@antelopejs/interface-dms 0.3.5 → 0.4.0

package/dist/auth/db/tables/users.table.d.ts

@@ -1,6 +1,12 @@
 import { Table } from "@antelopejs/interface-database-decorators";
 import type { DefaultDataTypes } from "../../../base/data-types/default-types";
 export declare const USERS_TABLE_NAME = "users";
+/** First day of the week: 0 Sunday, 1 Monday, 6 Saturday. */
+export type UserWeekStart = 0 | 1 | 6;
+/** `h23`: 24-hour clock (14:05); `h12`: 12-hour clock (2:05 PM). */
+export type UserTimeFormat = "h23" | "h12";
+/** `numeric`: 01/10/2026; `text`: the month as a word (1 Oct 2026). */
+export type UserDateFormat = "numeric" | "text";
 declare const User_base: import("@antelopejs/interface-database-decorators").TableClass<Table & {
     testHash<This extends {}, F extends keyof This>(this: This, field: F, value: This[F]): unknown;
 }, [], object>;
@@ -10,20 +16,74 @@ export declare class User extends User_base {
     updatedAt: Date;
     email: string;
     name: string;
+    /**
+     * Profile picture as an image value ({ key, alt? }) in the default storage,
+     * downscaled client-side to a square of at most 100x100 pixels.
+     */
     avatar: DefaultDataTypes.ImageValue | null;
+    /**
+     * User's preferred language/locale (e.g., 'en', 'fr')
+     */
     language: string;
+    /** IANA time zone dates and times are shown in (`Europe/Brussels`). */
+    timeZone?: string | null;
+    /** First day of the week in calendars and date pickers. */
+    weekStart?: UserWeekStart | null;
+    /** Clock used for times. */
+    timeFormat?: UserTimeFormat | null;
+    /** How full dates are written. */
+    dateFormat?: UserDateFormat | null;
     password: string | null;
+    /**
+     * When the password was last set by the user (change or recovery); null
+     * for accounts that never changed it since this field exists.
+     */
+    passwordChangedAt: Date | null;
+    /**
+     * Authentication key used for JWT secret generation
+     */
     authKey: string;
+    /**
+     * Is the user email validated?
+     */
     isValidated: boolean;
+    /**
+     * Token for email validation
+     */
     validationToken: string | null;
+    /**
+     * Date when the validation token was requested
+     */
     validationRequestedAt: Date | null;
+    /**
+     * Token for password reset
+     */
     forgotPasswordToken: string | null;
+    /**
+     * Date when the forgot password token was requested
+     */
     forgotPasswordRequestedAt: Date | null;
+    /**
+     * Is the user an owner with full access to everything?
+     */
     owner: boolean;
+    /**
+     * Last time the user was seen using the dashboard with a valid access token.
+     * Written at most once per `USER_ACTIVITY_WRITE_INTERVAL_MS`, so it is
+     * accurate to that interval; `null` until the first authenticated request.
+     */
+    lastActiveAt: Date | null;
     twoFactorMethods: string[];
     twoFactorSecret: string | null;
     twoFactorPendingSecret: string | null;
     twoFactorBackupCodes: string[];
+    /** When the current set of backup codes was generated. */
+    twoFactorBackupCodesGeneratedAt: Date | null;
+    /**
+     * When the user confirmed they kept the current backup codes (downloaded,
+     * copied or acknowledged); null until then.
+     */
+    twoFactorBackupCodesSavedAt: Date | null;
     twoFactorEmailCode: string | null;
     twoFactorEmailCodeRequestedAt: Date | null;
 }

package/dist/auth/db/tables/users.table.js

@@ -50,11 +50,31 @@ __decorate([
     (0, interface_database_decorators_1.Field)("string"),
     __metadata("design:type", String)
 ], User.prototype, "language", void 0);
+__decorate([
+    (0, interface_database_decorators_1.Field)("string"),
+    __metadata("design:type", Object)
+], User.prototype, "timeZone", void 0);
+__decorate([
+    (0, interface_database_decorators_1.Field)("number"),
+    __metadata("design:type", Object)
+], User.prototype, "weekStart", void 0);
+__decorate([
+    (0, interface_database_decorators_1.Field)("string"),
+    __metadata("design:type", Object)
+], User.prototype, "timeFormat", void 0);
+__decorate([
+    (0, interface_database_decorators_1.Field)("string"),
+    __metadata("design:type", Object)
+], User.prototype, "dateFormat", void 0);
 __decorate([
     (0, interface_database_decorators_1.Hashed)(),
     (0, interface_database_decorators_1.Field)("string"),
     __metadata("design:type", Object)
 ], User.prototype, "password", void 0);
+__decorate([
+    (0, interface_database_decorators_1.Field)("date"),
+    __metadata("design:type", Object)
+], User.prototype, "passwordChangedAt", void 0);
 __decorate([
     (0, interface_database_decorators_1.Field)("string"),
     __metadata("design:type", String)
@@ -86,6 +106,10 @@ __decorate([
     (0, interface_database_decorators_1.Field)("boolean"),
     __metadata("design:type", Boolean)
 ], User.prototype, "owner", void 0);
+__decorate([
+    (0, interface_database_decorators_1.Field)("date"),
+    __metadata("design:type", Object)
+], User.prototype, "lastActiveAt", void 0);
 __decorate([
     (0, interface_database_decorators_1.Field)(["string"]),
     __metadata("design:type", Array)
@@ -102,6 +126,14 @@ __decorate([
     (0, interface_database_decorators_1.Field)(["string"]),
     __metadata("design:type", Array)
 ], User.prototype, "twoFactorBackupCodes", void 0);
+__decorate([
+    (0, interface_database_decorators_1.Field)("date"),
+    __metadata("design:type", Object)
+], User.prototype, "twoFactorBackupCodesGeneratedAt", void 0);
