tempest-express-sdk 0.9.0 → 0.10.0

package/dist/index.js

@@ -1,4 +1,4 @@
-export { VERSION } from './chunk-4QZZGHGV.js';
+export { VERSION } from './chunk-U3SXT3KR.js';
 import { AsyncLocalStorage } from 'async_hooks';
 import { extendZodWithOpenApi, OpenAPIRegistry, OpenApiGeneratorV31, OpenApiGeneratorV3 } from '@asteasolutions/zod-to-openapi';
 export { OpenAPIRegistry } from '@asteasolutions/zod-to-openapi';
@@ -8581,6 +8581,50 @@ function makeTwilioWebhookRouter(options) {
   return router;
 }
 
+// src/integrations/email.ts
+var EmailProvider = class {
+  email;
+  subject;
+  /**
+   * @param options - The email sender and default subject.
+   */
+  constructor(options) {
+    this.email = options.email;
+    this.subject = options.subject ?? "Notification";
+  }
+  /**
+   * Send a plain-text email.
+   *
+   * @param to - Recipient address.
+   * @param text - Body text (also used as HTML).
+   * @returns A sent result.
+   */
+  async sendText(to, text) {
+    await this.email.send({ to, subject: this.subject, text });
+    return { status: "sent" };
+  }
+  /**
+   * Send an email linking to the media (caption becomes the lead text).
+   *
+   * @param to - Recipient address.
+   * @param media - The media reference (URL) + optional caption.
+   * @returns A sent result.
+   */
+  async sendMedia(to, media) {
+    const caption = media.caption ?? "";
+    await this.email.send({
+      to,
+      subject: this.subject,
+      html: `${caption ? `<p>${caption}</p>` : ""}<p><a href="${media.media}">${media.media}</a></p>`
+    });
+    return { status: "sent" };
+  }
+  /** Always `"connected"` — SMTP reachability is verified on first send. */
+  async status() {
+    return "connected";
+  }
+};
+
 // src/admin/site.ts
 var AdminSite = class {
   /**
@@ -8720,6 +8764,10 @@ var mfaEnrollResponseSchema = z.object({
   otpauthUri: z.string().openapi({ description: "otpauth:// URI to render as QR." })
 }).openapi("MfaEnrollResponse");
 var mfaCodeSchema = z.object({ code: z.string().min(1).openapi({ description: "Authenticator code." }) }).openapi("MfaCode");
+var mfaChallengeSchema = z.object({
+  mfaToken: z.string().min(1).openapi({ description: "Challenge token from login." }),
+  code: z.string().min(1).openapi({ description: "Authenticator code." })
+}).openapi("MfaChallenge");
 var activationSchema = z.object({ token: z.string().min(1).openapi({ description: "Activation token." }) }).openapi("Activation");
 var passwordResetRequestSchema = z.object({ email: z.string().email().openapi({ description: "Account email." }) }).openapi("PasswordResetRequest");
 var passwordResetConfirmSchema = z.object({
@@ -8744,6 +8792,8 @@ var UserAuthService = class {
   passwordMinLength;
   accessTtlSeconds;
   refreshTtlSeconds;
+  mfa;
+  mfaChallengeTtlSeconds;
   /**
    * @param options - Store, password/JWT helpers and token policy.
    */
@@ -8754,6 +8804,8 @@ var UserAuthService = class {
     this.passwordMinLength = options.passwordMinLength ?? 12;
     this.accessTtlSeconds = options.accessTtlSeconds ?? 3600;
     this.refreshTtlSeconds = options.refreshTtlSeconds ?? 60 * 60 * 24 * 14;
+    this.mfa = options.mfa;
+    this.mfaChallengeTtlSeconds = options.mfaChallengeTtlSeconds ?? 300;
   }
   /** Mint a signed access + refresh token pair for `user`. */
   async issueTokens(user) {
@@ -8803,7 +8855,7 @@ var UserAuthService = class {
    * Authenticate a user by email + password.
    *
    * @param data - Validated login payload.
-   * @returns The public user and a fresh token pair.
+   * @returns Full auth, or an {@link MfaChallenge} when MFA is enabled.
    * @throws {UnauthorizedException} On bad credentials or inactive account.
    */
   async login(data) {
@@ -8815,6 +8867,37 @@ var UserAuthService = class {
     if (!user.isActive) {
       throw new UnauthorizedException({ message: "Account is inactive" });
     }
+    if (this.mfa && await this.mfa.isEnabled(user.id)) {
+      const mfaToken = await this.jwt.encode(
+        { sub: user.id, type: "mfa" },
+        { ttlSeconds: this.mfaChallengeTtlSeconds }
+      );
+      return { mfaRequired: true, mfaToken };
+    }
+    return { user: toPublic(user), tokens: await this.issueTokens(user) };
+  }
+  /**
+   * Complete an MFA login challenge: verify the code and issue tokens.
+   *
+   * @param mfaToken - The challenge token from {@link login}.
+   * @param code - The authenticator code.
+   * @returns The public user and a fresh token pair.
+   * @throws {UnauthorizedException} When the challenge/code is invalid, MFA is
+   *   not configured, or the account no longer exists / is inactive.
+   */
+  async verifyMfaChallenge(mfaToken, code) {
+    if (!this.mfa) throw new UnauthorizedException({ message: "MFA not configured" });
+    const claims = await this.jwt.decodeOrNull(mfaToken);
+    if (!claims || claims.type !== "mfa" || typeof claims.sub !== "string") {
+      throw new UnauthorizedException({ message: "Invalid MFA challenge" });
+    }
+    if (!await this.mfa.verify(claims.sub, code)) {
+      throw new UnauthorizedException({ message: "Invalid MFA code" });
+    }
+    const user = await this.store.findById(claims.sub);
+    if (!user || !user.isActive) {
+      throw new UnauthorizedException({ message: "Account is inactive" });
+    }
     return { user: toPublic(user), tokens: await this.issueTokens(user) };
   }
   /**
@@ -8888,6 +8971,15 @@ var MfaService = class {
     const secret = await this.store.getSecret(userId);
     return secret ? this.totp.verify(secret, code) : false;
   }
+  /**
+   * Whether MFA is enabled for a user (used to gate the login challenge).
+   *
+   * @param userId - The user.
+   * @returns `true` when MFA is enabled.
+   */
+  async isEnabled(userId) {
+    return this.store.isEnabled(userId);
+  }
   /**
    * Disable MFA after verifying a code.
    *
@@ -9135,6 +9227,10 @@ function makeAuthRouter(options) {
   }
   if (options.mfa) {
     const mfa = options.mfa;
+    router.post(`${prefix}/mfa/challenge`, async (req, res) => {
+      const { mfaToken, code } = mfaChallengeSchema.parse(req.body);
+      res.json(await service.verifyMfaChallenge(mfaToken, code));
+    });
     const requireUser = (req) => {
       const claims = getAuth(req);
       if (!claims || typeof claims.sub !== "string") {
@@ -9436,6 +9532,6 @@ function runServer(app, options = {}) {
   });
 }
 
