@bevel-software/platform-core-backend 0.26.0 → 0.28.0

package/dist/modules/audit/index.js

@@ -2,6 +2,7 @@ export * from './audit.contract.js';
 export { AgentAuditService, MAX_EVENT_PAGE, retentionDaysFrom } from './agent-audit.service.js';
 export { createAgentRestAuditMiddleware } from './agent-rest-audit.middleware.js';
 export { createAuditRoutes } from './audit.routes.js';
+export { createAgentConnectionRoutes } from './agent-connection.routes.js';
 export { RequestAudit } from './request-audit.js';
 export { classifyToolCall, skillContaining, skillReadPath, splitUtcpName, } from './event-classifier.js';
 //# sourceMappingURL=index.js.map

package/dist/modules/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,aAAa,GAId,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAgC,MAAM,8BAA8B,CAAC;AACzG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,aAAa,GAId,MAAM,uBAAuB,CAAC"}

package/dist/modules/auth/account-hooks.d.ts

@@ -0,0 +1,46 @@
+import type { AuthUser } from '@bevel-software/platform-shared';
+/**
+ * An admin invited somebody: a NEW account was made for the address. Never
+ * raised for an account that was already there (an invite that only set a
+ * starting password, a password reset, a rename), and never for a first
+ * single sign-on, which provisions by itself: the person is already in.
+ */
+export interface AccountInvitedEvent {
+    /** The new account, as the admin's answer carries it. */
+    account: Pick<AuthUser, 'id' | 'email' | 'name'>;
+    /** The admin who invited them. */
+    invitedBy: Pick<AuthUser, 'id' | 'email' | 'name'>;
+    /**
+     * Whether the account was created with a starting password the admin
+     * typed. The password itself never travels: a listener that writes to the
+     * person says it comes from the admin separately.
+     */
+    passwordSet: boolean;
+}
+/**
+ * A listener answers how it reached the person — a non-empty channel name,
+ * `'email'` say — or null when it did not (nothing configured, the send
+ * failed). It is awaited: the admin's answer says who was notified,
+ * truthfully, so a listener bounds its own wait. A throw is logged and
+ * counts as null; it never fails the invite. An empty name is no channel and
+ * counts as null too.
+ */
+export type AccountInvitedHook = (event: AccountInvitedEvent) => Promise<string | null>;
+/**
+ * Core's seam for "an account was invited": a deployment (the cloud with its
+ * mail, an enterprise overlay) registers how to tell the person, and core
+ * says in its answer whether somebody did. Core registers nothing, so a
+ * core-only deployment notifies nobody and the admin is handed the link and
+ * the message to send, as before.
+ */
+export interface IAccountHooks {
+    onAccountInvited(hook: AccountInvitedHook): void;
+    /** Run every listener in registration order; the channels that reached the person, in that order. */
+    runAccountInvited(event: AccountInvitedEvent): Promise<string[]>;
+}
+export declare class AccountHooks implements IAccountHooks {
+    private readonly invited;
+    onAccountInvited(hook: AccountInvitedHook): void;
+    runAccountInvited(event: AccountInvitedEvent): Promise<string[]>;
+}
+//# sourceMappingURL=account-hooks.d.ts.map

package/dist/modules/auth/account-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-hooks.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAKhE;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;IACjD,kCAAkC;IAClC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;IACnD;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjD,qGAAqG;IACrG,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAClE;AAED,qBAAa,YAAa,YAAW,aAAa;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IAEpD,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI;IAI1C,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAcvE"}

package/dist/modules/auth/account-hooks.js

@@ -0,0 +1,25 @@
+import { logger } from '../../shared/logging.js';
+const log = logger('accounts');
+export class AccountHooks {
+    invited = [];
+    onAccountInvited(hook) {
+        this.invited.push(hook);
+    }
+    async runAccountInvited(event) {
+        const notified = [];
+        for (const hook of this.invited) {
+            try {
+                const channel = await hook(event);
+                if (channel !== null && channel !== '')
+                    notified.push(channel);
+            }
+            catch (err) {
+                // The account exists whether or not the person was told: the admin's
+                // answer says they were not, and the admin sends the link themselves.
+                log.error('an account-invited listener failed; the person was not notified by it:', { err });
+            }
+        }
+        return notified;
+    }
+}
+//# sourceMappingURL=account-hooks.js.map

