@byline/admin 4.19.0 → 5.1.0

package/dist/modules/auth/jwt-session-provider.js

@@ -1,9 +1,10 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { ERR_ACCOUNT_DISABLED, ERR_INVALID_CREDENTIALS, ERR_INVALID_TOKEN, ERR_REVOKED_TOKEN } from "@byline/auth";
-import { SignJWT, jwtVerify } from "jose";
+import { ERR_ACCESS_EXPIRED, ERR_ACCOUNT_DISABLED, ERR_INVALID_CREDENTIALS, ERR_INVALID_TOKEN, ERR_REVOKED_TOKEN, ERR_SESSION_CHANGED } from "@byline/auth";
+import { passwordSignInSchema } from "@byline/core/validation";
+import { SignJWT, compactVerify, jwtVerify } from "jose";
 import { v7 } from "uuid";
 import { verifyPassword } from "./password.js";
-import { resolveActor } from "./resolve-actor.js";
+import { resolveActor, resolveActorFromUser } from "./resolve-actor.js";
 function _check_private_redeclaration(obj, privateCollection) {
     if (privateCollection.has(obj)) throw new TypeError("Cannot initialize the same private elements twice on an object");
 }
@@ -51,18 +52,19 @@ const CAPABILITIES = {
     magicLink: false,
     sso: false
 };
-var _store = /*#__PURE__*/ new WeakMap(), _signingKey = /*#__PURE__*/ new WeakMap(), _issuer = /*#__PURE__*/ new WeakMap(), _accessTtl = /*#__PURE__*/ new WeakMap(), _refreshTtl = /*#__PURE__*/ new WeakMap(), _now = /*#__PURE__*/ new WeakMap(), _issueTokens = /*#__PURE__*/ new WeakSet(), _signAccessToken = /*#__PURE__*/ new WeakSet();
+var _onEvent = /*#__PURE__*/ new WeakMap(), _store = /*#__PURE__*/ new WeakMap(), _signingKey = /*#__PURE__*/ new WeakMap(), _issuer = /*#__PURE__*/ new WeakMap(), _accessTtl = /*#__PURE__*/ new WeakMap(), _refreshTtl = /*#__PURE__*/ new WeakMap(), _now = /*#__PURE__*/ new WeakMap(), _emit = /*#__PURE__*/ new WeakSet(), _observedLogins = /*#__PURE__*/ new WeakSet(), _issueTokens = /*#__PURE__*/ new WeakSet(), _signAccessToken = /*#__PURE__*/ new WeakSet();
 class JwtSessionProvider {
     async signInWithPassword(args) {
+        const credentials = passwordSignInSchema.parse(args);
         const users = _class_private_field_get(this, _store).adminUsers;
-        const row = await users.getByEmailForSignIn(args.email);
+        const row = await users.getByEmailForSignIn(credentials.email);
         if (!row) {
-            await verifyPassword(args.password, DUMMY_HASH_FOR_TIMING);
+            await verifyPassword(credentials.password, DUMMY_HASH_FOR_TIMING);
             throw ERR_INVALID_CREDENTIALS({
                 message: 'invalid credentials'
             });
         }
-        const ok = await verifyPassword(args.password, row.password_hash);
+        const ok = await verifyPassword(credentials.password, row.password_hash);
         if (!ok) {
             await users.recordLoginFailure(row.id);
             throw ERR_INVALID_CREDENTIALS({
@@ -72,101 +74,196 @@ class JwtSessionProvider {
         if (!row.is_enabled) throw ERR_ACCOUNT_DISABLED({
             message: 'account disabled'
         });
-        await users.recordLoginSuccess(row.id, args.ip ?? null);
-        const actor = await resolveActor(_class_private_field_get(this, _store), row.id);
-        if (!actor) throw ERR_ACCOUNT_DISABLED({
-            message: 'account disabled'
-        });
-        const tokens = await _class_private_method_get(this, _issueTokens, issueTokens).call(this, {
-            adminUserId: row.id,
-            ip: args.ip ?? null,
-            userAgent: args.userAgent ?? null
+        const previous = await _class_private_method_get(this, _observedLogins, observedLogins).call(this, args);
+        const withLocks = (work)=>previous.length ? _class_private_field_get(this, _store).withSessionLocks([
+                row.id,
+                ...previous.map((login)=>login.admin_user_id)
+            ], work) : _class_private_field_get(this, _store).withSessionLock(row.id, (store)=>work(store));
+        return withLocks(async (store)=>{
+            const current = await store.adminUsers.getByIdForSignIn(row.id);
+            if (!current?.is_enabled) throw ERR_ACCOUNT_DISABLED({
+                message: 'account disabled'
+            });
+            if (current.password_hash !== row.password_hash || current.session_version !== row.session_version) throw ERR_INVALID_CREDENTIALS({
+                message: 'credentials changed during sign-in'
+            });
+            for (const observed of previous){
+                const login = await store.loginSessions.findById(observed.id);
