@byline/admin 0.9.3

package/dist/modules/auth/index.js

@@ -0,0 +1,25 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * `@byline/admin/auth` — session handling for the built-in admin realm.
+ *
+ * Hosts the reference `JwtSessionProvider` and the sign-in / refresh /
+ * revoke orchestration that consumes it, along with password hashing
+ * (`hashPassword` / `verifyPassword`) and the `RefreshTokensRepository`
+ * contract the provider drives.
+ *
+ * The `SessionProvider` **interface** lives in `@byline/auth` so the
+ * pluggability contract stays narrow; this module supplies the
+ * Byline-native implementation. Third-party providers (Lucia, WorkOS,
+ * Clerk, institutional SSO) should be shipped as separate packages
+ * against `@byline/auth` rather than added here.
+ */
+export { JwtSessionProvider } from './jwt-session-provider.js';
+export { hashPassword, verifyPassword } from './password.js';
+export { resolveActor } from './resolve-actor.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAiC,MAAM,2BAA2B,CAAA;AAC7F,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/modules/auth/jwt-session-provider.d.ts

@@ -0,0 +1,47 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { type AdminAuth, type RefreshSessionArgs, type SessionProvider, type SessionProviderCapabilities, type SessionTokens, type SignInResult, type SignInWithPasswordArgs } from '@byline/auth';
+import type { AdminStore } from '../../store.js';
+export interface JwtSessionProviderConfig {
+    /**
+     * Adapter-backed admin repositories. Construct via the DB adapter's
+     * admin-store factory (e.g. `createAdminStore(db)` from
+     * `@byline/db-postgres/admin`) and pass the result in — the provider
+     * does not touch Drizzle or any other adapter-specific API directly.
+     */
+    store: AdminStore;
+    /**
+     * HMAC-SHA256 signing secret. Must be at least 32 bytes (256 bits) of
+     * entropy. Load from a secret manager — never hard-code.
+     *
+     * To switch to asymmetric signing (RS256/EdDSA), swap out this provider
+     * for a custom one backed by `jose` key objects.
+     */
+    signingSecret: string | Uint8Array;
+    /** Issuer claim (`iss`) on access tokens. Defaults to `'byline'`. */
+    issuer?: string;
+    /** Access-token lifetime in seconds. Default 15 min. */
+    accessTokenTtlSeconds?: number;
+    /** Refresh-token lifetime in seconds. Default 30 days. */
+    refreshTokenTtlSeconds?: number;
+    /** Clock reference — override for deterministic tests. */
+    now?: () => Date;
+}
+export declare class JwtSessionProvider implements SessionProvider {
+    #private;
+    readonly capabilities: SessionProviderCapabilities;
+    constructor(config: JwtSessionProviderConfig);
+    signInWithPassword(args: SignInWithPasswordArgs): Promise<SignInResult>;
+    verifyAccessToken(token: string): Promise<{
+        actor: AdminAuth;
+    }>;
+    refreshSession(args: RefreshSessionArgs): Promise<SessionTokens>;
+    revokeSession(refreshToken: string): Promise<void>;
+    resolveActor(adminUserId: string): Promise<AdminAuth | null>;
+}
+//# sourceMappingURL=jwt-session-provider.d.ts.map

package/dist/modules/auth/jwt-session-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-session-provider.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/jwt-session-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAEL,KAAK,SAAS,EAKd,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAA;AAMrB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAYhD,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,KAAK,EAAE,UAAU,CAAA;IACjB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,GAAG,UAAU,CAAA;IAClC,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CACjB;AAED,qBAAa,kBAAmB,YAAW,eAAe;;IACxD,SAAgB,YAAY,8BAAe;gBAS/B,MAAM,EAAE,wBAAwB;IAqBtC,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC;IAyCvE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IAwB/D,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwDhE,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlD,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;CAmDnE"}

