@bevel-software/platform-core-backend 0.1.0

package/dist/modules/auth/account-erasure.service.d.ts

@@ -0,0 +1,80 @@
+import type { Database } from '../database/connection.js';
+/** A user row as the admin surface needs it (no avatar, no timestamps churn). */
+export interface AdminUserView {
+    id: string;
+    email: string;
+    name: string;
+    createdAt: number;
+}
+/** The drizzle client erasure participants receive inside the transaction. */
+export type ErasureTx = Parameters<Parameters<Database['transaction']>[0]>[0];
+/** Identity context for one erasure run. */
+export interface ErasureTarget {
+    userId: string;
+    /** The user's (lowercased) email at erasure time — for email-keyed rows. */
+    email: string;
+    /**
+     * Per-erasure placeholder identity for anonymized audit rows. Random per
+     * erasure: no link back to the person, but rows from ONE erasure stay
+     * correlated and email-keyed unique indexes can't collide across erasures.
+     */
+    erasedEmail: string;
+    erasedName: string;
+}
+/**
+ * A module-owned slice of account erasure. The core service erases the rows
+ * it owns (tokens, locks, review-trail anonymization, the user row) and runs
+ * every registered participant so each module cleans up its own tables —
+ * chat threads, connector links, routine authorship, … — without the auth
+ * module knowing they exist. Registered at the composition root.
+ *
+ *  - `before` runs OUTSIDE the transaction, first. For idempotent pre-cleanup
+ *    against external stores (e.g. chat-thread message memory) where a failure
+ *    must leave a retryable state, not a half-committed one.
+ *  - `inTransaction` runs INSIDE the erasure transaction, BEFORE the users row
+ *    is deleted (so FKs onto users are still satisfiable and RESTRICT FKs make
+ *    missed rows fail loudly). It may return a callback, which runs after the
+ *    transaction commits — for external-store cleanup of rows captured during
+ *    the transaction.
+ */
+export interface IErasureParticipant {
+    before?(target: ErasureTarget): Promise<void>;
+    inTransaction?(tx: ErasureTx, target: ErasureTarget): Promise<void | (() => Promise<void>)>;
+}
+/**
+ * GDPR account erasure (Art. 17). Operator-driven: an admin deletes a user in
+ * response to an erasure request. What it guarantees:
+ *
+ *  - Rows that ARE the user's personal data are hard-deleted: API/OAuth
+ *    tokens, held file locks, the user row itself, and every registered
+ *    participant's module-owned rows (chat threads incl. message memory,
+ *    Microsoft connection, feedback, revalidation requests, upload tokens).
+ *    Deleting the user row cascades whatever FKs onto it with ON DELETE
+ *    CASCADE (account links, watchlist sources/findings, connector configs,
+ *    vault secrets); deleting a connection key cascades its usage metering.
+ *  - Audit rows that must survive for the review trail (approvals, merge log,
+ *    review comments, change requests, queued commits — and, via participants,
+ *    e.g. routine authorship) are kept but ANONYMIZED with the per-erasure
+ *    placeholder identity.
+ *
+ * Out of scope, by firm policy (disclosed in the DPA): git history is never
+ * rewritten. Commit authorship and historical access-file entries stay in the
+ * KB's version history permanently as part of the tamper-evident record;
+ * erasure covers every database/filesystem store plus the CURRENT KB state.
+ *
+ * Note: sign-in is get-or-create by email, so a person who authenticates again
+ * after erasure simply gets a fresh, empty account — that is intended.
+ */
+export interface IAccountErasureService {
+    listUsers(): Promise<AdminUserView[]>;
+    /** Erase `userId`. Returns false when no such user exists. */
+    eraseUser(userId: string): Promise<boolean>;
+}
+export declare class AccountErasureService implements IAccountErasureService {
+    private readonly db;
+    private readonly participants;
+    constructor(db: Database, participants?: IErasureParticipant[]);
+    listUsers(): Promise<AdminUserView[]>;
+    eraseUser(userId: string): Promise<boolean>;
+}
+//# sourceMappingURL=account-erasure.service.d.ts.map

