@appweaver/data 0.0.0-stage → 2.0.0

package/security/helper.js

@@ -0,0 +1,298 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceAuthModel = resourceAuthModel;
+exports.resourceAuthService = resourceAuthService;
+exports.hashPassword = hashPassword;
+exports.checkPassword = checkPassword;
+exports.needsRehash = needsRehash;
+exports.updatePasswordHash = updatePasswordHash;
+exports.validatePasswordComplexity = validatePasswordComplexity;
+exports.isOAuth2Enabled = isOAuth2Enabled;
+exports.hasRole = hasRole;
+exports.hasRoles = hasRoles;
+exports.hasPermission = hasPermission;
+exports.hasPermissions = hasPermissions;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@appweaver/common");
+const auth_config_1 = require("./auth-config");
+const internal_1 = require("@appweaver/core/internal");
+const core_1 = require("@appweaver/core");
+/** The Argon2id cost of new password hashes (OWASP minimum): m KiB of memory, t passes, p lanes. Each hash stores its
+ * own, and {@link needsRehash} flags the ones made with other parameters */
+const ARGON2_PARAMS = { m: 19456, t: 2, p: 1 };
+const ARGON2_VERSION = 19;
+const ARGON2_SALT_BYTES = 16;
+const ARGON2_KEY_BYTES = 32;
+/** A stored hash in the PHC string format, i.e. `$argon2id$v=19$m=19456,t=2,p=1$<salt>$<key>` with unpadded base64
+ * salt and key */
+const ARGON2_HASH_PATTERN = /^\$argon2id\$v=(\d+)\$m=(\d{1,7}),t=(\d{1,3}),p=(\d{1,3})\$([A-Za-z0-9+/]{11,})\$([A-Za-z0-9+/]{6,})$/;
+/**
+ * Evaluates and retrieves the resource authentication model from the available resource models.
+ *
+ * The function iterates through the resource models in the given context and returns the first model
+ * that satisfies the `isResourceAuthModel` condition. If no such model is found, it returns undefined.
+ *
+ * @return {ResourceModel | undefined} The resource authentication model if present, otherwise undefined.
+ */
+function resourceAuthModel() {
+    for (const model of internal_1.context.resource.models.values()) {
+        if ((0, common_1.isResourceAuthModel)(model)) {
+            return model;
+        }
+    }
+}
+/**
+ * Provides authentication service for a resource by identifying and injecting
+ * the appropriate resource authentication service if available.
+ *
+ * @return {IResourceService<AuthUser, AuthUser> | undefined} The resource authentication service
+ *         instance if found, otherwise undefined.
+ */
+function resourceAuthService() {
+    for (const service of internal_1.context.resource.services.values()) {
+        if ((0, common_1.isResourceAuthService)(service)) {
+            return (0, core_1.injectService)(service[common_1.RESOURCE_NAME]);
+        }
+    }
+}
+/**
+ * Hashes a plain text password with the Argon2id function of the runtime and a random salt. The hash holds the
+ * Argon2 parameters and the salt, in the PHC string format `$argon2id$v=19$m=19456,t=2,p=1$<salt>$<key>`.
+ *
+ * @param {string} password - The plain text password to be hashed.
+ * @return {Promise<string>} A promise that resolves to the hashed password.
+ */
+async function hashPassword(password) {
+    const salt = (0, node_crypto_1.randomBytes)(ARGON2_SALT_BYTES);
+    const key = await deriveKey(password, salt, ARGON2_PARAMS, ARGON2_KEY_BYTES);
+    const { m, t, p } = ARGON2_PARAMS;
+    return `$argon2id$v=${ARGON2_VERSION}$m=${m},t=${t},p=${p}$${toPhcBase64(salt)}$${toPhcBase64(key)}`;
+}
+/**
+ * Validates a plain text password against a hashed password, using the parameters stored in the hash. A hash not in
+ * the form {@link hashPassword} produces never matches.
+ *
+ * @param {string} password - The plain text password to validate.
+ * @param {string} passwordHash - The hashed password to compare against.
+ * @return {Promise<boolean>} Returns a promise that resolves to `true` if the password matches the hash,
+ * otherwise `false`.
+ */
+async function checkPassword(password, passwordHash) {
+    const parsed = parseHash(passwordHash);
+    if (!parsed) {
+        return false;
+    }
+    const key = await deriveKey(password, parsed.salt, parsed.params, parsed.key.length);
+    return (0, node_crypto_1.timingSafeEqual)(key, parsed.key);
+}
+/**
+ * Tells whether a password hash was made with other parameters than {@link hashPassword} uses now, so it should be
