tempest-express-sdk 0.5.0 → 0.7.0

package/dist/index.js

@@ -1,4 +1,4 @@
-export { VERSION } from './chunk-ZU6W433I.js';
+export { VERSION } from './chunk-PKUUVK7K.js';
 import { AsyncLocalStorage } from 'async_hooks';
 import { extendZodWithOpenApi, OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
 export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
@@ -8194,6 +8194,190 @@ function makeWhatsAppWebhookRouter(options) {
   return router;
 }
 
+// src/integrations/telegram.ts
+var MEDIA_METHOD = {
+  image: { method: "sendPhoto", field: "photo" },
+  video: { method: "sendVideo", field: "video" },
+  audio: { method: "sendAudio", field: "audio" },
+  document: { method: "sendDocument", field: "document" }
+};
+var TelegramProvider = class {
+  http;
+  pollTimeout;
+  /**
+   * @param options - Bot token and API options.
+   */
+  constructor(options) {
+    const base = `${options.apiBase ?? "https://api.telegram.org"}/bot${options.token}`;
+    this.pollTimeout = options.pollTimeoutSeconds ?? 30;
+    this.http = new HTTPClient({
+      baseUrl: base,
+      defaultHeaders: { "content-type": "application/json" },
+      // Timeout must exceed the long-poll window.
+      timeoutMs: (this.pollTimeout + 10) * 1e3
+    });
+  }
+  /** Call a Bot API method, returning the `result`, throwing on `ok: false`. */
+  async call(method, body) {
+    const res = await this.http.post(`/${method}`, { body: JSON.stringify(body) });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok || !data.ok) {
+      throw new Error(`Telegram ${method} failed: ${data.description ?? res.statusText}`);
+    }
+    return data.result;
+  }
+  async sendText(to, text) {
+    const result = await this.call("sendMessage", {
+      chat_id: to,
+      text
+    });
+    return { id: String(result.message_id), status: "sent" };
+  }
+  async sendMedia(to, media) {
+    const { method, field } = MEDIA_METHOD[media.kind];
+    const body = { chat_id: to, [field]: media.media };
+    if (media.caption !== void 0) body.caption = media.caption;
+    const result = await this.call(method, body);
+    return { id: String(result.message_id), status: "sent" };
+  }
+  async status() {
+    try {
+      await this.call("getMe", {});
+      return "connected";
+    } catch {
+      return "disconnected";
+    }
+  }
+  /**
+   * Subscribe to inbound messages via `getUpdates` long-polling.
+   *
+   * @param handler - Invoked for each inbound text message.
+   * @returns A stop function that ends the polling loop.
+   */
+  async onMessage(handler) {
+    let running = true;
+    let offset = 0;
+    const loop = async () => {
+      while (running) {
+        let updates = [];
+        try {
+          updates = await this.call("getUpdates", {
+            offset,
+            timeout: this.pollTimeout
+          });
+        } catch {
+          if (running) await new Promise((r) => setTimeout(r, 1e3));
+          continue;
+        }
+        for (const update2 of updates) {
+          offset = update2.update_id + 1;
+          const message = update2.message;
+          if (!message) continue;
+          await handler({
+            from: String(message.chat.id),
+            messageId: String(message.message_id),
+            ...typeof message.text === "string" ? { text: message.text } : {},
+            mediaType: null,
+            timestamp: new Date(message.date * 1e3).toISOString(),
+            direction: "incoming"
+          });
+        }
+      }
+    };
+    void loop();
+    return async () => {
+      running = false;
+    };
+  }
+};
+var TwilioSmsProvider = class {
+  http;
+  from;
+  messagesPath;
+  accountPath;
+  /**
+   * @param options - Account SID, auth token and default sender.
+   */
+  constructor(options) {
+    this.from = options.from;