+                if (login && login.admin_user_id === observed.admin_user_id) await store.loginSessions.revoke(login.id, _class_private_field_get(this, _now).call(this));
+            }
+            await store.adminUsers.recordLoginSuccess(row.id, args.ip ?? null);
+            const actor = await resolveActorFromUser(store, current);
+            if (!actor) throw ERR_ACCOUNT_DISABLED({
+                message: 'account disabled'
+            });
+            const tokens = await _class_private_method_get(this, _issueTokens, issueTokens).call(this, store, {
+                adminUserId: row.id,
+                sessionVersion: current.session_version,
+                ip: args.ip ?? null,
+                userAgent: args.userAgent ?? null
+            });
+            return {
+                ...tokens,
+                actor
+            };
         });
-        return {
-            ...tokens,
-            actor
-        };
     }
     async verifyAccessToken(token) {
         let payload;
         try {
             const result = await jwtVerify(token, _class_private_field_get(this, _signingKey), {
-                issuer: _class_private_field_get(this, _issuer)
+                issuer: _class_private_field_get(this, _issuer),
+                algorithms: [
+                    'HS256'
+                ],
+                currentDate: _class_private_field_get(this, _now).call(this),
+                requiredClaims: [
+                    'sub',
+                    'iat',
+                    'exp',
+                    'jti',
+                    'sv',
+                    'sid'
+                ]
             });
             payload = result.payload;
         } catch (err) {
+            if (err instanceof Error && 'code' in err && 'ERR_JWT_EXPIRED' === err.code) throw ERR_ACCESS_EXPIRED({
+                message: 'access token expired'
+            });
             throw ERR_INVALID_TOKEN({
                 message: 'access token verification failed',
                 cause: err
             });
         }
-        if ('access' !== payload.typ) throw ERR_INVALID_TOKEN({
+        if ('access' !== payload.typ || 'string' != typeof payload.sub || !validSid(payload.sid) || !Number.isSafeInteger(payload.sv) || payload.sv < 0) throw ERR_INVALID_TOKEN({
             message: 'unexpected token type'
         });
-        const actor = await resolveActor(_class_private_field_get(this, _store), payload.sub);
+        const current = await _class_private_field_get(this, _store).adminUsers.getByIdForSignIn(payload.sub);
+        if (!current?.is_enabled) throw ERR_ACCOUNT_DISABLED({
+            message: 'account disabled or deleted'
+        });
+        if (current.session_version !== payload.sv) throw ERR_REVOKED_TOKEN({
+            message: 'account session generation changed'
+        });
+        const login = await _class_private_field_get(this, _store).loginSessions.findById(payload.sid);
+        if (!login || login.admin_user_id !== payload.sub || login.session_version !== payload.sv || null != login.revoked_at || login.expires_at.getTime() <= _class_private_field_get(this, _now).call(this).getTime()) throw ERR_REVOKED_TOKEN({
+            message: 'login revoked or expired'
+        });
+        const actor = await resolveActorFromUser(_class_private_field_get(this, _store), current);
         if (!actor) throw ERR_ACCOUNT_DISABLED({
             message: 'account disabled or deleted'
         });
         return {
-            actor
+            actor,
+            sessionId: payload.sid
         };
     }
     async refreshSession(args) {
-        const refreshTokens = _class_private_field_get(this, _store).refreshTokens;
+        _class_private_method_get(this, _emit, emit).call(this, 'refresh_attempted');
         const hash = hashToken(args.refreshToken);
-        const row = await refreshTokens.findByHash(hash);
-        if (!row) throw ERR_INVALID_TOKEN({
+        const observed = await _class_private_field_get(this, _store).refreshTokens.findByHash(hash);
+        if (!observed) throw ERR_INVALID_TOKEN({
             message: 'refresh token not recognised'
         });
-        const now = _class_private_field_get(this, _now).call(this);
-        if (null != row.revoked_at) {
-            if (null != row.rotated_to_id) {
-                await refreshTokens.revokeChain(row.id, now);
-                throw ERR_REVOKED_TOKEN({
-                    message: 'refresh token was already rotated — chain revoked'