package/dist/modules/auth/account-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-hooks.js","sourceRoot":"","sources":["../../../src/modules/auth/account-hooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AA4C/B,MAAM,OAAO,YAAY;IACN,OAAO,GAAyB,EAAE,CAAC;IAEpD,gBAAgB,CAAC,IAAwB;QACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA0B;QAChD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,EAAE;oBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,sEAAsE;gBACtE,GAAG,CAAC,KAAK,CAAC,wEAAwE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/modules/auth/account-switch-guard.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Auth's contract for a write that must not land on a switched-off account:
+ * `whileSwitchedOn` runs `write` only while `email` is not switched off, and
+ * keeps it so until `write` has finished. A switch-off either committed
+ * before the check (`write` is refused with a 409 `deactivated` and never
+ * runs) or waits until `write` is done. An address with no account yet counts
+ * as switched on.
+ *
+ * Implemented by `AuthService`; other modules take this contract, not the
+ * service, so how auth coordinates switch-offs stays its own.
+ */
+export interface IAccountSwitchGuard {
+    whileSwitchedOn(email: string, write: () => Promise<void>): Promise<void>;
+}
+//# sourceMappingURL=account-switch-guard.d.ts.map

package/dist/modules/auth/account-switch-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-switch-guard.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-switch-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E"}

package/dist/modules/auth/account-switch-guard.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=account-switch-guard.js.map

package/dist/modules/auth/account-switch-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-switch-guard.js","sourceRoot":"","sources":["../../../src/modules/auth/account-switch-guard.ts"],"names":[],"mappings":""}

package/dist/modules/auth/account-switch-lock.d.ts

@@ -0,0 +1,34 @@
+import type { Database } from '../database/connection.js';
+/** The handle `db.transaction` hands its callback. */
+type Tx = Parameters<Parameters<Database['transaction']>[0]>[0];
+/**
+ * How long a switch-off or a promotion waits for the address's lock. The
+ * holder may be a promotion committing `roles.yaml` (a git commit and push,
+ * seconds), so the wait is generous; it is bounded all the same, for the
+ * reason `database/advisory-lock.ts` gives: a waiter blocked for good sits
+ * on a pooled connection, and a wedged holder would take the pool with it.
+ */
+export declare const ACCOUNT_SWITCH_LOCK_WAIT_MS = 15000;
+/** What a caller is told when the wait ran out: a 409, to try again shortly. */
+export declare const ACCOUNT_BUSY_MESSAGE = "Another change to this account is still being saved; try again in a moment.";
+/**
+ * Hold, for the rest of `tx`, the one lock that orders an address's switch-off
+ * against a write that must not land on a switched-off account (the invite's
+ * Admin promotion).
+ *
+ * A row lock cannot do it: an address with no account yet has no row, and an
+ * account can be created switched off (single sign-on waiting for an admin)
+ * or created and switched off while the promotion is being written. So the
+ * lock is a transaction-scoped advisory lock on the canonical address, taken
+ * by every write that switches an account off and by the promotion, before
+ * either reads the row. Whichever comes second waits for the first to commit,
+ * then reads what it committed (READ COMMITTED takes a fresh snapshot per
+ * statement). A different address that hashes to the same key only waits.
+ *
+ * The wait is bounded by a transaction-local `lock_timeout`
+ * ({@link ACCOUNT_SWITCH_LOCK_WAIT_MS}), which the transaction's end reverts
+ * with everything else; running out of it is answered as a 409 `account-busy`.
+ */
+export declare function takeAccountSwitchLock(tx: Pick<Tx, 'execute'>, email: string, waitMs?: number): Promise<void>;
+export {};
+//# sourceMappingURL=account-switch-lock.d.ts.map

package/dist/modules/auth/account-switch-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-switch-lock.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-switch-lock.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAK1D,sDAAsD;AACtD,KAAK,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAKlD,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,gFAAgF,CAAC;AAElH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,EACvB,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAoC,GAC3C,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/modules/auth/account-switch-lock.js