+__decorate([
+    (0, interface_database_decorators_1.Field)("date"),
+    __metadata("design:type", Object)
+], User.prototype, "twoFactorBackupCodesSavedAt", void 0);
 __decorate([
     (0, interface_database_decorators_1.Field)("string"),
     __metadata("design:type", Object)

package/dist/auth/db/tables/users.table.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.table.js","sourceRoot":"","sources":["../../../../src/auth/db/tables/users.table.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6FASmD;AACnD,kDAAsD;AAGzC,QAAA,gBAAgB,GAAG,OAAO,CAAC;AAGjC,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,qCAAK,CAAC,IAAI,CAAC,4CAAY,CAAC;CA0GjD,CAAA;AA1GY,oBAAI;AAGP;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;iCACI;AAKZ;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,4CAAY,GAAE;IACd,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACK,IAAI;uCAAC;AAKhB;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,0CAAU,GAAE;IACZ,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACK,IAAI;uCAAC;AAKhB;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mCACM;AAGd;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;kCACK;AAOb;IADP,IAAA,qCAAK,EAAC,KAAK,CAAC;;oCACsC;AAO3C;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;sCACS;AAKjB;IAFP,IAAA,sCAAM,GAAE;IACR,IAAA,qCAAK,EAAC,QAAQ,CAAC;;sCACgB;AAQxB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;qCACQ;AAOhB;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,SAAS,CAAC;;yCACY;AAOrB;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;6CACuB;AAM/B;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;mDAC6B;AAOnC;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;iDAC2B;AAMnC;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;uDACiC;AAMvC;IADP,IAAA,qCAAK,EAAC,SAAS,CAAC;;mCACM;AAGf;IADP,IAAA,qCAAK,EAAC,CAAC,QAAQ,CAAC,CAAC;;8CACiB;AAG3B;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;6CACuB;AAG/B;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;oDAC8B;AAGtC;IADP,IAAA,qCAAK,EAAC,CAAC,QAAQ,CAAC,CAAC;;kDACqB;AAG/B;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;gDAC0B;AAGlC;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;2DACqC;eAzGxC,IAAI;IADhB,IAAA,6CAAa,EAAC,wBAAgB,EAAE,4BAAgB,CAAC;GACrC,IAAI,CA0GhB"}
+{"version":3,"file":"users.table.js","sourceRoot":"","sources":["../../../../src/auth/db/tables/users.table.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6FASmD;AACnD,kDAAsD;AAGzC,QAAA,gBAAgB,GAAG,OAAO,CAAC;AAYjC,IAAM,IAAI,GAAV,MAAM,IAAK,SAAQ,qCAAK,CAAC,IAAI,CAAC,4CAAY,CAAC;CAsJjD,CAAA;AAtJY,oBAAI;AAGP;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;iCACI;AAKZ;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,4CAAY,GAAE;IACd,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACK,IAAI;uCAAC;AAKhB;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,0CAAU,GAAE;IACZ,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACK,IAAI;uCAAC;AAKhB;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mCACM;AAGd;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;kCACK;AAOb;IADP,IAAA,qCAAK,EAAC,KAAK,CAAC;;oCACsC;AAO3C;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;sCACS;AAMjB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;sCACiB;AAIzB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;uCACyB;AAIjC;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;wCAC2B;AAInC;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;wCAC2B;AAKnC;IAFP,IAAA,sCAAM,GAAE;IACR,IAAA,qCAAK,EAAC,QAAQ,CAAC;;sCACgB;AAOxB;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;+CACyB;AAQ/B;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;qCACQ;AAOhB;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,SAAS,CAAC;;yCACY;AAOrB;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;6CACuB;AAM/B;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;mDAC6B;AAOnC;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;iDAC2B;AAMnC;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;uDACiC;AAMvC;IADP,IAAA,qCAAK,EAAC,SAAS,CAAC;;mCACM;AAQf;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;0CACoB;AAG1B;IADP,IAAA,qCAAK,EAAC,CAAC,QAAQ,CAAC,CAAC;;8CACiB;AAG3B;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;6CACuB;AAG/B;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;oDAC8B;AAGtC;IADP,IAAA,qCAAK,EAAC,CAAC,QAAQ,CAAC,CAAC;;kDACqB;AAI/B;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;6DACuC;AAO7C;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;yDACmC;AAGzC;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;gDAC0B;AAGlC;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;2DACqC;eArJxC,IAAI;IADhB,IAAA,6CAAa,EAAC,wBAAgB,EAAE,4BAAgB,CAAC;GACrC,IAAI,CAsJhB"}

package/dist/auth/index.d.ts

@@ -1,25 +1,34 @@
 import { type RequestContext } from "@antelopejs/interface-api";
 import { type SessionModel, type User, type UserExternalIdentity, type UserModel } from "./db";
-import { type RequestAuthenticator, type RequestPrincipal } from "./request-authenticators";
+import type { ParsedUserAgent } from "./internal/user-agent";
 export * from "./request-authenticators";
-export type DeviceType = "mobile" | "tablet" | "desktop";
-export interface ParsedUserAgent {
-    browserName: string;
-    browserVersion: string;
-    osName: string;
-    osVersion: string;
-    deviceType: DeviceType;
-}
+/**
+ * Sending account e-mails and reading a user agent are DMS behaviour, not
+ * contract: the templates, the mailer and the parser are the module's. Declared
+ * here because the registration and session flows below need them.