package/dist/modules/auth/account-erasure.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-erasure.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-erasure.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAc1D,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,aAAa,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACtC,8DAA8D;IAC9D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED,qBAAa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,EAAE,EAAE,QAAQ,EACZ,YAAY,GAAE,mBAAmB,EAAO;IAGrD,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAQrC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA4ElD"}

package/dist/modules/auth/account-erasure.service.js

@@ -0,0 +1,91 @@
+import { randomUUID } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { changeRequests, externalApiKeys, fileLocks, oauthAuthCodes, oauthTokens, pendingCommits, prComments, prFileApprovals, prMergeLog, users, } from '../database/schema.js';
+export class AccountErasureService {
+    db;
+    participants;
+    constructor(db, participants = []) {
+        this.db = db;
+        this.participants = participants;
+    }
+    async listUsers() {
+        const rows = await this.db
+            .select({ id: users.id, email: users.email, name: users.name, createdAt: users.createdAt })
+            .from(users)
+            .orderBy(users.email);
+        return rows.map((r) => ({ ...r, createdAt: r.createdAt.getTime() }));
+    }
+    async eraseUser(userId) {
+        const [user] = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
+        if (!user)
+            return false;
+        const target = {
+            userId,
+            email: user.email.toLowerCase(),
+            erasedEmail: `deleted-${randomUUID()}@erased.invalid`,
+            erasedName: 'Deleted user',
+        };
+        // Participant pre-passes (e.g. chat threads + their Mastra memory) run
+        // outside the transaction on purpose: external stores are separate
+        // systems, and the pre-passes are idempotent, so a failure here leaves a
+        // retryable state rather than a half-committed one.
+        for (const p of this.participants) {
+            if (p.before)
+                await p.before(target);
+        }
+        const postCommit = [];
+        await this.db.transaction(async (tx) => {
+            // Token-shaped rows (all hashed, but they key to the user). Dependents
+            // like the LLM-usage metering rows cascade at the DB layer.
+            await tx.delete(externalApiKeys).where(eq(externalApiKeys.userId, userId));
+            await tx.delete(oauthAuthCodes).where(eq(oauthAuthCodes.userId, userId));
+            await tx.delete(oauthTokens).where(eq(oauthTokens.userId, userId));
+            // Personal-data rows the core owns.
+            await tx.delete(fileLocks).where(eq(fileLocks.holderUserId, userId));
+            // Audit rows: anonymize in place (no user FK on these; they key by email).
+            await tx
+                .update(prFileApprovals)
+                .set({ approverEmail: target.erasedEmail, approverName: target.erasedName })
+                .where(eq(prFileApprovals.approverEmail, target.email));
+            await tx
+                .update(prMergeLog)
+                .set({ triggeredByEmail: target.erasedEmail, triggeredByName: target.erasedName })
+                .where(eq(prMergeLog.triggeredByEmail, target.email));
+            await tx
+                .update(prComments)
+                .set({ authorEmail: target.erasedEmail, authorName: target.erasedName })
+                .where(eq(prComments.authorEmail, target.email));
+            await tx
+                .update(changeRequests)
+                .set({ authorEmail: target.erasedEmail, authorName: target.erasedName })
+                .where(eq(changeRequests.authorEmail, target.email));
+            // Queued-but-uncommitted saves: the eventual git commit is authored with
+            // the placeholder instead of the erased identity. The file content still
+            // lands — erasing an account must not lose other people's KB state.
+            await tx
+                .update(pendingCommits)
+                .set({ authorEmail: target.erasedEmail, authorName: target.erasedName })
+                .where(eq(pendingCommits.authorEmail, target.email));
+            // Module-owned rows, before the users delete so FKs onto users are
+            // still satisfiable — and so a participant that MISSES rows makes the
+            // users delete below fail on its RESTRICT FK, rolling everything back:
+            // a loud retry, never a silent orphan.
+            for (const p of this.participants) {
+                if (!p.inTransaction)
+                    continue;
+                const cb = await p.inTransaction(tx, target);
+                if (cb)
+                    postCommit.push(cb);
+            }
+            // Finally the user row (plus its ON DELETE CASCADE dependents).
+            await tx.delete(users).where(eq(users.id, userId));
+        });
+        // Post-commit callbacks (e.g. Mastra memory cleanup for chat threads
+        // captured inside the transaction).
+        for (const cb of postCommit)
+            await cb();
+        console.log(`[account-erasure] erased user id=${userId}`);
+        return true;
+    }
+}
+//# sourceMappingURL=account-erasure.service.js.map

