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import { AnyAuthChallenge, AskResponse, askThrowError, AuthenticateUserChallenge, ErrorTypeEnum } from 'quidproquo-core';\n\n// TODO: Fix this import (name it up the chain)\nimport { qpqWebServerUtils } from '../../../../index';\nimport { HTTPEvent, HTTPEventResponse } from '../../../../types';\nimport { authLogic } from '../../logic';\nimport {\n  AnyChallengePayload,\n  AssociateSoftwareTokenPayload,\n  ChallengePayload,\n  ChangePasswordPayload,\n  ConfirmForgotPasswordPayload,\n  ForgotPasswordPayload,\n  isMfaChallengePayload,\n  isMfaSetupChallengePayload,\n  isNewPasswordChallengePayload,\n  LoginPayload,\n  RefreshPayload,\n} from '../../types';\n\n// Field-presence validator for askFromValidJsonEventRequest. The payload types\n// are just casts over whatever json the client sent, so each handler checks its\n// required fields are real non-empty strings before anything touches the user\n// directory. A miss comes back as a 422 Invalid instead of a downstream error.\nconst requireStringFields =\n  <T>(...fields: string[]) =>\n  (data: unknown): T => {\n    const record = (data ?? {}) as Record<string, unknown>;\n    const missing = fields.filter((field) => typeof record[field] !== 'string' || record[field] === '');\n\n    if (missing.length > 0) {\n      throw new Error(`Missing or invalid fields: ${missing.join(', ')}`);\n    }\n\n    return data as T;\n  };\n\n// Maps the wire payload (discriminated by `challenge`) onto the core auth\n// challenge shape. The type guards narrow `payload`, so no manual casts are\n// needed. Add a branch here as new challenge types are supported. An unknown\n// or malformed challenge is a client error, so it surfaces as a 400.\nfunction* askChallengePayloadToAuthChallenge(payload: AnyChallengePayload): AskResponse<AnyAuthChallenge> {\n  if (isNewPasswordChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,\n      username: payload.email,\n      session: payload.session,\n      newPassword: payload.newPassword,\n    };\n  }\n\n  if (isMfaChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA,\n      username: payload.email,\n      session: payload.session,\n      mfaCode: payload.mfaCode,\n    };\n  }\n\n  if (isMfaSetupChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.MFA_SETUP,\n      username: payload.email,\n      session: payload.session,\n      mfaCode: payload.mfaCode,\n    };\n  }\n\n  return yield* askThrowError(ErrorTypeEnum.BadRequest, `Unsupported or malformed auth challenge: ${(payload as ChallengePayload).challenge}`);\n}\n\nexport function* login(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username, password } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<LoginPayload>(\n    event,\n    requireStringFields('username', 'password'),\n  );\n\n  const authResponse = yield* authLogic.askLogin(username, password);\n\n  return qpqWebServerUtils.toJsonEventResponse(authResponse);\n}\n\nexport function* refreshToken(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { refreshToken } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<RefreshPayload>(event, requireStringFields('refreshToken'));\n\n  const refreshResponse = yield* authLogic.askRefreshToken(refreshToken);\n\n  return qpqWebServerUtils.toJsonEventResponse(refreshResponse);\n}\n\nexport function* respondToAuthChallenge(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const payload = yield* qpqWebServerUtils.askFromValidJsonEventRequest<AnyChallengePayload>(\n    event,\n    requireStringFields('email', 'session', 'challenge'),\n  );\n\n  const authChallenge = yield* askChallengePayloadToAuthChallenge(payload);\n\n  const response = yield* authLogic.askRespondToAuthChallenge(authChallenge);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* associateSoftwareToken(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { session } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<AssociateSoftwareTokenPayload>(event, requireStringFields('session'));\n\n  const response = yield* authLogic.askAssociateSoftwareToken(session);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* forgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<ForgotPasswordPayload>(event, requireStringFields('username'));\n\n  const deliveryDetails = yield* authLogic.askForgotPassword(username);\n\n  return qpqWebServerUtils.toJsonEventResponse(deliveryDetails);\n}\n\nexport function* confirmForgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username, code, password } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<ConfirmForgotPasswordPayload>(\n    event,\n    requireStringFields('username', 'code', 'password'),\n  );\n\n  const response = yield* authLogic.askConfirmForgotPassword(username, code, password);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* changePassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { oldPassword, newPassword } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<ChangePasswordPayload>(\n    event,\n    requireStringFields('oldPassword', 'newPassword'),\n  );\n\n  // The route is authenticated, so the access token should always be present.\n  // Guard anyway so a misconfigured route fails as a 401, not a directory error.\n  const accessToken = qpqWebServerUtils.getAccessTokenFromHeaders(event.headers);\n  if (!accessToken) {\n    return yield* askThrowError(ErrorTypeEnum.Unauthorized, 'Missing access token.');\n  }\n\n  yield* authLogic.askChangePassword(oldPassword, newPassword, accessToken);\n\n  return qpqWebServerUtils.toJsonEventResponse({ success: true });\n}\n"]}

package/lib/commonjs/services/auth/types/challengePayloadGuards.js

@@ -2,10 +2,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isMfaSetupChallengePayload = exports.isMfaChallengePayload = exports.isNewPasswordChallengePayload = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
-const isNewPasswordChallengePayload = (payload) => payload.challenge === quidproquo_core_1.AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED;
+// These payloads come straight off the wire, so a guard cannot trust the type
+// it is narrowing to. Each one checks the discriminant AND that the extra
+// credential field is a real non-empty string, otherwise the guard would let
+// `undefined` credentials through to the user directory.
+const isNonEmptyString = (value) => typeof value === 'string' && value !== '';
+const isNewPasswordChallengePayload = (payload) => payload.challenge === quidproquo_core_1.AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED && isNonEmptyString(payload.newPassword);
 exports.isNewPasswordChallengePayload = isNewPasswordChallengePayload;
-const isMfaChallengePayload = (payload) => payload.challenge === quidproquo_core_1.AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA;
+const isMfaChallengePayload = (payload) => payload.challenge === quidproquo_core_1.AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA && isNonEmptyString(payload.mfaCode);
 exports.isMfaChallengePayload = isMfaChallengePayload;
-const isMfaSetupChallengePayload = (payload) => payload.challenge === quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP;
+const isMfaSetupChallengePayload = (payload) => payload.challenge === quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP && isNonEmptyString(payload.mfaCode);
 exports.isMfaSetupChallengePayload = isMfaSetupChallengePayload;
 //# sourceMappingURL=challengePayloadGuards.js.map