+ *
+ * @internal
+ */
 export declare const NotifyWelcome: (userId: string, name: string) => Promise<void>;
+/** @internal */
 export declare const NotifyCollaboratorJoined: (ownerIds: string[], name: string, email: string) => Promise<void>;
+/** @internal */
 export declare const ParseUserAgent: (userAgent: string) => Promise<ParsedUserAgent>;
-export declare function authenticateRequestPrincipal(ctx: RequestContext, authenticators?: readonly RequestAuthenticator[]): Promise<RequestPrincipal>;
 export interface TenantTokenInput {
     tenantId: string;
     id: string;
     rawToken: string;
 }
+/**
+ * Authenticate the request's bearer token and return the validated `User`.
+ * Throws 401 when the token is missing or invalid. Building block for
+ * authorization guards layered on top of this interface (see
+ * `interfaces/dms/guards`).
+ */
 export declare function authenticateRequestUser(ctx: RequestContext): Promise<User>;
+/**
+ * @internal
+ */
 export declare namespace internal {
     const AuthUserAuthenticator: (data: string | undefined) => Promise<TenantTokenInput>;
     const IfAuthUserAuthenticator: (data: string | undefined) => Promise<TenantTokenInput | undefined>;
@@ -28,18 +37,58 @@ export declare namespace internal {
     const IfAuthUserValidator: (data: TenantTokenInput | undefined) => Promise<User | undefined>;
     const AuthOwnerOnlyValidator: (data: TenantTokenInput) => Promise<boolean | User>;
 }
+/**
+ * Authentication decorator that returns raw user data, ignoring email validation.
+ */
 export declare const AuthRawUser: (validator?: import("@antelopejs/interface-auth").AuthValidator<TenantTokenInput, boolean | User> | undefined) => import("@antelopejs/interface-core/decorators").ClassDecorator<import("@antelopejs/interface-core/decorators").Class<any, any[]>> & import("@antelopejs/interface-core/decorators").PropertyDecorator & import("@antelopejs/interface-core/decorators").ParameterDecorator;
+/**
+ * Authentication decorator that provides the `User` instance and enforces email validation
+ * if required by the configuration.
+ */
 export declare const AuthUser: (validator?: import("@antelopejs/interface-auth").AuthValidator<TenantTokenInput, boolean | User> | undefined) => import("@antelopejs/interface-core/decorators").ClassDecorator<import("@antelopejs/interface-core/decorators").Class<any, any[]>> & import("@antelopejs/interface-core/decorators").PropertyDecorator & import("@antelopejs/interface-core/decorators").ParameterDecorator;
+/**
+ * Optional authentication decorator that returns User | undefined without throwing 401
+ * Use this for routes that work both when authenticated and unauthenticated
+ */
 export declare const IfAuthUser: (validator?: import("@antelopejs/interface-auth").AuthValidator<TenantTokenInput | undefined, User | undefined> | undefined) => import("@antelopejs/interface-core/decorators").ClassDecorator<import("@antelopejs/interface-core/decorators").Class<any, any[]>> & import("@antelopejs/interface-core/decorators").PropertyDecorator & import("@antelopejs/interface-core/decorators").ParameterDecorator;
+/**
+ * Authentication decorator that requires the authenticated user to be a platform
+ * owner (`User.owner === true`). Throws 401 when no token is provided and 403
+ * when the user is authenticated but not an owner.
+ *
+ * Used to gate all module routes (`/module/<id>/...`) per the SaaS security
+ * convention: modules are owner-only administration spaces.
+ *
+ * @returns Authentication decorator
+ */
 export declare const AuthOwnerOnly: () => import("@antelopejs/interface-core/decorators").ClassDecorator<import("@antelopejs/interface-core/decorators").Class<any, any[]>> & import("@antelopejs/interface-core/decorators").PropertyDecorator & import("@antelopejs/interface-core/decorators").ParameterDecorator;
+/**
+ * Generate an access token for a user
+ * @param tenantId
+ * @param user
+ * @param sessionId
+ * @returns A valid access token for a duration defined in the configuration (`accessTokenLifetime`)
+ */
 export declare const generateAccessToken: (tenantId: string, user: User, sessionId?: string | undefined) => Promise<{
     expiresIn: number;
     token: string;
 }>;
+/**
+ * Generate a refresh token for a user
+ * @param tenantId
+ * @param user
+ * @param sessionId
+ * @returns A valid refresh token for a duration defined in the configuration (`refreshTokenLifetime`)
+ */
 export declare const generateRefreshToken: (tenantId: string, user: User, sessionId?: string | undefined) => Promise<{
     expiresIn: number;
     token: string;
 }>;
+/**
+ * Validate a refresh token and return the user id and tenantId
+ * @param token
+ * @returns The user id and tenantId
+ */
 export declare const validateRefreshToken: (token: string) => Promise<{
     id: string;
     tenantId: string;
@@ -66,12 +115,24 @@ export declare const validateTenantAssignmentToken: (token: string) => Promise<{
 export declare const send2FAEmail: (user: User, code: string) => Promise<void>;
 export declare const sendEmailValidationEmail: (user: User) => Promise<void>;
 export declare const sendEmailForgotEmail: (user: User) => Promise<void>;
+/**
+ * What an invitation email can say about where it leads. Every field is
+ * optional: without them the email keeps its generic wording.