package/dist/modules/auth/account-erasure.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-erasure.service.js","sourceRoot":"","sources":["../../../src/modules/auth/account-erasure.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,KAAK,GACN,MAAM,uBAAuB,CAAC;AA8E/B,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,EAAY,EACZ,eAAsC,EAAE;QADxC,OAAE,GAAF,EAAE,CAAU;QACZ,iBAAY,GAAZ,YAAY,CAA4B;IACxD,CAAC;IAEJ,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;aAC1F,IAAI,CAAC,KAAK,CAAC;aACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,MAAM,GAAkB;YAC5B,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAC/B,WAAW,EAAE,WAAW,UAAU,EAAE,iBAAiB;YACrD,UAAU,EAAE,cAAc;SAC3B,CAAC;QAEF,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,oDAAoD;QACpD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,MAAM;gBAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,UAAU,GAA+B,EAAE,CAAC;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACrC,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3E,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACzE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAEnE,oCAAoC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YAErE,2EAA2E;YAC3E,MAAM,EAAE;iBACL,MAAM,CAAC,eAAe,CAAC;iBACvB,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBAC3E,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACjF,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACvE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnD,MAAM,EAAE;iBACL,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACvE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACvD,yEAAyE;YACzE,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,EAAE;iBACL,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;iBACvE,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAEvD,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,uCAAuC;YACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClC,IAAI,CAAC,CAAC,CAAC,aAAa;oBAAE,SAAS;gBAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,EAAE;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;YAED,gEAAgE;YAChE,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,qEAAqE;QACrE,oCAAoC;QACpC,KAAK,MAAM,EAAE,IAAI,UAAU;YAAE,MAAM,EAAE,EAAE,CAAC;QAExC,OAAO,CAAC,GAAG,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/modules/auth/auth.middleware.d.ts

@@ -0,0 +1,23 @@
+import type { Request, Response, NextFunction } from 'express';
+import type { AuthService } from './auth.service.js';
+declare global {
+    namespace Express {
+        interface Request {
+            userId?: string;
+            userEmail?: string;
+        }
+    }
+}
+/**
+ * Name of the auth cookie set alongside the Bearer JWT at login. The cookie
+ * exists solely so the SSE route can authenticate — the browser's
+ * `EventSource` API can't set custom headers, so a Bearer token in
+ * `Authorization` can't reach it. All other routes still use the Bearer
+ * header, which the frontend stores in memory and attaches via `authFetch`.
+ *
+ * Same JWT value as the Bearer token. The cookie is `HttpOnly` + `SameSite=Lax`
+ * + `Secure` (in prod) — see `auth.routes.ts` for the issue site.
+ */
+export declare const AUTH_COOKIE_NAME = "bevel_token";
+export declare function createAuthMiddleware(authService: AuthService): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=auth.middleware.d.ts.map

package/dist/modules/auth/auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB;KACF;CACF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAyB9C,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,WAAW,IACnD,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UA4BxD"}

