ysk-server-core 1.0.0

package/dist/security/mfa/rate-limit.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Sliding-window failure counter + temporary lockout (login / TOTP).
+ * In-memory; optional JSON file under dataDir for restart persistence.
+ */
+export type RateLimitConfig = {
+    /** max failures before lock */
+    maxFailures?: number;
+    /** window to count failures (ms) */
+    windowMs?: number;
+    /** lock duration after threshold (ms) */
+    lockMs?: number;
+};
+export declare function checkRateLimit(scope: string, id: string, cfg?: RateLimitConfig, now?: number): {
+    ok: true;
+} | {
+    ok: false;
+    retryAfterSec: number;
+    lockedUntil: number;
+};
+export declare function recordRateLimitFailure(scope: string, id: string, cfg?: RateLimitConfig, now?: number): {
+    locked: boolean;
+    failures: number;
+    retryAfterSec?: number;
+};
+export declare function clearRateLimit(scope: string, id: string): void;
+/** Test helper */
+export declare function _resetRateLimitsForTests(): void;
+export declare function persistRateLimits(dataDir: string): void;
+export declare function loadRateLimits(dataDir: string): void;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/security/mfa/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/security/mfa/rate-limit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,MAAM,MAAM,eAAe,GAAG;IAC5B,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAmBF,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,GAAG,GAAE,eAAoB,EACzB,GAAG,SAAa,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAiB1E;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,GAAG,GAAE,eAAoB,EACzB,GAAG,SAAa,GACf;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAkB/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,kBAAkB;AAClB,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAUvD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAapD"}

package/dist/security/mfa/rate-limit.js

@@ -0,0 +1,90 @@
+/**
+ * Sliding-window failure counter + temporary lockout (login / TOTP).
+ * In-memory; optional JSON file under dataDir for restart persistence.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+const DEFAULTS = {
+    maxFailures: 5,
+    windowMs: 15 * 60_000,
+    lockMs: 15 * 60_000,
+};
+const globalMap = new Map();
+function keyOf(scope, id) {
+    return `${scope}:${id.toLowerCase()}`;
+}
+export function checkRateLimit(scope, id, cfg = {}, now = Date.now()) {
+    void cfg;
+    const k = keyOf(scope, id);
+    const b = globalMap.get(k) ?? { fails: [] };
+    if (b.lockedUntil && b.lockedUntil > now) {
+        return {
+            ok: false,
+            retryAfterSec: Math.ceil((b.lockedUntil - now) / 1000),
+            lockedUntil: b.lockedUntil,
+        };
+    }
+    if (b.lockedUntil && b.lockedUntil <= now) {
+        b.lockedUntil = undefined;
+        b.fails = [];
+    }
+    globalMap.set(k, b);
+    return { ok: true };
+}
+export function recordRateLimitFailure(scope, id, cfg = {}, now = Date.now()) {
+    const c = { ...DEFAULTS, ...cfg };
+    const k = keyOf(scope, id);
+    const b = globalMap.get(k) ?? { fails: [] };
+    b.fails = b.fails.filter((t) => now - t < c.windowMs);
+    b.fails.push(now);
+    if (b.fails.length >= c.maxFailures) {
+        b.lockedUntil = now + c.lockMs;
+        b.fails = [];
+        globalMap.set(k, b);
+        return {
+            locked: true,
+            failures: c.maxFailures,
+            retryAfterSec: Math.ceil(c.lockMs / 1000),
+        };
+    }
+    globalMap.set(k, b);
+    return { locked: false, failures: b.fails.length };
+}
+export function clearRateLimit(scope, id) {
+    globalMap.delete(keyOf(scope, id));
+}
+/** Test helper */
+export function _resetRateLimitsForTests() {
+    globalMap.clear();
+}
+export function persistRateLimits(dataDir) {
+    try {
+        const dir = join(dataDir, 'secrets');
+        mkdirSync(dir, { recursive: true });
+        const obj = {};
+        for (const [k, v] of globalMap)
+            obj[k] = v;
+        writeFileSync(join(dir, 'rate-limits.json'), JSON.stringify(obj), 'utf8');
+    }
+    catch {
+        /* ignore */
+    }
+}
+export function loadRateLimits(dataDir) {
+    try {
+        const path = join(dataDir, 'secrets', 'rate-limits.json');
+        if (!existsSync(path))
+            return;
+        const obj = JSON.parse(readFileSync(path, 'utf8'));
+        const now = Date.now();
+        for (const [k, v] of Object.entries(obj)) {
+            if (v.lockedUntil && v.lockedUntil < now && (!v.fails || v.fails.length === 0))
+                continue;
+            globalMap.set(k, v);
+        }
+    }
+    catch {
+        /* ignore */
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/security/mfa/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/security/mfa/rate-limit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAWjC,MAAM,QAAQ,GAA8B;IAC1C,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,MAAM;IACrB,MAAM,EAAE,EAAE,GAAG,MAAM;CACpB,CAAC;AAOF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5C,SAAS,KAAK,CAAC,KAAa,EAAE,EAAU;IACtC,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,EAAU,EACV,MAAuB,EAAE,EACzB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,KAAK,GAAG,CAAC;IACT,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC5C,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;YACtD,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;QAC1C,CAAC,CAAC,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;IACf,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,EAAU,EACV,MAAuB,EAAE,EACzB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;IAClC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC,CAAC,WAAW,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;SAC1C,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,EAAU;IACtD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,wBAAwB;IACtC,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA2B,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;gBAAE,SAAS;YACzF,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC"}