package/lib/commonjs/services/auth/types/challengePayloadGuards.js.map

@@ -1 +1 @@
-{"version":3,"file":"challengePayloadGuards.js","sourceRoot":"","sources":["../../../../../src/services/auth/types/challengePayloadGuards.ts"],"names":[],"mappings":";;;AAAA,qDAA4D;AAIrD,MAAM,6BAA6B,GAAG,CAAC,OAA4B,EAA0C,EAAE,CACpH,OAAO,CAAC,SAAS,KAAK,2CAAyB,CAAC,qBAAqB,CAAC;AAD3D,QAAA,6BAA6B,iCAC8B;AAEjE,MAAM,qBAAqB,GAAG,CAAC,OAA4B,EAAkC,EAAE,CACpG,OAAO,CAAC,SAAS,KAAK,2CAAyB,CAAC,kBAAkB,CAAC;AADxD,QAAA,qBAAqB,yBACmC;AAE9D,MAAM,0BAA0B,GAAG,CAAC,OAA4B,EAAuC,EAAE,CAC9G,OAAO,CAAC,SAAS,KAAK,2CAAyB,CAAC,SAAS,CAAC;AAD/C,QAAA,0BAA0B,8BACqB","sourcesContent":["import { AuthenticateUserChallenge } from 'quidproquo-core';\n\nimport { AnyChallengePayload, MfaChallengePayload, MfaSetupChallengePayload, NewPasswordChallengePayload } from './types';\n\nexport const isNewPasswordChallengePayload = (payload: AnyChallengePayload): payload is NewPasswordChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED;\n\nexport const isMfaChallengePayload = (payload: AnyChallengePayload): payload is MfaChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA;\n\nexport const isMfaSetupChallengePayload = (payload: AnyChallengePayload): payload is MfaSetupChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.MFA_SETUP;\n"]}
+{"version":3,"file":"challengePayloadGuards.js","sourceRoot":"","sources":["../../../../../src/services/auth/types/challengePayloadGuards.ts"],"names":[],"mappings":";;;AAAA,qDAA4D;AAI5D,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,yDAAyD;AAEzD,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC;AAEjG,MAAM,6BAA6B,GAAG,CAAC,OAA4B,EAA0C,EAAE,CACpH,OAAO,CAAC,SAAS,KAAK,2CAAyB,CAAC,qBAAqB,IAAI,gBAAgB,CAAE,OAAuC,CAAC,WAAW,CAAC,CAAC;AADrI,QAAA,6BAA6B,iCACwG;AAE3I,MAAM,qBAAqB,GAAG,CAAC,OAA4B,EAAkC,EAAE,CACpG,OAAO,CAAC,SAAS,KAAK,2CAAyB,CAAC,kBAAkB,IAAI,gBAAgB,CAAE,OAA+B,CAAC,OAAO,CAAC,CAAC;AADtH,QAAA,qBAAqB,yBACiG;AAE5H,MAAM,0BAA0B,GAAG,CAAC,OAA4B,EAAuC,EAAE,CAC9G,OAAO,CAAC,SAAS,KAAK,2CAAyB,CAAC,SAAS,IAAI,gBAAgB,CAAE,OAAoC,CAAC,OAAO,CAAC,CAAC;AADlH,QAAA,0BAA0B,8BACwF","sourcesContent":["import { AuthenticateUserChallenge } from 'quidproquo-core';\n\nimport { AnyChallengePayload, MfaChallengePayload, MfaSetupChallengePayload, NewPasswordChallengePayload } from './types';\n\n// These payloads come straight off the wire, so a guard cannot trust the type\n// it is narrowing to. Each one checks the discriminant AND that the extra\n// credential field is a real non-empty string, otherwise the guard would let\n// `undefined` credentials through to the user directory.\n\nconst isNonEmptyString = (value: unknown): value is string => typeof value === 'string' && value !== '';\n\nexport const isNewPasswordChallengePayload = (payload: AnyChallengePayload): payload is NewPasswordChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED && isNonEmptyString((payload as NewPasswordChallengePayload).newPassword);\n\nexport const isMfaChallengePayload = (payload: AnyChallengePayload): payload is MfaChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA && isNonEmptyString((payload as MfaChallengePayload).mfaCode);\n\nexport const isMfaSetupChallengePayload = (payload: AnyChallengePayload): payload is MfaSetupChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.MFA_SETUP && isNonEmptyString((payload as MfaSetupChallengePayload).mfaCode);\n"]}

package/lib/commonjs/services/index.d.ts

@@ -1,5 +1,3 @@
 export * from './auth';
 export * from './getServiceEntryQpqFunctionRuntime';
-export * from './log';
 export * from './serviceImporter';
-export * from './webSocketQueue';

package/lib/commonjs/services/index.js

@@ -16,7 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./auth"), exports);
 __exportStar(require("./getServiceEntryQpqFunctionRuntime"), exports);
-__exportStar(require("./log"), exports);
 __exportStar(require("./serviceImporter"), exports);
-__exportStar(require("./webSocketQueue"), exports);
 //# sourceMappingURL=index.js.map