@@ -0,0 +1,48 @@
+import { sql } from 'drizzle-orm';
+import { canonicalEmail } from '../../shared/email-identity.js';
+import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { pgErrorCode } from '../database/pg-error.js';
+/**
+ * How long a switch-off or a promotion waits for the address's lock. The
+ * holder may be a promotion committing `roles.yaml` (a git commit and push,
+ * seconds), so the wait is generous; it is bounded all the same, for the
+ * reason `database/advisory-lock.ts` gives: a waiter blocked for good sits
+ * on a pooled connection, and a wedged holder would take the pool with it.
+ */
+export const ACCOUNT_SWITCH_LOCK_WAIT_MS = 15_000;
+/** Postgres raises this when `lock_timeout` expires while waiting for a lock. */
+const LOCK_NOT_AVAILABLE = '55P03';
+/** What a caller is told when the wait ran out: a 409, to try again shortly. */
+export const ACCOUNT_BUSY_MESSAGE = 'Another change to this account is still being saved; try again in a moment.';
+/**
+ * Hold, for the rest of `tx`, the one lock that orders an address's switch-off
+ * against a write that must not land on a switched-off account (the invite's
+ * Admin promotion).
+ *
+ * A row lock cannot do it: an address with no account yet has no row, and an
+ * account can be created switched off (single sign-on waiting for an admin)
+ * or created and switched off while the promotion is being written. So the
+ * lock is a transaction-scoped advisory lock on the canonical address, taken
+ * by every write that switches an account off and by the promotion, before
+ * either reads the row. Whichever comes second waits for the first to commit,
+ * then reads what it committed (READ COMMITTED takes a fresh snapshot per
+ * statement). A different address that hashes to the same key only waits.
+ *
+ * The wait is bounded by a transaction-local `lock_timeout`
+ * ({@link ACCOUNT_SWITCH_LOCK_WAIT_MS}), which the transaction's end reverts
+ * with everything else; running out of it is answered as a 409 `account-busy`.
+ */
+export async function takeAccountSwitchLock(tx, email, waitMs = ACCOUNT_SWITCH_LOCK_WAIT_MS) {
+    await tx.execute(sql `select set_config('lock_timeout', ${String(waitMs)}, true)`);
+    try {
+        await tx.execute(sql `select pg_advisory_xact_lock(hashtext(${`account-switch:${canonicalEmail(email)}`}))`);
+    }
+    catch (err) {
+        // Drizzle wraps the driver's error, so the SQLSTATE is on its cause.
+        if (pgErrorCode(err) === LOCK_NOT_AVAILABLE) {
+            throw new WorkflowDomainError(ACCOUNT_BUSY_MESSAGE, 409, { kind: 'account-busy' });
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=account-switch-lock.js.map

package/dist/modules/auth/account-switch-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-switch-lock.js","sourceRoot":"","sources":["../../../src/modules/auth/account-switch-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAKtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,6EAA6E,CAAC;AAElH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAuB,EACvB,KAAa,EACb,SAAiB,2BAA2B;IAE5C,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qCAAqC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,yCAAyC,kBAAkB,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAC5C,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/modules/auth/account.routes.d.ts

@@ -1,5 +1,6 @@
 import express from 'express';
 import type { AuthService } from './auth.service.js';
+import type { IAccountHooks } from './account-hooks.js';
 import { type IAccountErasureService } from './account-erasure.service.js';
 import type { IAdminAccessService } from '../admin/admin.interface.js';
 import type { UserAccessRemovalService } from '../access/user-access-removal.service.js';
@@ -15,5 +16,7 @@ import './auth.middleware.js';
  * {@link IAdminAccessService} — the Admin role in `roles.yaml`, plus the env
  * bootstrap admin (always-admin, see AdminAccessService).
  */
-export declare function createAccountRoutes(authService: Pick<AuthService, 'listAccounts' | 'createAccount' | 'getUserById' | 'deactivate' | 'reactivate'>, adminAccess: IAdminAccessService, accountErasure: Pick<IAccountErasureService, 'eraseUser'>, accessRemoval?: Pick<UserAccessRemovalService, 'report' | 'assertRemovable' | 'remove' | 'filesNaming'>): express.Router;
+export declare function createAccountRoutes(authService: Pick<AuthService, 'listAccounts' | 'createAccount' | 'createAccountWithoutPassword' | 'createAccountWithStartingPassword' | 'getUserById' | 'deactivate' | 'reactivate' | 'isOwnerEmail' | 'assertDeletable'>, adminAccess: IAdminAccessService, accountErasure: Pick<IAccountErasureService, 'eraseUser'>, 
+/** Who tells an invited person (see {@link IAccountHooks}); core registers nobody. */
+accountHooks: Pick<IAccountHooks, 'runAccountInvited'>, accessRemoval?: Pick<UserAccessRemovalService, 'report' | 'assertRemovable' | 'remove' | 'filesNaming'>): express.Router;
 //# sourceMappingURL=account.routes.d.ts.map