package/dist/modules/auth/auth.middleware.js

@@ -0,0 +1,68 @@
+/**
+ * Name of the auth cookie set alongside the Bearer JWT at login. The cookie
+ * exists solely so the SSE route can authenticate — the browser's
+ * `EventSource` API can't set custom headers, so a Bearer token in
+ * `Authorization` can't reach it. All other routes still use the Bearer
+ * header, which the frontend stores in memory and attaches via `authFetch`.
+ *
+ * Same JWT value as the Bearer token. The cookie is `HttpOnly` + `SameSite=Lax`
+ * + `Secure` (in prod) — see `auth.routes.ts` for the issue site.
+ */
+export const AUTH_COOKIE_NAME = 'bevel_token';
+/**
+ * Read the auth cookie out of the raw `Cookie` header without pulling in
+ * `cookie-parser`. We only ever look for one cookie, so a tiny parser
+ * beats the dep surface of a middleware. Returns `null` if the cookie
+ * is absent or empty.
+ */
+function readAuthCookie(req) {
+    const header = req.headers.cookie;
+    if (!header)
+        return null;
+    for (const segment of header.split(';')) {
+        const trimmed = segment.trim();
+        if (!trimmed.startsWith(`${AUTH_COOKIE_NAME}=`))
+            continue;
+        const value = trimmed.slice(AUTH_COOKIE_NAME.length + 1);
+        if (!value)
+            return null;
+        try {
+            return decodeURIComponent(value);
+        }
+        catch {
+            return value;
+        }
+    }
+    return null;
+}
+export function createAuthMiddleware(authService) {
+    return (req, res, next) => {
+        // Bearer is the primary path — every JSON API call in the frontend
+        // attaches it via `authFetch`. Cookie is the fallback for transports
+        // that can't carry headers (EventSource, image tags), set at login by
+        // `/auth/login` so SSE in particular Just Works after login without
+        // any frontend cooperation.
+        const header = req.headers.authorization;
+        let token = null;
+        if (header && header.startsWith('Bearer ')) {
+            token = header.slice('Bearer '.length).trim() || null;
+        }
+        if (!token) {
+            token = readAuthCookie(req);
+        }
+        if (!token) {
+            res.status(401).json({ error: 'Missing or invalid Authorization header or auth cookie' });
+            return;
+        }
+        try {
+            const { userId, email } = authService.verifyToken(token);
+            req.userId = userId;
+            req.userEmail = email;
+            next();
+        }
+        catch {
+            res.status(401).json({ error: 'Invalid or expired token' });
+        }
+    };
+}
+//# sourceMappingURL=auth.middleware.js.map

package/dist/modules/auth/auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAaA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC;YAAE,SAAS;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAwB;IAC3D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/auth/auth.routes.d.ts

@@ -0,0 +1,25 @@
+import express from 'express';
+import type { AuthService } from './auth.service.js';
+/**
+ * Max age of the JWT cookie (seconds). Matches the JWT's own `expiresIn:
+ * '7d'` so the cookie expires when the token does — browsers stop
+ * sending it past expiry, sparing the auth middleware verifying tokens
+ * that are guaranteed to fail.
+ */
+export declare const AUTH_COOKIE_MAX_AGE_S: number;
+/**
+ * A pluggable SSO login method. Core ships password login only; the
+ * composition root passes provider plugins (e.g. Microsoft OIDC, owned by the
+ * sharepoint module) which mount their own routes under `/auth/<key>/…` and
+ * are advertised to the login screen under `key` by the capability probe.
+ * A plugin is only passed in when its machinery is configured AND the
+ * instance hasn't switched it off — presence means enabled.
+ */
+export interface AuthProviderPlugin {
+    /** Probe key + route namespace (e.g. 'microsoft' → /auth/microsoft/…). */
+    readonly key: string;
+    /** Mount the provider's routes (login redirect, callback) on the auth router. */
+    mountRoutes(router: express.Router, authService: AuthService): void;
+}
+export declare function createAuthRoutes(authService: AuthService, authMiddleware: express.RequestHandler, providers?: AuthProviderPlugin[], passwordLoginEnabled?: boolean): express.Router;
+//# sourceMappingURL=auth.routes.d.ts.map

package/dist/modules/auth/auth.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,SAAS,GAAE,kBAAkB,EAAO,EACpC,oBAAoB,UAAO,GAC1B,OAAO,CAAC,MAAM,CAgEhB"}