package/dist/modules/auth/jwt-session-provider.js

@@ -0,0 +1,215 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { ERR_ACCOUNT_DISABLED, ERR_INVALID_CREDENTIALS, ERR_INVALID_TOKEN, ERR_REVOKED_TOKEN, } from '@byline/auth';
+import { jwtVerify, SignJWT } from 'jose';
+import { v7 as uuidv7 } from 'uuid';
+import { verifyPassword } from './password.js';
+import { resolveActor } from './resolve-actor.js';
+const DEFAULT_ISSUER = 'byline';
+const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 15 * 60; // 15 minutes
+const DEFAULT_REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60; // 30 days
+const CAPABILITIES = {
+    passwordChange: true,
+    magicLink: false,
+    sso: false,
+};
+export class JwtSessionProvider {
+    capabilities = CAPABILITIES;
+    #store;
+    #signingKey;
+    #issuer;
+    #accessTtl;
+    #refreshTtl;
+    #now;
+    constructor(config) {
+        this.#store = config.store;
+        this.#signingKey =
+            typeof config.signingSecret === 'string'
+                ? new TextEncoder().encode(config.signingSecret)
+                : config.signingSecret;
+        if (this.#signingKey.byteLength < 32) {
+            throw new Error('JwtSessionProvider: signingSecret must carry at least 32 bytes of entropy (256 bits)');
+        }
+        this.#issuer = config.issuer ?? DEFAULT_ISSUER;
+        this.#accessTtl = config.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+        this.#refreshTtl = config.refreshTokenTtlSeconds ?? DEFAULT_REFRESH_TOKEN_TTL_SECONDS;
+        this.#now = config.now ?? (() => new Date());
+    }
+    // -----------------------------------------------------------------------
+    // SessionProvider
+    // -----------------------------------------------------------------------
+    async signInWithPassword(args) {
+        const users = this.#store.adminUsers;
+        const row = await users.getByEmailForSignIn(args.email);
+        // Uniform error response for unknown email vs. wrong password — don't
+        // leak which one. Still do a real verify against a dummy hash so the
+        // timing is comparable; the argon2 cost dominates regardless.
+        if (!row) {
+            await verifyPassword(args.password, DUMMY_HASH_FOR_TIMING);
+            throw ERR_INVALID_CREDENTIALS({ message: 'invalid credentials' });
+        }
+        const ok = await verifyPassword(args.password, row.password_hash);
+        if (!ok) {
+            await users.recordLoginFailure(row.id);
+            throw ERR_INVALID_CREDENTIALS({ message: 'invalid credentials' });
+        }
+        if (!row.is_enabled) {
+            throw ERR_ACCOUNT_DISABLED({ message: 'account disabled' });
+        }
+        await users.recordLoginSuccess(row.id, args.ip ?? null);
+        const actor = await resolveActor(this.#store, row.id);
+        // resolveActor also checks is_enabled, but we just recorded success
+        // above, so null here would indicate a race (the account was disabled
+        // between the check and the resolve). Treat as disabled.
+        if (!actor) {
+            throw ERR_ACCOUNT_DISABLED({ message: 'account disabled' });
+        }
+        const tokens = await this.#issueTokens({
+            adminUserId: row.id,
+            ip: args.ip ?? null,
+            userAgent: args.userAgent ?? null,
+        });
+        return { ...tokens, actor };
+    }
+    async verifyAccessToken(token) {
+        let payload;
+        try {
+            const result = await jwtVerify(token, this.#signingKey, {
+                issuer: this.#issuer,
+            });
+            payload = result.payload;
+        }
+        catch (err) {
+            throw ERR_INVALID_TOKEN({ message: 'access token verification failed', cause: err });
+        }
+        if (payload.typ !== 'access') {
+            throw ERR_INVALID_TOKEN({ message: 'unexpected token type' });
+        }
+        const actor = await resolveActor(this.#store, payload.sub);
+        if (!actor) {
+            // The token was valid but the user is now disabled or deleted.
+            throw ERR_ACCOUNT_DISABLED({ message: 'account disabled or deleted' });
+        }
+        return { actor };
+    }
+    async refreshSession(args) {
+        const refreshTokens = this.#store.refreshTokens;
+        const hash = hashToken(args.refreshToken);
+        const row = await refreshTokens.findByHash(hash);
+        if (!row) {
+            throw ERR_INVALID_TOKEN({ message: 'refresh token not recognised' });
+        }
+        const now = this.#now();
+        // Already revoked?
+        if (row.revoked_at != null) {
+            if (row.rotated_to_id != null) {