package/dist/security/mfa/recovery-codes.d.ts

@@ -0,0 +1,10 @@
+/**
+ * One-time recovery codes — store only SHA-256 hashes.
+ */
+export declare function generateRecoveryCodes(count?: number): string[];
+export declare function hashRecoveryCode(code: string): string;
+export declare function consumeRecoveryCode(hashes: string[], code: string): {
+    ok: boolean;
+    remaining: string[];
+};
+//# sourceMappingURL=recovery-codes.d.ts.map

package/dist/security/mfa/recovery-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-codes.d.ts","sourceRoot":"","sources":["../../../src/security/mfa/recovery-codes.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,wBAAgB,qBAAqB,CAAC,KAAK,SAAK,GAAG,MAAM,EAAE,CAQ1D;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBtC"}

package/dist/security/mfa/recovery-codes.js

@@ -0,0 +1,38 @@
+/**
+ * One-time recovery codes — store only SHA-256 hashes.
+ */
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+export function generateRecoveryCodes(count = 10) {
+    const codes = [];
+    for (let i = 0; i < count; i++) {
+        // 8 groups of 4 hex → easy to type: abcd-ef01-...
+        const raw = randomBytes(8).toString('hex');
+        codes.push(`${raw.slice(0, 4)}-${raw.slice(4, 8)}-${raw.slice(8, 12)}-${raw.slice(12, 16)}`);
+    }
+    return codes;
+}
+export function hashRecoveryCode(code) {
+    const norm = code.trim().toLowerCase().replace(/\s+/g, '');
+    return createHash('sha256').update(norm).digest('hex');
+}
+export function consumeRecoveryCode(hashes, code) {
+    const h = hashRecoveryCode(code);
+    const next = [];
+    let ok = false;
+    for (const stored of hashes) {
+        try {
+            const a = Buffer.from(stored, 'hex');
+            const b = Buffer.from(h, 'hex');
+            if (!ok && a.length === b.length && timingSafeEqual(a, b)) {
+                ok = true;
+                continue; // drop used
+            }
+        }
+        catch {
+            /* keep */
+        }
+        next.push(stored);
+    }
+    return { ok, remaining: next };
+}
+//# sourceMappingURL=recovery-codes.js.map

package/dist/security/mfa/recovery-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-codes.js","sourceRoot":"","sources":["../../../src/security/mfa/recovery-codes.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,UAAU,qBAAqB,CAAC,KAAK,GAAG,EAAE;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,kDAAkD;QAClD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAgB,EAChB,IAAY;IAEZ,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC1D,EAAE,GAAG,IAAI,CAAC;gBACV,SAAS,CAAC,YAAY;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC"}

package/dist/security/mfa/remember-device.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Remember-device tokens — skip TOTP for limited days after successful 2FA.
+ * Token: yskdev_<base64url(payload)>.<hmac>
+ * Payload: userId|deviceId|exp
+ */
+import type { JsonStore } from '../../db/store.js';
+export declare function createRememberDeviceToken(input: {
+    dataDir: string;
+    db: JsonStore;
+    userId: string;
+    userAgent?: string;
+    ip?: string;
+    days?: number;
+}): {
+    token: string;
+    deviceId: string;
+    expiresAt: string;
+};
+export declare function verifyRememberDeviceToken(input: {
+    dataDir: string;
+    db: JsonStore;
+    userId: string;
+    token: string;
+}): boolean;
+export declare function listRememberDevices(db: JsonStore, userId: string): {
+    id: string;
+    created_at: string;
+    expires_at: string;
+    user_agent: string | undefined;
+    ip: string | undefined;
+}[];
+export declare function revokeRememberDevice(db: JsonStore, userId: string, deviceId: string): boolean;
+export declare function revokeAllRememberDevices(db: JsonStore, userId: string): number;
+//# sourceMappingURL=remember-device.d.ts.map