package/dist/modules/auth/auth.routes.js

@@ -0,0 +1,72 @@
+import express from 'express';
+import { AUTH_COOKIE_NAME } from './auth.middleware.js'; // also imports Express Request augmentation
+/**
+ * Max age of the JWT cookie (seconds). Matches the JWT's own `expiresIn:
+ * '7d'` so the cookie expires when the token does — browsers stop
+ * sending it past expiry, sparing the auth middleware verifying tokens
+ * that are guaranteed to fail.
+ */
+export const AUTH_COOKIE_MAX_AGE_S = 7 * 24 * 60 * 60;
+export function createAuthRoutes(authService, authMiddleware, providers = [], passwordLoginEnabled = true) {
+    const router = express.Router();
+    // POST /api/auth/login — email + shared-password login (unprotected)
+    router.post('/auth/login', async (req, res) => {
+        if (!passwordLoginEnabled) {
+            res.status(403).json({ error: 'Password login is disabled' });
+            return;
+        }
+        const { email, password } = req.body;
+        if (!email || !password) {
+            res.status(400).json({ error: 'email and password are required' });
+            return;
+        }
+        try {
+            const result = await authService.loginWithPassword(email, password);
+            // Also set the JWT as an HttpOnly cookie so transports that can't
+            // carry headers (EventSource for SSE, image tags) authenticate
+            // automatically. JSON callers continue to use the Bearer header
+            // returned in the body. Secure in production; off in dev so the
+            // cookie survives `http://localhost` requests.
+            res.cookie(AUTH_COOKIE_NAME, result.token, {
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: process.env.NODE_ENV === 'production',
+                maxAge: AUTH_COOKIE_MAX_AGE_S * 1000,
+                path: '/',
+            });
+            res.json(result);
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : 'Unknown error';
+            console.error('Login error:', msg);
+            res.status(401).json({ error: 'Authentication failed' });
+        }
+    });
+    // GET /api/auth/providers — unprotected capability probe so the login screen
+    // knows which login methods to render. SSO providers appear under their key.
+    router.get('/auth/providers', (_req, res) => {
+        res.json({
+            password: passwordLoginEnabled,
+            ...Object.fromEntries(providers.map((p) => [p.key, true])),
+        });
+    });
+    for (const provider of providers)
+        provider.mountRoutes(router, authService);
+    // GET /api/auth/me — validate stored JWT, return user info (protected)
+    router.get('/auth/me', authMiddleware, async (req, res) => {
+        try {
+            const user = await authService.getUserById(req.userId);
+            if (!user) {
+                res.status(404).json({ error: 'User not found' });
+                return;
+            }
+            res.json(user);
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : 'Unknown error';
+            res.status(500).json({ error: msg });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=auth.routes.js.map

package/dist/modules/auth/auth.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC,CAAC,4CAA4C;AAErG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAiBtD,MAAM,UAAU,gBAAgB,CAC9B,WAAwB,EACxB,cAAsC,EACtC,YAAkC,EAAE,EACpC,oBAAoB,GAAG,IAAI;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6C,CAAC;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpE,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,+CAA+C;YAC/C,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE;gBACzC,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAC7C,MAAM,EAAE,qBAAqB,GAAG,IAAI;gBACpC,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE5E,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/auth/auth.service.d.ts