-export { ActivationService, AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, MfaService, NotFoundException, PHONE_BR_PATTERN, PasswordResetService, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, activationSchema, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeMetricsRouter, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaCodeSchema, mfaEnrollResponseSchema, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
+export { ActivationService, AdminSite, AppException, AttemptThrottle, BaseController, BaseModel, BaseService, CEP_PATTERN, CNPJ_PATTERN, CPF_PATTERN, CircuitOpenError, CompositeFeatureFlagBackend, ConflictException, DEFAULT_LOCALE, EmailProvider, EmailUtils, EnvFeatureFlagBackend, EventStream, ExpiredTokenException, FeatureFlags, ForbiddenException, HTTPClient, HTTP_500_MARKER, InvalidTokenException, JSONLogger, JWTUtils, LocalUploadStorage, MemoryBroker, MemoryCacheManager, MemoryFeatureFlagBackend, MemorySessionStore, MemoryThrottleBackend, MessageCatalog, MetricsUtils, MfaService, NotFoundException, PHONE_BR_PATTERN, PasswordResetService, PasswordUtils, REQUEST_ID_HEADER, RabbitBroker, RedisCacheManager, RedisSSEBroker, RedisSessionStore, Region, RetryPolicy, SSEBroker, ServerSentEvent, SessionService, TOTPHelper, TaskManager, TelegramProvider, TooManyRequestsException, TwilioSmsProvider, UF, UnauthorizedException, UserAuthService, ValidationException, WebPushDispatcher, WebPushError, WebPushGoneError, WebSocketHub, WhatsAppProvider, activationSchema, attachWebSocketHub, authResponseSchema, baseAppSettingsSchema, baseAppSettingsShape, baseResponseSchema, bearerToken, buildContentDisposition, cached3 as cached, cepField, citiesByUf, cnpjField, coerceFlag, configureLogging, corsSettingsShape, cpfField, cpfOrCnpjField, createApp, createOpenApiRegistry, createdByColumn, cursorPaginationFilterSchema, cursorPaginationSchema, databaseSettingsShape, decodeCursor, defaultMessageCatalog, defineEnum, deletedAtColumn, encodeCursor, generateOpaqueToken, generateOpenApiDocument, getAuth, getClientIp, getConditions, getPaginationConditions, getRequestId, getState, hashOpaqueToken, inboundMessageSchema, isValidCep, isValidCity, isValidCnpj, isValidCpf, isValidCpfCnpj, isValidPhoneBr, isValidUf, listStates, loadSettings, loginSchema, makeAdminRouter, makeAppExceptionHandler, makeAuthRouter, makeFlagGuard, makeHealthRouter, makeJwtAuthMiddleware, makeMetricsRouter, makeSessionMiddleware, makeTwilioWebhookRouter, makeUnhandledExceptionHandler, makeWhatsAppWebhookRouter, mfaChallengeSchema, mfaCodeSchema, mfaEnrollResponseSchema, modifyDict, mountOpenApiJson, mountRedoc, mountSwaggerUi, normalizeCep, normalizeCnpj, normalizeCpf, normalizeCpfCnpj, normalizePhoneBr, normalizeUf, notFoundHandler, onlyDigits, paginationFilterSchema, paginationSchema, parseAcceptLanguage, parseCookies, passwordResetConfirmSchema, passwordResetRequestSchema, phoneBrField, refreshSchema, registerExceptionHandlers, requestIdMiddleware, requireRoles, runServer, runWithRequestContext, serverSettingsShape, sessionCookie, setRequestId, signupSchema, sseResponse, statesByRegion, tableNameFor, toDict, toUtc, tokenFromUrl, tokenPairSchema, ufField, updatedByColumn, userPublicSchema, utcnow, validateTwilioSignature, verifyOpaqueToken, webPushKeysSchema, webPushPayloadSchema, webPushSubscriptionSchema, wsEnvelopeSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map