-                });
+        const outcome = await _class_private_field_get(this, _store).withSessionLock(observed.admin_user_id, async (store, user)=>{
+            if (!user?.is_enabled) throw ERR_ACCOUNT_DISABLED({
+                message: 'account disabled or deleted'
+            });
+            const refreshTokens = store.refreshTokens;
+            const row = await refreshTokens.findByHash(hash);
+            if (!row) throw ERR_INVALID_TOKEN({
+                message: 'refresh token not recognised'
+            });
+            const now = _class_private_field_get(this, _now).call(this);
+            const login = row.sid ? await store.loginSessions.findById(row.sid) : null;
+            if (!login || login.admin_user_id !== user.id || login.session_version !== user.session_version || null != login.revoked_at) throw ERR_REVOKED_TOKEN({
+                message: 'login revoked'
+            });
+            if (args.expectedSessionId && args.expectedSessionId !== login.id) throw ERR_SESSION_CHANGED({
+                message: 'session changed before renewal'
+            });
+            if (null != row.revoked_at) {
+                if (null != row.rotated_to_id) {
+                    await store.loginSessions.revoke(login.id, now);
+                    await refreshTokens.revokeChain(row.id, now);
+                }
+                return {
+                    contested: null != row.rotated_to_id,
+                    error: ERR_REVOKED_TOKEN({
+                        message: 'refresh token has been revoked'
+                    })
+                };
             }
-            throw ERR_REVOKED_TOKEN({
-                message: 'refresh token has been revoked'
+            if (row.session_version !== user.session_version) throw ERR_REVOKED_TOKEN({
+                message: 'account session generation changed'
+            });
+            if (row.expires_at.getTime() <= now.getTime() || login.expires_at.getTime() <= now.getTime()) throw ERR_INVALID_TOKEN({
+                message: 'refresh token expired'
+            });
+            const newId = v7();
+            const newRefreshPlain = generateOpaqueToken();
+            const refreshExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _refreshTtl));
+            await refreshTokens.issue({
+                id: newId,
+                admin_user_id: row.admin_user_id,
+                token_hash: hashToken(newRefreshPlain),
+                session_version: user.session_version,
+                sid: login.id,
+                expires_at: refreshExpiresAt,
+                user_agent: args.userAgent ?? null,
+                ip: args.ip ?? null
             });
+            await store.loginSessions.extend(login.id, refreshExpiresAt);
+            await refreshTokens.markRotated(row.id, newId, now);
+            const accessToken = await _class_private_method_get(this, _signAccessToken, signAccessToken).call(this, row.admin_user_id, user.session_version, login.id, now);
+            return {
+                tokens: {
+                    sessionId: login.id,
+                    accessToken,
+                    refreshToken: newRefreshPlain,
+                    accessTokenExpiresAt: new Date(now.getTime() + 1000 * _class_private_field_get(this, _accessTtl)),
+                    refreshTokenExpiresAt: refreshExpiresAt
+                }
+            };
+        });
+        if ('error' in outcome) {
+            if (outcome.contested) _class_private_method_get(this, _emit, emit).call(this, 'refresh_contested');
+            throw outcome.error;
         }
-        if (row.expires_at.getTime() <= now.getTime()) throw ERR_INVALID_TOKEN({
-            message: 'refresh token expired'
-        });
-        const newId = v7();
-        const newRefreshPlain = generateOpaqueToken();
-        const newRefreshHash = hashToken(newRefreshPlain);
-        const refreshExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _refreshTtl));
-        await refreshTokens.issue({
-            id: newId,
-            admin_user_id: row.admin_user_id,
-            token_hash: newRefreshHash,
-            expires_at: refreshExpiresAt,
-            user_agent: args.userAgent ?? null,
-            ip: args.ip ?? null
-        });
-        await refreshTokens.markRotated(row.id, newId, now);
-        const accessToken = await _class_private_method_get(this, _signAccessToken, signAccessToken).call(this, row.admin_user_id, now);
