tempest-express-sdk 0.6.0 → 0.8.0

package/dist/index.cjs

@@ -7329,6 +7329,76 @@ function makeSessionMiddleware(service, options = {}) {
   };
 }
 
+// src/sessions/redisStore.ts
+var RedisSessionStore = class {
+  /**
+   * @param client - A connected node-redis v4 (or compatible) client.
+   * @param prefix - Key prefix. Default `sess:`.
+   */
+  constructor(client, prefix = "sess:") {
+    this.client = client;
+    this.prefix = prefix;
+  }
+  client;
+  prefix;
+  key(idHash) {
+    return `${this.prefix}${idHash}`;
+  }
+  userKey(userId) {
+    return `${this.prefix}user:${userId}`;
+  }
+  async get(idHash) {
+    const raw = await this.client.get(this.key(idHash));
+    if (raw === null) return null;
+    const session = JSON.parse(raw);
+    if (session.expiresAt <= Date.now()) {
+      await this.delete(idHash);
+      return null;
+    }
+    return session;
+  }
+  async set(session) {
+    const ttlSeconds = Math.max(1, Math.ceil((session.expiresAt - Date.now()) / 1e3));
+    await this.client.set(this.key(session.idHash), JSON.stringify(session), {
+      EX: ttlSeconds
+    });
+    await this.client.sAdd(this.userKey(session.userId), session.idHash);
+  }
+  async delete(idHash) {
+    const raw = await this.client.get(this.key(idHash));
+    await this.client.del(this.key(idHash));
+    if (raw) {
+      const session = JSON.parse(raw);
+      await this.client.sRem(this.userKey(session.userId), idHash);
+    }
+  }
+  async deleteByUser(userId) {
+    const ids = await this.client.sMembers(this.userKey(userId));
+    let count = 0;
+    for (const idHash of ids) {
+      await this.client.del(this.key(idHash));
+      await this.client.sRem(this.userKey(userId), idHash);
+      count += 1;
+    }
+    return count;
+  }
+  async listByUser(userId) {
+    const ids = await this.client.sMembers(this.userKey(userId));
+    const sessions = [];
+    const now = Date.now();
+    for (const idHash of ids) {
+      const raw = await this.client.get(this.key(idHash));
+      if (raw === null) {
+        await this.client.sRem(this.userKey(userId), idHash);
+        continue;
+      }
+      const session = JSON.parse(raw);
+      if (session.expiresAt > now) sessions.push(session);
+    }
+    return sessions.sort((a, b) => a.createdAt - b.createdAt);
+  }
+};
+
 // src/sse/eventStream.ts
 var ServerSentEvent = class {
   constructor(init) {
@@ -7501,6 +7571,92 @@ var SSEBroker = class {
   }
 };
 
