@bevel-software/platform-core-backend 0.22.0 → 0.23.0

package/dist/modules/auth/account-admission.d.ts

@@ -1,12 +1,14 @@
 /**
  * Whether a NEW account may be provisioned on this deployment, asked before
- * the row is inserted. The one seam a host that sells seats needs: core
- * admits everyone, and a cloud overlay answers from its plan without
- * forking any sign-in path.
+ * the row is inserted — and whether a deactivated one may be switched back
+ * on, which takes up the same place. The one seam a host that sells seats
+ * needs: core admits everyone, and a cloud overlay answers from its plan
+ * without forking any sign-in path.
  *
- * Asked only for an address with no account yet. An existing user's sign-in
- * is never a provisioning, so a refusal can never lock out someone who is
- * already in.
+ * Never asked for an account that is already on. An existing user's sign-in
+ * is not a provisioning, so a refusal can never lock out someone who is
+ * already in; taking someone out is the admin's act (deactivation), not the
+ * port's.
  */
 export type AccountProvisionReason = 
 /** A first sign-in through single sign-on, which provisions on its own. */
@@ -16,12 +18,27 @@ export type AccountProvisionReason =
 /** The deployment owner's first password sign-in, which creates their row. */
  | 'bootstrap'
 /** A verified identity from an embedding surface that needs a row without a session. */
- | 'embed';
+ | 'embed'
+/** An admin switching a deactivated account back on. */
+ | 'reactivate';
 export type AccountAdmissionVerdict = {
     ok: true;
 } | {
     ok: false;
     message: string;
+    /**
+     * Keep the person on file instead of turning them away: the account is
+     * created DEACTIVATED, the sign-in is still refused with `message`, and
+     * an admin finds them on the accounts list, ready to be switched on.
+     * For a host whose rule is "whoever is on our domain may join while
+     * there is room" — the one past the room waits instead of bouncing.
+     *
+     * Honoured only for a sign-in through single sign-on, the one
+     * provisioning nobody asked for. Everywhere else a verdict carrying it
+     * is a plain refusal: an admin creating an account would be told no,
+     * and a deactivated account is never reactivated into one.
+     */
+    waitForAdmin?: boolean;
 };
 export interface IAccountAdmission {
     canProvision(email: string, reason: AccountProvisionReason): Promise<AccountAdmissionVerdict>;
@@ -35,6 +52,40 @@ export declare const admitEveryone: IAccountAdmission;
  */
 export declare class AccountAdmissionRefusedError extends Error {
     readonly status = 403;
+    /** The person was put on file, switched off, for an admin to switch on (see `waitForAdmin`). */
+    readonly waitingForAdmin: boolean;
+    constructor(message: string, opts?: {
+        waitingForAdmin?: boolean;
+    });
+}
+/**
+ * The account exists and an admin switched it off — at sign-in, or for a
+ * credential it still holds. A 403 like a refusal: the identity is fine,
+ * the deployment no longer lets it in.
+ */
+export declare class AccountDeactivatedError extends Error {
+    readonly status = 403;
+    constructor(message?: string);
+}
+/**
+ * Whether the account behind a credential is on could not be asked — the
+ * database failed. Not the caller's fault and not a verdict on them: a
+ * route answers it with a 500, never with the 401 that would sign a valid
+ * caller out during an outage.
+ */
+export declare class AuthBackendError extends Error {
+    readonly cause: unknown;
+    constructor(cause: unknown);
+}
+/**
+ * An admin's change to an account that the deployment refuses on purpose
+ * (switching off the deployment admin, or an account the platform runs its
+ * own work as). Its message is for the admin; a route answers it with 400.
+ */
+export declare class AccountChangeRefusedError extends Error {
+    readonly status = 400;
     constructor(message: string);
 }
+/** What a person with a deactivated account is told, wherever they knock. */
+export declare const ACCOUNT_DEACTIVATED_MESSAGE = "Your account on this workspace is switched off. Ask its admin to turn it back on.";
 //# sourceMappingURL=account-admission.d.ts.map