package/dist/security/mfa/remember-device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remember-device.d.ts","sourceRoot":"","sources":["../../../src/security/mfa/remember-device.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAUnD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA0BzD;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CA4BV;AAED,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM;;;;;;IAQhE;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAKT;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI9E"}

package/dist/security/mfa/remember-device.js

@@ -0,0 +1,112 @@
+/**
+ * Remember-device tokens — skip TOTP for limited days after successful 2FA.
+ * Token: yskdev_<base64url(payload)>.<hmac>
+ * Payload: userId|deviceId|exp
+ */
+import { createHmac, createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { resolveMasterKey } from '../ssh-identity/crypto.js';
+const DEFAULT_DAYS = 30;
+function hmacKey(dataDir) {
+    // Fail closed: never use a static fallback key in production
+    return resolveMasterKey(dataDir).key;
+}
+export function createRememberDeviceToken(input) {
+    const deviceId = randomBytes(12).toString('hex');
+    const days = input.days ?? DEFAULT_DAYS;
+    const exp = Date.now() + days * 24 * 60 * 60 * 1000;
+    const payload = `${input.userId}|${deviceId}|${exp}`;
+    const sig = createHmac('sha256', hmacKey(input.dataDir))
+        .update(payload)
+        .digest('base64url');
+    const token = `yskdev_${Buffer.from(payload).toString('base64url')}.${sig}`;
+    const hashes = loadDeviceHashes(input.db, input.userId);
+    hashes.push({
+        id: deviceId,
+        hash: createHash('sha256').update(token).digest('hex'),
+        exp,
+        ua: (input.userAgent ?? '').slice(0, 120),
+        ip: input.ip,
+        created_at: new Date().toISOString(),
+    });
+    // keep last 10
+    while (hashes.length > 10)
+        hashes.shift();
+    saveDeviceHashes(input.db, input.userId, hashes);
+    return {
+        token,
+        deviceId,
+        expiresAt: new Date(exp).toISOString(),
+    };
+}
+export function verifyRememberDeviceToken(input) {
+    if (!input.token.startsWith('yskdev_'))
+        return false;
+    const body = input.token.slice('yskdev_'.length);
+    const [pB64, sig] = body.split('.');
+    if (!pB64 || !sig)
+        return false;
+    let payload;
+    try {
+        payload = Buffer.from(pB64, 'base64url').toString('utf8');
+    }
+    catch {
+        return false;
+    }
+    const expected = createHmac('sha256', hmacKey(input.dataDir))
+        .update(payload)
+        .digest('base64url');
+    try {
+        const a = Buffer.from(sig);
+        const b = Buffer.from(expected);
+        if (a.length !== b.length || !timingSafeEqual(a, b))
+            return false;
+    }
+    catch {
+        return false;
+    }
+    const [uid, deviceId, expStr] = payload.split('|');
+    if (uid !== input.userId)
+        return false;
+    const exp = Number(expStr);
+    if (!Number.isFinite(exp) || Date.now() > exp)
+        return false;
+    const hashes = loadDeviceHashes(input.db, input.userId);
+    const h = createHash('sha256').update(input.token).digest('hex');
+    return hashes.some((d) => d.id === deviceId && d.hash === h && d.exp >= Date.now());
+}
+export function listRememberDevices(db, userId) {
+    return loadDeviceHashes(db, userId).map((d) => ({
+        id: d.id,
+        created_at: d.created_at,
+        expires_at: new Date(d.exp).toISOString(),
+        user_agent: d.ua,
+        ip: d.ip,
+    }));
+}
+export function revokeRememberDevice(db, userId, deviceId) {
+    const hashes = loadDeviceHashes(db, userId);
+    const next = hashes.filter((d) => d.id !== deviceId);
+    saveDeviceHashes(db, userId, next);
+    return next.length < hashes.length;
+}
+export function revokeAllRememberDevices(db, userId) {
+    const n = loadDeviceHashes(db, userId).length;
+    saveDeviceHashes(db, userId, []);
+    return n;
+}
+function loadDeviceHashes(db, userId) {
+    const raw = db.snapshot.settings[`devices.${userId}`];
+    if (!raw)
+        return [];
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+}
+function saveDeviceHashes(db, userId, rows) {
+    db.snapshot.settings[`devices.${userId}`] = JSON.stringify(rows);
+    db.persist();
+}
+//# sourceMappingURL=remember-device.js.map