package/lib/commonjs/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,sEAAoD;AACpD,wCAAsB;AACtB,oDAAkC;AAClC,mDAAiC","sourcesContent":["export * from './auth';\nexport * from './getServiceEntryQpqFunctionRuntime';\nexport * from './log';\nexport * from './serviceImporter';\nexport * from './webSocketQueue';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,sEAAoD;AACpD,oDAAkC","sourcesContent":["export * from './auth';\nexport * from './getServiceEntryQpqFunctionRuntime';\nexport * from './serviceImporter';\n"]}

package/lib/commonjs/utils/websocketEventUtils.js

@@ -7,15 +7,25 @@ const fromJsonWebsocketEventRequest = (websocketJsonEvent) => {
     if (!websocketJsonEvent.body) {
         throw new Error('websocketJsonEvent.body is undefined');
     }
-    const item = JSON.parse(websocketJsonEvent.body);
-    return item;
+    try {
+        const item = JSON.parse(websocketJsonEvent.body);
+        return item;
+    }
+    catch (_a) {
+        throw new Error('Unable to parse incoming json body from websocket event.');
+    }
 };
 exports.fromJsonWebsocketEventRequest = fromJsonWebsocketEventRequest;
 function* askFromJsonWebsocketEventRequest(websocketJsonEvent) {
     if (!websocketJsonEvent.body) {
-        yield* (0, quidproquo_core_1.askThrowError)(quidproquo_core_1.ErrorTypeEnum.Invalid, 'websocketJsonEvent.body is undefined');
+        return yield* (0, quidproquo_core_1.askThrowError)(quidproquo_core_1.ErrorTypeEnum.Invalid, 'websocketJsonEvent.body is undefined');
+    }
+    try {
+        const item = JSON.parse(websocketJsonEvent.body);
+        return item;
+    }
+    catch (_a) {
+        return yield* (0, quidproquo_core_1.askThrowError)(quidproquo_core_1.ErrorTypeEnum.Invalid, 'Unable to parse incoming json from WebsocketEvent.');
     }
-    const item = JSON.parse(websocketJsonEvent.body);
-    return item;
 }
 //# sourceMappingURL=websocketEventUtils.js.map

package/lib/commonjs/utils/websocketEventUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"websocketEventUtils.js","sourceRoot":"","sources":["../../../src/utils/websocketEventUtils.ts"],"names":[],"mappings":";;;AAaA,4EAOC;AApBD,qDAA4E;AAIrE,MAAM,6BAA6B,GAAG,CAAI,kBAA0C,EAAK,EAAE;IAChG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAPW,QAAA,6BAA6B,iCAOxC;AAEF,QAAe,CAAC,CAAC,gCAAgC,CAAI,kBAA0C;IAC7F,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK,CAAC,CAAC,IAAA,+BAAa,EAAC,+BAAa,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAK,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { AskResponse, askThrowError, ErrorTypeEnum } from 'quidproquo-core';\n\nimport { WebsocketEvent } from '../types';\n\nexport const fromJsonWebsocketEventRequest = <T>(websocketJsonEvent: WebsocketEvent<string>): T => {\n  if (!websocketJsonEvent.body) {\n    throw new Error('websocketJsonEvent.body is undefined');\n  }\n\n  const item: T = JSON.parse(websocketJsonEvent.body);\n  return item;\n};\n\nexport function* askFromJsonWebsocketEventRequest<T>(websocketJsonEvent: WebsocketEvent<string>): AskResponse<T> {\n  if (!websocketJsonEvent.body) {\n    yield* askThrowError(ErrorTypeEnum.Invalid, 'websocketJsonEvent.body is undefined');\n  }\n\n  const item: T = JSON.parse(websocketJsonEvent.body!);\n  return item;\n}\n"]}
+{"version":3,"file":"websocketEventUtils.js","sourceRoot":"","sources":["../../../src/utils/websocketEventUtils.ts"],"names":[],"mappings":";;;AAiBA,4EAWC;AA5BD,qDAA4E;AAIrE,MAAM,6BAA6B,GAAG,CAAI,kBAA0C,EAAK,EAAE;IAChG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC,CAAC;AAXW,QAAA,6BAA6B,iCAWxC;AAEF,QAAe,CAAC,CAAC,gCAAgC,CAAI,kBAA0C;IAC7F,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,IAAA,+BAAa,EAAC,+BAAa,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,IAAA,+BAAa,EAAC,+BAAa,CAAC,OAAO,EAAE,oDAAoD,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC","sourcesContent":["import { AskResponse, askThrowError, ErrorTypeEnum } from 'quidproquo-core';\n\nimport { WebsocketEvent } from '../types';\n\nexport const fromJsonWebsocketEventRequest = <T>(websocketJsonEvent: WebsocketEvent<string>): T => {\n  if (!websocketJsonEvent.body) {\n    throw new Error('websocketJsonEvent.body is undefined');\n  }\n\n  try {\n    const item: T = JSON.parse(websocketJsonEvent.body);\n    return item;\n  } catch {\n    throw new Error('Unable to parse incoming json body from websocket event.');\n  }\n};\n\nexport function* askFromJsonWebsocketEventRequest<T>(websocketJsonEvent: WebsocketEvent<string>): AskResponse<T> {\n  if (!websocketJsonEvent.body) {\n    return yield* askThrowError(ErrorTypeEnum.Invalid, 'websocketJsonEvent.body is undefined');\n  }\n\n  try {\n    const item: T = JSON.parse(websocketJsonEvent.body);\n    return item;\n  } catch {\n    return yield* askThrowError(ErrorTypeEnum.Invalid, 'Unable to parse incoming json from WebsocketEvent.');\n  }\n}\n"]}