package/dist/modules/auth/account-admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-admission.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB;AAChC,2EAA2E;AACzE,KAAK;AACP,iDAAiD;GAC/C,cAAc;AAChB,8EAA8E;GAC5E,WAAW;AACb,wFAAwF;GACtF,OAAO,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/F;AAED,iDAAiD;AACjD,eAAO,MAAM,aAAa,EAAE,iBAE3B,CAAC;AAEF;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,OAAO;gBAEV,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"account-admission.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,sBAAsB;AAChC,2EAA2E;AACzE,KAAK;AACP,iDAAiD;GAC/C,cAAc;AAChB,8EAA8E;GAC5E,WAAW;AACb,wFAAwF;GACtF,OAAO;AACT,wDAAwD;GACtD,YAAY,CAAC;AAEjB,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEN,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/F;AAED,iDAAiD;AACjD,eAAO,MAAM,aAAa,EAAE,iBAE3B,CAAC;AAEF;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,OAAO;IACtB,gGAAgG;IAChG,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO;CAKtE;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,OAAO;gBAEV,OAAO,SAA8B;CAIlD;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO;gBAAd,KAAK,EAAE,OAAO;CAIpC;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,MAAM,OAAO;gBAEV,OAAO,EAAE,MAAM;CAI5B;AAED,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,sFAAsF,CAAC"}

package/dist/modules/auth/account-admission.js

@@ -9,9 +9,52 @@ export const admitEveryone = {
  */
 export class AccountAdmissionRefusedError extends Error {
     status = 403;
-    constructor(message) {
+    /** The person was put on file, switched off, for an admin to switch on (see `waitForAdmin`). */
+    waitingForAdmin;
+    constructor(message, opts = {}) {
         super(message);
         this.name = 'AccountAdmissionRefusedError';
+        this.waitingForAdmin = opts.waitingForAdmin ?? false;
+    }
+}
+/**
+ * The account exists and an admin switched it off — at sign-in, or for a
+ * credential it still holds. A 403 like a refusal: the identity is fine,
+ * the deployment no longer lets it in.
+ */
+export class AccountDeactivatedError extends Error {
+    status = 403;
+    constructor(message = ACCOUNT_DEACTIVATED_MESSAGE) {
+        super(message);
+        this.name = 'AccountDeactivatedError';
+    }
+}
+/**
+ * Whether the account behind a credential is on could not be asked — the
+ * database failed. Not the caller's fault and not a verdict on them: a
+ * route answers it with a 500, never with the 401 that would sign a valid
+ * caller out during an outage.
+ */
+export class AuthBackendError extends Error {
+    cause;
+    constructor(cause) {
+        super('The account could not be looked up');
+        this.cause = cause;
+        this.name = 'AuthBackendError';
+    }
+}
+/**
+ * An admin's change to an account that the deployment refuses on purpose
+ * (switching off the deployment admin, or an account the platform runs its
+ * own work as). Its message is for the admin; a route answers it with 400.
+ */
+export class AccountChangeRefusedError extends Error {
+    status = 400;
+    constructor(message) {
+        super(message);
+        this.name = 'AccountChangeRefusedError';
     }
 }
+/** What a person with a deactivated account is told, wherever they knock. */
+export const ACCOUNT_DEACTIVATED_MESSAGE = 'Your account on this workspace is switched off. Ask its admin to turn it back on.';
 //# sourceMappingURL=account-admission.js.map

