@aooth/user 0.1.23 → 0.1.25

package/dist/index.cjs

@@ -420,11 +420,7 @@ var UserService = class {
 		if (!user.account.active) throw new require_federated_identity_store.UserAuthError("INACTIVE");
 		await this.ensureNotLockedOrThrow(user.id, user.account);
 		if (await this.hasher.verify(password, user.password.hash)) {
-			const now = this.config.clock();
-			await this.store.update(user.id, { set: { account: {
-				lastLogin: now,
-				failedLoginAttempts: 0
-			} } });
+			const now = await this.recordLogin(user.id);
 			user.account.lastLogin = now;
 			user.account.failedLoginAttempts = 0;
 			return {
@@ -434,6 +430,27 @@ var UserService = class {
 		}
 		return this.incrementAndMaybeLock(user.id, user.account, "INVALID_CREDENTIALS", lockoutOverride);
 	}
+	/**
+	* Stamp a successful login on the user record: `account.lastLogin = now` and
+	* reset `account.failedLoginAttempts = 0`. The single writer of `lastLogin`.
+	*
+	* Called by {@link login} on a valid password verify, AND by passwordless
+	* auto-login terminals (invite-accept / signup) which issue a session without
+	* going through `login()`. Stamping there closes out that first login so the
+	* derived `isFirstLogin = !lastLogin` check stops re-classifying the user's
+	* first *credentialed* sign-in as a first login.
+	*
+	* Returns the timestamp written, so callers holding an in-memory row can patch
+	* it without re-reading the store.
+	*/
+	async recordLogin(id) {
+		const now = this.config.clock();
+		await this.store.update(id, { set: { account: {
+			lastLogin: now,
+			failedLoginAttempts: 0
+		} } });
+		return now;
+	}
 	async verifyPassword(id, password) {
 		const user = await this.store.findById(id);
 		if (!user) throw new require_federated_identity_store.UserAuthError("NOT_FOUND");

package/dist/index.d.cts

@@ -124,6 +124,20 @@ declare class UserService<T extends object = object> {
    */
   findByIdentifier(value: string): Promise<(UserCredentials & T) | null>;
   login(handle: string, password: string, lockoutOverride?: Partial<LockoutConfig>): Promise<LoginResult<T>>;
+  /**
+   * Stamp a successful login on the user record: `account.lastLogin = now` and
+   * reset `account.failedLoginAttempts = 0`. The single writer of `lastLogin`.
+   *
+   * Called by {@link login} on a valid password verify, AND by passwordless
+   * auto-login terminals (invite-accept / signup) which issue a session without
+   * going through `login()`. Stamping there closes out that first login so the
+   * derived `isFirstLogin = !lastLogin` check stops re-classifying the user's
+   * first *credentialed* sign-in as a first login.
+   *
+   * Returns the timestamp written, so callers holding an in-memory row can patch
+   * it without re-reading the store.
+   */
+  recordLogin(id: string): Promise<number>;
   verifyPassword(id: string, password: string): Promise<boolean>;
   changePassword(id: string, currentPassword: string, newPassword: string, repeatPassword?: string): Promise<void>;
   setPassword(id: string, newPassword: string): Promise<void>;

package/dist/index.d.mts

@@ -124,6 +124,20 @@ declare class UserService<T extends object = object> {
    */
   findByIdentifier(value: string): Promise<(UserCredentials & T) | null>;
   login(handle: string, password: string, lockoutOverride?: Partial<LockoutConfig>): Promise<LoginResult<T>>;
+  /**
+   * Stamp a successful login on the user record: `account.lastLogin = now` and
+   * reset `account.failedLoginAttempts = 0`. The single writer of `lastLogin`.
+   *
+   * Called by {@link login} on a valid password verify, AND by passwordless
+   * auto-login terminals (invite-accept / signup) which issue a session without
+   * going through `login()`. Stamping there closes out that first login so the
+   * derived `isFirstLogin = !lastLogin` check stops re-classifying the user's
+   * first *credentialed* sign-in as a first login.
+   *
+   * Returns the timestamp written, so callers holding an in-memory row can patch
+   * it without re-reading the store.
+   */
+  recordLogin(id: string): Promise<number>;
   verifyPassword(id: string, password: string): Promise<boolean>;
   changePassword(id: string, currentPassword: string, newPassword: string, repeatPassword?: string): Promise<void>;
   setPassword(id: string, newPassword: string): Promise<void>;

package/dist/index.mjs

@@ -419,11 +419,7 @@ var UserService = class {
 		if (!user.account.active) throw new UserAuthError("INACTIVE");
 		await this.ensureNotLockedOrThrow(user.id, user.account);
 		if (await this.hasher.verify(password, user.password.hash)) {
-			const now = this.config.clock();
-			await this.store.update(user.id, { set: { account: {
-				lastLogin: now,
-				failedLoginAttempts: 0
-			} } });
+			const now = await this.recordLogin(user.id);
 			user.account.lastLogin = now;
 			user.account.failedLoginAttempts = 0;
 			return {
@@ -433,6 +429,27 @@ var UserService = class {
 		}
 		return this.incrementAndMaybeLock(user.id, user.account, "INVALID_CREDENTIALS", lockoutOverride);
 	}
+	/**
+	* Stamp a successful login on the user record: `account.lastLogin = now` and
+	* reset `account.failedLoginAttempts = 0`. The single writer of `lastLogin`.
+	*
+	* Called by {@link login} on a valid password verify, AND by passwordless
+	* auto-login terminals (invite-accept / signup) which issue a session without
+	* going through `login()`. Stamping there closes out that first login so the
+	* derived `isFirstLogin = !lastLogin` check stops re-classifying the user's
+	* first *credentialed* sign-in as a first login.
+	*
+	* Returns the timestamp written, so callers holding an in-memory row can patch
+	* it without re-reading the store.
+	*/
+	async recordLogin(id) {
+		const now = this.config.clock();
+		await this.store.update(id, { set: { account: {
+			lastLogin: now,
+			failedLoginAttempts: 0
+		} } });
+		return now;
+	}
 	async verifyPassword(id, password) {
 		const user = await this.store.findById(id);
 		if (!user) throw new UserAuthError("NOT_FOUND");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/user",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "User credential primitives for aoothjs",
   "keywords": [
     "aoothjs",
@@ -60,14 +60,14 @@
     "access": "public"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.76",
-    "@atscript/db": "^0.1.106",
-    "@atscript/db-sql-tools": "^0.1.106",
-    "@atscript/db-sqlite": "^0.1.106",
-    "@atscript/typescript": "^0.1.76",
+    "@atscript/core": "^0.1.77",
+    "@atscript/db": "^0.1.107",
+    "@atscript/db-sql-tools": "^0.1.107",
+    "@atscript/db-sqlite": "^0.1.107",
+    "@atscript/typescript": "^0.1.77",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.76"
+    "unplugin-atscript": "^0.1.77"
   },
   "peerDependencies": {
     "@atscript/db": ">=0.1.79"