@antelopejs/dms 0.4.6 → 0.4.8

package/dist/test/unit/db/notification-feed-index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-feed-index.test.js","sourceRoot":"","sources":["../../../../src/test/unit/db/notification-feed-index.test.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAC9B,+CAAgE;AAChE,yCAAkD;AAIlD,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAG9C,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,KAAK,UAAU,YAAY;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAM,IAAA,mBAAc,EAAC,mCAA0B,CAAC,CAAC,CAC5D,eAAe,CAChB,CAAC;YACF,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,QAAQ,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAChF,EAAE,CAAC,sEAAsE,EAAE,KAAK;QAC9E,IAAI,CAAC,OAAO,CAAC,uBAAuB,GAAG,gBAAgB,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAA,aAAM,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACrE,IAAA,aAAM,EAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;YAC3C,WAAW;YACX,QAAQ;YACR,WAAW;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/db/notification-preferences.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/db/notification-preferences.test.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const chai_1 = require("chai");
+const userNotificationPreferences_model_1 = require("../../../db/models/userNotificationPreferences.model");
+const USER_ID = "notification-preferences-concurrent-user";
+const CONCURRENT_READS = 5;
+describe("[unit] notification preferences — one row per user", () => {
+    const model = (0, interface_database_decorators_1.GetModel)(userNotificationPreferences_model_1.UserNotificationPreferencesModel);
+    after(async () => {
+        await model.table.getAll(USER_ID, "userId").delete().run();
+    });
+    it("creates a single row under concurrent first reads, and every read gets it", async () => {
+        const results = await Promise.all(Array.from({ length: CONCURRENT_READS }, () => model.getOrCreatePreferences(USER_ID)));
+        const rows = await model.table.getAll(USER_ID, "userId").run();
+        (0, chai_1.expect)(rows.map((row) => row._id)).to.deep.equal([USER_ID]);
+        for (const result of results)
+            (0, chai_1.expect)(result._id).to.equal(USER_ID);
+    });
+});
+//# sourceMappingURL=notification-preferences.test.js.map

package/dist/test/unit/db/notification-preferences.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-preferences.test.js","sourceRoot":"","sources":["../../../../src/test/unit/db/notification-preferences.test.ts"],"names":[],"mappings":";;AAAA,6FAAqE;AACrE,+BAA8B;AAC9B,4GAAwG;AAExG,MAAM,OAAO,GAAG,0CAA0C,CAAC;AAC3D,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,oEAAgC,CAAC,CAAC;IAEzD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAC5C,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CACtC,CACF,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/D,IAAA,aAAM,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAA,aAAM,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/db/session-refresh-token.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/db/session-refresh-token.test.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const chai_1 = require("chai");
+const db_1 = require("@antelopejs/interface-dms/auth/db");
+const USER_ID = "session-refresh-token-user";
+const LEGACY_SESSION_ID = "session-refresh-token-legacy";
+const HASHED_SESSION_ID = "session-refresh-token-hashed";
+const ONE_MINUTE_MS = 60_000;
+describe("[unit] session refresh tokens — stored hashed, rotated against the database", () => {
+    const model = (0, interface_database_decorators_1.GetModel)(db_1.SessionModel);
+    function insertSession(id, refreshToken) {
+        const now = new Date();
+        return model.insert({
+            _id: id,
+            userId: USER_ID,
+            refreshToken,
+            userAgent: "",
+            ip: "",
+            browser: "",
+            os: "",
+            deviceType: "",
+            location: "",
+            createdAt: now,
+            lastActiveAt: now,
+        });
+    }
+    after(async () => {
+        await model.deleteByUserId(USER_ID);
+    });
+    it("rotates a legacy plaintext row once and leaves no plaintext behind", async () => {
+        await insertSession(LEGACY_SESSION_ID, "legacy-T0");
+        const rotatedAt = new Date();
+        (0, chai_1.expect)(await model.rotateRefreshToken(LEGACY_SESSION_ID, "legacy-T0", "legacy-T1", rotatedAt)).to.equal("legacy-T1");
+        const session = await model.get(LEGACY_SESSION_ID);
+        (0, chai_1.expect)(session?.refreshToken).to.equal("");
+        (0, chai_1.expect)((0, db_1.isCurrentRefreshToken)(session, "legacy-T1")).to.equal(true);
+        (0, chai_1.expect)((0, db_1.isCurrentRefreshToken)(session, "legacy-T0")).to.equal(false);
+    });
+    it("rotates a hashed row and hands the successor to a late predecessor holder", async () => {
+        await insertSession(HASHED_SESSION_ID, "");
+        await model.replaceRefreshToken(HASHED_SESSION_ID, "T1");
+        const rotatedAt = new Date();
+        (0, chai_1.expect)(await model.rotateRefreshToken(HASHED_SESSION_ID, "T1", "T2", rotatedAt)).to.equal("T2");
+        (0, chai_1.expect)(await model.rotateRefreshToken(HASHED_SESSION_ID, "T1", "loser", rotatedAt)).to.equal("T2");
+        (0, chai_1.expect)(await model.rotateRefreshToken(HASHED_SESSION_ID, "T1", "late", new Date(rotatedAt.getTime() + ONE_MINUTE_MS))).to.equal(null);
+        const session = await model.get(HASHED_SESSION_ID);
+        (0, chai_1.expect)(session?.refreshToken).to.equal("");
+        (0, chai_1.expect)((0, db_1.isCurrentRefreshToken)(session, "T2")).to.equal(true);
+    });
+});
+//# sourceMappingURL=session-refresh-token.test.js.map