package/dist/modules/auth/account.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,YAAY,CAAC,EAC9G,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,EACzD,aAAa,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GACtG,OAAO,CAAC,MAAM,CAoNhB"}
+{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAIzF,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,IAAI,CACf,WAAW,EACT,cAAc,GACd,eAAe,GACf,8BAA8B,GAC9B,mCAAmC,GACnC,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,iBAAiB,CACpB,EACD,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC;AACzD,sFAAsF;AACtF,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,EACtD,aAAa,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GACtG,OAAO,CAAC,MAAM,CAkThB"}

package/dist/modules/auth/account.routes.js

@@ -7,6 +7,7 @@ import { AccountAdmissionRefusedError, AccountChangeRefusedError } from './accou
 import { erasedAccountId } from './account-erasure.service.js';
 import { sendError } from '../access/admin-route-helpers.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { canonicalEmail } from '../../shared/email-identity.js';
 import './auth.middleware.js'; // Express Request augmentation
 /**
  * Admin account management — the ONE account surface (the core User Accounts
@@ -19,7 +20,9 @@ import './auth.middleware.js'; // Express Request augmentation
  * {@link IAdminAccessService} — the Admin role in `roles.yaml`, plus the env
  * bootstrap admin (always-admin, see AdminAccessService).
  */
-export function createAccountRoutes(authService, adminAccess, accountErasure, accessRemoval) {
+export function createAccountRoutes(authService, adminAccess, accountErasure, 
+/** Who tells an invited person (see {@link IAccountHooks}); core registers nobody. */
+accountHooks, accessRemoval) {
     const router = express.Router();
     const requireAdmin = async (req, res, next) => {
         if (!(await adminAccess.isAdmin(req.userEmail))) {
@@ -29,7 +32,8 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
         next();
     };
     // GET /api/admin/accounts — id, email, name, whether a password hash is
-    // stored, and whether the account is the env bootstrap admin.
+    // stored, whether the account is the env bootstrap admin, and whether it is
+    // an owner (and, if so, whether it may be deleted).
     router.get('/admin/accounts', requireAdmin, async (_req, res) => {
         res.json({ accounts: await authService.listAccounts() });
     });
@@ -37,8 +41,12 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
     // (or reset the password of an existing one; upsert-by-email is deliberate,
     // see AuthService.createAccount). Without a password the account is for
     // single sign-on: the person finds it waiting when they first sign in.
+    // With `keepExistingPassword: true` (an invite's starting password) the
+    // password goes only to a new account or a switched-on one with none; the
+    // reply's `passwordSet` says whether it did, and `deactivated` whether a
+    // refusal was because the account is switched off.
     router.post('/admin/accounts', requireAdmin, async (req, res) => {
-        const { email, name, password } = req.body;
+        const { email, name, password, keepExistingPassword } = req.body;
         if (!email) {
             res.status(400).json({ error: 'email is required' });
             return;
@@ -48,7 +56,66 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
             res.status(400).json({ error: 'password must be a string' });
             return;
         }
+        // Fail closed: anything but a boolean is a mistake, never "overwrite".
+        if (keepExistingPassword !== undefined && typeof keepExistingPassword !== 'boolean') {
+            res.status(400).json({ error: 'keepExistingPassword must be a boolean' });
+            return;
+        }
+        if (keepExistingPassword === true && typeof password !== 'string') {
+            res.status(400).json({ error: 'keepExistingPassword needs a password' });
+            return;
+        }
+        // Another admin setting an owner's password could then sign in as the
+        // owner. The owner sets their own on the Account page; an owner account
+        // without a password (restoring one, say; an empty one counts as none,
+        // as in createAccount) is still created here. An invite's starting
+        // password is a password too: the owner is invited by nobody.
+        if (password &&
+            authService.isOwnerEmail(email) &&
+            canonicalEmail(email) !== canonicalEmail(req.userEmail ?? '')) {
+            res.status(400).json({ error: "The owner's password can't be set by another admin; the owner sets it on their Account page." });
+            return;
+        }
         try {
+            // A NEW account is an invitation, and the deployment's listeners say
+            // how the person was told (`notified`): the answer the admin reads is
+            // true to what happened, so the dialog can say "emailed" or hand over
+            // the link. An account that was already there is not invited again.
+            const invited = async (account, created, passwordSet) => {
+                if (!created)
+                    return [];
+                // The inviting admin, by name when their account can be read. The
+                // account is already made: a failed read falls back to the identity
+                // the request carries rather than answering an error a retry could
+                // not make good (the account is not new the second time).
+                const requester = { id: req.userId ?? '', email: req.userEmail ?? '', name: '' };
+                const by = req.userId
+                    ? await authService.getUserById(req.userId).catch((err) => {