package/dist/security/mfa/remember-device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remember-device.js","sourceRoot":"","sources":["../../../src/security/mfa/remember-device.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,SAAS,OAAO,CAAC,OAAe;IAC9B,6DAA6D;IAC7D,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAOzC;IACC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;SACrD,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACtD,GAAG;QACH,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACzC,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC,CAAC;IACH,eAAe;IACf,OAAO,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC1C,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAKzC;IACC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;SAC1D,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAa,EAAE,MAAc;IAC/D,OAAO,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACzC,UAAU,EAAE,CAAC,CAAC,EAAE;QAChB,EAAE,EAAE,CAAC,CAAC,EAAE;KACT,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,EAAa,EACb,MAAc,EACd,QAAgB;IAEhB,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACrD,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,EAAa,EAAE,MAAc;IACpE,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;IAC9C,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC;AACX,CAAC;AAWD,SAAS,gBAAgB,CAAC,EAAa,EAAE,MAAc;IACrD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAa,EAAE,MAAc,EAAE,IAAc;IACrE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjE,EAAE,CAAC,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/security/mfa/step-up.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Recent TOTP verification cache for step-up (sensitive ops).
+ * In-memory per userId; TTL default 5 minutes.
+ */
+export declare function markTotpStepUp(userId: string, now?: number): void;
+export declare function hasRecentTotpStepUp(userId: string, maxAgeMs?: number, now?: number): boolean;
+export declare function clearTotpStepUp(userId: string): void;
+export declare function _resetStepUpForTests(): void;
+//# sourceMappingURL=step-up.d.ts.map

package/dist/security/mfa/step-up.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.d.ts","sourceRoot":"","sources":["../../../src/security/mfa/step-up.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI,CAErE;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,SAAa,EACrB,GAAG,SAAa,GACf,OAAO,CAQT;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/security/mfa/step-up.js

@@ -0,0 +1,25 @@
+/**
+ * Recent TOTP verification cache for step-up (sensitive ops).
+ * In-memory per userId; TTL default 5 minutes.
+ */
+const recent = new Map();
+export function markTotpStepUp(userId, now = Date.now()) {
+    recent.set(userId, now);
+}
+export function hasRecentTotpStepUp(userId, maxAgeMs = 5 * 60_000, now = Date.now()) {
+    const t = recent.get(userId);
+    if (t == null)
+        return false;
+    if (now - t > maxAgeMs) {
+        recent.delete(userId);
+        return false;
+    }
+    return true;
+}
+export function clearTotpStepUp(userId) {
+    recent.delete(userId);
+}
+export function _resetStepUpForTests() {
+    recent.clear();
+}
+//# sourceMappingURL=step-up.js.map

package/dist/security/mfa/step-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../../../src/security/mfa/step-up.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzC,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7D,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,QAAQ,GAAG,CAAC,GAAG,MAAM,EACrB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,GAAG,GAAG,CAAC,GAAG,QAAQ,EAAE,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC"}

package/dist/security/mfa/totp-crypto.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Encrypt panel TOTP secrets at rest (reuse SSH secrets master key).
+ * Format: yskenc:v1:<base64(iv|tag|cipher)>
+ */
+export declare function isEncryptedTotpSecret(stored: string): boolean;
+export declare function encryptTotpSecret(dataDir: string, userId: string, plain: string): string;
+export declare function decryptTotpSecret(dataDir: string, userId: string, stored: string): string;
+/** Migrate plaintext → encrypted if needed */
+export declare function ensureEncryptedTotpSecret(dataDir: string, userId: string, stored: string): {
+    secret: string;
+    migrated: string | null;
+};
+//# sourceMappingURL=totp-crypto.d.ts.map

package/dist/security/mfa/totp-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-crypto.d.ts","sourceRoot":"","sources":["../../../src/security/mfa/totp-crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIxF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzF;AAED,8CAA8C;AAC9C,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAI7C"}