+ */
 export interface AdminInviteEmailContext {
+    /** The workspace the invitee is joining. */
     workspaceName?: string;
+    /** Who sent the invitation. */
     inviterName?: string;
+    /** The invitee's language (`en`, `fr`, ...); English when unsupported. */
     language?: string;
 }
 export declare const sendAdminInviteEmail: (email: string, token: string, inviteeName?: string | undefined, context?: AdminInviteEmailContext | undefined) => Promise<void>;
+/**
+ * Remove sensitive keys from a user
+ * @param user
+ * @returns Partial user without sensitive keys
+ */
 export declare const sanitizeUser: (user: User) => Promise<Partial<User>>;
 export interface JwtUserPayload {
     id: string;
@@ -86,7 +147,50 @@ export interface ExternalIdentityInput {
 export interface ExternalIdentityLinkResult {
     wasCreated: boolean;
 }
+/**
+ * Bind an external login identity (GitHub, Google, ...) to a user.
+ *
+ * Idempotent for the owning user: re-linking the same provider account only
+ * refreshes its last login. Binding an account already owned by another user
+ * throws 409 — a provider account is a single-user credential. Uniqueness is
+ * enforced by the row's deterministic primary key, so two concurrent bindings
+ * of the same provider account collide instead of duplicating; the loser
+ * re-reads and either refreshes or gets the 409.
+ *
+ * Scoped to authentication. Provider connections powering product features
+ * (repository access, deployments) keep their own storage and must never be
+ * derived from these rows.
+ *
+ * @param userId Owning user
+ * @param identity Provider account to bind
+ * @returns Whether the binding was created by this call, as opposed to an
+ *          existing one being refreshed
+ */
 export declare function linkExternalIdentity(userId: string, identity: ExternalIdentityInput): Promise<ExternalIdentityLinkResult>;
+/**
+ * List the external login identities bound to a user.
+ *
+ * @param userId Owning user
+ * @returns Bound identities, empty when the user only signs in with a password
+ */
 export declare function getExternalIdentities(userId: string): Promise<UserExternalIdentity[]>;
+/**
+ * Run everything that must happen once an account has really joined a tenant:
+ * the welcome and collaborator notifications, then the `USER_REGISTERED` hook.
+ *
+ * Shared by every entry point that registers a user — the DMS password signup,
+ * a provider login consuming an invitation, and any module owning its own
+ * registration flow (a SaaS transactional signup calls it once provisioning
+ * committed) — so automations and notifications never depend on which door the
+ * account came through.
+ *
+ * The hook is observational: registration is already complete when it runs, so
+ * a failing subscriber is logged rather than allowed to fail the request and
+ * strand the user without a valid retry token.
+ *
+ * @param userModel Users model
+ * @param user The registered account
+ * @param tenantId Tenant the account joined
+ */
 export declare function announceRegistration(userModel: UserModel, user: User, tenantId: string): Promise<void>;
 export declare function createSession(sessionModel: SessionModel, userId: string, userAgent: string, ip: string): Promise<string>;

package/dist/auth/index.js

@@ -15,7 +15,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitizeUser = exports.sendAdminInviteEmail = exports.sendEmailForgotEmail = exports.sendEmailValidationEmail = exports.send2FAEmail = exports.validateTenantAssignmentToken = exports.generateTenantAssignmentToken = exports.validateTwoFactorToken = exports.generateTwoFactorToken = exports.validateRefreshToken = exports.generateRefreshToken = exports.generateAccessToken = exports.AuthOwnerOnly = exports.IfAuthUser = exports.AuthUser = exports.AuthRawUser = exports.internal = exports.ParseUserAgent = exports.NotifyCollaboratorJoined = exports.NotifyWelcome = void 0;
-exports.authenticateRequestPrincipal = authenticateRequestPrincipal;
 exports.authenticateRequestUser = authenticateRequestUser;
 exports.linkExternalIdentity = linkExternalIdentity;
 exports.getExternalIdentities = getExternalIdentities;
@@ -27,27 +26,31 @@ const interface_core_1 = require("@antelopejs/interface-core");
 const logging_1 = require("@antelopejs/interface-core/logging");
 const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
 const hooks_1 = require("../hooks");
-const constants_1 = require("../constants");
 const db_1 = require("./db");
-const request_authenticators_1 = require("./request-authenticators");
+const fire_and_forget_1 = require("../utils/fire-and-forget");
 __exportStar(require("./request-authenticators"), exports);
+/**
+ * Sending account e-mails and reading a user agent are DMS behaviour, not
+ * contract: the templates, the mailer and the parser are the module's. Declared
+ * here because the registration and session flows below need them.
+ *
+ * @internal
+ */
 exports.NotifyWelcome = (0, interface_core_1.InterfaceFunction)();
+/** @internal */
 exports.NotifyCollaboratorJoined = (0, interface_core_1.InterfaceFunction)();
+/** @internal */
 exports.ParseUserAgent = (0, interface_core_1.InterfaceFunction)();
 const HTTP_UNAUTHORIZED = 401;
 const HTTP_CONFLICT = 409;
 const UNAUTHORIZED_MESSAGE = "Unauthorized";
 const IDENTITY_ALREADY_LINKED_MESSAGE = "error.oauth.identity_already_linked";
-async function authenticateRequestPrincipal(ctx, authenticators = []) {
-    return (0, request_authenticators_1.resolveRequestPrincipal)(ctx, authenticators, async (token) => {
-        const decoded = await internal.AuthUserAuthenticator(token);
-        const user = await internal.AuthUserValidator(decoded);
-        if (!user || typeof user === "boolean") {
-            throw new interface_api_1.HTTPResult(HTTP_UNAUTHORIZED, UNAUTHORIZED_MESSAGE);
-        }
-        return { user, tenantId: decoded.tenantId || constants_1.DEFAULT_TENANT_ID };
-    });
-}
+/**
+ * Authenticate the request's bearer token and return the validated `User`.