package/dist/modules/auth/account-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-admission.js","sourceRoot":"","sources":["../../../src/modules/auth/account-admission.ts"],"names":[],"mappings":"AA0BA,iDAAiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;CACzC,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,GAAG,GAAG,CAAC;IAEtB,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"account-admission.js","sourceRoot":"","sources":["../../../src/modules/auth/account-admission.ts"],"names":[],"mappings":"AAgDA,iDAAiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;CACzC,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,GAAG,GAAG,CAAC;IACtB,gGAAgG;IACvF,eAAe,CAAU;IAElC,YAAY,OAAe,EAAE,OAAsC,EAAE;QACnE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC;IACvD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,MAAM,GAAG,GAAG,CAAC;IAEtB,YAAY,OAAO,GAAG,2BAA2B;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACpB;IAArB,YAAqB,KAAc;QACjC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QADzB,UAAK,GAAL,KAAK,CAAS;QAEjC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,MAAM,GAAG,GAAG,CAAC;IAEtB,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,mFAAmF,CAAC"}

package/dist/modules/auth/account.routes.d.ts

@@ -15,5 +15,5 @@ import './auth.middleware.js';
  * {@link IAdminAccessService} — the Admin role in `roles.yaml`, plus the env
  * bootstrap admin (always-admin, see AdminAccessService).
  */
-export declare function createAccountRoutes(authService: Pick<AuthService, 'listAccounts' | 'createAccount' | 'getUserById'>, adminAccess: IAdminAccessService, accountErasure: Pick<IAccountErasureService, 'eraseUser'>, accessRemoval?: Pick<UserAccessRemovalService, 'report' | 'assertRemovable' | 'remove' | 'filesNaming'>): express.Router;
+export declare function createAccountRoutes(authService: Pick<AuthService, 'listAccounts' | 'createAccount' | 'getUserById' | 'deactivate' | 'reactivate'>, adminAccess: IAdminAccessService, accountErasure: Pick<IAccountErasureService, 'eraseUser'>, accessRemoval?: Pick<UserAccessRemovalService, 'report' | 'assertRemovable' | 'remove' | 'filesNaming'>): express.Router;
 //# sourceMappingURL=account.routes.d.ts.map

package/dist/modules/auth/account.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,eAAe,GAAG,aAAa,CAAC,EAChF,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,EACzD,aAAa,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GACtG,OAAO,CAAC,MAAM,CA4JhB"}
+{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,YAAY,CAAC,EAC9G,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,EACzD,aAAa,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GACtG,OAAO,CAAC,MAAM,CAoNhB"}