+// src/sse/redisBroker.ts
+var RedisSSEBroker = class {
+  /**
+   * @param publisher - The main Redis client (used to `publish`).
+   * @param subscriber - A dedicated subscriber connection (`client.duplicate()`).
+   * @param options - Channel prefix + per-stream options.
+   */
+  constructor(publisher, subscriber, options = {}) {
+    this.publisher = publisher;
+    this.subscriber = subscriber;
+    this.prefix = options.prefix ?? "sse:";
+    const { prefix: _p, ...streamOptions } = options;
+    this.streamOptions = streamOptions;
+  }
+  publisher;
+  subscriber;
+  local = /* @__PURE__ */ new Map();
+  prefix;
+  streamOptions;
+  channelKey(channel) {
+    return `${this.prefix}${channel}`;
+  }
+  /** Emit a decoded payload to every local stream on a channel. */
+  emitLocal(channel, data, event) {
+    const set = this.local.get(channel);
+    if (!set) return;
+    for (const stream of set) stream.publish(data, event);
+  }
+  /**
+   * Register a subscriber stream, subscribing to the Redis channel on first use.
+   *
+   * @param channel - The channel name.
+   * @returns A fresh {@link EventStream} to serve to the client.
+   */
+  async register(channel) {
+    const stream = new EventStream(this.streamOptions);
+    let set = this.local.get(channel);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.local.set(channel, set);
+      await this.subscriber.subscribe(this.channelKey(channel), (raw) => {
+        try {
+          const { data, event } = JSON.parse(raw);
+          this.emitLocal(channel, data, event);
+        } catch {
+        }
+      });
+    }
+    set.add(stream);
+    return stream;
+  }
+  /**
+   * Remove a subscriber stream; unsubscribe from Redis when the last leaves.
+   *
+   * @param channel - The channel name.
+   * @param stream - The stream to remove.
+   */
+  async unregister(channel, stream) {
+    const set = this.local.get(channel);
+    if (!set) return;
+    set.delete(stream);
+    stream.close();
+    if (set.size === 0) {
+      this.local.delete(channel);
+      await this.subscriber.unsubscribe(this.channelKey(channel));
+    }
+  }
+  /** Local subscriber count on `channel` (this replica only). */
+  localSubscribers(channel) {
+    return this.local.get(channel)?.size ?? 0;
+  }
+  /**
+   * Publish to every subscriber across all replicas.
+   *
+   * @param channel - The channel name.
+   * @param data - The payload (JSON-encoded).
+   * @param event - Optional event name.
+   */
+  async publish(channel, data, event) {
+    await this.publisher.publish(
+      this.channelKey(channel),
+      JSON.stringify({ data, ...event ? { event } : {} })
+    );
+  }
+};
+
 // src/websockets/schemas.ts
 var wsEnvelopeSchema = zod.z.object({
   type: zod.z.string().openapi({ description: "Message type discriminator." }),
@@ -8515,6 +8671,17 @@ var authResponseSchema = zod.z.object({
   user: userPublicSchema,
   tokens: tokenPairSchema
 }).openapi("AuthResponse");
+var mfaEnrollResponseSchema = zod.z.object({
+  secret: zod.z.string().openapi({ description: "Base32 TOTP secret (manual entry)." }),
+  otpauthUri: zod.z.string().openapi({ description: "otpauth:// URI to render as QR." })
+}).openapi("MfaEnrollResponse");
+var mfaCodeSchema = zod.z.object({ code: zod.z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
+var activationSchema = zod.z.object({ token: zod.z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
+var passwordResetRequestSchema = zod.z.object({ email: zod.z.string().email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
+var passwordResetConfirmSchema = zod.z.object({
+  token: zod.z.string().min(1).openapi({ description: "Reset token." }),
+  password: zod.z.string().min(1).openapi({ description: "New plaintext password." })
+}).openapi("PasswordResetConfirm");
 
 // src/auth/service.ts
 function toPublic(user) {
@@ -8627,6 +8794,178 @@ var UserAuthService = class {
   }
 };
 