+ * Throws 401 when the token is missing or invalid. Building block for
+ * authorization guards layered on top of this interface (see
+ * `interfaces/dms/guards`).
+ */
 async function authenticateRequestUser(ctx) {
     const authHeader = ctx.rawRequest?.headers?.authorization;
     const token = typeof authHeader === "string" ? authHeader.split(" ")[1] : undefined;
@@ -58,6 +61,9 @@ async function authenticateRequestUser(ctx) {
     }
     return validated;
 }
+/**
+ * @internal
+ */
 var internal;
 (function (internal) {
     internal.AuthUserAuthenticator = (0, interface_core_1.InterfaceFunction)();
@@ -67,21 +73,42 @@ var internal;
     internal.IfAuthUserValidator = (0, interface_core_1.InterfaceFunction)();
     internal.AuthOwnerOnlyValidator = (0, interface_core_1.InterfaceFunction)();
 })(internal || (exports.internal = internal = {}));
+/**
+ * Authentication decorator that returns raw user data, ignoring email validation.
+ */
 exports.AuthRawUser = (0, interface_auth_1.CreateAuthDecorator)({
     source: (req, _) => req.headers.authorization?.split(" ")[1],
     authenticator: internal.AuthUserAuthenticator,
     validator: internal.AuthRawUserValidator,
 });
+/**
+ * Authentication decorator that provides the `User` instance and enforces email validation
+ * if required by the configuration.
+ */
 exports.AuthUser = (0, interface_auth_1.CreateAuthDecorator)({
     source: (req, _) => req.headers.authorization?.split(" ")[1],
     authenticator: internal.AuthUserAuthenticator,
     validator: internal.AuthUserValidator,
 });
+/**
+ * Optional authentication decorator that returns User | undefined without throwing 401
+ * Use this for routes that work both when authenticated and unauthenticated
+ */
 exports.IfAuthUser = (0, interface_auth_1.CreateAuthDecorator)({
     source: (req, _) => req.headers.authorization?.split(" ")[1],
     authenticator: internal.IfAuthUserAuthenticator,
     validator: internal.IfAuthUserValidator,
 });
+/**
+ * Authentication decorator that requires the authenticated user to be a platform
+ * owner (`User.owner === true`). Throws 401 when no token is provided and 403
+ * when the user is authenticated but not an owner.
+ *
+ * Used to gate all module routes (`/module/<id>/...`) per the SaaS security
+ * convention: modules are owner-only administration spaces.
+ *
+ * @returns Authentication decorator
+ */
 const AuthOwnerOnly = () => {
     const decorator = (0, interface_auth_1.CreateAuthDecorator)({
         source: (req, _) => req.headers.authorization?.split(" ")[1],
@@ -91,8 +118,27 @@ const AuthOwnerOnly = () => {
     return decorator();
 };
 exports.AuthOwnerOnly = AuthOwnerOnly;
+/**
+ * Generate an access token for a user
+ * @param tenantId
+ * @param user
+ * @param sessionId
+ * @returns A valid access token for a duration defined in the configuration (`accessTokenLifetime`)
+ */
 exports.generateAccessToken = (0, interface_core_1.InterfaceFunction)();
+/**
+ * Generate a refresh token for a user
+ * @param tenantId
+ * @param user
+ * @param sessionId
+ * @returns A valid refresh token for a duration defined in the configuration (`refreshTokenLifetime`)
+ */
 exports.generateRefreshToken = (0, interface_core_1.InterfaceFunction)();
+/**
+ * Validate a refresh token and return the user id and tenantId
+ * @param token
+ * @returns The user id and tenantId
+ */
 exports.validateRefreshToken = (0, interface_core_1.InterfaceFunction)();
 exports.generateTwoFactorToken = (0, interface_core_1.InterfaceFunction)();
 exports.validateTwoFactorToken = (0, interface_core_1.InterfaceFunction)();
@@ -102,12 +148,36 @@ exports.send2FAEmail = (0, interface_core_1.InterfaceFunction)();
 exports.sendEmailValidationEmail = (0, interface_core_1.InterfaceFunction)();
 exports.sendEmailForgotEmail = (0, interface_core_1.InterfaceFunction)();
 exports.sendAdminInviteEmail = (0, interface_core_1.InterfaceFunction)();
+/**
+ * Remove sensitive keys from a user
+ * @param user
+ * @returns Partial user without sensitive keys
+ */
 exports.sanitizeUser = (0, interface_core_1.InterfaceFunction)();
 function assertIdentityOwnedBy(identity, userId) {
     if (identity.userId !== userId) {
         throw new interface_api_1.HTTPResult(HTTP_CONFLICT, IDENTITY_ALREADY_LINKED_MESSAGE);
     }
 }
+/**
+ * Bind an external login identity (GitHub, Google, ...) to a user.
+ *
+ * Idempotent for the owning user: re-linking the same provider account only
+ * refreshes its last login. Binding an account already owned by another user
+ * throws 409 — a provider account is a single-user credential. Uniqueness is
+ * enforced by the row's deterministic primary key, so two concurrent bindings
+ * of the same provider account collide instead of duplicating; the loser
+ * re-reads and either refreshes or gets the 409.
+ *
+ * Scoped to authentication. Provider connections powering product features
+ * (repository access, deployments) keep their own storage and must never be
+ * derived from these rows.