+    this.messagesPath = `/2010-04-01/Accounts/${options.accountSid}/Messages.json`;
+    this.accountPath = `/2010-04-01/Accounts/${options.accountSid}.json`;
+    const basic = Buffer.from(`${options.accountSid}:${options.authToken}`).toString(
+      "base64"
+    );
+    this.http = new HTTPClient({
+      baseUrl: options.apiBase ?? "https://api.twilio.com",
+      defaultHeaders: {
+        Authorization: `Basic ${basic}`,
+        "content-type": "application/x-www-form-urlencoded"
+      }
+    });
+  }
+  /** POST a form body to Twilio and parse the JSON, throwing on non-2xx. */
+  async postForm(params) {
+    const res = await this.http.post(this.messagesPath, {
+      body: new URLSearchParams(params).toString()
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new Error(
+        `Twilio send failed (${res.status}): ${data.message ?? res.statusText}`
+      );
+    }
+    return {
+      status: data.status ?? "queued",
+      ...data.sid ? { id: data.sid } : {}
+    };
+  }
+  async sendText(to, text) {
+    return this.postForm({ To: to, From: this.from, Body: text });
+  }
+  async sendMedia(to, media) {
+    return this.postForm({
+      To: to,
+      From: this.from,
+      MediaUrl: media.media,
+      ...media.caption !== void 0 ? { Body: media.caption } : {}
+    });
+  }
+  async status() {
+    const res = await this.http.get(this.accountPath);
+    const data = await res.json().catch(() => ({}));
+    return data.status ?? (res.ok ? "connected" : "disconnected");
+  }
+};
+function validateTwilioSignature(authToken, url, params, signature) {
+  const data = url + Object.keys(params).sort().map((key) => key + params[key]).join("");
+  const expected = createHmac("sha1", authToken).update(data, "utf8").digest("base64");
+  const a = Buffer.from(expected);
+  const b = Buffer.from(signature);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function makeTwilioWebhookRouter(options) {
+  const path = options.path ?? "/sms/inbound";
+  const router = Router();
+  router.post(path, async (req, res) => {
+    const body = req.body ?? {};
+    if (options.authToken) {
+      const url = options.publicUrl ?? `${req.protocol}://${req.get("host")}${req.originalUrl}`;
+      const signature = req.header("x-twilio-signature") ?? "";
+      if (!validateTwilioSignature(options.authToken, url, body, signature)) {
+        throw new UnauthorizedException({ message: "Invalid Twilio signature" });
+      }
+    }
+    await options.onMessage({
+      from: String(body.From ?? ""),
+      messageId: String(body.MessageSid ?? ""),
+      ...body.Body ? { text: body.Body } : {},
+      mediaType: null,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      direction: "incoming"
+    });
+    res.type("text/xml").send("<Response></Response>");
+  });
+  return router;
+}
+
 // src/admin/site.ts
 var AdminSite = class {
   /**
@@ -8328,6 +8512,17 @@ var authResponseSchema = z.object({
   user: userPublicSchema,
   tokens: tokenPairSchema
 }).openapi("AuthResponse");
+var mfaEnrollResponseSchema = z.object({
+  secret: z.string().openapi({ description: "Base32 TOTP secret (manual entry)." }),
+  otpauthUri: z.string().openapi({ description: "otpauth:// URI to render as QR." })
+}).openapi("MfaEnrollResponse");
+var mfaCodeSchema = z.object({ code: z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
+var activationSchema = z.object({ token: z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
+var passwordResetRequestSchema = z.object({ email: z.string().email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
+var passwordResetConfirmSchema = z.object({
+  token: z.string().min(1).openapi({ description: "Reset token." }),
+  password: z.string().min(1).openapi({ description: "New plaintext password." })
+}).openapi("PasswordResetConfirm");
 