+                        log.warn('the inviting admin could not be read; the invite names them by address:', { err });
+                        return null;
+                    })
+                    : null;
+                return accountHooks.runAccountInvited({
+                    account: { id: account.id, email: account.email, name: account.name },
+                    invitedBy: by ?? requester,
+                    passwordSet,
+                });
+            };
+            if (keepExistingPassword === true && typeof password === 'string') {
+                const { user, created, passwordSet, deactivated } = await authService.createAccountWithStartingPassword(email, password);
+                const notified = await invited(user, created, passwordSet);
+                res.status(201).json({ ...user, passwordSet, deactivated, notified });
+                return;
+            }
+            if (!password) {
+                const { user, created } = await authService.createAccountWithoutPassword(email, name);
+                const notified = await invited(user, created, false);
+                res.status(201).json({ ...user, notified });
+                return;
+            }
+            // Set or reset password: an account that is here already, or one an
+            // admin makes with a password from the API. Not an invitation the
+            // listeners are told of: the dialog that invites never sends this form.
             const user = await authService.createAccount(email, name, password);
             res.status(201).json(user);
         }
@@ -56,7 +123,13 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
             const msg = error instanceof Error ? error.message : 'Unknown error';
             // The deployment has no place for the account (a seat limit, say): the
             // port's own words, as a refusal rather than a malformed request.
-            res.status(error instanceof AccountAdmissionRefusedError ? 403 : 400).json({ error: msg });
+            // `kind` tells it apart from `requireAdmin`'s 403, which a caller must
+            // not read as "no seat left".
+            if (error instanceof AccountAdmissionRefusedError) {
+                res.status(403).json({ error: msg, kind: 'admission' });
+                return;
+            }
+            res.status(400).json({ error: msg });
         }
     });
     // POST /api/admin/accounts/:userId/deactivate — switch an account off. It
@@ -83,13 +156,22 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
                 res.status(400).json({ error: error.message });
                 return;
             }
+            // The address's switch lock is held by a change still being saved (an
+            // invite's promotion committing roles.yaml, say): the 409 the lock
+            // promises, with its words, so the admin tries again rather than
+            // reading an outage.
+            if (error instanceof WorkflowDomainError) {
+                res.status(error.status).json({ error: error.message, ...(error.payload ?? {}) });
+                return;
+            }
             log.error('switching an account off failed:', { err: error });
             res.status(500).json({ error: 'Could not switch this account off' });
         }
     });
     // POST /api/admin/accounts/:userId/reactivate — switch it back on, if the
     // deployment has room: the admission port is asked, as for a new account
-    // (a host that sells seats answers from its plan; 403 with its words).
+    // (a host that sells seats answers from its plan; 403 with its words and
+    // `kind: 'admission'`).
     router.post('/admin/accounts/:userId/reactivate', requireAdmin, async (req, res) => {
         const userId = String(req.params.userId);
         try {
@@ -102,7 +184,7 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
         }
         catch (error) {
             if (error instanceof AccountAdmissionRefusedError) {
-                res.status(403).json({ error: error.message });
+                res.status(403).json({ error: error.message, kind: 'admission' });
                 return;
             }
             log.error('switching an account on failed:', { err: error });
@@ -155,14 +237,29 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
         // for the removal below — never logged, never returned.
         let email = null;
         let actor = null;
-        if (removeFromAccess) {
-            try {
-                const user = await authService.getUserById(userId);
-                if (!user) {
-                    res.status(404).json({ error: 'No such user' });
-                    return;
-                }
+        try {
+            const user = await authService.getUserById(userId);
+            if (!user) {
+                res.status(404).json({ error: 'No such user' });
+                return;
+            }
+            // An owner who could not sign back in afterwards is refused for every
+            // caller, whether or not the access option is ticked.
+            authService.assertDeletable(user.email);
+            if (removeFromAccess)
                 email = user.email;
+        }
+        catch (err) {
+            if (err instanceof AccountChangeRefusedError) {
+                res.status(400).json({ error: err.message });
+                return;
+            }
+            log.error('looking up the account to erase failed:', { err });
+            res.status(500).json({ error: 'Failed to erase user' });
+            return;
+        }
+        if (removeFromAccess && email !== null) {
+            try {
                 // The existing guards: the deployment owner and the last Admin are
                 // refused up front, before anything is erased.
                 await accessRemoval.assertRemovable(email);