+                // Rotated token replayed — the chain is compromised. Revoke every
+                // descendant so the attacker and the legitimate holder are both
+                // signed out.
+                await refreshTokens.revokeChain(row.id, now);
+                throw ERR_REVOKED_TOKEN({
+                    message: 'refresh token was already rotated — chain revoked',
+                });
+            }
+            throw ERR_REVOKED_TOKEN({ message: 'refresh token has been revoked' });
+        }
+        if (row.expires_at.getTime() <= now.getTime()) {
+            throw ERR_INVALID_TOKEN({ message: 'refresh token expired' });
+        }
+        // Rotate: mint a new token, mark the old one rotated_to the new id.
+        const newId = uuidv7();
+        const newRefreshPlain = generateOpaqueToken();
+        const newRefreshHash = hashToken(newRefreshPlain);
+        const refreshExpiresAt = new Date(now.getTime() + this.#refreshTtl * 1000);
+        await refreshTokens.issue({
+            id: newId,
+            admin_user_id: row.admin_user_id,
+            token_hash: newRefreshHash,
+            expires_at: refreshExpiresAt,
+            user_agent: args.userAgent ?? null,
+            ip: args.ip ?? null,
+        });
+        await refreshTokens.markRotated(row.id, newId, now);
+        const accessToken = await this.#signAccessToken(row.admin_user_id, now);
+        const accessExpiresAt = new Date(now.getTime() + this.#accessTtl * 1000);
+        return {
+            accessToken,
+            refreshToken: newRefreshPlain,
+            accessTokenExpiresAt: accessExpiresAt,
+            refreshTokenExpiresAt: refreshExpiresAt,
+        };
+    }
+    async revokeSession(refreshToken) {
+        const refreshTokens = this.#store.refreshTokens;
+        const row = await refreshTokens.findByHash(hashToken(refreshToken));
+        if (!row)
+            return; // Idempotent — unknown tokens are a no-op.
+        await refreshTokens.revoke(row.id, this.#now());
+    }
+    async resolveActor(adminUserId) {
+        return resolveActor(this.#store, adminUserId);
+    }
+    // -----------------------------------------------------------------------
+    // Internals
+    // -----------------------------------------------------------------------
+    async #issueTokens(input) {
+        const now = this.#now();
+        const refreshTokens = this.#store.refreshTokens;
+        const accessToken = await this.#signAccessToken(input.adminUserId, now);
+        const accessExpiresAt = new Date(now.getTime() + this.#accessTtl * 1000);
+        const refreshPlain = generateOpaqueToken();
+        const refreshHash = hashToken(refreshPlain);
+        const refreshExpiresAt = new Date(now.getTime() + this.#refreshTtl * 1000);
+        await refreshTokens.issue({
+            id: uuidv7(),
+            admin_user_id: input.adminUserId,
+            token_hash: refreshHash,
+            expires_at: refreshExpiresAt,
+            user_agent: input.userAgent,
+            ip: input.ip,
+        });
+        return {
+            accessToken,
+            refreshToken: refreshPlain,
+            accessTokenExpiresAt: accessExpiresAt,
+            refreshTokenExpiresAt: refreshExpiresAt,
+        };
+    }
+    async #signAccessToken(adminUserId, now) {
+        const iat = Math.floor(now.getTime() / 1000);
+        const exp = iat + this.#accessTtl;
+        return new SignJWT({ typ: 'access' })
+            .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
+            .setSubject(adminUserId)
+            .setIssuer(this.#issuer)
+            .setIssuedAt(iat)
+            .setExpirationTime(exp)
+            .setJti(randomUUID())
+            .sign(this.#signingKey);
+    }
+}
+// ---------------------------------------------------------------------------
+// Utilities
+// ---------------------------------------------------------------------------
+/** 32 bytes of randomness, base64url-encoded. ~43 chars on the wire. */
+function generateOpaqueToken() {
+    return randomBytes(32).toString('base64url');
+}
+/** SHA-256 hex digest of the raw refresh-token string. */
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+/**
+ * A stable argon2id hash used only to equalise sign-in timing on the
+ * unknown-email code path. The plaintext here is arbitrary — we never
+ * succeed against it. This is pre-generated at module-load time so the
+ * first sign-in call doesn't pay the generation cost.
+ */
+const DUMMY_HASH_FOR_TIMING = '$argon2id$v=19$m=19456,t=2,p=1$c2lkZS1jaGFubmVsLW1pdGlnYXRpb24$0Hqf2vQKZqSfZZ4nJRr7K5IOjn9ngjzaQjV+yTG6iNY';
+//# sourceMappingURL=jwt-session-provider.js.map