 // src/auth/service.ts
 function toPublic(user) {
@@ -8440,6 +8635,178 @@ var UserAuthService = class {
   }
 };
 
+// src/auth/mfa.ts
+var MfaService = class {
+  store;
+  totp;
+  /**
+   * @param options - Store and TOTP helper.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.totp = options.totp;
+  }
+  /**
+   * Begin enrollment: generate and persist a secret, return the QR URI.
+   *
+   * @param userId - The enrolling user.
+   * @param accountName - Label shown in the authenticator (usually the email).
+   * @returns The secret and provisioning URI.
+   */
+  async enroll(userId, accountName) {
+    const secret = this.totp.generateSecret();
+    await this.store.setSecret(userId, secret);
+    await this.store.setEnabled(userId, false);
+    return { secret, otpauthUri: this.totp.provisioningUri(secret, accountName) };
+  }
+  /**
+   * Confirm enrollment by verifying a code, enabling MFA on success.
+   *
+   * @param userId - The user.
+   * @param code - The 6-digit code from the authenticator.
+   * @throws {ValidationException} When no secret is pending or the code is wrong.
+   */
+  async confirm(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    if (!secret) throw new ValidationException({ message: "MFA not initialized" });
+    if (!this.totp.verify(secret, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, true);
+  }
+  /**
+   * Verify a code (login step). Returns `false` without throwing.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @returns `true` when the code is valid.
+   */
+  async verify(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    return secret ? this.totp.verify(secret, code) : false;
+  }
+  /**
+   * Disable MFA after verifying a code.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @throws {ValidationException} When the code is invalid.
+   */
+  async disable(userId, code) {
+    if (!await this.verify(userId, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, false);
+    await this.store.setSecret(userId, "");
+  }
+};
+
+// src/auth/activation.ts
+var ActivationService = class {
+  store;
+  ttlSeconds;
+  /**
+   * @param options - Store and token TTL.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.ttlSeconds = options.ttlSeconds ?? 60 * 60 * 24;
+  }
+  /**
+   * Start activation: issue a token and persist its hash.
+   *
+   * @param userId - The user to activate.
+   * @returns The one-time plaintext token (embed in the activation link).
+   */
+  async start(userId) {
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveActivationToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Activate an account from a token.
+   *
+   * @param token - The plaintext token from the activation link.
+   * @returns The activated user id.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async activate(token) {
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findActivationToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired activation token" });
+    }
+    await this.store.activate(record.userId);
+    await this.store.clearActivationToken(tokenHash);
+    return record.userId;
+  }
+};
+
+// src/auth/passwordReset.ts
+var PasswordResetService = class {
+  store;
+  password;
+  ttlSeconds;
+  passwordMinLength;
+  /**
+   * @param options - Store, password hasher and policy.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.password = options.password;
+    this.ttlSeconds = options.ttlSeconds ?? 3600;
+    this.passwordMinLength = options.passwordMinLength ?? 12;
+  }
+  /**
+   * Request a reset for `email`.
+   *
+   * Returns the plaintext token only when the email maps to a user; otherwise
+   * `null`. Callers should respond with the same success shape either way to
+   * avoid user enumeration — email the token only when present.
+   *
+   * @param email - The account email.
+   * @returns The one-time token, or `null` when no user matches.
+   */
+  async request(email) {
+    const userId = await this.store.findUserIdByEmail(email.toLowerCase());
+    if (!userId) return null;
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveResetToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Confirm a reset: validate the token + new password and rehash.
+   *
+   * @param token - The plaintext reset token.
+   * @param newPassword - The new plaintext password.
+   * @throws {ValidationException} When the new password is too short.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async confirm(token, newPassword) {
+    if (newPassword.length < this.passwordMinLength) {
+      throw new ValidationException({
+        message: `Password must be at least ${this.passwordMinLength} characters`,
+        details: { minLength: this.passwordMinLength }
+      });
+    }
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findResetToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired reset token" });
+    }
+    await this.store.updatePassword(record.userId, await this.password.hash(newPassword));
+    await this.store.clearResetToken(tokenHash);
+  }
+};
+
 // src/auth/middleware.ts
 function bearerToken(req) {
   const header = req.header("authorization");
@@ -8542,6 +8909,53 @@ function makeAuthRouter(options) {
     }
     res.json(claims);
   });
+  if (options.activation) {
+    const activation = options.activation;
+    router.post(`${prefix}/activate`, async (req, res) => {
+      const { token } = activationSchema.parse(req.body);
+      const userId = await activation.activate(token);
+      res.json({ activated: true, userId });
+    });
+  }
+  if (options.passwordReset) {
+    const reset = options.passwordReset;
+    router.post(`${prefix}/password-reset/request`, async (req, res) => {
+      const { email } = passwordResetRequestSchema.parse(req.body);
+      const token = await reset.request(email);
+      res.status(202).json({ requested: true, ...token ? { token } : {} });
+    });
+    router.post(`${prefix}/password-reset/confirm`, async (req, res) => {
+      const { token, password } = passwordResetConfirmSchema.parse(req.body);
+      await reset.confirm(token, password);
+      res.json({ reset: true });
+    });
+  }
+  if (options.mfa) {
+    const mfa = options.mfa;
+    const requireUser = (req) => {
+      const claims = getAuth(req);
+      if (!claims || typeof claims.sub !== "string") {
+        throw new UnauthorizedException({ message: "Not authenticated" });
+      }
+      return claims.sub;
+    };
+    router.post(`${prefix}/mfa/enroll`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const claims = getAuth(req);
+      const userId = requireUser(req);
+      const label = typeof claims?.email === "string" ? claims.email : userId;
+      res.json(await mfa.enroll(userId, label));
+    });
+    router.post(`${prefix}/mfa/confirm`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.confirm(requireUser(req), code);
+      res.json({ enabled: true });
+    });
+    router.post(`${prefix}/mfa/disable`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.disable(requireUser(req), code);
+      res.json({ enabled: false });
+    });
+  }
   return router;
 }
 var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
@@ -8809,6 +9223,6 @@ function runServer(app, options = {}) {
   });
 }
 
-export { AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, NotFoundException, PHONE_BR_PATTERN, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TooManyRequestsException, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeSessionMiddleware, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
+export { ActivationService, AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, MfaService, NotFoundException, PHONE_BR_PATTERN, PasswordResetService, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, activationSchema, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaCodeSchema, mfaEnrollResponseSchema, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map