package/dist/test/unit/db/session-refresh-token.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-refresh-token.test.js","sourceRoot":"","sources":["../../../../src/test/unit/db/session-refresh-token.test.ts"],"names":[],"mappings":";;AAAA,6FAAqE;AACrE,+BAA8B;AAC9B,0DAG2C;AAE3C,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAC7C,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AACzD,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AACzD,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,QAAQ,CAAC,6EAA6E,EAAE,GAAG,EAAE;IAC3F,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,iBAAY,CAAC,CAAC;IAErC,SAAS,aAAa,CAAC,EAAU,EAAE,YAAoB;QACrD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,MAAM,CAAC;YAClB,GAAG,EAAE,EAAE;YACP,MAAM,EAAE,OAAO;YACf,YAAY;YACZ,SAAS,EAAE,EAAE;YACb,EAAE,EAAE,EAAE;YACN,OAAO,EAAE,EAAE;YACX,EAAE,EAAE,EAAE;YACN,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,aAAa,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAE7B,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAC5B,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,SAAS,CACV,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAExB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACnD,IAAA,aAAM,EAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,IAAA,0BAAqB,EAAC,OAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpE,IAAA,aAAM,EAAC,IAAA,0BAAqB,EAAC,OAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,aAAa,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAE7B,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CACzE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAC5B,iBAAiB,EACjB,IAAI,EACJ,OAAO,EACP,SAAS,CACV,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAC5B,iBAAiB,EACjB,IAAI,EACJ,MAAM,EACN,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAC9C,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEjB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACnD,IAAA,aAAM,EAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,IAAA,0BAAqB,EAAC,OAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/db/session-sweep.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/db/session-sweep.test.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const chai_1 = require("chai");
+const db_1 = require("@antelopejs/interface-dms/auth/db");
+const config_1 = require("../../../config");
+const sweep_expired_sessions_1 = require("../../../crons/sweep-expired-sessions");
+const USER_ID = "session-sweep-user";
+const STALE_SESSION_ID = "session-sweep-stale";
+const ACTIVE_SESSION_ID = "session-sweep-active";
+const ONE_MINUTE_MS = 60_000;
+describe("[unit] session sweep — idle sessions past the refresh token lifetime", () => {
+    const model = (0, interface_database_decorators_1.GetModel)(db_1.SessionModel);
+    const now = new Date();
+    const lifetime = (0, config_1.getAuthConfig)().refreshTokenLifetime;
+    function insertSession(id, lastActiveAt) {
+        return model.insert({
+            _id: id,
+            userId: USER_ID,
+            refreshToken: "",
+            userAgent: "",
+            ip: "",
+            browser: "",
+            os: "",
+            deviceType: "",
+            location: "",
+            createdAt: lastActiveAt,
+            lastActiveAt,
+        });
+    }
+    before(async () => {
+        await insertSession(STALE_SESSION_ID, new Date(now.getTime() - lifetime - ONE_MINUTE_MS));
+        await insertSession(ACTIVE_SESSION_ID, new Date(now.getTime() - lifetime + ONE_MINUTE_MS));
+    });
+    after(async () => {
+        await model.deleteByUserId(USER_ID);
+    });
+    it("deletes a session idle for longer than a refresh token lives, and keeps the others", async () => {
+        await (0, sweep_expired_sessions_1.runSweepExpiredSessions)(now);
+        (0, chai_1.expect)(await model.get(STALE_SESSION_ID)).to.equal(undefined);
+        (0, chai_1.expect)((await model.get(ACTIVE_SESSION_ID))?._id).to.equal(ACTIVE_SESSION_ID);
+    });
+});
+//# sourceMappingURL=session-sweep.test.js.map