-        const accessExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _accessTtl));
-        return {
-            accessToken,
-            refreshToken: newRefreshPlain,
-            accessTokenExpiresAt: accessExpiresAt,
-            refreshTokenExpiresAt: refreshExpiresAt
-        };
+        _class_private_method_get(this, _emit, emit).call(this, 'refresh_completed');
+        return outcome.tokens;
     }
-    async revokeSession(refreshToken) {
-        const refreshTokens = _class_private_field_get(this, _store).refreshTokens;
-        const row = await refreshTokens.findByHash(hashToken(refreshToken));
-        if (!row) return;
-        await refreshTokens.revoke(row.id, _class_private_field_get(this, _now).call(this));
+    async revokeSession(args) {
+        const logins = await _class_private_method_get(this, _observedLogins, observedLogins).call(this, {
+            previousAccessToken: args.accessToken,
+            previousRefreshToken: args.refreshToken
+        });
+        if (args.expectedSessionId && logins.some((login)=>login.id !== args.expectedSessionId)) throw ERR_SESSION_CHANGED({
+            message: 'session changed before logout'
+        });
+        for (const login of logins)await _class_private_field_get(this, _store).withSessionLock(login.admin_user_id, async (store)=>{
+            await store.loginSessions.revoke(login.id, _class_private_field_get(this, _now).call(this));
+        });
+        if (args.refreshToken) {
+            const row = await _class_private_field_get(this, _store).refreshTokens.findByHash(hashToken(args.refreshToken));
+            if (row) await _class_private_field_get(this, _store).withSessionLock(row.admin_user_id, async (store)=>{
+                await store.refreshTokens.revokeChain(row.id, _class_private_field_get(this, _now).call(this));
+            });
+        }
     }
     async resolveActor(adminUserId) {
         return resolveActor(_class_private_field_get(this, _store), adminUserId);
     }
     constructor(config){
+        _class_private_method_init(this, _emit);
+        _class_private_method_init(this, _observedLogins);
         _class_private_method_init(this, _issueTokens);
         _class_private_method_init(this, _signAccessToken);
+        _class_private_field_init(this, _onEvent, {
+            writable: true,
+            value: void 0
+        });
         _class_private_field_init(this, _store, {
             writable: true,
             value: void 0
@@ -192,6 +289,7 @@ class JwtSessionProvider {
             value: void 0
         });
         this.capabilities = CAPABILITIES;
+        _class_private_field_set(this, _onEvent, config.onEvent);
         _class_private_field_set(this, _store, config.store);
         _class_private_field_set(this, _signingKey, 'string' == typeof config.signingSecret ? new TextEncoder().encode(config.signingSecret) : config.signingSecret);
         if (_class_private_field_get(this, _signingKey).byteLength < 32) throw new Error('JwtSessionProvider: signingSecret must carry at least 32 bytes of entropy (256 bits)');
@@ -201,34 +299,85 @@ class JwtSessionProvider {
         _class_private_field_set(this, _now, config.now ?? (()=>new Date()));
     }
 }
-async function issueTokens(input) {
+function emit(type) {
+    var _this, _this1;
+    try {
+        null == (_this = _class_private_field_get(_this1 = this, _onEvent)) || _this.call(_this1, {
+            type
+        });
+    } catch  {}
+}
+async function observedLogins(args) {
+    const ids = new Set();
+    if (args.previousAccessToken) {
+        let claims;
+        try {
+            const verified = await compactVerify(args.previousAccessToken, _class_private_field_get(this, _signingKey), {
+                algorithms: [
+                    'HS256'
+                ]
+            });
+            claims = JSON.parse(new TextDecoder().decode(verified.payload));
+        } catch  {}
+        if (claims?.iss === _class_private_field_get(this, _issuer) && 'access' === claims.typ && validSid(claims.sid) && 'string' == typeof claims.sub) {
+            const login = await _class_private_field_get(this, _store).loginSessions.findById(claims.sid);
+            if (login?.admin_user_id === claims.sub) ids.add(login.id);
+        }
+    }
+    if (args.previousRefreshToken) {
+        const token = await _class_private_field_get(this, _store).refreshTokens.findByHash(hashToken(args.previousRefreshToken));