package/lib/esm/actions/dns/DnsListActionTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"DnsListActionTypes.js","sourceRoot":"","sources":["../../../../src/actions/dns/DnsListActionTypes.ts"],"names":[],"mappings":"","sourcesContent":["import { Action, ActionProcessor, ActionRequester, ContextListAction, QpqContext } from 'quidproquo-core';\n\nimport { DnsActionType } from './DnsActionType';\n\n// Payload\nexport interface DnsListActionPayload {}\n\n// Action\nexport interface DnsListAction extends Action<DnsListActionPayload> {\n  type: DnsActionType.List;\n}\n\n// Function Types\nexport type DnsListActionProcessor = ActionProcessor<DnsListAction, string[]>;\nexport type DnsListActionRequester = ActionRequester<DnsListAction, string[]>;\n"]}
+{"version":3,"file":"DnsListActionTypes.js","sourceRoot":"","sources":["../../../../src/actions/dns/DnsListActionTypes.ts"],"names":[],"mappings":"","sourcesContent":["import { Action, ActionProcessor, ActionRequester } from 'quidproquo-core';\n\nimport { DnsActionType } from './DnsActionType';\n\n// Payload\nexport interface DnsListActionPayload {}\n\n// Action\nexport interface DnsListAction extends Action<DnsListActionPayload> {\n  type: DnsActionType.List;\n}\n\n// Function Types\nexport type DnsListActionProcessor = ActionProcessor<DnsListAction, string[]>;\nexport type DnsListActionRequester = ActionRequester<DnsListAction, string[]>;\n"]}

package/lib/esm/actions/index.d.ts

@@ -4,7 +4,6 @@ export * from './dns';
 export * from './genericDataResource';
 export * from './openApiSpec';
 export * from './routeAuthValidation';
-export * from './service';
 export * from './serviceFunction';
 export * from './webEntry';
 export * from './websocket';

package/lib/esm/actions/index.js

@@ -4,7 +4,6 @@ export * from './dns';
 export * from './genericDataResource';
 export * from './openApiSpec';
 export * from './routeAuthValidation';
-export * from './service';
 export * from './serviceFunction';
 export * from './webEntry';
 export * from './websocket';

package/lib/esm/actions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/actions/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,OAAO,CAAC;AACtB,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC","sourcesContent":["export * from './admin';\nexport * from './apiKeyValidation';\nexport * from './dns';\nexport * from './genericDataResource';\nexport * from './openApiSpec';\nexport * from './routeAuthValidation';\nexport * from './service';\nexport * from './serviceFunction';\nexport * from './webEntry';\nexport * from './websocket';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/actions/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,OAAO,CAAC;AACtB,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC","sourcesContent":["export * from './admin';\nexport * from './apiKeyValidation';\nexport * from './dns';\nexport * from './genericDataResource';\nexport * from './openApiSpec';\nexport * from './routeAuthValidation';\nexport * from './serviceFunction';\nexport * from './webEntry';\nexport * from './websocket';\n"]}

package/lib/esm/config/settings/index.d.ts

@@ -13,9 +13,7 @@ export * from './route';
 export * from './seed';
 export * from './seo';
 export * from './serviceFunction';
-export * from './stateDispatchOverWebsockets';
 export * from './storageDriveCorsSettings';
 export * from './subdomainRedirect';
 export * from './webEntry';
 export * from './websocket';
-export * from './webSocketQueue';

package/lib/esm/config/settings/index.js

@@ -13,10 +13,8 @@ export * from './route';
 export * from './seed';
 export * from './seo';
 export * from './serviceFunction';
-export * from './stateDispatchOverWebsockets';
 export * from './storageDriveCorsSettings';
 export * from './subdomainRedirect';
 export * from './webEntry';
 export * from './websocket';
-export * from './webSocketQueue';
 //# sourceMappingURL=index.js.map

package/lib/esm/config/settings/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/config/settings/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,OAAO,CAAC;AACtB,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC","sourcesContent":["export * from './api';\nexport * from './apiKey';\nexport * from './cache';\nexport * from './certificate';\nexport * from './defaultRouteOptions';\nexport * from './defineAuthSystem';\nexport * from './dns';\nexport * from './domainProxy';\nexport * from './fileUploadSettings';\nexport * from './migration';\nexport * from './openApi';\nexport * from './route';\nexport * from './seed';\nexport * from './seo';\nexport * from './serviceFunction';\nexport * from './stateDispatchOverWebsockets';\nexport * from './storageDriveCorsSettings';\nexport * from './subdomainRedirect';\nexport * from './webEntry';\nexport * from './websocket';\nexport * from './webSocketQueue';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/config/settings/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,OAAO,CAAC;AACtB,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC","sourcesContent":["export * from './api';\nexport * from './apiKey';\nexport * from './cache';\nexport * from './certificate';\nexport * from './defaultRouteOptions';\nexport * from './defineAuthSystem';\nexport * from './dns';\nexport * from './domainProxy';\nexport * from './fileUploadSettings';\nexport * from './migration';\nexport * from './openApi';\nexport * from './route';\nexport * from './seed';\nexport * from './seo';\nexport * from './serviceFunction';\nexport * from './storageDriveCorsSettings';\nexport * from './subdomainRedirect';\nexport * from './webEntry';\nexport * from './websocket';\n"]}

package/lib/esm/index.d.ts

@@ -1,7 +1,6 @@
 export * from './actionProcessor';
 export * from './actions';
 export * from './config';
-export * from './context';
 export * from './qpqWebServerUtils';
 export * from './services';
 export * from './stories';

package/lib/esm/index.js

@@ -1,7 +1,6 @@
 export * from './actionProcessor';
 export * from './actions';
 export * from './config';
-export * from './context';
 export * from './qpqWebServerUtils';
 export * from './services';
 export * from './stories';

package/lib/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC","sourcesContent":["export * from './actionProcessor';\nexport * from './actions';\nexport * from './config';\nexport * from './context';\nexport * from './qpqWebServerUtils';\nexport * from './services';\nexport * from './stories';\nexport * from './types';\nexport * from './utils';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC","sourcesContent":["export * from './actionProcessor';\nexport * from './actions';\nexport * from './config';\nexport * from './qpqWebServerUtils';\nexport * from './services';\nexport * from './stories';\nexport * from './types';\nexport * from './utils';\n"]}

