tempest-express-sdk 0.6.0 → 0.8.0

package/dist/index.js

@@ -1,4 +1,4 @@
-export { VERSION } from './chunk-3IDD2UXU.js';
+export { VERSION } from './chunk-JWJJAIXV.js';
 import { AsyncLocalStorage } from 'async_hooks';
 import { extendZodWithOpenApi, OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
 export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
@@ -7326,6 +7326,76 @@ function makeSessionMiddleware(service, options = {}) {
   };
 }
 
+// src/sessions/redisStore.ts
+var RedisSessionStore = class {
+  /**
+   * @param client - A connected node-redis v4 (or compatible) client.
+   * @param prefix - Key prefix. Default `sess:`.
+   */
+  constructor(client, prefix = "sess:") {
+    this.client = client;
+    this.prefix = prefix;
+  }
+  client;
+  prefix;
+  key(idHash) {
+    return `${this.prefix}${idHash}`;
+  }
+  userKey(userId) {
+    return `${this.prefix}user:${userId}`;
+  }
+  async get(idHash) {
+    const raw = await this.client.get(this.key(idHash));
+    if (raw === null) return null;
+    const session = JSON.parse(raw);
+    if (session.expiresAt <= Date.now()) {
+      await this.delete(idHash);
+      return null;
+    }
+    return session;
+  }
+  async set(session) {
+    const ttlSeconds = Math.max(1, Math.ceil((session.expiresAt - Date.now()) / 1e3));
+    await this.client.set(this.key(session.idHash), JSON.stringify(session), {
+      EX: ttlSeconds
+    });
+    await this.client.sAdd(this.userKey(session.userId), session.idHash);
+  }
+  async delete(idHash) {
+    const raw = await this.client.get(this.key(idHash));
+    await this.client.del(this.key(idHash));
+    if (raw) {
+      const session = JSON.parse(raw);
+      await this.client.sRem(this.userKey(session.userId), idHash);
+    }
+  }
+  async deleteByUser(userId) {
+    const ids = await this.client.sMembers(this.userKey(userId));
+    let count = 0;
+    for (const idHash of ids) {
+      await this.client.del(this.key(idHash));
+      await this.client.sRem(this.userKey(userId), idHash);
+      count += 1;
+    }
+    return count;
+  }
+  async listByUser(userId) {
+    const ids = await this.client.sMembers(this.userKey(userId));
+    const sessions = [];
+    const now = Date.now();
+    for (const idHash of ids) {
+      const raw = await this.client.get(this.key(idHash));
+      if (raw === null) {
+        await this.client.sRem(this.userKey(userId), idHash);
+        continue;
+      }
+      const session = JSON.parse(raw);
+      if (session.expiresAt > now) sessions.push(session);
+    }
+    return sessions.sort((a, b) => a.createdAt - b.createdAt);
+  }
+};
+
 // src/sse/eventStream.ts
 var ServerSentEvent = class {
   constructor(init) {
@@ -7498,6 +7568,92 @@ var SSEBroker = class {
   }
 };
 