package/dist/modules/auth/account.routes.js

@@ -3,7 +3,7 @@ import { randomUUID } from 'node:crypto';
 import { logger } from '../../shared/logging.js';
 import { printable } from '../../shared/printable.js';
 const log = logger('accounts');
-import { AccountAdmissionRefusedError } from './account-admission.js';
+import { AccountAdmissionRefusedError, AccountChangeRefusedError } from './account-admission.js';
 import { erasedAccountId } from './account-erasure.service.js';
 import { sendError } from '../access/admin-route-helpers.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
@@ -33,13 +33,19 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
     router.get('/admin/accounts', requireAdmin, async (_req, res) => {
         res.json({ accounts: await authService.listAccounts() });
     });
-    // POST /api/admin/accounts { email, name?, password } — create an account
+    // POST /api/admin/accounts { email, name?, password? } — create an account
     // (or reset the password of an existing one; upsert-by-email is deliberate,
-    // see AuthService.createAccount).
+    // see AuthService.createAccount). Without a password the account is for
+    // single sign-on: the person finds it waiting when they first sign in.
     router.post('/admin/accounts', requireAdmin, async (req, res) => {
         const { email, name, password } = req.body;
-        if (!email || !password) {
-            res.status(400).json({ error: 'email and password are required' });
+        if (!email) {
+            res.status(400).json({ error: 'email is required' });
+            return;
+        }
+        // Absent means single sign-on; anything else that is not text is a mistake, not that.
+        if (password !== undefined && typeof password !== 'string') {
+            res.status(400).json({ error: 'password must be a string' });
             return;
         }
         try {
@@ -53,6 +59,56 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
             res.status(error instanceof AccountAdmissionRefusedError ? 403 : 400).json({ error: msg });
         }
     });
+    // POST /api/admin/accounts/:userId/deactivate — switch an account off. It
+    // keeps its row, history and place in roles and groups; nothing it holds
+    // signs in any more (see AuthService.isActive). An admin's own account is
+    // refused, so whoever does this is still an admin who is on afterwards —
+    // the deployment is never left with no admin able to sign in.
+    router.post('/admin/accounts/:userId/deactivate', requireAdmin, async (req, res) => {
+        const userId = String(req.params.userId);
+        if (userId === req.userId) {
+            res.status(400).json({ error: 'You cannot switch off your own account. Ask another admin.' });
+            return;
+        }
+        try {
+            if (!(await authService.deactivate(userId))) {
+                res.status(404).json({ error: 'No such user' });
+                return;
+            }
+            log.info('account audit:', { action: 'deactivate', actorUserId: req.userId, targetUserId: userId });
+            res.status(204).end();
+        }
+        catch (error) {
+            if (error instanceof AccountChangeRefusedError) {
+                res.status(400).json({ error: error.message });
+                return;
+            }
+            log.error('switching an account off failed:', { err: error });
+            res.status(500).json({ error: 'Could not switch this account off' });
+        }
+    });
+    // POST /api/admin/accounts/:userId/reactivate — switch it back on, if the
+    // deployment has room: the admission port is asked, as for a new account
+    // (a host that sells seats answers from its plan; 403 with its words).
+    router.post('/admin/accounts/:userId/reactivate', requireAdmin, async (req, res) => {
+        const userId = String(req.params.userId);
+        try {
+            if (!(await authService.reactivate(userId))) {
+                res.status(404).json({ error: 'No such user' });
+                return;
+            }
+            log.info('account audit:', { action: 'reactivate', actorUserId: req.userId, targetUserId: userId });
+            res.status(204).end();
+        }
+        catch (error) {
+            if (error instanceof AccountAdmissionRefusedError) {
+                res.status(403).json({ error: error.message });
+                return;
+            }
+            log.error('switching an account on failed:', { err: error });
+            res.status(500).json({ error: 'Could not switch this account on' });
+        }
+    });
     // GET /api/admin/accounts/:userId/references — how many places in the
     // knowledge base name this account's address (roles, groups, access rules,
     // file grants) and whether removing them is allowed. Feeds the delete

package/dist/modules/auth/account.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAG/B,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAgF,EAChF,WAAgC,EAChC,cAAyD,EACzD,aAAuG;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAIrC,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;QAE1F,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,aAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACzE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;oBAC3B,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACjC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;iBACjC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;gBACvD,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,wEAAwE;YACxE,IAAI,YAAY,GAAoB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,aAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,wDAAwD,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,OAAO,GACX,GAAG,YAAY,mBAAmB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBACpD,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,sEAAsE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAG/B,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA8G,EAC9G,WAAgC,EAChC,cAAyD,EACzD,aAAuG;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAIrC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,sFAAsF;QACtF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;QAE1F,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,aAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACzE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;oBAC3B,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACjC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;iBACjC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;gBACvD,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,wEAAwE;YACxE,IAAI,YAAY,GAAoB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,aAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,wDAAwD,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,OAAO,GACX,GAAG,YAAY,mBAAmB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBACpD,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,sEAAsE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/modules/auth/auth.middleware.d.ts

@@ -19,5 +19,5 @@ declare global {
  * + `Secure` (in prod) — see `auth.routes.ts` for the issue site.
  */
 export declare const AUTH_COOKIE_NAME = "bevel_token";
-export declare function createAuthMiddleware(authService: AuthService): (req: Request, res: Response, next: NextFunction) => void;
+export declare function createAuthMiddleware(authService: Pick<AuthService, 'resolveSession'>): (req: Request, res: Response, next: NextFunction) => Promise<void>;
 //# sourceMappingURL=auth.middleware.d.ts.map

package/dist/modules/auth/auth.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB;KACF;CACF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAyB9C,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,WAAW,IACnD,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UA4BxD"}
+{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB;KACF;CACF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAyB9C,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,IACrE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAsC9D"}

