tempest-express-sdk 0.5.0 → 0.7.0

package/dist/index.cjs

@@ -8197,6 +8197,190 @@ function makeWhatsAppWebhookRouter(options) {
   return router;
 }
 
+// src/integrations/telegram.ts
+var MEDIA_METHOD = {
+  image: { method: "sendPhoto", field: "photo" },
+  video: { method: "sendVideo", field: "video" },
+  audio: { method: "sendAudio", field: "audio" },
+  document: { method: "sendDocument", field: "document" }
+};
+var TelegramProvider = class {
+  http;
+  pollTimeout;
+  /**
+   * @param options - Bot token and API options.
+   */
+  constructor(options) {
+    const base = `${options.apiBase ?? "https://api.telegram.org"}/bot${options.token}`;
+    this.pollTimeout = options.pollTimeoutSeconds ?? 30;
+    this.http = new HTTPClient({
+      baseUrl: base,
+      defaultHeaders: { "content-type": "application/json" },
+      // Timeout must exceed the long-poll window.
+      timeoutMs: (this.pollTimeout + 10) * 1e3
+    });
+  }
+  /** Call a Bot API method, returning the `result`, throwing on `ok: false`. */
+  async call(method, body) {
+    const res = await this.http.post(`/${method}`, { body: JSON.stringify(body) });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok || !data.ok) {
+      throw new Error(`Telegram ${method} failed: ${data.description ?? res.statusText}`);
+    }
+    return data.result;
+  }
+  async sendText(to, text) {
+    const result = await this.call("sendMessage", {
+      chat_id: to,
+      text
+    });
+    return { id: String(result.message_id), status: "sent" };
+  }
+  async sendMedia(to, media) {
+    const { method, field } = MEDIA_METHOD[media.kind];
+    const body = { chat_id: to, [field]: media.media };
+    if (media.caption !== void 0) body.caption = media.caption;
+    const result = await this.call(method, body);
+    return { id: String(result.message_id), status: "sent" };
+  }
+  async status() {
+    try {
+      await this.call("getMe", {});
+      return "connected";
+    } catch {
+      return "disconnected";
+    }
+  }
+  /**
+   * Subscribe to inbound messages via `getUpdates` long-polling.
+   *
+   * @param handler - Invoked for each inbound text message.
+   * @returns A stop function that ends the polling loop.
+   */
+  async onMessage(handler) {
+    let running = true;
+    let offset = 0;
+    const loop = async () => {
+      while (running) {
+        let updates = [];
+        try {
+          updates = await this.call("getUpdates", {
+            offset,
+            timeout: this.pollTimeout
+          });
+        } catch {
+          if (running) await new Promise((r) => setTimeout(r, 1e3));
+          continue;
+        }
+        for (const update2 of updates) {
+          offset = update2.update_id + 1;
+          const message = update2.message;
+          if (!message) continue;
+          await handler({
+            from: String(message.chat.id),
+            messageId: String(message.message_id),
+            ...typeof message.text === "string" ? { text: message.text } : {},
+            mediaType: null,
+            timestamp: new Date(message.date * 1e3).toISOString(),
+            direction: "incoming"
+          });
+        }
+      }
+    };
+    void loop();
+    return async () => {
+      running = false;
+    };
+  }
+};
+var TwilioSmsProvider = class {
+  http;
+  from;
+  messagesPath;
+  accountPath;
+  /**
+   * @param options - Account SID, auth token and default sender.
+   */
+  constructor(options) {
+    this.from = options.from;
+    this.messagesPath = `/2010-04-01/Accounts/${options.accountSid}/Messages.json`;
+    this.accountPath = `/2010-04-01/Accounts/${options.accountSid}.json`;