+ * replaced with a new hash of the password, e.g. on the next successful login.
+ *
+ * @param {string} passwordHash - The stored password hash.
+ * @return {boolean} `true` if the hash is not a current Argon2id hash, otherwise `false`.
+ */
+function needsRehash(passwordHash) {
+    const parsed = parseHash(passwordHash);
+    return (!parsed ||
+        parsed.key.length !== ARGON2_KEY_BYTES ||
+        parsed.params.m !== ARGON2_PARAMS.m ||
+        parsed.params.t !== ARGON2_PARAMS.t ||
+        parsed.params.p !== ARGON2_PARAMS.p);
+}
+/**
+ * Updates the password hash for a given user and optionally logs the user out by setting a logout timestamp.
+ *
+ * @param {Partial<AuthUser>} authUser - The user object containing authentication details. Only partial fields are
+ * expected.
+ * @param {string} [password] - The new password to hash and set for the user. If not provided, no password update
+ * occurs.
+ * @param {boolean} [logout=false] - Indicates whether to log the user out by setting the logout timestamp.
+ * @return Resolves when the password hash is updated and optional logout processing is complete.
+ * @throws {AuthError} `AUTH_PASSWORD_WEAK` if the provided password does not satisfy password complexity requirements.
+ */
+async function updatePasswordHash(authUser, password, logout = false) {
+    if (password) {
+        if (!auth_config_1.passwordConfig.ENABLED) {
+            throw new common_1.AuthError(common_1.ErrorCode.AuthPasswordDisabled, 'Password creation is not supported');
+        }
+        const result = validatePasswordComplexity(password);
+        if (!result.valid) {
+            throw new common_1.AuthError(common_1.ErrorCode.AuthPasswordWeak, result.message, {
+                reason: result.message
+            });
+        }
+        authUser.passwordHash = await hashPassword(password);
+        if (logout) {
+            authUser.logoutAt = new Date();
+        }
+    }
+    delete authUser['password'];
+}
+/**
+ * Validates the complexity of a given password based on the configured rules.
+ * @param {string} password - The password to be validated.
+ * @return {ValidationResult} An object with the validation result and message.
+ */
+function validatePasswordComplexity(password) {
+    const minLength = auth_config_1.passwordConfig.MIN_LENGTH;
+    if (password.length < minLength) {
+        return {
+            valid: false,
+            message: `Password must be at least ${minLength} characters long`
+        };
+    }
+    const maxLength = auth_config_1.passwordConfig.MAX_LENGTH;
+    if (password.length > maxLength) {
+        return {
+            valid: false,
+            message: `Password must not be longer than ${maxLength} characters`
+        };
+    }
+    if (!/[A-Z]/.test(password) && auth_config_1.passwordConfig.UPPERCASE) {
+        return {
+            valid: false,
+            message: `Password must have at least one uppercase character`
+        };
+    }
+    if (!/[a-z]/.test(password) && auth_config_1.passwordConfig.LOWERCASE) {
+        return {
+            valid: false,
+            message: `Password must have at least one lowercase character`
+        };
+    }
+    if (!/[0-9]/.test(password) && auth_config_1.passwordConfig.NUMERIC) {
+        return {
+            valid: false,
+            message: `Password must have at least one numeric character`
+        };
+    }
+    if (!/[^A-Za-z0-9]/.test(password) && auth_config_1.passwordConfig.SPECIAL) {
+        return {
+            valid: false,
+            message: `Password must have at least one special character`
+        };
+    }
+    return { valid: true, message: 'OK' };
+}
+/**
+ * Checks whether at least one OAuth2 provider is enabled, by resolving each OAuth2 auth source to its
+ * `SECURITY_OAUTH2_<PROVIDER>_ENABLED` config flag. New providers are picked up automatically as long as they follow
+ * that naming convention.
+ *
+ * @return {boolean} True when any OAuth2 provider is enabled.
+ */
+function isOAuth2Enabled() {
+    // Read by the flattened keys, since the OAuth2 config belongs to the web module
+    return Object.values(common_1.AuthSource)
+        .filter((source) => source.startsWith('oauth2'))