package/dist/modules/auth/account.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAG/B,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA8G,EAC9G,WAAgC,EAChC,cAAyD,EACzD,aAAuG;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAIrC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,sFAAsF;QACtF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;QAE1F,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,aAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACzE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;oBAC3B,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACjC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;iBACjC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;gBACvD,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,wEAAwE;YACxE,IAAI,YAAY,GAAoB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,aAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,wDAAwD,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,OAAO,GACX,GAAG,YAAY,mBAAmB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBACpD,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,sEAAsE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAI/B,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAWC,EACD,WAAgC,EAChC,cAAyD;AACzD,sFAAsF;AACtF,YAAsD,EACtD,aAAuG;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,GAAG,CAAC,IAK3D,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,sFAAsF;QACtF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,IAAI,oBAAoB,KAAK,SAAS,IAAI,OAAO,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACpF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,8DAA8D;QAC9D,IACE,QAAQ;YACR,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC;YAC/B,cAAc,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAC7D,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8FAA8F,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,OAAO,GAAG,KAAK,EAAE,OAAiB,EAAE,OAAgB,EAAE,WAAoB,EAAqB,EAAE;gBACrG,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;gBACxB,kEAAkE;gBAClE,oEAAoE;gBACpE,mEAAmE;gBACnE,0DAA0D;gBAC1D,MAAM,SAAS,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBACjF,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM;oBACnB,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;wBAC/D,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;wBAC7F,OAAO,IAAI,CAAC;oBACd,CAAC,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC;gBACT,OAAO,YAAY,CAAC,iBAAiB,CAAC;oBACpC,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBACrE,SAAS,EAAE,EAAE,IAAI,SAAS;oBAC1B,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC,CAAC;YACF,IAAI,oBAAoB,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,WAAW,CAAC,iCAAiC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACzH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACtF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,kEAAkE;YAClE,wEAAwE;YACxE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,8BAA8B;YAC9B,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,mEAAmE;YACnE,iEAAiE;YACjE,qBAAqB;YACrB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;YACpG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;QAE1F,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,sDAAsD;YACtD,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,gBAAgB;gBAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,gBAAgB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,aAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACzE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;oBAC3B,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACjC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;iBACjC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;gBACvD,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,wEAAwE;YACxE,IAAI,YAAY,GAAoB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,aAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,wDAAwD,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,OAAO,GACX,GAAG,YAAY,mBAAmB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBACpD,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,sEAAsE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/modules/auth/auth.middleware.d.ts

@@ -19,5 +19,12 @@ declare global {
  * + `Secure` (in prod) — see `auth.routes.ts` for the issue site.
  */
 export declare const AUTH_COOKIE_NAME = "bevel_token";
+/**
+ * Read the auth cookie out of the raw `Cookie` header without pulling in
+ * `cookie-parser`. We only ever look for one cookie, so a tiny parser
+ * beats the dep surface of a middleware. Returns `null` if the cookie
+ * is absent or empty.
+ */
+export declare function readAuthCookie(req: Request): string | null;
 export declare function createAuthMiddleware(authService: Pick<AuthService, 'resolveSession'>): (req: Request, res: Response, next: NextFunction) => Promise<void>;
 //# sourceMappingURL=auth.middleware.d.ts.map

package/dist/modules/auth/auth.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB;KACF;CACF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAyB9C,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,IACrE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAsC9D"}
+{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB;KACF;CACF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAe1D;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,IACrE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAsC9D"}

package/dist/modules/auth/auth.middleware.js

@@ -16,7 +16,7 @@ export const AUTH_COOKIE_NAME = 'bevel_token';
  * beats the dep surface of a middleware. Returns `null` if the cookie
  * is absent or empty.
  */
-function readAuthCookie(req) {
+export function readAuthCookie(req) {
     const header = req.headers.cookie;
     if (!header)
         return null;

package/dist/modules/auth/auth.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAYnF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC;YAAE,SAAS;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAgD;IACnF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,IAAI,OAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,gEAAgE;YAChE,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,kDAAkD;YAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YACnH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAYnF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC;YAAE,SAAS;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAgD;IACnF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,IAAI,OAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,gEAAgE;YAChE,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,oEAAoE;YACpE,kDAAkD;YAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YACnH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}