+    const basic = Buffer.from(`${options.accountSid}:${options.authToken}`).toString(
+      "base64"
+    );
+    this.http = new HTTPClient({
+      baseUrl: options.apiBase ?? "https://api.twilio.com",
+      defaultHeaders: {
+        Authorization: `Basic ${basic}`,
+        "content-type": "application/x-www-form-urlencoded"
+      }
+    });
+  }
+  /** POST a form body to Twilio and parse the JSON, throwing on non-2xx. */
+  async postForm(params) {
+    const res = await this.http.post(this.messagesPath, {
+      body: new URLSearchParams(params).toString()
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new Error(
+        `Twilio send failed (${res.status}): ${data.message ?? res.statusText}`
+      );
+    }
+    return {
+      status: data.status ?? "queued",
+      ...data.sid ? { id: data.sid } : {}
+    };
+  }
+  async sendText(to, text) {
+    return this.postForm({ To: to, From: this.from, Body: text });
+  }
+  async sendMedia(to, media) {
+    return this.postForm({
+      To: to,
+      From: this.from,
+      MediaUrl: media.media,
+      ...media.caption !== void 0 ? { Body: media.caption } : {}
+    });
+  }
+  async status() {
+    const res = await this.http.get(this.accountPath);
+    const data = await res.json().catch(() => ({}));
+    return data.status ?? (res.ok ? "connected" : "disconnected");
+  }
+};
+function validateTwilioSignature(authToken, url, params, signature) {
+  const data = url + Object.keys(params).sort().map((key) => key + params[key]).join("");
+  const expected = crypto.createHmac("sha1", authToken).update(data, "utf8").digest("base64");
+  const a = Buffer.from(expected);
+  const b = Buffer.from(signature);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+function makeTwilioWebhookRouter(options) {
+  const path = options.path ?? "/sms/inbound";
+  const router = express2.Router();
+  router.post(path, async (req, res) => {
+    const body = req.body ?? {};
+    if (options.authToken) {
+      const url = options.publicUrl ?? `${req.protocol}://${req.get("host")}${req.originalUrl}`;
+      const signature = req.header("x-twilio-signature") ?? "";
+      if (!validateTwilioSignature(options.authToken, url, body, signature)) {
+        throw new UnauthorizedException({ message: "Invalid Twilio signature" });
+      }
+    }
+    await options.onMessage({
+      from: String(body.From ?? ""),
+      messageId: String(body.MessageSid ?? ""),
+      ...body.Body ? { text: body.Body } : {},
+      mediaType: null,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      direction: "incoming"
+    });
+    res.type("text/xml").send("<Response></Response>");
+  });
+  return router;
+}
+
 // src/admin/site.ts
 var AdminSite = class {
   /**
@@ -8331,6 +8515,17 @@ var authResponseSchema = zod.z.object({
   user: userPublicSchema,
   tokens: tokenPairSchema
 }).openapi("AuthResponse");
+var mfaEnrollResponseSchema = zod.z.object({
+  secret: zod.z.string().openapi({ description: "Base32 TOTP secret (manual entry)." }),
+  otpauthUri: zod.z.string().openapi({ description: "otpauth:// URI to render as QR." })
+}).openapi("MfaEnrollResponse");
+var mfaCodeSchema = zod.z.object({ code: zod.z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
+var activationSchema = zod.z.object({ token: zod.z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
+var passwordResetRequestSchema = zod.z.object({ email: zod.z.string().email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
+var passwordResetConfirmSchema = zod.z.object({
+  token: zod.z.string().min(1).openapi({ description: "Reset token." }),
+  password: zod.z.string().min(1).openapi({ description: "New plaintext password." })
+}).openapi("PasswordResetConfirm");
 