package/dist/modules/auth/auth.middleware.js

@@ -1,3 +1,4 @@
+import { AccountDeactivatedError, AuthBackendError } from './account-admission.js';
 /**
  * Name of the auth cookie set alongside the Bearer JWT at login. The cookie
  * exists solely so the SSE route can authenticate — the browser's
@@ -36,7 +37,7 @@ function readAuthCookie(req) {
     return null;
 }
 export function createAuthMiddleware(authService) {
-    return (req, res, next) => {
+    return async (req, res, next) => {
         // Bearer is the primary path — every JSON API call in the frontend
         // attaches it via `authFetch`. Cookie is the fallback for transports
         // that can't carry headers (EventSource, image tags), set at login by
@@ -54,15 +55,25 @@ export function createAuthMiddleware(authService) {
             res.status(401).json({ error: 'Missing or invalid Authorization header or auth cookie' });
             return;
         }
+        let session;
         try {
-            const { userId, email } = authService.verifyToken(token);
-            req.userId = userId;
-            req.userEmail = email;
-            next();
+            session = await authService.resolveSession(token);
         }
-        catch {
-            res.status(401).json({ error: 'Invalid or expired token' });
+        catch (err) {
+            // The account could not be looked up: not the caller's doing, and a
+            // 401 here would sign every valid session out during an outage.
+            if (err instanceof AuthBackendError) {
+                res.status(500).json({ error: 'Authentication backend unavailable' });
+                return;
+            }
+            // A 401 otherwise, so the app drops the session and shows the login
+            // page; a switched-off account is told why there.
+            res.status(401).json({ error: err instanceof AccountDeactivatedError ? err.message : 'Invalid or expired token' });
+            return;
         }
+        req.userId = session.userId;
+        req.userEmail = session.email;
+        next();
     };
 }
 //# sourceMappingURL=auth.middleware.js.map

package/dist/modules/auth/auth.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAaA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC;YAAE,SAAS;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAwB;IAC3D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAYnF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC;YAAE,SAAS;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAgD;IACnF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,IAAI,OAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,gEAAgE;YAChE,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,kDAAkD;YAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YACnH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/auth/auth.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKrD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,SAAS,CAAC,IAAI,OAAO,CAAC;IACtB,iFAAiF;IACjF,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,SAAS,GAAE,kBAAkB,EAAO,EACpC,oBAAoB,UAAO,GAC1B,OAAO,CAAC,MAAM,CAsKhB"}
+{"version":3,"file":"auth.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMrD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,SAAS,CAAC,IAAI,OAAO,CAAC;IACtB,iFAAiF;IACjF,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,SAAS,GAAE,kBAAkB,EAAO,EACpC,oBAAoB,UAAO,GAC1B,OAAO,CAAC,MAAM,CA6KhB"}

package/dist/modules/auth/auth.routes.js

@@ -3,6 +3,7 @@ import { logger } from '../../shared/logging.js';
 const log = logger('auth');
 import { AUTH_COOKIE_NAME } from './auth.middleware.js'; // also imports Express Request augmentation
 import { FixedWindowRateLimiter } from './rate-limit.js';
+import { AccountDeactivatedError } from './account-admission.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
 /**
  * Max age of the JWT cookie (seconds). Matches the JWT's own `expiresIn:
@@ -74,6 +75,13 @@ export function createAuthRoutes(authService, authMiddleware, providers = [], pa
             res.json(result);
         }
         catch (error) {
+            // The password was right and an admin switched the account off: said
+            // as such (only ever after the password is proven, see
+            // `loginWithPassword`), so the person knows whom to ask.
+            if (error instanceof AccountDeactivatedError) {
+                res.status(403).json({ error: error.message });
+                return;
+            }
             const msg = error instanceof Error ? error.message : 'Unknown error';
             log.error('Login error:', { detail: msg });
             res.status(401).json({ error: 'Authentication failed' });