package/dist/modules/auth/jwt-session-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-session-provider.js","sourceRoot":"","sources":["../../../src/modules/auth/jwt-session-provider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAEjE,OAAO,EAGL,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,MAAM,cAAc,GAAG,QAAQ,CAAA;AAC/B,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,CAAA,CAAC,aAAa;AAC9D,MAAM,iCAAiC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA,CAAC,UAAU;AAEtE,MAAM,YAAY,GAAgC;IAChD,cAAc,EAAE,IAAI;IACpB,SAAS,EAAE,KAAK;IAChB,GAAG,EAAE,KAAK;CACX,CAAA;AA4BD,MAAM,OAAO,kBAAkB;IACb,YAAY,GAAG,YAAY,CAAA;IAElC,MAAM,CAAY;IAClB,WAAW,CAAY;IACvB,OAAO,CAAQ;IACf,UAAU,CAAQ;IAClB,WAAW,CAAQ;IACnB,IAAI,CAAY;IAEzB,YAAY,MAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,WAAW;YACd,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;gBACtC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;gBAChD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAA;QAC1B,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAA;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAA;QAC9C,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,qBAAqB,IAAI,gCAAgC,CAAA;QAClF,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,sBAAsB,IAAI,iCAAiC,CAAA;QACrF,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;IAClB,0EAA0E;IAE1E,KAAK,CAAC,kBAAkB,CAAC,IAA4B;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAA;QACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAEvD,sEAAsE;QACtE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAA;YAC1D,MAAM,uBAAuB,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;QACjE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtC,MAAM,uBAAuB,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,CAAA;QAEvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QACrD,oEAAoE;QACpE,sEAAsE;QACtE,yDAAyD;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACrC,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;SAClC,CAAC,CAAA;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,OAA2B,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAqB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;gBAC1E,MAAM,EAAE,IAAI,CAAC,OAAO;aACrB,CAAC,CAAA;YACF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAA;QAC/D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,+DAA+D;YAC/D,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAwB;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAA;QAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAEhD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAEvB,mBAAmB;QACnB,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC9B,kEAAkE;gBAClE,gEAAgE;gBAChE,cAAc;gBACd,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC5C,MAAM,iBAAiB,CAAC;oBACtB,OAAO,EAAE,mDAAmD;iBAC7D,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAA;QAC/D,CAAC;QAED,oEAAoE;QACpE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAA;QACtB,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAA;QAC7C,MAAM,cAAc,GAAG,SAAS,CAAC,eAAe,CAAC,CAAA;QACjD,MAAM,gBAAgB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QAE1E,MAAM,aAAa,CAAC,KAAK,CAAC;YACxB,EAAE,EAAE,KAAK;YACT,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,UAAU,EAAE,cAAc;YAC1B,UAAU,EAAE,gBAAgB;YAC5B,UAAU,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YAClC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;SACpB,CAAC,CAAA;QACF,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;QAEnD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;QACvE,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;QAExE,OAAO;YACL,WAAW;YACX,YAAY,EAAE,eAAe;YAC7B,oBAAoB,EAAE,eAAe;YACrC,qBAAqB,EAAE,gBAAgB;SACxC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAA;QAC/C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAA;QACnE,IAAI,CAAC,GAAG;YAAE,OAAM,CAAC,2CAA2C;QAC5D,MAAM,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC/C,CAAC;IAED,0EAA0E;IAC1E,YAAY;IACZ,0EAA0E;IAE1E,KAAK,CAAC,YAAY,CAAC,KAIlB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAA;QAE/C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QACvE,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;QAExE,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAA;QAC1C,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;QAC3C,MAAM,gBAAgB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QAC1E,MAAM,aAAa,CAAC,KAAK,CAAC;YACxB,EAAE,EAAE,MAAM,EAAE;YACZ,aAAa,EAAE,KAAK,CAAC,WAAW;YAChC,UAAU,EAAE,WAAW;YACvB,UAAU,EAAE,gBAAgB;YAC5B,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,EAAE,EAAE,KAAK,CAAC,EAAE;SACb,CAAC,CAAA;QAEF,OAAO;YACL,WAAW;YACX,YAAY,EAAE,YAAY;YAC1B,oBAAoB,EAAE,eAAe;YACrC,qBAAqB,EAAE,gBAAgB;SACxC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,GAAS;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;aAClC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAChD,UAAU,CAAC,WAAW,CAAC;aACvB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;aACvB,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,CAAC;aACtB,MAAM,CAAC,UAAU,EAAE,CAAC;aACpB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC3B,CAAC;CACF;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,wEAAwE;AACxE,SAAS,mBAAmB;IAC1B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,qBAAqB,GACzB,4GAA4G,CAAA"}