package/dist/test/unit/db/session-sweep.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sweep.test.js","sourceRoot":"","sources":["../../../../src/test/unit/db/session-sweep.test.ts"],"names":[],"mappings":";;AAAA,6FAAqE;AACrE,+BAA8B;AAC9B,0DAAiE;AACjE,4CAAgD;AAChD,kFAAgF;AAEhF,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACjD,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,QAAQ,CAAC,sEAAsE,EAAE,GAAG,EAAE;IACpF,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,iBAAY,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAA,sBAAa,GAAE,CAAC,oBAAoB,CAAC;IAEtD,SAAS,aAAa,CAAC,EAAU,EAAE,YAAkB;QACnD,OAAO,KAAK,CAAC,MAAM,CAAC;YAClB,GAAG,EAAE,EAAE;YACP,MAAM,EAAE,OAAO;YACf,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,EAAE;YACb,EAAE,EAAE,EAAE;YACN,OAAO,EAAE,EAAE;YACX,EAAE,EAAE,EAAE;YACN,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,YAAY;YACvB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,KAAK,IAAI,EAAE;QAChB,MAAM,aAAa,CACjB,gBAAgB,EAChB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,aAAa,CAAC,CACnD,CAAC;QACF,MAAM,aAAa,CACjB,iBAAiB,EACjB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,aAAa,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,IAAA,gDAAuB,EAAC,GAAG,CAAC,CAAC;QAEnC,IAAA,aAAM,EAAC,MAAM,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAA,aAAM,EAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CACxD,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/interfaces/dms/password-policy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/interfaces/dms/password-policy.test.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const password_1 = require("@antelopejs/interface-dms/auth/password");
+const COMPLIANT_PASSWORD = "StrongP@ss1";
+const ALLOWED_SPECIAL_CHARS = "@$!%*?&";
+describe("[unit] auth/password policy", () => {
+    it("requires at least 8 characters", () => {
+        (0, chai_1.expect)(password_1.PASSWORD_MIN_LENGTH).to.equal(8);
+    });
+    it("accepts a password meeting every rule", () => {
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)(COMPLIANT_PASSWORD)).to.equal(true);
+    });
+    it("accepts a password of exactly the minimum length", () => {
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)("Abcdef1@")).to.equal(true);
+    });
+    it("accepts every allowed special character", () => {
+        for (const special of ALLOWED_SPECIAL_CHARS) {
+            (0, chai_1.expect)((0, password_1.isPasswordCompliant)(`Abcdef1${special}`), special).to.equal(true);
+        }
+    });
+    it("rejects a password shorter than the minimum length", () => {
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)("Abcde1@")).to.equal(false);
+    });
+    it("rejects a password without an uppercase letter", () => {
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)("weakp@ss1")).to.equal(false);
+    });
+    it("rejects a password without a digit", () => {
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)("Weakpass@")).to.equal(false);
+    });
+    it("rejects a password without a special character", () => {
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)("Weakpass1")).to.equal(false);
+    });
+    it("rejects a character outside the allowed set", () => {
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)("StrongP@ss1#")).to.equal(false);
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)("StrongP@ss1 ")).to.equal(false);
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)("StrongP@ss1é")).to.equal(false);
+    });
+    it("rejects an empty password", () => {
+        (0, chai_1.expect)((0, password_1.isPasswordCompliant)("")).to.equal(false);
+    });
+});
+//# sourceMappingURL=password-policy.test.js.map

package/dist/test/unit/interfaces/dms/password-policy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.test.js","sourceRoot":"","sources":["../../../../../src/test/unit/interfaces/dms/password-policy.test.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAC9B,sEAGiD;AAEjD,MAAM,kBAAkB,GAAG,aAAa,CAAC;AACzC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAExC,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,IAAA,aAAM,EAAC,8BAAmB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC5C,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,UAAU,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,IAAA,aAAM,EAAC,IAAA,8BAAmB,EAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/interfaces/dms-auth/refresh-token-rotation.test.js