+        .some((source) => common_1.config.bool(`SECURITY_OAUTH2_${source.replace('oauth2', '').toUpperCase()}_ENABLED`, false));
+}
+/**
+ * Checks if the given user has a specific role.
+ *
+ * @param {AuthUser} authUser - The authenticated user object containing role information.
+ * @param {string} role - The name of the role to check for.
+ * @return {boolean} True if the user has the specified role; otherwise, false.
+ */
+function hasRole(authUser, role) {
+    return authUser.roles.some((r) => r.name === role);
+}
+/**
+ * Checks if the authenticated user has the required roles based on the specified operator.
+ *
+ * @param {AuthUser} authUser - The authenticated user whose roles are being checked.
+ * @param {Array<string> | undefined} roles - The list of roles to check against. If undefined, the method returns
+ * true`.
+ * @param {'or' | 'and'} [operator='or'] - The logical operator for role matching. Use 'or' to check if the user has at
+ * least one role, and 'and' to check if the user has all roles.
+ * @return {boolean} Returns `true` if the user satisfies the role check based on the specified operator, otherwise
+ * `false`.
+ */
+function hasRoles(authUser, roles, operator = 'or') {
+    if (!roles) {
+        return true;
+    }
+    const predicate = (role) => hasRole(authUser, role);
+    return operator === 'and' ? roles.every(predicate) : roles.some(predicate);
+}
+/**
+ * Determines if the authenticated user has the specified permission.
+ *
+ * @param {AuthUser} authUser - The authenticated user object containing roles and permissions.
+ * @param {string} permission - The name of the permission to check for.
+ * @return {boolean} Returns true if the user has the specified permission, otherwise false.
+ */
+function hasPermission(authUser, permission) {
+    return authUser.roles
+        .flatMap((r) => r.permissions)
+        .some((p) => p.name === permission);
+}
+/**
+ * Checks if the authenticated user has the specified permissions based on the given operator.
+ *
+ * @param {AuthUser} authUser - The authenticated user object.
+ * @param {string[] | undefined} permissions - The list of permissions to check. If undefined, it defaults to granting
+ * access.
+ * @param {'or' | 'and'} [operator='or'] - Determines whether all permissions (and) or at least one permission (or) must
+ * be satisfied.
+ * @return {boolean} Returns true if the user satisfies the permission requirements, false otherwise.
+ */
+function hasPermissions(authUser, permissions, operator = 'or') {
+    if (!permissions) {
+        return true;
+    }
+    const predicate = (perm) => hasPermission(authUser, perm);
+    return operator === 'and'
+        ? permissions.every(predicate)
+        : permissions.some(predicate);
+}
+/**
+ * Parses a PHC Argon2id hash, rejecting the parameters out of bounds, so a tampered hash cannot make the check exhaust
+ * the memory or CPU.
+ */
+function parseHash(passwordHash) {
+    const match = ARGON2_HASH_PATTERN.exec(passwordHash);
+    if (!match || Number(match[1]) !== ARGON2_VERSION) {
+        return null;
+    }
+    const params = {
+        m: Number(match[2]),
+        t: Number(match[3]),
+        p: Number(match[4])
+    };
+    const bounded = params.p >= 1 &&
+        params.p <= 16 &&
+        params.m >= 8 * params.p &&
+        params.m <= 262144 &&
+        params.t >= 1 &&
+        params.t <= 10;
+    if (!bounded) {
+        return null;
+    }
+    return {
+        params,
+        salt: Buffer.from(match[5], 'base64'),
+        key: Buffer.from(match[6], 'base64')
+    };
+}
+/**
+ * Derives the Argon2id key of a password.
+ */
+function deriveKey(password, salt, params, keyBytes) {
+    const parameters = {
+        message: password,
+        nonce: salt,
+        memory: params.m,
+        passes: params.t,
+        parallelism: params.p,
+        tagLength: keyBytes
+    };
+    return new Promise((resolve, reject) => {
+        (0, node_crypto_1.argon2)('argon2id', parameters, (error, key) => error ? reject(error) : resolve(key));
+    });
+}
+/** Encodes bytes in the unpadded base64 of the PHC string format. */
+function toPhcBase64(bytes) {
+    return bytes.toString('base64').replace(/=+$/, '');
+}