package/lib/esm/services/auth/entry/controller/authController.js

@@ -1,12 +1,25 @@
-import { AuthenticateUserChallenge } from 'quidproquo-core';
+import { askThrowError, AuthenticateUserChallenge, ErrorTypeEnum } from 'quidproquo-core';
 // TODO: Fix this import (name it up the chain)
 import { qpqWebServerUtils } from '../../../../index';
 import { authLogic } from '../../logic';
 import { isMfaChallengePayload, isMfaSetupChallengePayload, isNewPasswordChallengePayload, } from '../../types';
+// Field-presence validator for askFromValidJsonEventRequest. The payload types
+// are just casts over whatever json the client sent, so each handler checks its
+// required fields are real non-empty strings before anything touches the user
+// directory. A miss comes back as a 422 Invalid instead of a downstream error.
+const requireStringFields = (...fields) => (data) => {
+    const record = (data ?? {});
+    const missing = fields.filter((field) => typeof record[field] !== 'string' || record[field] === '');
+    if (missing.length > 0) {
+        throw new Error(`Missing or invalid fields: ${missing.join(', ')}`);
+    }
+    return data;
+};
 // Maps the wire payload (discriminated by `challenge`) onto the core auth
 // challenge shape. The type guards narrow `payload`, so no manual casts are
-// needed. Add a branch here as new challenge types are supported.
-const challengePayloadToAuthChallenge = (payload) => {
+// needed. Add a branch here as new challenge types are supported. An unknown
+// or malformed challenge is a client error, so it surfaces as a 400.
+function* askChallengePayloadToAuthChallenge(payload) {
     if (isNewPasswordChallengePayload(payload)) {
         return {
             challenge: AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,
@@ -31,42 +44,47 @@ const challengePayloadToAuthChallenge = (payload) => {
             mfaCode: payload.mfaCode,
         };
     }
-    throw new Error(`Unsupported auth challenge: ${payload.challenge}`);
-};
+    return yield* askThrowError(ErrorTypeEnum.BadRequest, `Unsupported or malformed auth challenge: ${payload.challenge}`);
+}
 export function* login(event) {
-    const { username, password } = yield* qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { username, password } = yield* qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('username', 'password'));
     const authResponse = yield* authLogic.askLogin(username, password);
     return qpqWebServerUtils.toJsonEventResponse(authResponse);
 }
 export function* refreshToken(event) {
-    const { refreshToken } = yield* qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { refreshToken } = yield* qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('refreshToken'));
     const refreshResponse = yield* authLogic.askRefreshToken(refreshToken);
     return qpqWebServerUtils.toJsonEventResponse(refreshResponse);
 }
 export function* respondToAuthChallenge(event) {
-    const payload = yield* qpqWebServerUtils.askFromJsonEventRequest(event);
-    const response = yield* authLogic.askRespondToAuthChallenge(challengePayloadToAuthChallenge(payload));
+    const payload = yield* qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('email', 'session', 'challenge'));
+    const authChallenge = yield* askChallengePayloadToAuthChallenge(payload);
+    const response = yield* authLogic.askRespondToAuthChallenge(authChallenge);
     return qpqWebServerUtils.toJsonEventResponse(response);
 }
 export function* associateSoftwareToken(event) {
-    const { session } = yield* qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { session } = yield* qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('session'));
     const response = yield* authLogic.askAssociateSoftwareToken(session);
     return qpqWebServerUtils.toJsonEventResponse(response);
 }
 export function* forgotPassword(event) {
-    const { username } = yield* qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { username } = yield* qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('username'));
     const deliveryDetails = yield* authLogic.askForgotPassword(username);
     return qpqWebServerUtils.toJsonEventResponse(deliveryDetails);
 }
 export function* confirmForgotPassword(event) {
-    const { username, code, password } = yield* qpqWebServerUtils.askFromJsonEventRequest(event);
+    const { username, code, password } = yield* qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('username', 'code', 'password'));
     const response = yield* authLogic.askConfirmForgotPassword(username, code, password);
     return qpqWebServerUtils.toJsonEventResponse(response);
 }
 export function* changePassword(event) {
-    const { oldPassword, newPassword } = yield* qpqWebServerUtils.askFromJsonEventRequest(event);
-    // The route is authenticated, so the access token is present on the request.
-    const accessToken = qpqWebServerUtils.getAccessTokenFromHeaders(event.headers) || '';
+    const { oldPassword, newPassword } = yield* qpqWebServerUtils.askFromValidJsonEventRequest(event, requireStringFields('oldPassword', 'newPassword'));
+    // The route is authenticated, so the access token should always be present.
+    // Guard anyway so a misconfigured route fails as a 401, not a directory error.
+    const accessToken = qpqWebServerUtils.getAccessTokenFromHeaders(event.headers);
+    if (!accessToken) {
+        return yield* askThrowError(ErrorTypeEnum.Unauthorized, 'Missing access token.');
+    }
     yield* authLogic.askChangePassword(oldPassword, newPassword, accessToken);
     return qpqWebServerUtils.toJsonEventResponse({ success: true });
 }