@@ -1,10 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = require("node:crypto");
 const chai_1 = require("chai");
 const sessions_model_1 = require("@antelopejs/interface-dms/auth/db/models/sessions.model");
-function createSession(refreshToken) {
+function sha256(token) {
+    return (0, node_crypto_1.createHash)("sha256").update(token).digest("hex");
+}
+function createLegacySession(refreshToken) {
     return { _id: "session", refreshToken };
 }
+function matchesPresented(session, presentedHash) {
+    if (session.refreshTokenHash) {
+        return session.refreshTokenHash === presentedHash;
+    }
+    return (!!session.refreshToken && sha256(session.refreshToken) === presentedHash);
+}
 function createModel() {
     const model = Object.create(sessions_model_1.SessionModel.prototype);
     let update;
@@ -18,9 +28,11 @@ function createModel() {
                     return query;
                 },
                 run: async () => {
-                    if (model.currentSession?.refreshToken !== "T0")
+                    const session = model.currentSession;
+                    if (!session ||
+                        !matchesPresented(session, update.previousRefreshTokenHash))
                         return 0;
-                    Object.assign(model.currentSession, update);
+                    Object.assign(session, update);
                     return 1;
                 },
             };
@@ -34,20 +46,20 @@ describe("refresh token rotation", () => {
     const committedAt = new Date("2026-08-28T12:00:00.000Z");
     it("returns the canonical winner to a concurrent CAS loser", async () => {
         const model = createModel();
-        model.currentSession = createSession("T0");
+        model.currentSession = createLegacySession("T0");
         (0, chai_1.expect)(await model.rotateRefreshToken("session", "T0", "T1", committedAt)).to.equal("T1");
         (0, chai_1.expect)(await model.rotateRefreshToken("session", "T0", "loser", committedAt)).to.equal("T1");
     });
     it("accepts a loser that began just before the winning commit", async () => {
         const model = createModel();
-        model.currentSession = createSession("T0");
+        model.currentSession = createLegacySession("T0");
         const loserStartedAt = new Date(committedAt.getTime() - 1);
         await model.rotateRefreshToken("session", "T0", "T1", committedAt);
         (0, chai_1.expect)(await model.rotateRefreshToken("session", "T0", "loser", loserStartedAt)).to.equal("T1");
     });
     it("recovers a late duplicate and response-loss retry", async () => {
         const model = createModel();
-        model.currentSession = createSession("T0");
+        model.currentSession = createLegacySession("T0");
         await model.rotateRefreshToken("session", "T0", "T1", committedAt);
         const retryAt = new Date(committedAt.getTime() + 10_000);
         (0, chai_1.expect)(await model.rotateRefreshToken("session", "T0", "discarded", retryAt)).to.equal("T1");
@@ -55,7 +67,7 @@ describe("refresh token rotation", () => {
     });
     it("does not slide predecessor expiry", async () => {
         const model = createModel();
-        model.currentSession = createSession("T0");
+        model.currentSession = createLegacySession("T0");
         await model.rotateRefreshToken("session", "T0", "T1", committedAt);
         await model.rotateRefreshToken("session", "T0", "discarded", new Date(committedAt.getTime() + 10_000));
         const expiredAt = new Date(committedAt.getTime() + sessions_model_1.REFRESH_TOKEN_PREDECESSOR_GRACE_MS + 1);
@@ -63,7 +75,7 @@ describe("refresh token rotation", () => {
     });
     it("rejects other tokens and deleted sessions", async () => {
         const model = createModel();
-        model.currentSession = createSession("T0");
+        model.currentSession = createLegacySession("T0");
         await model.rotateRefreshToken("session", "T0", "T1", committedAt);
         (0, chai_1.expect)(await model.rotateRefreshToken("session", "other", "discarded", committedAt)).to.equal(null);
         model.currentSession = undefined;
@@ -71,7 +83,7 @@ describe("refresh token rotation", () => {
     });
     it("clears predecessor state on replacement", async () => {
         const model = createModel();
-        model.currentSession = createSession("T0");
+        model.currentSession = createLegacySession("T0");
         await model.rotateRefreshToken("session", "T0", "T1", committedAt);
         Object.defineProperty(model, "update", {
             value: async (_id, update) => {
@@ -84,5 +96,58 @@ describe("refresh token rotation", () => {
         await model.replaceRefreshToken("session", "replacement");
         (0, chai_1.expect)(await model.rotateRefreshToken("session", "T0", "discarded", committedAt)).to.equal(null);
     });
+    it("keeps no refresh token in plaintext once rotated", async () => {
+        const model = createModel();
+        model.currentSession = createLegacySession("T0");
+        await model.rotateRefreshToken("session", "T0", "T1", committedAt);
+        const session = model.currentSession;
+        (0, chai_1.expect)(session.refreshToken).to.equal("");
+        (0, chai_1.expect)(session.refreshTokenHash).to.equal(sha256("T1"));
+        (0, chai_1.expect)(session.sealedRefreshToken).to.be.a("string");
+        (0, chai_1.expect)(session.sealedRefreshToken).to.not.include("T1");
+        (0, chai_1.expect)((0, sessions_model_1.isCurrentRefreshToken)(session, "T1")).to.equal(true);
+        (0, chai_1.expect)((0, sessions_model_1.isCurrentRefreshToken)(session, "T0")).to.equal(false);
+    });
+    it("accepts a legacy plaintext token once, then only its successor", async () => {
+        const model = createModel();
+        model.currentSession = createLegacySession("T0");
+        (0, chai_1.expect)((0, sessions_model_1.isCurrentRefreshToken)(model.currentSession, "T0")).to.equal(true);
+        await model.rotateRefreshToken("session", "T0", "T1", committedAt);
+        const afterGrace = new Date(committedAt.getTime() + sessions_model_1.REFRESH_TOKEN_PREDECESSOR_GRACE_MS + 1);
+        (0, chai_1.expect)(await model.rotateRefreshToken("session", "T0", "discarded", afterGrace)).to.equal(null);
+        (0, chai_1.expect)(await model.rotateRefreshToken("session", "T1", "T2", afterGrace)).to.equal("T2");
+    });
+    it("hands the sealed successor back to a holder of the predecessor", async () => {
+        const model = createModel();
+        model.currentSession = createLegacySession("T0");
+        await model.rotateRefreshToken("session", "T0", "T1", committedAt);
+        const secondRotation = new Date(committedAt.getTime() + 60_000);
+        await model.rotateRefreshToken("session", "T1", "T2", secondRotation);
+        (0, chai_1.expect)(await model.rotateRefreshToken("session", "T1", "loser", secondRotation)).to.equal("T2");
+    });
+    it("opens nothing for a predecessor the successor was not sealed under", async () => {
+        const model = createModel();
+        model.currentSession = createLegacySession("T0");
+        await model.rotateRefreshToken("session", "T0", "T1", committedAt);
+        model.currentSession.previousRefreshTokenHash =
+            sha256("forged");
+        (0, chai_1.expect)(await model.rotateRefreshToken("session", "forged", "loser", committedAt)).to.equal(null);
+    });
+    it("stores only the hash on replacement", async () => {
+        const model = createModel();
+        model.currentSession = createLegacySession("T0");
+        Object.defineProperty(model, "update", {
+            value: async (_id, update) => {
+                Object.assign(model.currentSession, update);
+                return 1;
+            },
+        });
+        await model.replaceRefreshToken("session", "replacement");
+        const session = model.currentSession;
+        (0, chai_1.expect)(session.refreshToken).to.equal("");
+        (0, chai_1.expect)(session.sealedRefreshToken).to.equal(null);
+        (0, chai_1.expect)((0, sessions_model_1.isCurrentRefreshToken)(session, "replacement")).to.equal(true);
+        (0, chai_1.expect)((0, sessions_model_1.isCurrentRefreshToken)(session, "T0")).to.equal(false);
+    });
 });
 //# sourceMappingURL=refresh-token-rotation.test.js.map