package/dist/modules/auth/auth.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC,CAAC,4CAA4C;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AA8BtD,MAAM,UAAU,gBAAgB,CAC9B,WAAwB,EACxB,cAAsC,EACtC,YAAkC,EAAE,EACpC,oBAAoB,GAAG,IAAI;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IACvE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,uBAAuB;IACvB,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE3F,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6C,CAAC;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,wCAAwC;YACxC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,+CAA+C;YAC/C,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE;gBACzC,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAC7C,MAAM,EAAE,qBAAqB,GAAG,IAAI;gBACpC,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,EAAE,SAAS;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,IAAI,IAAI,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;SACxE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE5E,0EAA0E;IAC1E,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAG5C,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAO,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,wEAAwE;YACxE,4DAA4D;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,wEAAwE;YACxE,oEAAoE;YACpE,iBAAiB;YACjB,EAAE;YACF,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,oEAAoE;YACpE,yEAAyE;YACzE,8CAA8C;YAC9C,EAAE;YACF,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,OAAO,GAAI,GAAG,CAAC,IAAyC,EAAE,MAAM,CAAC;YACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,MAAM,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"auth.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC,CAAC,4CAA4C;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AA8BtD,MAAM,UAAU,gBAAgB,CAC9B,WAAwB,EACxB,cAAsC,EACtC,YAAkC,EAAE,EACpC,oBAAoB,GAAG,IAAI;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IACvE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,uBAAuB;IACvB,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE3F,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6C,CAAC;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,wCAAwC;YACxC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,+CAA+C;YAC/C,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE;gBACzC,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAC7C,MAAM,EAAE,qBAAqB,GAAG,IAAI;gBACpC,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,uDAAuD;YACvD,yDAAyD;YACzD,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,EAAE,SAAS;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,IAAI,IAAI,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;SACxE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE5E,0EAA0E;IAC1E,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAG5C,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAO,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,wEAAwE;YACxE,4DAA4D;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,wEAAwE;YACxE,oEAAoE;YACpE,iBAAiB;YACjB,EAAE;YACF,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,oEAAoE;YACpE,yEAAyE;YACzE,8CAA8C;YAC9C,EAAE;YACF,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,OAAO,GAAI,GAAG,CAAC,IAAyC,EAAE,MAAM,CAAC;YACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,MAAM,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/auth/auth.service.d.ts