 // src/auth/service.ts
 function toPublic(user) {
@@ -8443,6 +8638,178 @@ var UserAuthService = class {
   }
 };
 
+// src/auth/mfa.ts
+var MfaService = class {
+  store;
+  totp;
+  /**
+   * @param options - Store and TOTP helper.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.totp = options.totp;
+  }
+  /**
+   * Begin enrollment: generate and persist a secret, return the QR URI.
+   *
+   * @param userId - The enrolling user.
+   * @param accountName - Label shown in the authenticator (usually the email).
+   * @returns The secret and provisioning URI.
+   */
+  async enroll(userId, accountName) {
+    const secret = this.totp.generateSecret();
+    await this.store.setSecret(userId, secret);
+    await this.store.setEnabled(userId, false);
+    return { secret, otpauthUri: this.totp.provisioningUri(secret, accountName) };
+  }
+  /**
+   * Confirm enrollment by verifying a code, enabling MFA on success.
+   *
+   * @param userId - The user.
+   * @param code - The 6-digit code from the authenticator.
+   * @throws {ValidationException} When no secret is pending or the code is wrong.
+   */
+  async confirm(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    if (!secret) throw new ValidationException({ message: "MFA not initialized" });
+    if (!this.totp.verify(secret, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, true);
+  }
+  /**
+   * Verify a code (login step). Returns `false` without throwing.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @returns `true` when the code is valid.
+   */
+  async verify(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    return secret ? this.totp.verify(secret, code) : false;
+  }
+  /**
+   * Disable MFA after verifying a code.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @throws {ValidationException} When the code is invalid.
+   */
+  async disable(userId, code) {
+    if (!await this.verify(userId, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, false);
+    await this.store.setSecret(userId, "");
+  }
+};
+
+// src/auth/activation.ts
+var ActivationService = class {
+  store;
+  ttlSeconds;
+  /**
+   * @param options - Store and token TTL.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.ttlSeconds = options.ttlSeconds ?? 60 * 60 * 24;
+  }
+  /**
+   * Start activation: issue a token and persist its hash.
+   *
+   * @param userId - The user to activate.
+   * @returns The one-time plaintext token (embed in the activation link).
+   */
+  async start(userId) {
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveActivationToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Activate an account from a token.
+   *
+   * @param token - The plaintext token from the activation link.
+   * @returns The activated user id.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async activate(token) {
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findActivationToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired activation token" });
+    }
+    await this.store.activate(record.userId);
+    await this.store.clearActivationToken(tokenHash);
+    return record.userId;
+  }
+};
+
+// src/auth/passwordReset.ts
+var PasswordResetService = class {
+  store;
+  password;
+  ttlSeconds;
+  passwordMinLength;
+  /**
+   * @param options - Store, password hasher and policy.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.password = options.password;
+    this.ttlSeconds = options.ttlSeconds ?? 3600;
+    this.passwordMinLength = options.passwordMinLength ?? 12;
+  }
+  /**
+   * Request a reset for `email`.
+   *
+   * Returns the plaintext token only when the email maps to a user; otherwise
+   * `null`. Callers should respond with the same success shape either way to
+   * avoid user enumeration — email the token only when present.
+   *
+   * @param email - The account email.
+   * @returns The one-time token, or `null` when no user matches.
+   */
+  async request(email) {
+    const userId = await this.store.findUserIdByEmail(email.toLowerCase());
+    if (!userId) return null;
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveResetToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Confirm a reset: validate the token + new password and rehash.
+   *
+   * @param token - The plaintext reset token.
+   * @param newPassword - The new plaintext password.
+   * @throws {ValidationException} When the new password is too short.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async confirm(token, newPassword) {
+    if (newPassword.length < this.passwordMinLength) {
+      throw new ValidationException({
+        message: `Password must be at least ${this.passwordMinLength} characters`,
+        details: { minLength: this.passwordMinLength }
+      });
+    }
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findResetToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired reset token" });
+    }
+    await this.store.updatePassword(record.userId, await this.password.hash(newPassword));
+    await this.store.clearResetToken(tokenHash);
+  }
+};
+
 // src/auth/middleware.ts
 function bearerToken(req) {
   const header = req.header("authorization");
@@ -8545,6 +8912,53 @@ function makeAuthRouter(options) {
     }
     res.json(claims);
   });
+  if (options.activation) {
+    const activation = options.activation;
+    router.post(`${prefix}/activate`, async (req, res) => {
+      const { token } = activationSchema.parse(req.body);
+      const userId = await activation.activate(token);
+      res.json({ activated: true, userId });
+    });
+  }
+  if (options.passwordReset) {
+    const reset = options.passwordReset;
+    router.post(`${prefix}/password-reset/request`, async (req, res) => {
+      const { email } = passwordResetRequestSchema.parse(req.body);
+      const token = await reset.request(email);
+      res.status(202).json({ requested: true, ...token ? { token } : {} });
+    });
+    router.post(`${prefix}/password-reset/confirm`, async (req, res) => {
+      const { token, password } = passwordResetConfirmSchema.parse(req.body);
+      await reset.confirm(token, password);
+      res.json({ reset: true });
+    });
+  }
+  if (options.mfa) {
+    const mfa = options.mfa;
+    const requireUser = (req) => {
+      const claims = getAuth(req);
+      if (!claims || typeof claims.sub !== "string") {
+        throw new UnauthorizedException({ message: "Not authenticated" });
+      }
+      return claims.sub;
+    };
+    router.post(`${prefix}/mfa/enroll`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const claims = getAuth(req);
+      const userId = requireUser(req);
+      const label = typeof claims?.email === "string" ? claims.email : userId;
+      res.json(await mfa.enroll(userId, label));
+    });
+    router.post(`${prefix}/mfa/confirm`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.confirm(requireUser(req), code);
+      res.json({ enabled: true });
+    });
+    router.post(`${prefix}/mfa/disable`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.disable(requireUser(req), code);
+      res.json({ enabled: false });
+    });
+  }
   return router;
 }
 var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
@@ -8813,7 +9227,7 @@ function runServer(app, options = {}) {
 }
 