package/dist/test/unit/interfaces/dms-auth/refresh-token-rotation.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token-rotation.test.js","sourceRoot":"","sources":["../../../../../src/test/unit/interfaces/dms-auth/refresh-token-rotation.test.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAC9B,4FAGiE;AA6BjE,SAAS,aAAa,CAAC,YAAoB;IACzC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAa,CAAC;AACrD,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,6BAAY,CAAC,SAAS,CAAc,CAAC;IACjE,IAAI,MAAsB,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAmC,CAAC;IACxD,WAAW,CAAC,KAAK,GAAG;QAClB,MAAM,EAAE,GAAG,EAAE;YACX,MAAM,KAAK,GAAc;gBACvB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;gBACnB,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE;oBACrB,MAAM,GAAG,UAAU,CAAC;oBACpB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,IAAI,KAAK,CAAC,cAAc,EAAE,YAAY,KAAK,IAAI;wBAAE,OAAO,CAAC,CAAC;oBAC1D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;oBAC5C,OAAO,CAAC,CAAC;gBACX,CAAC;aACF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;IACF,KAAK,CAAC,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAEzD,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAE3C,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CACnE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CACtE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEnE,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CACzE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;QAEzD,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CACtE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAA,aAAM,EAAC,KAAK,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAC/D,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC,kBAAkB,CAC5B,SAAS,EACT,IAAI,EACJ,WAAW,EACX,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CACzC,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,WAAW,CAAC,OAAO,EAAE,GAAG,mDAAkC,GAAG,CAAC,CAC/D,CAAC;QAEF,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CACxE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAC5B,SAAS,EACT,OAAO,EACP,WAAW,EACX,WAAW,CACZ,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEjB,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACjC,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAC1E,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE;YACrC,KAAK,EAAE,KAAK,EAAE,GAAW,EAAE,MAAwB,EAAE,EAAE;gBACrD,IAAI,CAAC,KAAK,CAAC,cAAc;oBAAE,OAAO,CAAC,CAAC;gBACpC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;gBAC5C,OAAO,CAAC,CAAC;YACX,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAE1D,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAC1E,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"refresh-token-rotation.test.js","sourceRoot":"","sources":["../../../../../src/test/unit/interfaces/dms-auth/refresh-token-rotation.test.ts"],"names":[],"mappings":";;AAAA,6CAAyC;AACzC,+BAA8B;AAC9B,4FAIiE;AA+BjE,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAGD,SAAS,mBAAmB,CAAC,YAAoB;IAC/C,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,YAAY,EAAa,CAAC;AACrD,CAAC;AAOD,SAAS,gBAAgB,CAAC,OAAgB,EAAE,aAAqB;IAC/D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,gBAAgB,KAAK,aAAa,CAAC;IACpD,CAAC;IACD,OAAO,CACL,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,aAAa,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,6BAAY,CAAC,SAAS,CAAc,CAAC;IACjE,IAAI,MAAsB,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAmC,CAAC;IACxD,WAAW,CAAC,KAAK,GAAG;QAClB,MAAM,EAAE,GAAG,EAAE;YACX,MAAM,KAAK,GAAc;gBACvB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;gBACnB,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE;oBACrB,MAAM,GAAG,UAAU,CAAC;oBACpB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;oBACrC,IACE,CAAC,OAAO;wBACR,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,wBAAwB,CAAC;wBAE3D,OAAO,CAAC,CAAC;oBACX,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAC/B,OAAO,CAAC,CAAC;gBACX,CAAC;aACF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;IACF,KAAK,CAAC,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAEzD,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEjD,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CACnE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CACtE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEnE,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CACzE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;QAEzD,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CACtE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAA,aAAM,EAAC,KAAK,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAC/D,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC,kBAAkB,CAC5B,SAAS,EACT,IAAI,EACJ,WAAW,EACX,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CACzC,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,WAAW,CAAC,OAAO,EAAE,GAAG,mDAAkC,GAAG,CAAC,CAC/D,CAAC;QAEF,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CACxE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAC5B,SAAS,EACT,OAAO,EACP,WAAW,EACX,WAAW,CACZ,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEjB,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACjC,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAC1E,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE;YACrC,KAAK,EAAE,KAAK,EAAE,GAAW,EAAE,MAAwB,EAAE,EAAE;gBACrD,IAAI,CAAC,KAAK,CAAC,cAAc;oBAAE,OAAO,CAAC,CAAC;gBACpC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;gBAC5C,OAAO,CAAC,CAAC;YACX,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAE1D,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAC1E,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,KAAK,CAAC,cAAyB,CAAC;QAEhD,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,IAAA,aAAM,EAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAA,aAAM,EAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,IAAA,aAAM,EAAC,IAAA,sCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAA,aAAM,EAAC,IAAA,sCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,IAAA,aAAM,EAAC,IAAA,sCAAqB,EAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,IAAI,CACzB,WAAW,CAAC,OAAO,EAAE,GAAG,mDAAkC,GAAG,CAAC,CAC/D,CAAC;QAEF,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CACzE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjB,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAClE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAEtE,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CACzE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAElE,KAAK,CAAC,cAA0B,CAAC,wBAAwB;YACxD,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEnB,IAAA,aAAM,EACJ,MAAM,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAC1E,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE;YACrC,KAAK,EAAE,KAAK,EAAE,GAAW,EAAE,MAAwB,EAAE,EAAE;gBACrD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAyB,EAAE,MAAM,CAAC,CAAC;gBACvD,OAAO,CAAC,CAAC;YACX,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,cAAyB,CAAC;QAEhD,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,IAAA,aAAM,EAAC,IAAA,sCAAqB,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,IAAA,aAAM,EAAC,IAAA,sCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/pages/settings/profile-email-change.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/pages/settings/profile-email-change.test.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const chai_1 = require("chai");
+const profile_helpers_1 = require("../../../../pages/settings/users/profile-helpers");
+const HTTP_CONFLICT = 409;
+const EMAIL_TAKEN = "error.email_already_used";
+const CURRENT_USER_ID = "profile-email-current";
+const OTHER_USER_ID = "profile-email-other";
+const OTHER_EMAIL = "holder@acme.dev";
+const FREE_EMAIL = "free@acme.dev";
+const OWN_EMAIL = "mine@acme.dev";
+function modelHolding(accounts) {
+    return {
+        getByEmail: async (lookup) => {
+            const id = accounts[lookup.trim().toLowerCase()];
+            return id ? { _id: id } : undefined;
+        },
+    };
+}
+async function attempt(userModel, email) {
+    try {
+        return await (0, profile_helpers_1.assertEmailAvailable)(userModel, email, CURRENT_USER_ID);
+    }
+    catch (error) {
+        if (error instanceof interface_api_1.HTTPResult)
+            return error;
+        throw error;
+    }
+}
+describe("[unit] profile — e-mail change is refused for an address another account holds", () => {
+    const userModel = modelHolding({
+        [OTHER_EMAIL]: OTHER_USER_ID,
+        [OWN_EMAIL]: CURRENT_USER_ID,
+    });
+    it("refuses another account's address, whatever its casing", async () => {
+        const result = await attempt(userModel, " Holder@ACME.dev ");
+        (0, chai_1.expect)(result).to.be.instanceOf(interface_api_1.HTTPResult);
+        const refusal = result;
+        (0, chai_1.expect)(refusal.getStatus()).to.equal(HTTP_CONFLICT);
+        (0, chai_1.expect)(refusal.getBody()).to.equal(EMAIL_TAKEN);
+    });
+    it("accepts a free address, normalized", async () => {
+        (0, chai_1.expect)(await attempt(userModel, "Free@Acme.dev")).to.equal(FREE_EMAIL);
+    });
+    it("accepts the user's own address", async () => {
+        (0, chai_1.expect)(await attempt(userModel, "Mine@acme.dev")).to.equal(OWN_EMAIL);
+    });
+});
+//# sourceMappingURL=profile-email-change.test.js.map