package/dist/modules/auth/password.d.ts

@@ -0,0 +1,16 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Hash a plaintext password. Returns a full PHC string. */
+export declare function hashPassword(plaintext: string): Promise<string>;
+/**
+ * Verify a plaintext password against a stored PHC string. Returns `false`
+ * on mismatch — never throws for a normal mismatch. Re-throws on malformed
+ * hash strings or underlying library errors so those get surfaced.
+ */
+export declare function verifyPassword(plaintext: string, phc: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/modules/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/password.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4BH,4DAA4D;AAC5D,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKrE;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGrF"}

package/dist/modules/auth/password.js

@@ -0,0 +1,48 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Password hashing — argon2id via @node-rs/argon2.
+ *
+ * Stores the full PHC string (`$argon2id$v=19$m=…$…$…`) in the
+ * `byline_admin_users.password` column. That makes the algorithm and
+ * parameters self-describing, so upgrading params later (or migrating off
+ * argon2id entirely) is a straightforward re-hash on next successful sign-in.
+ *
+ * Defaults follow OWASP 2023 guidance for argon2id: memory 19 MiB,
+ * iterations 2, parallelism 1. These are reasonable for typical server
+ * hardware; tune if sign-in latency becomes a concern under load.
+ */
+import { hash, verify } from '@node-rs/argon2';
+/**
+ * `@node-rs/argon2` defaults to argon2id; we just tune the parameters.
+ * (The `Algorithm` enum exported by the package is a const enum and
+ * cannot be referenced under `verbatimModuleSyntax`.)
+ */
+const HASH_OPTIONS = {
+    memoryCost: 19456, // 19 MiB
+    timeCost: 2,
+    parallelism: 1,
+};
+/** Hash a plaintext password. Returns a full PHC string. */
+export async function hashPassword(plaintext) {
+    if (plaintext.length === 0) {
+        throw new Error('hashPassword: plaintext must be non-empty');
+    }
+    return hash(plaintext, HASH_OPTIONS);
+}
+/**
+ * Verify a plaintext password against a stored PHC string. Returns `false`
+ * on mismatch — never throws for a normal mismatch. Re-throws on malformed
+ * hash strings or underlying library errors so those get surfaced.
+ */
+export async function verifyPassword(plaintext, phc) {
+    if (plaintext.length === 0 || phc.length === 0)
+        return false;
+    return verify(phc, plaintext);
+}
+//# sourceMappingURL=password.js.map

package/dist/modules/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/modules/auth/password.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,YAAY,GAAG;IACnB,UAAU,EAAE,KAAK,EAAE,SAAS;IAC5B,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;CACf,CAAA;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB;IAClD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,GAAW;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5D,OAAO,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;AAC/B,CAAC"}