package/lib/esm/services/auth/entry/controller/authController.js.map

@@ -1 +1 @@
-{"version":3,"file":"authController.js","sourceRoot":"","sources":["../../../../../../src/services/auth/entry/controller/authController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE3F,+CAA+C;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAML,qBAAqB,EACrB,0BAA0B,EAC1B,6BAA6B,GAG9B,MAAM,aAAa,CAAC;AAErB,0EAA0E;AAC1E,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,+BAA+B,GAAG,CAAC,OAA4B,EAAoB,EAAE;IACzF,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,yBAAyB,CAAC,qBAAqB;YAC1D,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,SAAS,EAAE,yBAAyB,CAAC,kBAAkB;YACvD,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,SAAS,EAAE,yBAAyB,CAAC,SAAS;YAC9C,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,+BAAgC,OAA+B,CAAC,SAAS,EAAE,CAAC,CAAC;AAC/F,CAAC,CAAC;AAEF,MAAM,SAAS,CAAC,CAAC,KAAK,CAAC,KAAgB;IACrC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,CAAe,KAAK,CAAC,CAAC;IAErG,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEnE,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,YAAY,CAAC,KAAgB;IAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,CAAiB,KAAK,CAAC,CAAC;IAEjG,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAEvE,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,sBAAsB,CAAC,KAAgB;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,CAAsB,KAAK,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtG,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,sBAAsB,CAAC,KAAgB;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,CAAgC,KAAK,CAAC,CAAC;IAE3G,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAErE,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,cAAc,CAAC,KAAgB;IAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,CAAwB,KAAK,CAAC,CAAC;IAEpG,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,qBAAqB,CAAC,KAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,CAA+B,KAAK,CAAC,CAAC;IAE3H,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAErF,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,cAAc,CAAC,KAAgB;IAC9C,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,CAAwB,KAAK,CAAC,CAAC;IAEpH,6EAA6E;IAC7E,MAAM,WAAW,GAAG,iBAAiB,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAErF,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAE1E,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import { AnyAuthChallenge, AskResponse, AuthenticateUserChallenge } from 'quidproquo-core';\n\n// TODO: Fix this import (name it up the chain)\nimport { qpqWebServerUtils } from '../../../../index';\nimport { HTTPEvent, HTTPEventResponse } from '../../../../types';\nimport { authLogic } from '../../logic';\nimport {\n  AnyChallengePayload,\n  AssociateSoftwareTokenPayload,\n  ChangePasswordPayload,\n  ConfirmForgotPasswordPayload,\n  ForgotPasswordPayload,\n  isMfaChallengePayload,\n  isMfaSetupChallengePayload,\n  isNewPasswordChallengePayload,\n  LoginPayload,\n  RefreshPayload,\n} from '../../types';\n\n// Maps the wire payload (discriminated by `challenge`) onto the core auth\n// challenge shape. The type guards narrow `payload`, so no manual casts are\n// needed. Add a branch here as new challenge types are supported.\nconst challengePayloadToAuthChallenge = (payload: AnyChallengePayload): AnyAuthChallenge => {\n  if (isNewPasswordChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,\n      username: payload.email,\n      session: payload.session,\n      newPassword: payload.newPassword,\n    };\n  }\n\n  if (isMfaChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA,\n      username: payload.email,\n      session: payload.session,\n      mfaCode: payload.mfaCode,\n    };\n  }\n\n  if (isMfaSetupChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.MFA_SETUP,\n      username: payload.email,\n      session: payload.session,\n      mfaCode: payload.mfaCode,\n    };\n  }\n\n  throw new Error(`Unsupported auth challenge: ${(payload as AnyChallengePayload).challenge}`);\n};\n\nexport function* login(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username, password } = yield* qpqWebServerUtils.askFromJsonEventRequest<LoginPayload>(event);\n\n  const authResponse = yield* authLogic.askLogin(username, password);\n\n  return qpqWebServerUtils.toJsonEventResponse(authResponse);\n}\n\nexport function* refreshToken(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { refreshToken } = yield* qpqWebServerUtils.askFromJsonEventRequest<RefreshPayload>(event);\n\n  const refreshResponse = yield* authLogic.askRefreshToken(refreshToken);\n\n  return qpqWebServerUtils.toJsonEventResponse(refreshResponse);\n}\n\nexport function* respondToAuthChallenge(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const payload = yield* qpqWebServerUtils.askFromJsonEventRequest<AnyChallengePayload>(event);\n\n  const response = yield* authLogic.askRespondToAuthChallenge(challengePayloadToAuthChallenge(payload));\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* associateSoftwareToken(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { session } = yield* qpqWebServerUtils.askFromJsonEventRequest<AssociateSoftwareTokenPayload>(event);\n\n  const response = yield* authLogic.askAssociateSoftwareToken(session);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* forgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username } = yield* qpqWebServerUtils.askFromJsonEventRequest<ForgotPasswordPayload>(event);\n\n  const deliveryDetails = yield* authLogic.askForgotPassword(username);\n\n  return qpqWebServerUtils.toJsonEventResponse(deliveryDetails);\n}\n\nexport function* confirmForgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username, code, password } = yield* qpqWebServerUtils.askFromJsonEventRequest<ConfirmForgotPasswordPayload>(event);\n\n  const response = yield* authLogic.askConfirmForgotPassword(username, code, password);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* changePassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { oldPassword, newPassword } = yield* qpqWebServerUtils.askFromJsonEventRequest<ChangePasswordPayload>(event);\n\n  // The route is authenticated, so the access token is present on the request.\n  const accessToken = qpqWebServerUtils.getAccessTokenFromHeaders(event.headers) || '';\n\n  yield* authLogic.askChangePassword(oldPassword, newPassword, accessToken);\n\n  return qpqWebServerUtils.toJsonEventResponse({ success: true });\n}\n"]}