package/dist/test/unit/pages/settings/profile-email-change.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-email-change.test.js","sourceRoot":"","sources":["../../../../../src/test/unit/pages/settings/profile-email-change.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,+BAA8B;AAE9B,sFAAwF;AAExF,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAChD,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAC5C,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,UAAU,GAAG,eAAe,CAAC;AACnC,MAAM,SAAS,GAAG,eAAe,CAAC;AAElC,SAAS,YAAY,CAAC,QAAgC;IACpD,OAAO;QAEL,UAAU,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE;YACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,EAAE,EAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,CAAC;KACsB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,SAAoB,EACpB,KAAa;IAEb,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,sCAAoB,EAAC,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,0BAAU;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,CAAC,WAAW,CAAC,EAAE,aAAa;QAC5B,CAAC,SAAS,CAAC,EAAE,eAAe;KAC7B,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAC7D,IAAA,aAAM,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAoB,CAAC;QACrC,IAAA,aAAM,EAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACpD,IAAA,aAAM,EAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,IAAA,aAAM,EAAC,MAAM,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,IAAA,aAAM,EAAC,MAAM,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/validation/password.d.ts

@@ -1,3 +1,2 @@
 import * as z from "zod";
-export declare const PASSWORD_REGEX: RegExp;
 export declare const passwordSchema: z.ZodString;

package/dist/validation/password.js

@@ -33,8 +33,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.passwordSchema = exports.PASSWORD_REGEX = void 0;
+exports.passwordSchema = void 0;
 const z = __importStar(require("zod"));
-exports.PASSWORD_REGEX = /^(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]+$/;
-exports.passwordSchema = z.string().min(8).regex(exports.PASSWORD_REGEX);
+const password_1 = require("@antelopejs/interface-dms/auth/password");
+exports.passwordSchema = z
+    .string()
+    .min(password_1.PASSWORD_MIN_LENGTH)
+    .regex(password_1.PASSWORD_PATTERN);
 //# sourceMappingURL=password.js.map

package/dist/validation/password.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/validation/password.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEZ,QAAA,cAAc,GACzB,wDAAwD,CAAC;AAE9C,QAAA,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAc,CAAC,CAAC"}
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/validation/password.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,sEAGiD;AAEpC,QAAA,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,8BAAmB,CAAC;KACxB,KAAK,CAAC,2BAAgB,CAAC,CAAC"}

package/frontend-vue/layers/dms-core/i18n/locales/core-en-GB.json

@@ -44,6 +44,10 @@
       "title": "Restoring your session...",
       "description": "Your session has expired. Refreshing your access and reloading the page."
     },
+    "network": {
+      "title": "Connection lost",
+      "description": "The server could not be reached. Check your connection and try again."
+    },
     "switch_account_failed": "Failed to switch account",
     "email_already_used": "This email address is already used.",
     "user_not_found": "No user found with this email address.",

package/frontend-vue/layers/dms-core/i18n/locales/core-fr-FR.json

@@ -44,6 +44,10 @@
       "title": "Restauration de votre session...",
       "description": "Votre session a expiré. Renouvellement de l'accès et rechargement de la page."
     },
+    "network": {
+      "title": "Connexion perdue",
+      "description": "Le serveur est injoignable. Vérifiez votre connexion et réessayez."
+    },
     "switch_account_failed": "Échec du changement de compte",
     "email_already_requested": "Cette adresse e-mail a déjà été demandée. Veuillez attendre avant de réessayer.",
     "email_already_used": "Cette adresse e-mail est déjà utilisée.",

package/frontend-vue/layers/dms-ui/app/components/table-view/TableView.vue

@@ -7,7 +7,7 @@ import type {
   Table,
   VisibilityState,
 } from "@tanstack/vue-table";
-import { refDebounced, watchDebounced } from "@vueuse/core";
+import { refDebounced, useActiveElement, watchDebounced } from "@vueuse/core";
 import {
   QUICK_ACTION_BUTTON_KEY,
   QUICK_ACTION_COMPONENT_KEY,
@@ -1010,6 +1010,7 @@ defineShortcuts(
     globalFilter,
     rowSelect,
     data: shownData,
+    activeElement: useActiveElement(),
   }),
 );
 

package/frontend-vue/layers/dms-ui/app/components/tree/Tree.vue

@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { useActiveElement } from "@vueuse/core";
 import type { TreeNode, TreeProps } from "../../composables/tree/types";
 import {
   TreeSelectionBehavior,
@@ -120,15 +121,15 @@ function navigateTree(direction: TreeNavigationDirection) {
   navigationHandlers[direction]();
 }
 
