tempest-express-sdk 0.6.0 → 0.7.0

package/dist/index.js

@@ -1,4 +1,4 @@
-export { VERSION } from './chunk-3IDD2UXU.js';
+export { VERSION } from './chunk-PKUUVK7K.js';
 import { AsyncLocalStorage } from 'async_hooks';
 import { extendZodWithOpenApi, OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
 export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
@@ -8512,6 +8512,17 @@ var authResponseSchema = z.object({
   user: userPublicSchema,
   tokens: tokenPairSchema
 }).openapi("AuthResponse");
+var mfaEnrollResponseSchema = z.object({
+  secret: z.string().openapi({ description: "Base32 TOTP secret (manual entry)." }),
+  otpauthUri: z.string().openapi({ description: "otpauth:// URI to render as QR." })
+}).openapi("MfaEnrollResponse");
+var mfaCodeSchema = z.object({ code: z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
+var activationSchema = z.object({ token: z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
+var passwordResetRequestSchema = z.object({ email: z.string().email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
+var passwordResetConfirmSchema = z.object({
+  token: z.string().min(1).openapi({ description: "Reset token." }),
+  password: z.string().min(1).openapi({ description: "New plaintext password." })
+}).openapi("PasswordResetConfirm");
 
 // src/auth/service.ts
 function toPublic(user) {
@@ -8624,6 +8635,178 @@ var UserAuthService = class {
   }
 };
 
+// src/auth/mfa.ts
+var MfaService = class {
+  store;
+  totp;
+  /**
+   * @param options - Store and TOTP helper.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.totp = options.totp;
+  }
+  /**
+   * Begin enrollment: generate and persist a secret, return the QR URI.
+   *
+   * @param userId - The enrolling user.
+   * @param accountName - Label shown in the authenticator (usually the email).
+   * @returns The secret and provisioning URI.
+   */
+  async enroll(userId, accountName) {
+    const secret = this.totp.generateSecret();
+    await this.store.setSecret(userId, secret);
+    await this.store.setEnabled(userId, false);
+    return { secret, otpauthUri: this.totp.provisioningUri(secret, accountName) };
+  }
+  /**
+   * Confirm enrollment by verifying a code, enabling MFA on success.
+   *
+   * @param userId - The user.
+   * @param code - The 6-digit code from the authenticator.
+   * @throws {ValidationException} When no secret is pending or the code is wrong.
+   */
+  async confirm(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    if (!secret) throw new ValidationException({ message: "MFA not initialized" });
+    if (!this.totp.verify(secret, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, true);
+  }
+  /**
+   * Verify a code (login step). Returns `false` without throwing.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @returns `true` when the code is valid.
+   */
+  async verify(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    return secret ? this.totp.verify(secret, code) : false;
+  }
+  /**
+   * Disable MFA after verifying a code.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @throws {ValidationException} When the code is invalid.
+   */
+  async disable(userId, code) {
+    if (!await this.verify(userId, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, false);
+    await this.store.setSecret(userId, "");
+  }
+};
+
+// src/auth/activation.ts
+var ActivationService = class {
+  store;
+  ttlSeconds;
+  /**
+   * @param options - Store and token TTL.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.ttlSeconds = options.ttlSeconds ?? 60 * 60 * 24;
+  }
+  /**
+   * Start activation: issue a token and persist its hash.
+   *
+   * @param userId - The user to activate.
+   * @returns The one-time plaintext token (embed in the activation link).
+   */
+  async start(userId) {
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveActivationToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Activate an account from a token.
+   *
+   * @param token - The plaintext token from the activation link.
+   * @returns The activated user id.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async activate(token) {
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findActivationToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired activation token" });
+    }
+    await this.store.activate(record.userId);
+    await this.store.clearActivationToken(tokenHash);
+    return record.userId;
+  }
+};
+
+// src/auth/passwordReset.ts
+var PasswordResetService = class {
+  store;
+  password;
+  ttlSeconds;
+  passwordMinLength;
+  /**
+   * @param options - Store, password hasher and policy.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.password = options.password;
+    this.ttlSeconds = options.ttlSeconds ?? 3600;
+    this.passwordMinLength = options.passwordMinLength ?? 12;
+  }
+  /**
+   * Request a reset for `email`.
+   *
+   * Returns the plaintext token only when the email maps to a user; otherwise
+   * `null`. Callers should respond with the same success shape either way to
+   * avoid user enumeration — email the token only when present.
+   *
+   * @param email - The account email.
+   * @returns The one-time token, or `null` when no user matches.
+   */
+  async request(email) {
+    const userId = await this.store.findUserIdByEmail(email.toLowerCase());
+    if (!userId) return null;
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveResetToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Confirm a reset: validate the token + new password and rehash.
+   *
+   * @param token - The plaintext reset token.
+   * @param newPassword - The new plaintext password.
+   * @throws {ValidationException} When the new password is too short.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async confirm(token, newPassword) {
+    if (newPassword.length < this.passwordMinLength) {
+      throw new ValidationException({
+        message: `Password must be at least ${this.passwordMinLength} characters`,
+        details: { minLength: this.passwordMinLength }
+      });
+    }
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findResetToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired reset token" });
+    }
+    await this.store.updatePassword(record.userId, await this.password.hash(newPassword));
+    await this.store.clearResetToken(tokenHash);
+  }
+};
+
 // src/auth/middleware.ts
 function bearerToken(req) {
   const header = req.header("authorization");
@@ -8726,6 +8909,53 @@ function makeAuthRouter(options) {
     }
     res.json(claims);
   });
+  if (options.activation) {
+    const activation = options.activation;
+    router.post(`${prefix}/activate`, async (req, res) => {
+      const { token } = activationSchema.parse(req.body);
+      const userId = await activation.activate(token);
+      res.json({ activated: true, userId });
+    });
+  }
+  if (options.passwordReset) {
+    const reset = options.passwordReset;
+    router.post(`${prefix}/password-reset/request`, async (req, res) => {
+      const { email } = passwordResetRequestSchema.parse(req.body);
+      const token = await reset.request(email);
+      res.status(202).json({ requested: true, ...token ? { token } : {} });
+    });
+    router.post(`${prefix}/password-reset/confirm`, async (req, res) => {
+      const { token, password } = passwordResetConfirmSchema.parse(req.body);
+      await reset.confirm(token, password);
+      res.json({ reset: true });
+    });
+  }
+  if (options.mfa) {
+    const mfa = options.mfa;
+    const requireUser = (req) => {
+      const claims = getAuth(req);
+      if (!claims || typeof claims.sub !== "string") {
+        throw new UnauthorizedException({ message: "Not authenticated" });
+      }
+      return claims.sub;
+    };
+    router.post(`${prefix}/mfa/enroll`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const claims = getAuth(req);
+      const userId = requireUser(req);
+      const label = typeof claims?.email === "string" ? claims.email : userId;
+      res.json(await mfa.enroll(userId, label));
+    });
+    router.post(`${prefix}/mfa/confirm`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.confirm(requireUser(req), code);
+      res.json({ enabled: true });
+    });
+    router.post(`${prefix}/mfa/disable`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.disable(requireUser(req), code);
+      res.json({ enabled: false });
+    });
+  }
   return router;
 }
 var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
@@ -8993,6 +9223,6 @@ function runServer(app, options = {}) {
   });
 }
 
-export { AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, NotFoundException, PHONE_BR_PATTERN, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
+export { ActivationService, AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, MfaService, NotFoundException, PHONE_BR_PATTERN, PasswordResetService, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, activationSchema, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaCodeSchema, mfaEnrollResponseSchema, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map