package/dist/modules/auth/refresh-tokens-repository.d.ts

@@ -0,0 +1,71 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * `RefreshTokensRepository` — the persistence contract for the
+ * `byline_admin_refresh_tokens` table.
+ *
+ * Lives under `modules/auth` rather than at the package root because this
+ * table exists to serve the built-in JWT session provider — a third-party
+ * session provider (Lucia, WorkOS, Clerk) would not use it. `token_hash`
+ * stores the SHA-256 of the plaintext refresh token; the plaintext leaves
+ * the server exactly once, when it is issued to the caller.
+ */
+export interface RefreshTokenRow {
+    id: string;
+    admin_user_id: string;
+    token_hash: string;
+    issued_at: Date;
+    expires_at: Date;
+    revoked_at: Date | null;
+    rotated_to_id: string | null;
+    last_used_at: Date | null;
+    user_agent: string | null;
+    ip: string | null;
+}
+export interface IssueRefreshTokenInput {
+    id: string;
+    admin_user_id: string;
+    token_hash: string;
+    expires_at: Date;
+    user_agent?: string | null;
+    ip?: string | null;
+}
+export interface RefreshTokensRepository {
+    /** Insert a new refresh-token row. `id` is supplied by the caller (UUIDv7). */
+    issue(input: IssueRefreshTokenInput): Promise<RefreshTokenRow>;
+    findByHash(tokenHash: string): Promise<RefreshTokenRow | null>;
+    findById(id: string): Promise<RefreshTokenRow | null>;
+    /** Stamp `last_used_at` for observability. */
+    touch(id: string, at?: Date): Promise<void>;
+    /**
+     * Atomically revoke `oldId` and set its `rotated_to_id` to `newId`.
+     * Caller is responsible for inserting the new row (via `issue`) before
+     * calling this — ordering is a contract.
+     */
+    markRotated(oldId: string, newId: string, at?: Date): Promise<void>;
+    /** Revoke a single token. Idempotent. */
+    revoke(id: string, at?: Date): Promise<void>;
+    /**
+     * Walk the rotation chain starting at `startId` and revoke every token
+     * in it. Called when a rotated token is replayed — indicates the chain
+     * has been compromised and every descendant is suspect. Returns the
+     * number of rows touched.
+     */
+    revokeChain(startId: string, at?: Date): Promise<number>;
+    /** Revoke every non-revoked token for a user. Used on password change / sign-out everywhere. */
+    revokeAllForUser(adminUserId: string, at?: Date): Promise<number>;
+    /** Remove rows whose `expires_at` is in the past. Housekeeping. */
+    purgeExpired(now?: Date): Promise<number>;
+    /** All non-revoked tokens for a user. Primarily for tests. */
+    listActiveForUser(adminUserId: string): Promise<RefreshTokenRow[]>;
+    /** All tokens (including revoked) for a user. Primarily for tests and debugging. */
+    listAllForUser(adminUserId: string): Promise<RefreshTokenRow[]>;
+    /** All tokens descended from `startId` via the rotation chain. Utility for tests. */
+    listRotationChain(startId: string): Promise<RefreshTokenRow[]>;
+}
+//# sourceMappingURL=refresh-tokens-repository.d.ts.map

package/dist/modules/auth/refresh-tokens-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-tokens-repository.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/refresh-tokens-repository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;GASG;AAEH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,IAAI,CAAA;IACf,UAAU,EAAE,IAAI,CAAA;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,IAAI,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,IAAI,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC9D,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IACrD,8CAA8C;IAC9C,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,yCAAyC;IACzC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxD,gGAAgG;IAChG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACjE,mEAAmE;IACnE,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACzC,8DAA8D;IAC9D,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAClE,oFAAoF;IACpF,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAC/D,qFAAqF;IACrF,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;CAC/D"}

package/dist/modules/auth/refresh-tokens-repository.js

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};
+//# sourceMappingURL=refresh-tokens-repository.js.map

package/dist/modules/auth/refresh-tokens-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-tokens-repository.js","sourceRoot":"","sources":["../../../src/modules/auth/refresh-tokens-repository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/modules/auth/resolve-actor.d.ts