+// src/auth/mfa.ts
+var MfaService = class {
+  store;
+  totp;
+  /**
+   * @param options - Store and TOTP helper.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.totp = options.totp;
+  }
+  /**
+   * Begin enrollment: generate and persist a secret, return the QR URI.
+   *
+   * @param userId - The enrolling user.
+   * @param accountName - Label shown in the authenticator (usually the email).
+   * @returns The secret and provisioning URI.
+   */
+  async enroll(userId, accountName) {
+    const secret = this.totp.generateSecret();
+    await this.store.setSecret(userId, secret);
+    await this.store.setEnabled(userId, false);
+    return { secret, otpauthUri: this.totp.provisioningUri(secret, accountName) };
+  }
+  /**
+   * Confirm enrollment by verifying a code, enabling MFA on success.
+   *
+   * @param userId - The user.
+   * @param code - The 6-digit code from the authenticator.
+   * @throws {ValidationException} When no secret is pending or the code is wrong.
+   */
+  async confirm(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    if (!secret) throw new ValidationException({ message: "MFA not initialized" });
+    if (!this.totp.verify(secret, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, true);
+  }
+  /**
+   * Verify a code (login step). Returns `false` without throwing.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @returns `true` when the code is valid.
+   */
+  async verify(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    return secret ? this.totp.verify(secret, code) : false;
+  }
+  /**
+   * Disable MFA after verifying a code.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @throws {ValidationException} When the code is invalid.
+   */
+  async disable(userId, code) {
+    if (!await this.verify(userId, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, false);
+    await this.store.setSecret(userId, "");
+  }
+};
+
+// src/auth/activation.ts
+var ActivationService = class {
+  store;
+  ttlSeconds;
+  /**
+   * @param options - Store and token TTL.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.ttlSeconds = options.ttlSeconds ?? 60 * 60 * 24;
+  }
+  /**
+   * Start activation: issue a token and persist its hash.
+   *
+   * @param userId - The user to activate.
+   * @returns The one-time plaintext token (embed in the activation link).
+   */
+  async start(userId) {
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveActivationToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Activate an account from a token.
+   *
+   * @param token - The plaintext token from the activation link.
+   * @returns The activated user id.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async activate(token) {
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findActivationToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired activation token" });
+    }
+    await this.store.activate(record.userId);
+    await this.store.clearActivationToken(tokenHash);
+    return record.userId;
+  }
+};
+
+// src/auth/passwordReset.ts
+var PasswordResetService = class {
+  store;
+  password;
+  ttlSeconds;
+  passwordMinLength;
+  /**
+   * @param options - Store, password hasher and policy.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.password = options.password;
+    this.ttlSeconds = options.ttlSeconds ?? 3600;
+    this.passwordMinLength = options.passwordMinLength ?? 12;
+  }
+  /**
+   * Request a reset for `email`.
+   *
+   * Returns the plaintext token only when the email maps to a user; otherwise
+   * `null`. Callers should respond with the same success shape either way to
+   * avoid user enumeration — email the token only when present.
+   *
+   * @param email - The account email.
+   * @returns The one-time token, or `null` when no user matches.
+   */
+  async request(email) {
+    const userId = await this.store.findUserIdByEmail(email.toLowerCase());
+    if (!userId) return null;
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveResetToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Confirm a reset: validate the token + new password and rehash.
+   *
+   * @param token - The plaintext reset token.
+   * @param newPassword - The new plaintext password.
+   * @throws {ValidationException} When the new password is too short.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async confirm(token, newPassword) {
+    if (newPassword.length < this.passwordMinLength) {
+      throw new ValidationException({
+        message: `Password must be at least ${this.passwordMinLength} characters`,
+        details: { minLength: this.passwordMinLength }
+      });
+    }
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findResetToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired reset token" });
+    }
+    await this.store.updatePassword(record.userId, await this.password.hash(newPassword));
+    await this.store.clearResetToken(tokenHash);
+  }
+};
+
 // src/auth/middleware.ts
 function bearerToken(req) {
   const header = req.header("authorization");
@@ -8729,6 +9068,53 @@ function makeAuthRouter(options) {
     }
     res.json(claims);
   });
+  if (options.activation) {
+    const activation = options.activation;
+    router.post(`${prefix}/activate`, async (req, res) => {
+      const { token } = activationSchema.parse(req.body);
+      const userId = await activation.activate(token);
+      res.json({ activated: true, userId });
+    });
+  }
+  if (options.passwordReset) {
+    const reset = options.passwordReset;
+    router.post(`${prefix}/password-reset/request`, async (req, res) => {
+      const { email } = passwordResetRequestSchema.parse(req.body);
+      const token = await reset.request(email);
+      res.status(202).json({ requested: true, ...token ? { token } : {} });
+    });
+    router.post(`${prefix}/password-reset/confirm`, async (req, res) => {
+      const { token, password } = passwordResetConfirmSchema.parse(req.body);
+      await reset.confirm(token, password);
+      res.json({ reset: true });
+    });
+  }
+  if (options.mfa) {
+    const mfa = options.mfa;
+    const requireUser = (req) => {
+      const claims = getAuth(req);
+      if (!claims || typeof claims.sub !== "string") {
+        throw new UnauthorizedException({ message: "Not authenticated" });
+      }
+      return claims.sub;
+    };
+    router.post(`${prefix}/mfa/enroll`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const claims = getAuth(req);
+      const userId = requireUser(req);
+      const label = typeof claims?.email === "string" ? claims.email : userId;
+      res.json(await mfa.enroll(userId, label));
+    });
+    router.post(`${prefix}/mfa/confirm`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.confirm(requireUser(req), code);
+      res.json({ enabled: true });
+    });
+    router.post(`${prefix}/mfa/disable`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.disable(requireUser(req), code);
+      res.json({ enabled: false });
+    });
+  }
   return router;
 }
 var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
@@ -8997,7 +9383,7 @@ function runServer(app, options = {}) {
 }
 