package/security/resources/api-key/model.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceModel | undefined;
+export default _default;

package/security/resources/api-key/model.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@appweaver/common");
+const auth_config_1 = require("../../auth-config");
+const create_model_1 = require("../../../factory/create-model");
+const helper_1 = require("../../helper");
+const authModel = (0, helper_1.resourceAuthModel)();
+const shouldCreateModel = auth_config_1.apiKeyConfig.ENABLED || auth_config_1.apiKeyConfig.KEEP_DATABASE_TABLE;
+exports.default = shouldCreateModel
+    ? (0, create_model_1.createModel)({
+        name: 'ApiKey',
+        // Cascades from the auth model, so it is soft deleted together with it
+        softDelete: !!authModel?.config.softDelete,
+        scalars: {
+            key: {
+                type: 'string'
+            },
+            keyHash: {
+                type: 'string',
+                unique: true,
+                hidden: true
+            },
+            name: {
+                type: 'string',
+                required: false,
+                maxLength: 255
+            },
+            description: {
+                type: 'string',
+                required: false
+            },
+            enabled: {
+                type: 'boolean',
+                default: true
+            },
+            expiresAt: {
+                type: 'dateTime',
+                required: false
+            }
+        },
+        ...(authModel
+            ? {
+                relations: {
+                    [(0, common_1.uncapitalize)(authModel.name)]: {
+                        model: authModel.name,
+                        type: 'manyToOne',
+                        mappedBy: 'apiKeys',
+                        // API keys are meaningless without their user
+                        onDelete: 'cascade',
+                        input: {
+                            type: 'none'
+                        },
+                        output: {
+                            type: 'none'
+                        }
+                    }
+                }
+            }
+            : {}),
+        create: {
+            omit: ['key']
+        },
+        update: {
+            omit: ['key', 'expiresAt']
+        }
+    })
+    : undefined;

package/security/resources/api-key/policy.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourcePolicyConfig<Record<string, any>> | undefined;
+export default _default;

package/security/resources/api-key/policy.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@appweaver/common");
+const auth_config_1 = require("../../auth-config");
+const helper_1 = require("../../helper");
+const create_policy_1 = require("../../../factory/create-policy");
+function authModelField() {
+    return (0, common_1.uncapitalize)((0, helper_1.resourceAuthModel)().name);
+}
+exports.default = auth_config_1.apiKeyConfig.ENABLED
+    ? (0, create_policy_1.createPolicy)({
+        modelName: 'ApiKey',
+        checkAccess: (user, resource, action) => {
+            const authFieldName = authModelField();
+            const currentAuthId = user.id;
+            if (action === 'create') {
+                return resource[authFieldName].id === currentAuthId;
+            }
+            else {
+                return resource[`${authFieldName}Id`] === currentAuthId;
+            }
+        },
+        readRestrictions: (user) => {
+            return { [authModelField()]: { id: user.id } };
+        }
+    })
+    : undefined;

package/security/resources/api-key/service.d.ts

@@ -0,0 +1,3 @@
+import { ApiKey } from '../../../types/generated';
+declare const _default: import("@appweaver/common").Ctor<import("../../..").ResourceService<ApiKey, ApiKey, ApiKey, any, import("@appweaver/common").QueryFilter<ApiKey>, ApiKey>> | undefined;
+export default _default;