+ *
+ * @param userId Owning user
+ * @param identity Provider account to bind
+ * @returns Whether the binding was created by this call, as opposed to an
+ *          existing one being refreshed
+ */
 async function linkExternalIdentity(userId, identity) {
     const model = (0, interface_database_decorators_1.GetModel)(db_1.UserExternalIdentityModel);
     const id = (0, db_1.buildExternalIdentityId)(identity.provider, identity.providerAccountId);
@@ -140,26 +210,50 @@ async function linkExternalIdentity(userId, identity) {
         return { wasCreated: false };
     }
 }
+/**
+ * List the external login identities bound to a user.
+ *
+ * @param userId Owning user
+ * @returns Bound identities, empty when the user only signs in with a password
+ */
 function getExternalIdentities(userId) {
     return (0, interface_database_decorators_1.GetModel)(db_1.UserExternalIdentityModel).getByUserId(userId);
 }
 async function notifyAccountCreation(userModel, user) {
-    void (0, exports.NotifyWelcome)(user._id, user.name);
+    (0, fire_and_forget_1.fireAndForget)((0, exports.NotifyWelcome)(user._id, user.name), "welcome notification");
     try {
         const owners = await userModel.getOwners();
         const ownerIds = owners
             .map((owner) => owner._id)
             .filter((id) => id !== user._id);
         if (ownerIds.length > 0) {
-            void (0, exports.NotifyCollaboratorJoined)(ownerIds, user.name, user.email);
+            (0, fire_and_forget_1.fireAndForget)((0, exports.NotifyCollaboratorJoined)(ownerIds, user.name, user.email), "collaborator joined notification");
         }
     }
     catch (error) {
         logging_1.Logging.Error(`[DMS] Failed to notify owners of new collaborator "${user._id}": ${String(error)}`);
     }
 }
+/**
+ * Run everything that must happen once an account has really joined a tenant:
+ * the welcome and collaborator notifications, then the `USER_REGISTERED` hook.
+ *
+ * Shared by every entry point that registers a user — the DMS password signup,
+ * a provider login consuming an invitation, and any module owning its own
+ * registration flow (a SaaS transactional signup calls it once provisioning
+ * committed) — so automations and notifications never depend on which door the
+ * account came through.
+ *
+ * The hook is observational: registration is already complete when it runs, so
+ * a failing subscriber is logged rather than allowed to fail the request and
+ * strand the user without a valid retry token.
+ *
+ * @param userModel Users model
+ * @param user The registered account
+ * @param tenantId Tenant the account joined
+ */
 async function announceRegistration(userModel, user, tenantId) {
-    void notifyAccountCreation(userModel, user);
+    (0, fire_and_forget_1.fireAndForget)(notifyAccountCreation(userModel, user), "account creation notification");
     try {
         await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.USER_REGISTERED, {
             tenantId,
@@ -182,7 +276,6 @@ async function createSession(sessionModel, userId, userAgent, ip) {
     const now = new Date();
     const ids = await sessionModel.insert({
         userId,
-        refreshToken: "",
         userAgent: userAgent || "",
         ip: ip || "",
         browser: browser || "Unknown",

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA2DA,oEAYC;AAcD,0DAYC;AA4ND,oDAqCC;AAQD,sDAIC;AA0CD,oDAiBC;AAED,sCA4BC;AAvcD,6DAA4E;AAC5E,+DAAiE;AACjE,+DAA+D;AAC/D,gEAA6D;AAC7D,6FAAqE;AACrE,oCAA8C;AAC9C,4CAAiD;AACjD,6BAOc;AACd,qEAIkC;AAElC,2DAAyC;AAiB5B,QAAA,aAAa,GACxB,IAAA,kCAAiB,GAA0C,CAAC;AAEjD,QAAA,wBAAwB,GACnC,IAAA,kCAAiB,GAEd,CAAC;AAEO,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAA0C,CAAC;AAE9D,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAC5C,MAAM,+BAA+B,GAAG,qCAAqC,CAAC;AAOvE,KAAK,UAAU,4BAA4B,CAChD,GAAmB,EACnB,iBAAkD,EAAE;IAEpD,OAAO,IAAA,gDAAuB,EAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAClE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,0BAAU,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,6BAAiB,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAcM,KAAK,UAAU,uBAAuB,CAC3C,GAAmB;IAEnB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC;IAC1D,MAAM,KAAK,GACT,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,0BAAU,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAKD,IAAiB,QAAQ,CAsBxB;AAtBD,WAAiB,QAAQ;IACV,8BAAqB,GAChC,IAAA,kCAAiB,GAAkD,CAAC;IAEzD,gCAAuB,GAClC,IAAA,kCAAiB,GAEd,CAAC;IAEO,6BAAoB,GAC/B,IAAA,kCAAiB,GAA8C,CAAC;IAErD,0BAAiB,GAC5B,IAAA,kCAAiB,GAA8C,CAAC;IAErD,4BAAmB,GAC9B,IAAA,kCAAiB,GAEd,CAAC;IAEO,+BAAsB,GACjC,IAAA,kCAAiB,GAA8C,CAAC;AACpE,CAAC,EAtBgB,QAAQ,wBAAR,QAAQ,QAsBxB;AAKY,QAAA,WAAW,GAAG,IAAA,oCAAmB,EAAC;IAC7C,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,aAAa,EAAE,QAAQ,CAAC,qBAAqB;IAC7C,SAAS,EAAE,QAAQ,CAAC,oBAAoB;CACzC,CAAC,CAAC;AAMU,QAAA,QAAQ,GAAG,IAAA,oCAAmB,EAAC;IAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,aAAa,EAAE,QAAQ,CAAC,qBAAqB;IAC7C,SAAS,EAAE,QAAQ,CAAC,iBAAiB;CACtC,CAAC,CAAC;AAMU,QAAA,UAAU,GAAG,IAAA,oCAAmB,EAAC;IAC5C,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,aAAa,EAAE,QAAQ,CAAC,uBAAuB;IAC/C,SAAS,EAAE,QAAQ,CAAC,mBAAmB;CACxC,CAAC,CAAC;AAYI,MAAM,aAAa,GAAG,GAAG,EAAE;IAChC,MAAM,SAAS,GAAG,IAAA,oCAAmB,EAAC;QACpC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,aAAa,EAAE,QAAQ,CAAC,qBAAqB;QAC7C,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC;KAC3D,CAAC,CAAC;IACH,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;AAPW,QAAA,aAAa,iBAOxB;AASW,QAAA,mBAAmB,GAC9B,IAAA,kCAAiB,GAMd,CAAC;AASO,QAAA,oBAAoB,GAC/B,IAAA,kCAAiB,GAMd,CAAC;AAOO,QAAA,oBAAoB,GAC/B,IAAA,kCAAiB,GAEd,CAAC;AAEO,QAAA,sBAAsB,GACjC,IAAA,kCAAiB,GAEd,CAAC;AAEO,QAAA,sBAAsB,GAAG,IAAA,kCAAiB,GAOpD,CAAC;AAES,QAAA,6BAA6B,GACxC,IAAA,kCAAiB,GAAwD,CAAC;AAE/D,QAAA,6BAA6B,GACxC,IAAA,kCAAiB,GAAiD,CAAC;AAExD,QAAA,YAAY,GACvB,IAAA,kCAAiB,GAA+C,CAAC;AAEtD,QAAA,wBAAwB,GACnC,IAAA,kCAAiB,GAAiC,CAAC;AACxC,QAAA,oBAAoB,GAC/B,IAAA,kCAAiB,GAAiC,CAAC;AAcxC,QAAA,oBAAoB,GAC/B,IAAA,kCAAiB,GAOd,CAAC;AAOO,QAAA,YAAY,GAAG,IAAA,kCAAiB,GAAiC,CAAC;AAkB/E,SAAS,qBAAqB,CAC5B,QAA8B,EAC9B,MAAc;IAEd,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,0BAAU,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAqBM,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,QAA+B;IAE/B,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,8BAAyB,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,IAAA,4BAAuB,EAChC,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC;YACjB,GAAG,EAAE,EAAE;YACP,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,KAAK;YACL,SAAS,EAAE,GAAG;YACd,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,MAAM,WAAW,CAAC;QAC9B,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAQD,SAAgB,qBAAqB,CACnC,MAAc;IAEd,OAAO,IAAA,wCAAQ,EAAC,8BAAyB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,SAAoB,EACpB,IAAU;IAEV,KAAK,IAAA,qBAAa,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM;aACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;aACzB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,IAAA,gCAAwB,EAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAO,CAAC,KAAK,CACX,sDAAsD,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAoBM,KAAK,UAAU,oBAAoB,CACxC,SAAoB,EACpB,IAAU,EACV,QAAgB;IAEhB,KAAK,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,eAAe,EAAE;YACvC,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,YAA0B,EAC1B,MAAc,EACd,SAAiB,EACjB,EAAU;IAEV,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAc,EAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;SACxD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAErC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;QACpC,MAAM;QACN,YAAY,EAAE,EAAE;QAChB,SAAS,EAAE,SAAS,IAAI,EAAE;QAC1B,EAAE,EAAE,EAAE,IAAI,EAAE;QACZ,OAAO,EAAE,OAAO,IAAI,SAAS;QAC7B,EAAE,EAAE,EAAE,IAAI,SAAS;QACnB,UAAU;QACV,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,GAAG;QACd,YAAY,EAAE,GAAG;KAClB,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAwDA,0DAYC;AA4ND,oDAqCC;AAQD,sDAIC;AA6CD,oDAoBC;AAED,sCA2BC;AA/aD,6DAA4E;AAC5E,+DAAiE;AACjE,+DAA+D;AAC/D,gEAA6D;AAC7D,6FAAqE;AACrE,oCAA8C;AAC9C,6BAOc;AACd,8DAAyD;AAGzD,2DAAyC;AAEzC;;;;;;GAMG;AACU,QAAA,aAAa,GACxB,IAAA,kCAAiB,GAA0C,CAAC;AAE9D,gBAAgB;AACH,QAAA,wBAAwB,GACnC,IAAA,kCAAiB,GAEd,CAAC;AAEN,gBAAgB;AACH,QAAA,cAAc,GACzB,IAAA,kCAAiB,GAA0C,CAAC;AAE9D,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAC5C,MAAM,+BAA+B,GAAG,qCAAqC,CAAC;AAQ9E;;;;;GAKG;AACI,KAAK,UAAU,uBAAuB,CAC3C,GAAmB;IAEnB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC;IAC1D,MAAM,KAAK,GACT,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,0BAAU,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,IAAiB,QAAQ,CAsBxB;AAtBD,WAAiB,QAAQ;IACV,8BAAqB,GAChC,IAAA,kCAAiB,GAAkD,CAAC;IAEzD,gCAAuB,GAClC,IAAA,kCAAiB,GAEd,CAAC;IAEO,6BAAoB,GAC/B,IAAA,kCAAiB,GAA8C,CAAC;IAErD,0BAAiB,GAC5B,IAAA,kCAAiB,GAA8C,CAAC;