@@ -0,0 +1,76 @@
+import type { Database } from '../database/connection.js';
+import type { CoreConfig } from '../../core-config.js';
+import type { AuthUser } from '@bevel-software/platform-shared';
+export declare class AuthService {
+    private readonly db;
+    private readonly config;
+    constructor(db: Database, config: CoreConfig);
+    loginWithPassword(email: string, password: string): Promise<{
+        token: string;
+        user: AuthUser;
+    }>;
+    /**
+     * Establish a session for a user who authenticated via "Sign in with
+     * Microsoft". Same upsert-by-email + JWT path as password login — the only
+     * difference is identity came from a verified Microsoft id_token instead of
+     * the shared password. Email is the idempotency key, so a user who first
+     * used password login and later signs in with Microsoft (same email) keeps
+     * the same account/id.
+     */
+    loginWithMicrosoft(email: string, name: string): Promise<{
+        token: string;
+        user: AuthUser;
+    }>;
+    private signToken;
+    /**
+     * Get-or-create a user record by email, without issuing a session token.
+     * Used by the embed surface: an Atlassian (Forge) editor whose identity was
+     * verified server-side needs a real user row so file-lock commits attribute
+     * to them — but they never get a Bevel browser session. Same email-keyed
+     * upsert as the login paths, so an embed editor who later logs in keeps the
+     * same account/id. Returns `null` for a malformed email.
+     */
+    getOrCreateByEmail(email: string, name?: string): Promise<{
+        id: string;
+        email: string;
+        name: string;
+    } | null>;
+    private upsertUserByEmail;
+    verifyToken(token: string): {
+        userId: string;
+        email: string;
+    };
+    /**
+     * Resolve a set of `authorId` hashes back to the app users that produced
+     * them. Used by the PR list to display the human who triggered each PR
+     * instead of the shared GitHub service account.
+     *
+     * Loads all users and hashes them in-process rather than indexing on a
+     * stored hash column — the user table is small (one row per team member)
+     * and refreshes are infrequent (PR list polls at 60s), so the cost is
+     * negligible and we avoid carrying a denormalised hash column.
+     */
+    findUsersByEmailHash(hashes: Set<string>): Promise<Map<string, {
+        id: string;
+        email: string;
+        name: string;
+    }>>;
+    getUserById(userId: string): Promise<AuthUser | null>;
+    /**
+     * Whether `email` passes the optional `ALLOWED_EMAIL_DOMAINS` guard. Returns
+     * true when no guard is configured (the default). Matches the email's domain
+     * exactly or as a subdomain, so `bevel.software` admits `a@bevel.software`
+     * and `a@eu.bevel.software` but not `a@notbevel.software`. When a guard IS
+     * configured, a missing/blank email fails closed. Exposed so non-login
+     * surfaces (the embed panel) can apply the same gate.
+     */
+    isEmailDomainAllowed(email: string): boolean;
+    /**
+     * Enforce {@link isEmailDomainAllowed} at the login paths. No-op when the
+     * guard is unset. Expects an already-normalized (trimmed, lower-cased,
+     * regex-validated) email.
+     */
+    private assertAllowedDomain;
+    private checkPassword;
+}
+//# sourceMappingURL=auth.service.d.ts.map

package/dist/modules/auth/auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAmBhE,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAG/B,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAiB7C;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAW7C,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAQhD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAiB3D;;;;;;;OAOG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAM3B,OAAO,CAAC,aAAa;CAiBtB"}