+{"version":3,"file":"authController.js","sourceRoot":"","sources":["../../../../../../src/services/auth/entry/controller/authController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,aAAa,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEzH,+CAA+C;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAOL,qBAAqB,EACrB,0BAA0B,EAC1B,6BAA6B,GAG9B,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,mBAAmB,GACvB,CAAI,GAAG,MAAgB,EAAE,EAAE,CAC3B,CAAC,IAAa,EAAK,EAAE;IACnB,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAEpG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,IAAS,CAAC;AACnB,CAAC,CAAC;AAEJ,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,qEAAqE;AACrE,QAAQ,CAAC,CAAC,kCAAkC,CAAC,OAA4B;IACvE,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,yBAAyB,CAAC,qBAAqB;YAC1D,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,SAAS,EAAE,yBAAyB,CAAC,kBAAkB;YACvD,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,SAAS,EAAE,yBAAyB,CAAC,SAAS;YAC9C,QAAQ,EAAE,OAAO,CAAC,KAAK;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,UAAU,EAAE,4CAA6C,OAA4B,CAAC,SAAS,EAAE,CAAC,CAAC;AAC/I,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,KAAK,CAAC,KAAgB;IACrC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,4BAA4B,CAClF,KAAK,EACL,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAC5C,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEnE,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,YAAY,CAAC,KAAgB;IAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,4BAA4B,CAAiB,KAAK,EAAE,mBAAmB,CAAC,cAAc,CAAC,CAAC,CAAC;IAE3I,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAEvE,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,sBAAsB,CAAC,KAAgB;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,4BAA4B,CACnE,KAAK,EACL,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CACrD,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAE3E,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,sBAAsB,CAAC,KAAgB;IACtD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,4BAA4B,CAAgC,KAAK,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhJ,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAErE,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,cAAc,CAAC,KAAgB;IAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,4BAA4B,CAAwB,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;IAE1I,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAErE,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,qBAAqB,CAAC,KAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,4BAA4B,CACxF,KAAK,EACL,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CACpD,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAErF,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,cAAc,CAAC,KAAgB;IAC9C,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,4BAA4B,CACxF,KAAK,EACL,mBAAmB,CAAC,aAAa,EAAE,aAAa,CAAC,CAClD,CAAC;IAEF,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,WAAW,GAAG,iBAAiB,CAAC,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAE1E,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import { AnyAuthChallenge, AskResponse, askThrowError, AuthenticateUserChallenge, ErrorTypeEnum } from 'quidproquo-core';\n\n// TODO: Fix this import (name it up the chain)\nimport { qpqWebServerUtils } from '../../../../index';\nimport { HTTPEvent, HTTPEventResponse } from '../../../../types';\nimport { authLogic } from '../../logic';\nimport {\n  AnyChallengePayload,\n  AssociateSoftwareTokenPayload,\n  ChallengePayload,\n  ChangePasswordPayload,\n  ConfirmForgotPasswordPayload,\n  ForgotPasswordPayload,\n  isMfaChallengePayload,\n  isMfaSetupChallengePayload,\n  isNewPasswordChallengePayload,\n  LoginPayload,\n  RefreshPayload,\n} from '../../types';\n\n// Field-presence validator for askFromValidJsonEventRequest. The payload types\n// are just casts over whatever json the client sent, so each handler checks its\n// required fields are real non-empty strings before anything touches the user\n// directory. A miss comes back as a 422 Invalid instead of a downstream error.\nconst requireStringFields =\n  <T>(...fields: string[]) =>\n  (data: unknown): T => {\n    const record = (data ?? {}) as Record<string, unknown>;\n    const missing = fields.filter((field) => typeof record[field] !== 'string' || record[field] === '');\n\n    if (missing.length > 0) {\n      throw new Error(`Missing or invalid fields: ${missing.join(', ')}`);\n    }\n\n    return data as T;\n  };\n\n// Maps the wire payload (discriminated by `challenge`) onto the core auth\n// challenge shape. The type guards narrow `payload`, so no manual casts are\n// needed. Add a branch here as new challenge types are supported. An unknown\n// or malformed challenge is a client error, so it surfaces as a 400.\nfunction* askChallengePayloadToAuthChallenge(payload: AnyChallengePayload): AskResponse<AnyAuthChallenge> {\n  if (isNewPasswordChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,\n      username: payload.email,\n      session: payload.session,\n      newPassword: payload.newPassword,\n    };\n  }\n\n  if (isMfaChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA,\n      username: payload.email,\n      session: payload.session,\n      mfaCode: payload.mfaCode,\n    };\n  }\n\n  if (isMfaSetupChallengePayload(payload)) {\n    return {\n      challenge: AuthenticateUserChallenge.MFA_SETUP,\n      username: payload.email,\n      session: payload.session,\n      mfaCode: payload.mfaCode,\n    };\n  }\n\n  return yield* askThrowError(ErrorTypeEnum.BadRequest, `Unsupported or malformed auth challenge: ${(payload as ChallengePayload).challenge}`);\n}\n\nexport function* login(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username, password } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<LoginPayload>(\n    event,\n    requireStringFields('username', 'password'),\n  );\n\n  const authResponse = yield* authLogic.askLogin(username, password);\n\n  return qpqWebServerUtils.toJsonEventResponse(authResponse);\n}\n\nexport function* refreshToken(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { refreshToken } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<RefreshPayload>(event, requireStringFields('refreshToken'));\n\n  const refreshResponse = yield* authLogic.askRefreshToken(refreshToken);\n\n  return qpqWebServerUtils.toJsonEventResponse(refreshResponse);\n}\n\nexport function* respondToAuthChallenge(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const payload = yield* qpqWebServerUtils.askFromValidJsonEventRequest<AnyChallengePayload>(\n    event,\n    requireStringFields('email', 'session', 'challenge'),\n  );\n\n  const authChallenge = yield* askChallengePayloadToAuthChallenge(payload);\n\n  const response = yield* authLogic.askRespondToAuthChallenge(authChallenge);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* associateSoftwareToken(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { session } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<AssociateSoftwareTokenPayload>(event, requireStringFields('session'));\n\n  const response = yield* authLogic.askAssociateSoftwareToken(session);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* forgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<ForgotPasswordPayload>(event, requireStringFields('username'));\n\n  const deliveryDetails = yield* authLogic.askForgotPassword(username);\n\n  return qpqWebServerUtils.toJsonEventResponse(deliveryDetails);\n}\n\nexport function* confirmForgotPassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { username, code, password } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<ConfirmForgotPasswordPayload>(\n    event,\n    requireStringFields('username', 'code', 'password'),\n  );\n\n  const response = yield* authLogic.askConfirmForgotPassword(username, code, password);\n\n  return qpqWebServerUtils.toJsonEventResponse(response);\n}\n\nexport function* changePassword(event: HTTPEvent): AskResponse<HTTPEventResponse> {\n  const { oldPassword, newPassword } = yield* qpqWebServerUtils.askFromValidJsonEventRequest<ChangePasswordPayload>(\n    event,\n    requireStringFields('oldPassword', 'newPassword'),\n  );\n\n  // The route is authenticated, so the access token should always be present.\n  // Guard anyway so a misconfigured route fails as a 401, not a directory error.\n  const accessToken = qpqWebServerUtils.getAccessTokenFromHeaders(event.headers);\n  if (!accessToken) {\n    return yield* askThrowError(ErrorTypeEnum.Unauthorized, 'Missing access token.');\n  }\n\n  yield* authLogic.askChangePassword(oldPassword, newPassword, accessToken);\n\n  return qpqWebServerUtils.toJsonEventResponse({ success: true });\n}\n"]}