IAErD,4BAAmB,GAC9B,IAAA,kCAAiB,GAEd,CAAC;IAEO,+BAAsB,GACjC,IAAA,kCAAiB,GAA8C,CAAC;AACpE,CAAC,EAtBgB,QAAQ,wBAAR,QAAQ,QAsBxB;AAED;;GAEG;AACU,QAAA,WAAW,GAAG,IAAA,oCAAmB,EAAC;IAC7C,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,aAAa,EAAE,QAAQ,CAAC,qBAAqB;IAC7C,SAAS,EAAE,QAAQ,CAAC,oBAAoB;CACzC,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,QAAQ,GAAG,IAAA,oCAAmB,EAAC;IAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,aAAa,EAAE,QAAQ,CAAC,qBAAqB;IAC7C,SAAS,EAAE,QAAQ,CAAC,iBAAiB;CACtC,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,UAAU,GAAG,IAAA,oCAAmB,EAAC;IAC5C,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,aAAa,EAAE,QAAQ,CAAC,uBAAuB;IAC/C,SAAS,EAAE,QAAQ,CAAC,mBAAmB;CACxC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACI,MAAM,aAAa,GAAG,GAAG,EAAE;IAChC,MAAM,SAAS,GAAG,IAAA,oCAAmB,EAAC;QACpC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,aAAa,EAAE,QAAQ,CAAC,qBAAqB;QAC7C,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC;KAC3D,CAAC,CAAC;IACH,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;AAPW,QAAA,aAAa,iBAOxB;AAEF;;;;;;GAMG;AACU,QAAA,mBAAmB,GAC9B,IAAA,kCAAiB,GAMd,CAAC;AAEN;;;;;;GAMG;AACU,QAAA,oBAAoB,GAC/B,IAAA,kCAAiB,GAMd,CAAC;AAEN;;;;GAIG;AACU,QAAA,oBAAoB,GAC/B,IAAA,kCAAiB,GAEd,CAAC;AAEO,QAAA,sBAAsB,GACjC,IAAA,kCAAiB,GAEd,CAAC;AAEO,QAAA,sBAAsB,GAAG,IAAA,kCAAiB,GAOpD,CAAC;AAES,QAAA,6BAA6B,GACxC,IAAA,kCAAiB,GAAwD,CAAC;AAE/D,QAAA,6BAA6B,GACxC,IAAA,kCAAiB,GAAiD,CAAC;AAExD,QAAA,YAAY,GACvB,IAAA,kCAAiB,GAA+C,CAAC;AAEtD,QAAA,wBAAwB,GACnC,IAAA,kCAAiB,GAAiC,CAAC;AACxC,QAAA,oBAAoB,GAC/B,IAAA,kCAAiB,GAAiC,CAAC;AAcxC,QAAA,oBAAoB,GAC/B,IAAA,kCAAiB,GAOd,CAAC;AAEN;;;;GAIG;AACU,QAAA,YAAY,GAAG,IAAA,kCAAiB,GAAiC,CAAC;AAkB/E,SAAS,qBAAqB,CAC5B,QAA8B,EAC9B,MAAc;IAEd,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,0BAAU,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,QAA+B;IAE/B,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,8BAAyB,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,IAAA,4BAAuB,EAChC,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC;YACjB,GAAG,EAAE,EAAE;YACP,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,KAAK;YACL,SAAS,EAAE,GAAG;YACd,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,MAAM,WAAW,CAAC;QAC9B,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,MAAc;IAEd,OAAO,IAAA,wCAAQ,EAAC,8BAAyB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,SAAoB,EACpB,IAAU;IAEV,IAAA,+BAAa,EAAC,IAAA,qBAAa,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAE1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM;aACpB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;aACzB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAA,+BAAa,EACX,IAAA,gCAAwB,EAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EACzD,kCAAkC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAO,CAAC,KAAK,CACX,sDAAsD,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,UAAU,oBAAoB,CACxC,SAAoB,EACpB,IAAU,EACV,QAAgB;IAEhB,IAAA,+BAAa,EACX,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,EACtC,+BAA+B,CAChC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,eAAe,EAAE;YACvC,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,YAA0B,EAC1B,MAAc,EACd,SAAiB,EACjB,EAAU;IAEV,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAc,EAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;SACxD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAErC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;QACpC,MAAM;QACN,SAAS,EAAE,SAAS,IAAI,EAAE;QAC1B,EAAE,EAAE,EAAE,IAAI,EAAE;QACZ,OAAO,EAAE,OAAO,IAAI,SAAS;QAC7B,EAAE,EAAE,EAAE,IAAI,SAAS;QACnB,UAAU;QACV,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,GAAG;QACd,YAAY,EAAE,GAAG;KAClB,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC"}

package/dist/auth/internal/request-authenticators.d.ts

@@ -0,0 +1,6 @@
+import { type RequestContext } from "@antelopejs/interface-api";
+import type { RequestAuthenticator, RequestPrincipal } from "../request-authenticators";
+/** @internal Read only a successfully authenticated, unchanged request's tenant. */
+export declare function getAuthenticatedRequestTenantId(ctx: RequestContext): string | undefined;
+/** @internal Revalidate on every call; failures poison tenant resolution for this request. */
+export declare function resolveRequestPrincipal(ctx: RequestContext, authenticators: readonly RequestAuthenticator[], authenticateJwt: (token: string) => Promise<RequestPrincipal>): Promise<RequestPrincipal>;