-const shortcutHandlers: Record<string, () => void> = (
-  buildTreeShortcuts as (...args: unknown[]) => Record<string, () => void>
-)({
-  navigateTree,
-  props,
-  items,
-  selected,
-});
-defineShortcuts(shortcutHandlers as Record<string, (() => void) | undefined>);
+defineShortcuts(
+  buildTreeShortcuts({
+    navigateTree,
+    props,
+    items,
+    selected,
+    activeElement: useActiveElement(),
+  }),
+);
 </script>
 
 <template>

package/frontend-vue/layers/dms-ui/app/composables/table-view/shortcuts/index.ts

@@ -1,4 +1,4 @@
-import type { ShallowRef } from "vue";
+import { computed, type ComputedRef, type ShallowRef } from "vue";
 import type { RowSelectionState } from "@tanstack/vue-table";
 import type {
   TableRowActionOptions,
@@ -15,6 +15,7 @@ import {
 import {
   TABLE_VIEW_ESCAPE_METADATA,
   createTableViewEscapeShortcut,
+  isTableViewEscapeActive,
 } from "./tableViewEscape";
 import {
   TABLE_VIEW_SHIFT_A_METADATA,
@@ -42,8 +43,11 @@ interface BuildTableViewShortcutsParams<T extends Data> {
   globalFilter: ShallowRef<string | undefined>;
   rowSelect: Ref<RowSelectionState>;
   data: Ref<{ results: T[] } | null | undefined>;
+  activeElement: Ref<Element | null | undefined>;
 }
 
+type TableViewShortcuts = Record<string, (() => void) | undefined>;
+
 export function buildTableViewShortcuts<T extends Data>({
   refresh,
   tableProps,
@@ -51,11 +55,20 @@ export function buildTableViewShortcuts<T extends Data>({
   globalFilter,
   rowSelect,
   data,
-}: BuildTableViewShortcutsParams<T>): Record<string, () => void> {
-  return {
+  activeElement,
+}: BuildTableViewShortcutsParams<T>): ComputedRef<TableViewShortcuts> {
+  const shortcuts = {
     meta_r: createTableViewMetaRShortcut(refresh),
     shift_n: createTableViewShiftNShortcut(tableProps, newRow),
-    escape: createTableViewEscapeShortcut(globalFilter, rowSelect),
     shift_a: createTableViewShiftAShortcut(tableProps, data, rowSelect),
   };
+  const escape = createTableViewEscapeShortcut(globalFilter, rowSelect);
+  // An unregistered key is left untouched by `defineShortcuts`, so Escape
+  // reaches overlays whenever the table has nothing to clear.
+  return computed(() => ({
+    ...shortcuts,
+    escape: isTableViewEscapeActive(globalFilter, rowSelect, activeElement)
+      ? escape
+      : undefined,
+  }));
 }

package/frontend-vue/layers/dms-ui/app/composables/table-view/shortcuts/tableViewEscape.ts

@@ -1,12 +1,34 @@
 import type { ShallowRef } from "vue";
 import type { RowSelectionState } from "@tanstack/vue-table";
+import { isFocusInsideOverlay } from "../../../utils/overlayFocus";
 
 export const TABLE_VIEW_ESCAPE_METADATA: ShortcutMetadata = {
   key: ["$keyboard.escape"],
   descriptionKey: "$dms.shortcuts.tableview.escape.description",
   component: "$dms.components.tableview",
+  condition: {
+    descriptionKey: "$dms.shortcuts.tableview.escape.condition",
+  },
 };
 
+/**
+ * Nuxt UI's `defineShortcuts` calls `preventDefault()` on every key it
+ * handles, and reka-ui's DismissableLayer ignores a prevented Escape. The
+ * shortcut is therefore only registered when there is a search or a
+ * selection to clear, and never while focus sits inside an overlay, so the
+ * overlay above the table keeps closing on Escape.
+ */
+export function isTableViewEscapeActive(
+  globalFilter: ShallowRef<string | undefined>,
+  rowSelect: Ref<RowSelectionState>,
+  activeElement: Ref<Element | null | undefined>,
+): boolean {
+  if (isFocusInsideOverlay(activeElement.value)) return false;
+  return (
+    globalFilter.value !== undefined || Object.keys(rowSelect.value).length > 0
+  );
+}
+
 export function createTableViewEscapeShortcut(
   globalFilter: ShallowRef<string | undefined>,
   rowSelect: Ref<RowSelectionState>,