 // src/version.ts
-var VERSION = "0.6.0";
+var VERSION = "0.8.0";
 
 Object.defineProperty(exports, "OpenAPIRegistry", {
   enumerable: true,
@@ -9151,6 +9537,7 @@ Object.defineProperty(exports, "update", {
   enumerable: true,
   get: function () { return tempestDbJs.update; }
 });
+exports.ActivationService = ActivationService;
 exports.AdminSite = AdminSite;
 exports.AppException = AppException;
 exports.AttemptThrottle = AttemptThrottle;
@@ -9183,12 +9570,16 @@ exports.MemorySessionStore = MemorySessionStore;
 exports.MemoryThrottleBackend = MemoryThrottleBackend;
 exports.MessageCatalog = MessageCatalog;
 exports.MetricsUtils = MetricsUtils;
+exports.MfaService = MfaService;
 exports.NotFoundException = NotFoundException;
 exports.PHONE_BR_PATTERN = PHONE_BR_PATTERN;
+exports.PasswordResetService = PasswordResetService;
 exports.PasswordUtils = PasswordUtils;
 exports.REQUEST_ID_HEADER = REQUEST_ID_HEADER;
 exports.RabbitBroker = RabbitBroker;
 exports.RedisCacheManager = RedisCacheManager;
+exports.RedisSSEBroker = RedisSSEBroker;
+exports.RedisSessionStore = RedisSessionStore;
 exports.Region = Region;
 exports.RetryPolicy = RetryPolicy;
 exports.SSEBroker = SSEBroker;
@@ -9209,6 +9600,7 @@ exports.WebPushError = WebPushError;
 exports.WebPushGoneError = WebPushGoneError;
 exports.WebSocketHub = WebSocketHub;
 exports.WhatsAppProvider = WhatsAppProvider;
+exports.activationSchema = activationSchema;
 exports.attachWebSocketHub = attachWebSocketHub;
 exports.authResponseSchema = authResponseSchema;
 exports.baseAppSettingsSchema = baseAppSettingsSchema;
@@ -9266,6 +9658,8 @@ exports.makeSessionMiddleware = makeSessionMiddleware;
 exports.makeTwilioWebhookRouter = makeTwilioWebhookRouter;
 exports.makeUnhandledExceptionHandler = makeUnhandledExceptionHandler;
 exports.makeWhatsAppWebhookRouter = makeWhatsAppWebhookRouter;
+exports.mfaCodeSchema = mfaCodeSchema;
+exports.mfaEnrollResponseSchema = mfaEnrollResponseSchema;
 exports.modifyDict = modifyDict;
 exports.mountOpenApiJson = mountOpenApiJson;
 exports.mountRedoc = mountRedoc;
@@ -9282,6 +9676,8 @@ exports.paginationFilterSchema = paginationFilterSchema;
 exports.paginationSchema = paginationSchema;
 exports.parseAcceptLanguage = parseAcceptLanguage;
 exports.parseCookies = parseCookies;
+exports.passwordResetConfirmSchema = passwordResetConfirmSchema;
+exports.passwordResetRequestSchema = passwordResetRequestSchema;
 exports.phoneBrField = phoneBrField;
 exports.refreshSchema = refreshSchema;
 exports.registerExceptionHandlers = registerExceptionHandlers;