@@ -0,0 +1,25 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { AdminAuth } from '@byline/auth';
+import type { AdminStore } from '../../store.js';
+/**
+ * Build an `AdminAuth` from a user id by reading the admin-users row and
+ * collecting the distinct abilities granted through every role the user
+ * holds.
+ *
+ * Returns `null` when the user does not exist or is not enabled — callers
+ * interpret a null result as "no actor, sign-in refused". The enablement
+ * check lives here (rather than in the session provider) so that any code
+ * path resolving an actor from a stored user id — sign-in, token refresh,
+ * seeded super-admin context — applies the same gate.
+ *
+ * Consumes the admin-users and admin-permissions repositories through the
+ * `AdminStore` bundle; adapter-agnostic.
+ */
+export declare function resolveActor(store: AdminStore, adminUserId: string): Promise<AdminAuth | null>;
+//# sourceMappingURL=resolve-actor.d.ts.map

package/dist/modules/auth/resolve-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-actor.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/resolve-actor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAY3B"}

package/dist/modules/auth/resolve-actor.js

@@ -0,0 +1,36 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { AdminAuth } from '@byline/auth';
+/**
+ * Build an `AdminAuth` from a user id by reading the admin-users row and
+ * collecting the distinct abilities granted through every role the user
+ * holds.
+ *
+ * Returns `null` when the user does not exist or is not enabled — callers
+ * interpret a null result as "no actor, sign-in refused". The enablement
+ * check lives here (rather than in the session provider) so that any code
+ * path resolving an actor from a stored user id — sign-in, token refresh,
+ * seeded super-admin context — applies the same gate.
+ *
+ * Consumes the admin-users and admin-permissions repositories through the
+ * `AdminStore` bundle; adapter-agnostic.
+ */
+export async function resolveActor(store, adminUserId) {
+    const user = await store.adminUsers.getById(adminUserId);
+    if (!user)
+        return null;
+    if (!user.is_enabled)
+        return null;
+    const abilities = await store.adminPermissions.listAbilitiesForUser(adminUserId);
+    return new AdminAuth({
+        id: user.id,
+        abilities,
+        isSuperAdmin: user.is_super_admin,
+    });
+}
+//# sourceMappingURL=resolve-actor.js.map

package/dist/modules/auth/resolve-actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-actor.js","sourceRoot":"","sources":["../../../src/modules/auth/resolve-actor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAIxC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiB,EACjB,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAEjC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAA;IAEhF,OAAO,IAAI,SAAS,CAAC;QACnB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,SAAS;QACT,YAAY,EAAE,IAAI,CAAC,cAAc;KAClC,CAAC,CAAA;AACJ,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,31 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { AdminPermissionsRepository } from './modules/admin-permissions/repository.js';
+import type { AdminRolesRepository } from './modules/admin-roles/repository.js';
+import type { AdminUsersRepository } from './modules/admin-users/repository.js';
+import type { RefreshTokensRepository } from './modules/auth/refresh-tokens-repository.js';
+/**
+ * The bundle of repositories that `@byline/admin` needs from the DB
+ * adapter. A DB adapter package (`@byline/db-postgres`, a future
+ * `@byline/db-mysql`) is expected to expose a factory — conventionally
+ * `createAdminStore(db)` — that returns an `AdminStore` wired against
+ * its concrete schema. The bundle is passed to the built-in
+ * `JwtSessionProvider`, to `seedSuperAdmin`, and (later) to admin-user
+ * and admin-role commands.
+ *
+ * Keeping the four repositories together as a single argument avoids
+ * exploding constructor signatures and makes "needs admin DB access" a
+ * single, recognisable type.
+ */
+export interface AdminStore {
+    adminUsers: AdminUsersRepository;
+    adminRoles: AdminRolesRepository;
+    adminPermissions: AdminPermissionsRepository;
+    refreshTokens: RefreshTokensRepository;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAA;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AAE1F;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,oBAAoB,CAAA;IAChC,UAAU,EAAE,oBAAoB,CAAA;IAChC,gBAAgB,EAAE,0BAA0B,CAAA;IAC5C,aAAa,EAAE,uBAAuB,CAAA;CACvC"}

package/dist/store.js

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}