package/security/resources/api-key/service.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@appweaver/common");
+const auth_config_1 = require("../../auth-config");
+const create_service_1 = require("../../../factory/create-service");
+const helper_1 = require("../../helper");
+const core_1 = require("@appweaver/core");
+exports.default = auth_config_1.apiKeyConfig.ENABLED
+    ? (0, create_service_1.createService)({
+        modelName: 'ApiKey',
+        beforeCreate: (data) => {
+            data.key = (0, common_1.randomString)(64, { special: false });
+            data.keyHash = (0, common_1.makeHash)(data.key);
+            // Add relation to the current user when creating a new API Key
+            data[(0, common_1.uncapitalize)((0, helper_1.resourceAuthModel)().name)] = {
+                id: (0, core_1.currentAuthUser)().id
+            };
+            // Enforces max API key duration based on config value
+            const maxDuration = auth_config_1.apiKeyConfig.MAX_DURATION;
+            if (maxDuration) {
+                const maxExpiryDate = new Date(Date.now() + maxDuration * 1000);
+                if (!data.expiresAt ||
+                    new Date(data.expiresAt).getTime() > maxExpiryDate.getTime()) {
+                    data.expiresAt = maxExpiryDate;
+                }
+            }
+        },
+        afterCreate: async (data) => {
+            const service = (0, core_1.injectService)('ApiKey');
+            await service.update(data.id, { key: `...${data.key.slice(-6)}` });
+            data.key = `${data.id}${auth_config_1.apiKeyConfig.DELIMITER}${data.key}`;
+        }
+    })
+    : undefined;

package/security/resources/connected-account/model.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceModel | undefined;
+export default _default;

package/security/resources/connected-account/model.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@appweaver/common");
+const auth_config_1 = require("../../auth-config");
+const create_model_1 = require("../../../factory/create-model");
+const helper_1 = require("../../helper");
+const authModel = (0, helper_1.resourceAuthModel)();
+const shouldCreateModel = (0, helper_1.isOAuth2Enabled)() ||
+    auth_config_1.connectedAccountConfig.CONNECTED_ACCOUNTS_KEEP_DATABASE_TABLE;
+exports.default = shouldCreateModel
+    ? (0, create_model_1.createModel)({
+        name: 'ConnectedAccount',
+        // Cascades from the auth model, so it is soft deleted together with it
+        softDelete: !!authModel?.config.softDelete,
+        audit: {
+            createdById: false
+        },
+        scalars: {
+            provider: {
+                type: 'string',
+                maxLength: 255
+            },
+            providerAccountId: {
+                type: 'string',
+                maxLength: 255
+            },
+            scope: {
+                type: 'string',
+                required: false
+            },
+            lastLoginAt: {
+                type: 'dateTime'
+            }
+        },
+        ...(authModel
+            ? {
+                relations: {
+                    [(0, common_1.uncapitalize)(authModel.name)]: {
+                        model: authModel.name,
+                        type: 'manyToOne',
+                        mappedBy: 'connectedAccounts',
+                        // Connected accounts are meaningless without their user
+                        onDelete: 'cascade',
+                        input: {
+                            type: 'none'
+                        },
+                        output: {
+                            type: 'none'
+                        }
+                    }
+                }
+            }
+            : {}),
+        // A provider account may only ever be linked to a single user
+        unique: [['provider', 'providerAccountId']]
+    })
+    : undefined;

package/security/resources/connected-account/service.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").Ctor<import("../../..").ResourceService<any, any, any, any, import("@appweaver/common").QueryFilter<any>, any>> | undefined;
+export default _default;

package/security/resources/connected-account/service.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const create_service_1 = require("../../../factory/create-service");
+const helper_1 = require("../../helper");
+exports.default = (0, helper_1.isOAuth2Enabled)()
+    ? (0, create_service_1.createService)({ modelName: 'ConnectedAccount' })
+    : undefined;

package/security/resources/one-time-token/model.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceModel | undefined;
+export default _default;

package/security/resources/one-time-token/model.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@appweaver/core");
+const create_model_1 = require("../../../factory/create-model");
+// The database store is the one `auto` selects with a database
+const shouldCreateModel = ['auto', 'database'].includes(core_1.securityStoreConfig.PROVIDER) ||
+    core_1.securityStoreConfig.KEEP_DATABASE_TABLE;
+exports.default = shouldCreateModel
+    ? (0, create_model_1.createModel)({
+        name: 'OneTimeToken',
+        // Tokens are only created and deleted, never updated
+        audit: {
+            updatedAt: false,
+            createdById: false
+        },
+        scalars: {
+            tokenHash: {
+                type: 'string',
+                maxLength: 128,
+                unique: true
+            },
+            purpose: {
+                type: 'string',
+                maxLength: 64
+            },
+            data: {
+                type: 'json'
+            },
+            expiresAt: {
+                type: 'dateTime'
+            }
+        },
+        // Deleting the expired tokens filters by the expiration
+        index: [['expiresAt']]
+    })
+    : undefined;