package/dist/security/mfa/totp-crypto.js

@@ -0,0 +1,29 @@
+/**
+ * Encrypt panel TOTP secrets at rest (reuse SSH secrets master key).
+ * Format: yskenc:v1:<base64(iv|tag|cipher)>
+ */
+import { encryptPrivateKey, decryptPrivateKey, resolveMasterKey } from '../ssh-identity/crypto.js';
+const PREFIX = 'yskenc:v1:';
+export function isEncryptedTotpSecret(stored) {
+    return stored.startsWith(PREFIX);
+}
+export function encryptTotpSecret(dataDir, userId, plain) {
+    const { key } = resolveMasterKey(dataDir);
+    const blob = encryptPrivateKey(key, `totp:${userId}`, plain);
+    return PREFIX + blob;
+}
+export function decryptTotpSecret(dataDir, userId, stored) {
+    if (!isEncryptedTotpSecret(stored))
+        return stored; // legacy plaintext
+    const blob = stored.slice(PREFIX.length);
+    const { key } = resolveMasterKey(dataDir);
+    return decryptPrivateKey(key, `totp:${userId}`, blob);
+}
+/** Migrate plaintext → encrypted if needed */
+export function ensureEncryptedTotpSecret(dataDir, userId, stored) {
+    const plain = decryptTotpSecret(dataDir, userId, stored);
+    if (isEncryptedTotpSecret(stored))
+        return { secret: plain, migrated: null };
+    return { secret: plain, migrated: encryptTotpSecret(dataDir, userId, plain) };
+}
+//# sourceMappingURL=totp-crypto.js.map

package/dist/security/mfa/totp-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-crypto.js","sourceRoot":"","sources":["../../../src/security/mfa/totp-crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEnG,MAAM,MAAM,GAAG,YAAY,CAAC;AAE5B,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,MAAc,EAAE,KAAa;IAC9E,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7D,OAAO,MAAM,GAAG,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc;IAC/E,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,mBAAmB;IACtE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,MAAc,EACd,MAAc;IAEd,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/security/mfa/webauthn.d.ts

@@ -0,0 +1,69 @@
+import type { AuthenticatorTransportFuture, RegistrationResponseJSON, AuthenticationResponseJSON } from '@simplewebauthn/server';
+import type { JsonStore } from '../../db/store.js';
+export type WebAuthnCredentialRow = {
+    id: string;
+    credentialID: string;
+    credentialPublicKey: string;
+    counter: number;
+    transports?: AuthenticatorTransportFuture[];
+    created_at: string;
+    name?: string;
+};
+export type WebAuthnUserBlob = {
+    credentials: WebAuthnCredentialRow[];
+    currentChallenge?: string;
+};
+export declare function listWebAuthnCredentials(db: JsonStore, userId: string): {
+    id: string;
+    name: string;
+    created_at: string;
+    transports: AuthenticatorTransportFuture[] | undefined;
+}[];
+export declare function beginWebAuthnRegistration(input: {
+    db: JsonStore;
+    userId: string;
+    username: string;
+    origin?: string;
+}): Promise<import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON>;
+export declare function finishWebAuthnRegistration(input: {
+    db: JsonStore;
+    userId: string;
+    response: RegistrationResponseJSON;
+    origin?: string;
+    name?: string;
+}): Promise<{
+    ok: false;
+    notes: string[];
+    credential?: undefined;
+} | {
+    ok: true;
+    credential: {
+        id: string;
+        name: string | undefined;
+    };
+    notes: string[];
+}>;
+export declare function beginWebAuthnAuthentication(input: {
+    db: JsonStore;
+    userId: string;
+    origin?: string;
+}): Promise<{
+    ok: false;
+    notes: string[];
+    options?: undefined;
+} | {
+    ok: true;
+    options: import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON;
+    notes?: undefined;
+}>;
+export declare function finishWebAuthnAuthentication(input: {
+    db: JsonStore;
+    userId: string;
+    response: AuthenticationResponseJSON;
+    origin?: string;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+}>;
+export declare function deleteWebAuthnCredential(db: JsonStore, userId: string, credRowId: string): boolean;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/security/mfa/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../../src/security/mfa/webauthn.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAkCF,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM;;;;;IAOpE;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,oFAqBA;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,wBAAwB,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;;;;;;;;;;;GA4CA;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;;;;;;;;GAgBA;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,0BAA0B,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAuC5C;AAED,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAMT"}