@@ -109,7 +109,13 @@ export declare class AuthService {
      * account (e.g. one that first arrived via SSO, or a reset for a locked-out
      * user) is deliberate admin behavior, not an error.
      *
-     * The deployment admin is the one target this refuses, for the reason
+     * WITHOUT a password the account is made for single sign-on: the person
+     * signs in through the deployment's provider and finds their account
+     * waiting, already holding its place (a seat, on a host that sells them).
+     * Password sign-in refuses it until a password is set. For an address that
+     * already has an account it changes nothing but an explicitly given name.
+     *
+     * WITH a password, the deployment admin is the one target this refuses, for the reason
      * {@link changePassword} refuses it: that account's password is the
      * environment's, so a stored hash would not replace it but ADD a second
      * credential — one that keeps signing in after `ADMIN_PASSWORD` is rotated,
@@ -117,7 +123,7 @@ export declare class AuthService {
      * not only on the page, because this is the route any other admin reaches
      * with an arbitrary email.
      */
-    createAccount(email: string, name: string | undefined, password: string): Promise<AuthUser>;
+    createAccount(email: string, name: string | undefined, password?: string): Promise<AuthUser>;
     /**
      * Is `email` the deployment admin — the account whose password is set in
      * the deployment environment (`ADMIN_EMAIL` while `ADMIN_PASSWORD` is set)
@@ -183,6 +189,10 @@ export declare class AuthService {
         name: string;
         hasPassword: boolean;
         isEnvAdmin: boolean;
+        /** When an admin switched the account off; null while it is on. */
+        deactivatedAt: Date | null;
+        /** One of the accounts the platform runs its own work as: never switched off, nobody signs in with it. */
+        isSystem: boolean;
         createdAt: Date;
     }>>;
     private assertPasswordPolicy;
@@ -201,10 +211,68 @@ export declare class AuthService {
         name: string;
     } | null>;
     private upsertUserByEmail;
+    /**
+     * The signature and expiry of a session token, and nothing else — whether
+     * its account is still on is {@link resolveSession}'s question. Every
+     * place a session is ACCEPTED goes through that one.
+     */
     verifyToken(token: string): {
         userId: string;
         email: string;
     };
+    /**
+     * A session token that may still be used: signed by us, not expired, and
+     * its account still on. A token outlives a deactivation by up to seven
+     * days, so the signature alone no longer says the bearer may enter.
+     * Throws for an invalid token, {@link AccountDeactivatedError} for one
+     * whose account was switched off.
+     */
+    resolveSession(token: string): Promise<{
+        userId: string;
+        email: string;
+    }>;
+    private readonly activeCache;
+    /**
+     * Whether the account behind a credential is on: it exists and no admin
+     * switched it off. Asked for every credential presented that does not
+     * already read the account (a session token, an internal token), so it is
+     * cached for {@link ACTIVE_CACHE_MS}; switching an account off or on in
+     * this process forgets its entry at once.
+     *
+     * A missing row is not on either — an erased account's tokens die with it.
+     *
+     * The deployment admin's account is always on, whatever its row says: its
+     * environment password signs it in regardless (see `loginWithPassword`),
+     * and a session that sign-in mints must then be usable too, or the way
+     * back into a deployment would lead nowhere. {@link deactivate} refuses
+     * the account, but a host may write the column itself.
+     */
+    isActive(userId: string): Promise<boolean>;
+    /**
+     * Switch an account off. Its row, history and place in roles and groups
+     * stay; every credential it holds stops being honoured (see
+     * {@link isActive}). Idempotent: an account already off keeps the moment
+     * it was first switched off.
+     *
+     * The deployment admin is refused: the environment password is the way
+     * back into a deployment whose every other admin is gone, and switching
+     * it off would close that door from inside. So are the machine accounts
+     * core runs its own work as. Refusing an admin's own account is the
+     * route's concern, since it knows who is asking.
+     *
+     * Returns false when there is no such account.
+     */
+    deactivate(userId: string): Promise<boolean>;
+    /**
+     * Switch a deactivated account back on, if the deployment has room for it:
+     * the admission port is asked, as for a new account, because an account
+     * that is on takes the same place. A refusal throws
+     * {@link AccountAdmissionRefusedError} with the port's words. An account
+     * already on is not asked about.
+     *
+     * Returns false when there is no such account.
+     */
+    reactivate(userId: string): Promise<boolean>;
     /**
      * Resolve a set of `authorId` hashes back to the app users that produced
      * them. Used by the PR list to display the human who triggered each PR

package/dist/modules/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAsDhC;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;gBANT,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IACnC;;;OAGG;IACc,SAAS,GAAE,iBAAiC;IAG/D;;;;;OAKG;YACW,cAAc;IAY5B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IA+D7C;;;;;;;;;;;;;;OAcG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAY7C;;;;;;;;;;;;;OAaG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC;IAgCpB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC,CACH;IAYD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAShD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;OASG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY7D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAOL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAmEhC;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;gBANT,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IACnC;;;OAGG;IACc,SAAS,GAAE,iBAAiC;IAG/D;;;;;OAKG;YACW,cAAc;IAwB5B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAqE7C;;;;;;;;;;;;;;OAcG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAa7C;;;;;;;;;;;;;;;;;;;OAmBG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC;IA4CpB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC;QACpB,mEAAmE;QACnE,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;QAC3B,0GAA0G;QAC1G,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC,CACH;IAcD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAUhD,iBAAiB;IAS/B;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAc/E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsD;IAElF;;;;;;;;;;;;;;OAcG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAchD;;;;;;;;;;;;;OAaG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBlD;;;;;;;;OAQG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBlD;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;OASG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY7D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}