package/lib/esm/services/auth/types/challengePayloadGuards.js

@@ -1,5 +1,10 @@
 import { AuthenticateUserChallenge } from 'quidproquo-core';
-export const isNewPasswordChallengePayload = (payload) => payload.challenge === AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED;
-export const isMfaChallengePayload = (payload) => payload.challenge === AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA;
-export const isMfaSetupChallengePayload = (payload) => payload.challenge === AuthenticateUserChallenge.MFA_SETUP;
+// These payloads come straight off the wire, so a guard cannot trust the type
+// it is narrowing to. Each one checks the discriminant AND that the extra
+// credential field is a real non-empty string, otherwise the guard would let
+// `undefined` credentials through to the user directory.
+const isNonEmptyString = (value) => typeof value === 'string' && value !== '';
+export const isNewPasswordChallengePayload = (payload) => payload.challenge === AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED && isNonEmptyString(payload.newPassword);
+export const isMfaChallengePayload = (payload) => payload.challenge === AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA && isNonEmptyString(payload.mfaCode);
+export const isMfaSetupChallengePayload = (payload) => payload.challenge === AuthenticateUserChallenge.MFA_SETUP && isNonEmptyString(payload.mfaCode);
 //# sourceMappingURL=challengePayloadGuards.js.map

package/lib/esm/services/auth/types/challengePayloadGuards.js.map

@@ -1 +1 @@
-{"version":3,"file":"challengePayloadGuards.js","sourceRoot":"","sources":["../../../../../src/services/auth/types/challengePayloadGuards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAI5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,OAA4B,EAA0C,EAAE,CACpH,OAAO,CAAC,SAAS,KAAK,yBAAyB,CAAC,qBAAqB,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAA4B,EAAkC,EAAE,CACpG,OAAO,CAAC,SAAS,KAAK,yBAAyB,CAAC,kBAAkB,CAAC;AAErE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAA4B,EAAuC,EAAE,CAC9G,OAAO,CAAC,SAAS,KAAK,yBAAyB,CAAC,SAAS,CAAC","sourcesContent":["import { AuthenticateUserChallenge } from 'quidproquo-core';\n\nimport { AnyChallengePayload, MfaChallengePayload, MfaSetupChallengePayload, NewPasswordChallengePayload } from './types';\n\nexport const isNewPasswordChallengePayload = (payload: AnyChallengePayload): payload is NewPasswordChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED;\n\nexport const isMfaChallengePayload = (payload: AnyChallengePayload): payload is MfaChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA;\n\nexport const isMfaSetupChallengePayload = (payload: AnyChallengePayload): payload is MfaSetupChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.MFA_SETUP;\n"]}
+{"version":3,"file":"challengePayloadGuards.js","sourceRoot":"","sources":["../../../../../src/services/auth/types/challengePayloadGuards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAI5D,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,yDAAyD;AAEzD,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC;AAExG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,OAA4B,EAA0C,EAAE,CACpH,OAAO,CAAC,SAAS,KAAK,yBAAyB,CAAC,qBAAqB,IAAI,gBAAgB,CAAE,OAAuC,CAAC,WAAW,CAAC,CAAC;AAElJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAA4B,EAAkC,EAAE,CACpG,OAAO,CAAC,SAAS,KAAK,yBAAyB,CAAC,kBAAkB,IAAI,gBAAgB,CAAE,OAA+B,CAAC,OAAO,CAAC,CAAC;AAEnI,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAA4B,EAAuC,EAAE,CAC9G,OAAO,CAAC,SAAS,KAAK,yBAAyB,CAAC,SAAS,IAAI,gBAAgB,CAAE,OAAoC,CAAC,OAAO,CAAC,CAAC","sourcesContent":["import { AuthenticateUserChallenge } from 'quidproquo-core';\n\nimport { AnyChallengePayload, MfaChallengePayload, MfaSetupChallengePayload, NewPasswordChallengePayload } from './types';\n\n// These payloads come straight off the wire, so a guard cannot trust the type\n// it is narrowing to. Each one checks the discriminant AND that the extra\n// credential field is a real non-empty string, otherwise the guard would let\n// `undefined` credentials through to the user directory.\n\nconst isNonEmptyString = (value: unknown): value is string => typeof value === 'string' && value !== '';\n\nexport const isNewPasswordChallengePayload = (payload: AnyChallengePayload): payload is NewPasswordChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED && isNonEmptyString((payload as NewPasswordChallengePayload).newPassword);\n\nexport const isMfaChallengePayload = (payload: AnyChallengePayload): payload is MfaChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA && isNonEmptyString((payload as MfaChallengePayload).mfaCode);\n\nexport const isMfaSetupChallengePayload = (payload: AnyChallengePayload): payload is MfaSetupChallengePayload =>\n  payload.challenge === AuthenticateUserChallenge.MFA_SETUP && isNonEmptyString((payload as MfaSetupChallengePayload).mfaCode);\n"]}

package/lib/esm/services/index.d.ts

@@ -1,5 +1,3 @@
 export * from './auth';
 export * from './getServiceEntryQpqFunctionRuntime';
-export * from './log';
 export * from './serviceImporter';
-export * from './webSocketQueue';