package/dist/modules/auth/auth.service.js

@@ -0,0 +1,168 @@
+import { timingSafeEqual } from 'node:crypto';
+import jwt from 'jsonwebtoken';
+import { eq } from 'drizzle-orm';
+import { users } from '../database/schema.js';
+import { hashEmail } from '../../shared/hash-email.js';
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function toAuthUser(user) {
+    return {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        avatarUrl: user.avatarUrl ?? undefined,
+    };
+}
+export class AuthService {
+    db;
+    config;
+    constructor(db, config) {
+        this.db = db;
+        this.config = config;
+    }
+    async loginWithPassword(email, password) {
+        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        if (!EMAIL_REGEX.test(normalizedEmail)) {
+            throw new Error('Invalid email');
+        }
+        this.assertAllowedDomain(normalizedEmail);
+        if (!this.checkPassword(password ?? '')) {
+            throw new Error('Invalid password');
+        }
+        // Derive a default display name from the local-part of the email
+        const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
+        const user = await this.upsertUserByEmail(normalizedEmail, defaultName);
+        return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
+    }
+    /**
+     * Establish a session for a user who authenticated via "Sign in with
+     * Microsoft". Same upsert-by-email + JWT path as password login — the only
+     * difference is identity came from a verified Microsoft id_token instead of
+     * the shared password. Email is the idempotency key, so a user who first
+     * used password login and later signs in with Microsoft (same email) keeps
+     * the same account/id.
+     */
+    async loginWithMicrosoft(email, name) {
+        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        if (!EMAIL_REGEX.test(normalizedEmail)) {
+            throw new Error('Microsoft sign-in returned an invalid email');
+        }
+        this.assertAllowedDomain(normalizedEmail);
+        const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
+        const user = await this.upsertUserByEmail(normalizedEmail, displayName);
+        return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
+    }
+    signToken(userId, email) {
+        return jwt.sign({ userId, email }, this.config.jwtSecret, { expiresIn: '7d' });
+    }
+    /**
+     * Get-or-create a user record by email, without issuing a session token.
+     * Used by the embed surface: an Atlassian (Forge) editor whose identity was
+     * verified server-side needs a real user row so file-lock commits attribute
+     * to them — but they never get a Bevel browser session. Same email-keyed
+     * upsert as the login paths, so an embed editor who later logs in keeps the
+     * same account/id. Returns `null` for a malformed email.
+     */
+    async getOrCreateByEmail(email, name) {
+        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        if (!EMAIL_REGEX.test(normalizedEmail))
+            return null;
+        const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
+        const user = await this.upsertUserByEmail(normalizedEmail, displayName);
+        return { id: user.id, email: user.email, name: user.name };
+    }
+    async upsertUserByEmail(email, name) {
+        const [user] = await this.db
+            .insert(users)
+            .values({ email, name })
+            .onConflictDoUpdate({ target: users.email, set: { updatedAt: new Date() } })
+            .returning();
+        return user;
+    }
+    verifyToken(token) {
+        const decoded = jwt.verify(token, this.config.jwtSecret);
+        return { userId: decoded.userId, email: decoded.email };
+    }
+    /**
+     * Resolve a set of `authorId` hashes back to the app users that produced
+     * them. Used by the PR list to display the human who triggered each PR
+     * instead of the shared GitHub service account.
+     *
+     * Loads all users and hashes them in-process rather than indexing on a
+     * stored hash column — the user table is small (one row per team member)
+     * and refreshes are infrequent (PR list polls at 60s), so the cost is
+     * negligible and we avoid carrying a denormalised hash column.
+     */
+    async findUsersByEmailHash(hashes) {
+        const result = new Map();
+        if (hashes.size === 0)
+            return result;
+        const rows = await this.db.select().from(users);
+        for (const row of rows) {
+            const h = hashEmail(row.email);
+            if (!hashes.has(h))
+                continue;
+            result.set(h, { id: row.id, email: row.email, name: row.name });
+        }
+        return result;
+    }
+    async getUserById(userId) {
+        const [user] = await this.db
+            .select()
+            .from(users)
+            .where(eq(users.id, userId))
+            .limit(1);
+        if (!user)
+            return null;
+        return {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            avatarUrl: user.avatarUrl ?? undefined,
+        };
+    }
+    /**
+     * Whether `email` passes the optional `ALLOWED_EMAIL_DOMAINS` guard. Returns
+     * true when no guard is configured (the default). Matches the email's domain
+     * exactly or as a subdomain, so `bevel.software` admits `a@bevel.software`
+     * and `a@eu.bevel.software` but not `a@notbevel.software`. When a guard IS
+     * configured, a missing/blank email fails closed. Exposed so non-login
+     * surfaces (the embed panel) can apply the same gate.
+     */
+    isEmailDomainAllowed(email) {
+        const allowed = this.config.allowedEmailDomains;
+        if (allowed.length === 0)
+            return true;
+        const domain = (email ?? '').trim().toLowerCase().split('@')[1] ?? '';
+        if (!domain)
+            return false;
+        return allowed.some((d) => domain === d || domain.endsWith(`.${d}`));
+    }
+    /**
+     * Enforce {@link isEmailDomainAllowed} at the login paths. No-op when the
+     * guard is unset. Expects an already-normalized (trimmed, lower-cased,
+     * regex-validated) email.
+     */
+    assertAllowedDomain(normalizedEmail) {
+        if (!this.isEmailDomainAllowed(normalizedEmail)) {
+            throw new Error('Email domain is not allowed');
+        }
+    }
+    checkPassword(provided) {
+        const expected = this.config.testPassword;
+        // Reject if no password is configured on the server
+        if (!expected)
+            return false;
+        const a = Buffer.from(provided, 'utf8');
+        const b = Buffer.from(expected, 'utf8');
+        // Pad both buffers to the same length so timingSafeEqual runs unconditionally —
+        // returning early on length mismatch would leak the expected password's length via timing.
+        const len = Math.max(a.length, b.length);
+        const aPadded = Buffer.alloc(len);
+        const bPadded = Buffer.alloc(len);
+        a.copy(aPadded);
+        b.copy(bPadded);
+        const equal = timingSafeEqual(aPadded, bPadded);
+        return equal && a.length === b.length;
+    }
+}
+//# sourceMappingURL=auth.service.js.map