+// src/sse/redisBroker.ts
+var RedisSSEBroker = class {
+  /**
+   * @param publisher - The main Redis client (used to `publish`).
+   * @param subscriber - A dedicated subscriber connection (`client.duplicate()`).
+   * @param options - Channel prefix + per-stream options.
+   */
+  constructor(publisher, subscriber, options = {}) {
+    this.publisher = publisher;
+    this.subscriber = subscriber;
+    this.prefix = options.prefix ?? "sse:";
+    const { prefix: _p, ...streamOptions } = options;
+    this.streamOptions = streamOptions;
+  }
+  publisher;
+  subscriber;
+  local = /* @__PURE__ */ new Map();
+  prefix;
+  streamOptions;
+  channelKey(channel) {
+    return `${this.prefix}${channel}`;
+  }
+  /** Emit a decoded payload to every local stream on a channel. */
+  emitLocal(channel, data, event) {
+    const set = this.local.get(channel);
+    if (!set) return;
+    for (const stream of set) stream.publish(data, event);
+  }
+  /**
+   * Register a subscriber stream, subscribing to the Redis channel on first use.
+   *
+   * @param channel - The channel name.
+   * @returns A fresh {@link EventStream} to serve to the client.
+   */
+  async register(channel) {
+    const stream = new EventStream(this.streamOptions);
+    let set = this.local.get(channel);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.local.set(channel, set);
+      await this.subscriber.subscribe(this.channelKey(channel), (raw) => {
+        try {
+          const { data, event } = JSON.parse(raw);
+          this.emitLocal(channel, data, event);
+        } catch {
+        }
+      });
+    }
+    set.add(stream);
+    return stream;
+  }
+  /**
+   * Remove a subscriber stream; unsubscribe from Redis when the last leaves.
+   *
+   * @param channel - The channel name.
+   * @param stream - The stream to remove.
+   */
+  async unregister(channel, stream) {
+    const set = this.local.get(channel);
+    if (!set) return;
+    set.delete(stream);
+    stream.close();
+    if (set.size === 0) {
+      this.local.delete(channel);
+      await this.subscriber.unsubscribe(this.channelKey(channel));
+    }
+  }
+  /** Local subscriber count on `channel` (this replica only). */
+  localSubscribers(channel) {
+    return this.local.get(channel)?.size ?? 0;
+  }
+  /**
+   * Publish to every subscriber across all replicas.
+   *
+   * @param channel - The channel name.
+   * @param data - The payload (JSON-encoded).
+   * @param event - Optional event name.
+   */
+  async publish(channel, data, event) {
+    await this.publisher.publish(
+      this.channelKey(channel),
+      JSON.stringify({ data, ...event ? { event } : {} })
+    );
+  }
+};
+
 // src/websockets/schemas.ts
 var wsEnvelopeSchema = z.object({
   type: z.string().openapi({ description: "Message type discriminator." }),
@@ -8512,6 +8668,17 @@ var authResponseSchema = z.object({
   user: userPublicSchema,
   tokens: tokenPairSchema
 }).openapi("AuthResponse");
+var mfaEnrollResponseSchema = z.object({
+  secret: z.string().openapi({ description: "Base32 TOTP secret (manual entry)." }),
+  otpauthUri: z.string().openapi({ description: "otpauth:// URI to render as QR." })
+}).openapi("MfaEnrollResponse");
+var mfaCodeSchema = z.object({ code: z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
+var activationSchema = z.object({ token: z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
+var passwordResetRequestSchema = z.object({ email: z.string().email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
+var passwordResetConfirmSchema = z.object({
+  token: z.string().min(1).openapi({ description: "Reset token." }),
+  password: z.string().min(1).openapi({ description: "New plaintext password." })
+}).openapi("PasswordResetConfirm");
 
 // src/auth/service.ts
 function toPublic(user) {
@@ -8624,6 +8791,178 @@ var UserAuthService = class {
   }
 };
 