 // src/version.ts
-var VERSION = "0.5.0";
+var VERSION = "0.7.0";
 
 Object.defineProperty(exports, "OpenAPIRegistry", {
   enumerable: true,
@@ -8967,6 +9381,7 @@ Object.defineProperty(exports, "update", {
   enumerable: true,
   get: function () { return tempestDbJs.update; }
 });
+exports.ActivationService = ActivationService;
 exports.AdminSite = AdminSite;
 exports.AppException = AppException;
 exports.AttemptThrottle = AttemptThrottle;
@@ -8999,8 +9414,10 @@ exports.MemorySessionStore = MemorySessionStore;
 exports.MemoryThrottleBackend = MemoryThrottleBackend;
 exports.MessageCatalog = MessageCatalog;
 exports.MetricsUtils = MetricsUtils;
+exports.MfaService = MfaService;
 exports.NotFoundException = NotFoundException;
 exports.PHONE_BR_PATTERN = PHONE_BR_PATTERN;
+exports.PasswordResetService = PasswordResetService;
 exports.PasswordUtils = PasswordUtils;
 exports.REQUEST_ID_HEADER = REQUEST_ID_HEADER;
 exports.RabbitBroker = RabbitBroker;
@@ -9012,7 +9429,9 @@ exports.ServerSentEvent = ServerSentEvent;
 exports.SessionService = SessionService;
 exports.TOTPHelper = TOTPHelper;
 exports.TaskManager = TaskManager;
+exports.TelegramProvider = TelegramProvider;
 exports.TooManyRequestsException = TooManyRequestsException;
+exports.TwilioSmsProvider = TwilioSmsProvider;
 exports.UF = UF;
 exports.UnauthorizedException = UnauthorizedException;
 exports.UserAuthService = UserAuthService;
@@ -9023,6 +9442,7 @@ exports.WebPushError = WebPushError;
 exports.WebPushGoneError = WebPushGoneError;
 exports.WebSocketHub = WebSocketHub;
 exports.WhatsAppProvider = WhatsAppProvider;
+exports.activationSchema = activationSchema;
 exports.attachWebSocketHub = attachWebSocketHub;
 exports.authResponseSchema = authResponseSchema;
 exports.baseAppSettingsSchema = baseAppSettingsSchema;
@@ -9077,8 +9497,11 @@ exports.makeFlagGuard = makeFlagGuard;
 exports.makeHealthRouter = makeHealthRouter;
 exports.makeJwtAuthMiddleware = makeJwtAuthMiddleware;
 exports.makeSessionMiddleware = makeSessionMiddleware;
+exports.makeTwilioWebhookRouter = makeTwilioWebhookRouter;
 exports.makeUnhandledExceptionHandler = makeUnhandledExceptionHandler;
 exports.makeWhatsAppWebhookRouter = makeWhatsAppWebhookRouter;
+exports.mfaCodeSchema = mfaCodeSchema;
+exports.mfaEnrollResponseSchema = mfaEnrollResponseSchema;
 exports.modifyDict = modifyDict;
 exports.mountOpenApiJson = mountOpenApiJson;
 exports.mountRedoc = mountRedoc;
@@ -9095,6 +9518,8 @@ exports.paginationFilterSchema = paginationFilterSchema;
 exports.paginationSchema = paginationSchema;
 exports.parseAcceptLanguage = parseAcceptLanguage;
 exports.parseCookies = parseCookies;
+exports.passwordResetConfirmSchema = passwordResetConfirmSchema;
+exports.passwordResetRequestSchema = passwordResetRequestSchema;
 exports.phoneBrField = phoneBrField;
 exports.refreshSchema = refreshSchema;
 exports.registerExceptionHandlers = registerExceptionHandlers;
@@ -9117,6 +9542,7 @@ exports.ufField = ufField;
 exports.updatedByColumn = updatedByColumn;
 exports.userPublicSchema = userPublicSchema;
 exports.utcnow = utcnow;
+exports.validateTwilioSignature = validateTwilioSignature;
 exports.verifyOpaqueToken = verifyOpaqueToken;
 exports.webPushKeysSchema = webPushKeysSchema;
 exports.webPushPayloadSchema = webPushPayloadSchema;