package/security/resources/permission/model.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceModel;
+export default _default;

package/security/resources/permission/model.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const create_model_1 = require("../../../factory/create-model");
+exports.default = (0, create_model_1.createModel)({
+    name: 'Permission',
+    scalars: {
+        name: {
+            type: 'string',
+            unique: true,
+            maxLength: 255
+        }
+    },
+    read: {
+        omit: ['updatedAt', 'createdAt', 'createdById']
+    }
+});

package/security/resources/role/model.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@appweaver/common").ResourceModel;
+export default _default;

package/security/resources/role/model.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const create_model_1 = require("../../../factory/create-model");
+exports.default = (0, create_model_1.createModel)({
+    name: 'Role',
+    scalars: {
+        name: {
+            type: 'string',
+            unique: true,
+            maxLength: 255
+        }
+    },
+    relations: {
+        permissions: {
+            model: 'Permission',
+            type: 'manyToMany'
+        }
+    },
+    read: {
+        omit: ['updatedAt', 'createdAt', 'createdById']
+    }
+});

package/security/store/database-security-store.d.ts

@@ -0,0 +1,5 @@
+import { SecurityStore, ValidationResult } from '@appweaver/common';
+export declare class DatabaseSecurityStore extends SecurityStore {
+    generateOneTimeToken<T = any>(purpose: string, data: T, ttl: number): Promise<string>;
+    useOneTimeToken<T = any>(token: string, purpose: string, validateContent?: (value: T) => ValidationResult): Promise<T>;
+}

package/security/store/database-security-store.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseSecurityStore = void 0;
+const common_1 = require("@appweaver/common");
+const core_1 = require("@appweaver/core");
+class DatabaseSecurityStore extends common_1.SecurityStore {
+    /** @internal */
+    _db = (0, core_1.inject)(common_1.Database);
+    async generateOneTimeToken(purpose, data, ttl) {
+        const token = (0, common_1.generateToken)('bytes', 64);
+        const oneTimeTokens = this._db.client().oneTimeToken;
+        // Expired tokens are removed here, so they need no scheduled cleanup
+        await oneTimeTokens.deleteMany({
+            where: { expiresAt: { lt: new Date() } }
+        });
+        await oneTimeTokens.create({
+            data: {
+                tokenHash: (0, common_1.makeHash)(token),
+                purpose,
+                data: data,
+                expiresAt: new Date(Date.now() + ttl)
+            }
+        });
+        return token;
+    }
+    async useOneTimeToken(token, purpose, validateContent) {
+        const oneTimeTokens = this._db.client().oneTimeToken;
+        const oneTimeToken = await oneTimeTokens.findUnique({
+            where: { tokenHash: (0, common_1.makeHash)(token) }
+        });
+        if (oneTimeToken === null ||
+            oneTimeToken.purpose !== purpose ||
+            oneTimeToken.expiresAt.getTime() < Date.now()) {
+            throw new common_1.AuthError(common_1.ErrorCode.AuthInvalidToken, 'Invalid or expired token provided');
+        }
+        const data = oneTimeToken.data;
+        // A token failing the validation is kept, so it can be used again
+        if (validateContent) {
+            const result = validateContent(data);
+            if (!result.valid) {
+                throw new common_1.AuthError(common_1.ErrorCode.AuthInvalidToken, result.message);
+            }
+        }
+        // Only the one of concurrent uses that removes the token gets its data
+        const { count } = await oneTimeTokens.deleteMany({
+            where: { id: oneTimeToken.id }
+        });
+        if (count === 0) {
+            throw new common_1.AuthError(common_1.ErrorCode.AuthInvalidToken, 'Invalid or expired token provided');
+        }
+        return data;
+    }
+}
+exports.DatabaseSecurityStore = DatabaseSecurityStore;