+// src/auth/mfa.ts
+var MfaService = class {
+  store;
+  totp;
+  /**
+   * @param options - Store and TOTP helper.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.totp = options.totp;
+  }
+  /**
+   * Begin enrollment: generate and persist a secret, return the QR URI.
+   *
+   * @param userId - The enrolling user.
+   * @param accountName - Label shown in the authenticator (usually the email).
+   * @returns The secret and provisioning URI.
+   */
+  async enroll(userId, accountName) {
+    const secret = this.totp.generateSecret();
+    await this.store.setSecret(userId, secret);
+    await this.store.setEnabled(userId, false);
+    return { secret, otpauthUri: this.totp.provisioningUri(secret, accountName) };
+  }
+  /**
+   * Confirm enrollment by verifying a code, enabling MFA on success.
+   *
+   * @param userId - The user.
+   * @param code - The 6-digit code from the authenticator.
+   * @throws {ValidationException} When no secret is pending or the code is wrong.
+   */
+  async confirm(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    if (!secret) throw new ValidationException({ message: "MFA not initialized" });
+    if (!this.totp.verify(secret, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, true);
+  }
+  /**
+   * Verify a code (login step). Returns `false` without throwing.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @returns `true` when the code is valid.
+   */
+  async verify(userId, code) {
+    const secret = await this.store.getSecret(userId);
+    return secret ? this.totp.verify(secret, code) : false;
+  }
+  /**
+   * Disable MFA after verifying a code.
+   *
+   * @param userId - The user.
+   * @param code - The submitted code.
+   * @throws {ValidationException} When the code is invalid.
+   */
+  async disable(userId, code) {
+    if (!await this.verify(userId, code)) {
+      throw new ValidationException({ message: "Invalid MFA code" });
+    }
+    await this.store.setEnabled(userId, false);
+    await this.store.setSecret(userId, "");
+  }
+};
+
+// src/auth/activation.ts
+var ActivationService = class {
+  store;
+  ttlSeconds;
+  /**
+   * @param options - Store and token TTL.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.ttlSeconds = options.ttlSeconds ?? 60 * 60 * 24;
+  }
+  /**
+   * Start activation: issue a token and persist its hash.
+   *
+   * @param userId - The user to activate.
+   * @returns The one-time plaintext token (embed in the activation link).
+   */
+  async start(userId) {
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveActivationToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Activate an account from a token.
+   *
+   * @param token - The plaintext token from the activation link.
+   * @returns The activated user id.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async activate(token) {
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findActivationToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired activation token" });
+    }
+    await this.store.activate(record.userId);
+    await this.store.clearActivationToken(tokenHash);
+    return record.userId;
+  }
+};
+
+// src/auth/passwordReset.ts
+var PasswordResetService = class {
+  store;
+  password;
+  ttlSeconds;
+  passwordMinLength;
+  /**
+   * @param options - Store, password hasher and policy.
+   */
+  constructor(options) {
+    this.store = options.store;
+    this.password = options.password;
+    this.ttlSeconds = options.ttlSeconds ?? 3600;
+    this.passwordMinLength = options.passwordMinLength ?? 12;
+  }
+  /**
+   * Request a reset for `email`.
+   *
+   * Returns the plaintext token only when the email maps to a user; otherwise
+   * `null`. Callers should respond with the same success shape either way to
+   * avoid user enumeration — email the token only when present.
+   *
+   * @param email - The account email.
+   * @returns The one-time token, or `null` when no user matches.
+   */
+  async request(email) {
+    const userId = await this.store.findUserIdByEmail(email.toLowerCase());
+    if (!userId) return null;
+    const { plaintext, tokenHash } = generateOpaqueToken();
+    await this.store.saveResetToken(
+      userId,
+      tokenHash,
+      Date.now() + this.ttlSeconds * 1e3
+    );
+    return plaintext;
+  }
+  /**
+   * Confirm a reset: validate the token + new password and rehash.
+   *
+   * @param token - The plaintext reset token.
+   * @param newPassword - The new plaintext password.
+   * @throws {ValidationException} When the new password is too short.
+   * @throws {InvalidTokenException} When the token is unknown or expired.
+   */
+  async confirm(token, newPassword) {
+    if (newPassword.length < this.passwordMinLength) {
+      throw new ValidationException({
+        message: `Password must be at least ${this.passwordMinLength} characters`,
+        details: { minLength: this.passwordMinLength }
+      });
+    }
+    const tokenHash = hashOpaqueToken(token);
+    const record = await this.store.findResetToken(tokenHash);
+    if (!record || record.expiresAt <= Date.now()) {
+      throw new InvalidTokenException({ message: "Invalid or expired reset token" });
+    }
+    await this.store.updatePassword(record.userId, await this.password.hash(newPassword));
+    await this.store.clearResetToken(tokenHash);
+  }
+};
+
 // src/auth/middleware.ts
 function bearerToken(req) {
   const header = req.header("authorization");
@@ -8726,6 +9065,53 @@ function makeAuthRouter(options) {
     }
     res.json(claims);
   });
+  if (options.activation) {
+    const activation = options.activation;
+    router.post(`${prefix}/activate`, async (req, res) => {
+      const { token } = activationSchema.parse(req.body);
+      const userId = await activation.activate(token);
+      res.json({ activated: true, userId });
+    });
+  }
+  if (options.passwordReset) {
+    const reset = options.passwordReset;
+    router.post(`${prefix}/password-reset/request`, async (req, res) => {
+      const { email } = passwordResetRequestSchema.parse(req.body);
+      const token = await reset.request(email);
+      res.status(202).json({ requested: true, ...token ? { token } : {} });
+    });
+    router.post(`${prefix}/password-reset/confirm`, async (req, res) => {
+      const { token, password } = passwordResetConfirmSchema.parse(req.body);
+      await reset.confirm(token, password);
+      res.json({ reset: true });
+    });
+  }
+  if (options.mfa) {
+    const mfa = options.mfa;
+    const requireUser = (req) => {
+      const claims = getAuth(req);
+      if (!claims || typeof claims.sub !== "string") {
+        throw new UnauthorizedException({ message: "Not authenticated" });
+      }
+      return claims.sub;
+    };
+    router.post(`${prefix}/mfa/enroll`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const claims = getAuth(req);
+      const userId = requireUser(req);
+      const label = typeof claims?.email === "string" ? claims.email : userId;
+      res.json(await mfa.enroll(userId, label));
+    });
+    router.post(`${prefix}/mfa/confirm`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.confirm(requireUser(req), code);
+      res.json({ enabled: true });
+    });
+    router.post(`${prefix}/mfa/disable`, makeJwtAuthMiddleware(jwt), async (req, res) => {
+      const { code } = mfaCodeSchema.parse(req.body);
+      await mfa.disable(requireUser(req), code);
+      res.json({ enabled: false });
+    });
+  }
   return router;
 }
 var logger2 = new JSONLogger("tempest_express_sdk.api.handlers");
@@ -8993,6 +9379,6 @@ function runServer(app, options = {}) {
   });
 }
 
-export { AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, NotFoundException, PHONE_BR_PATTERN, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
+export { ActivationService, AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, MfaService, NotFoundException, PHONE_BR_PATTERN, PasswordResetService, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, activationSchema, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaCodeSchema, mfaEnrollResponseSchema, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map