+        if (token?.sid) {
+            const login = await _class_private_field_get(this, _store).loginSessions.findById(token.sid);
+            if (login?.admin_user_id === token.admin_user_id) ids.add(login.id);
+        }
+    }
+    const result = [];
+    for (const id of ids){
+        const login = await _class_private_field_get(this, _store).loginSessions.findById(id);
+        if (login) result.push(login);
+    }
+    return result;
+}
+async function issueTokens(store, input) {
     const now = _class_private_field_get(this, _now).call(this);
-    const refreshTokens = _class_private_field_get(this, _store).refreshTokens;
-    const accessToken = await _class_private_method_get(this, _signAccessToken, signAccessToken).call(this, input.adminUserId, now);
+    const refreshTokens = store.refreshTokens;
+    const sessionId = randomUUID();
+    const accessToken = await _class_private_method_get(this, _signAccessToken, signAccessToken).call(this, input.adminUserId, input.sessionVersion, sessionId, now);
     const accessExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _accessTtl));
     const refreshPlain = generateOpaqueToken();
     const refreshHash = hashToken(refreshPlain);
     const refreshExpiresAt = new Date(now.getTime() + 1000 * _class_private_field_get(this, _refreshTtl));
+    await store.loginSessions.create({
+        id: sessionId,
+        admin_user_id: input.adminUserId,
+        session_version: input.sessionVersion,
+        expires_at: refreshExpiresAt
+    });
     await refreshTokens.issue({
         id: v7(),
         admin_user_id: input.adminUserId,
         token_hash: refreshHash,
+        session_version: input.sessionVersion,
+        sid: sessionId,
         expires_at: refreshExpiresAt,
         user_agent: input.userAgent,
         ip: input.ip
     });
     return {
+        sessionId,
         accessToken,
         refreshToken: refreshPlain,
         accessTokenExpiresAt: accessExpiresAt,
         refreshTokenExpiresAt: refreshExpiresAt
     };
 }
-async function signAccessToken(adminUserId, now) {
+async function signAccessToken(adminUserId, sessionVersion, sessionId, now) {
     const iat = Math.floor(now.getTime() / 1000);
     const exp = iat + _class_private_field_get(this, _accessTtl);
     return new SignJWT({
-        typ: 'access'
+        typ: 'access',
+        sv: sessionVersion,
+        sid: sessionId
     }).setProtectedHeader({
         alg: 'HS256',
         typ: 'JWT'
@@ -241,4 +390,7 @@ function hashToken(token) {
     return createHash('sha256').update(token).digest('hex');
 }
 const DUMMY_HASH_FOR_TIMING = '$argon2id$v=19$m=19456,t=2,p=1$c2lkZS1jaGFubmVsLW1pdGlnYXRpb24$0Hqf2vQKZqSfZZ4nJRr7K5IOjn9ngjzaQjV+yTG6iNY';
+function validSid(value) {
+    return 'string' == typeof value && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
 export { JwtSessionProvider };

package/dist/modules/auth/login-sessions-repository.d.ts

@@ -0,0 +1,23 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Native JWT login membership. This is not a browser binding or a bearer credential store. */
+export interface LoginSessionRow {
+    id: string;
+    admin_user_id: string;
+    session_version: number;
+    expires_at: Date;
+    revoked_at: Date | null;
+}
+export interface LoginSessionsRepository {
+    /** All writes run under the owning account lock, through its scoped store. */
+    create(input: Omit<LoginSessionRow, 'revoked_at'>): Promise<void>;
+    findById(id: string): Promise<LoginSessionRow | null>;
+    extend(id: string, expiresAt: Date): Promise<void>;
+    revoke(id: string, at?: Date): Promise<void>;
+    revokeAllForUser(adminUserId: string, at?: Date): Promise<void>;
+}

package/dist/modules/auth/login-sessions-repository.js

@@ -0,0 +1 @@
+export { };

package/dist/modules/auth/refresh-tokens-repository.d.ts

@@ -19,6 +19,9 @@ export interface RefreshTokenRow {
     id: string;
     admin_user_id: string;
     token_hash: string;
+    /** Null only for legacy rows, which cannot authorize native sessions. */
+    sid: string | null;
+    session_version: number;
     issued_at: Date;
     expires_at: Date;
     revoked_at: Date | null;
@@ -28,9 +31,13 @@ export interface RefreshTokenRow {
     ip: string | null;
 }
 export interface IssueRefreshTokenInput {
+    /** Omitted only by legacy fixtures/imports; never accepted for native renewal. */
+    sid?: string | null;
     id: string;
     admin_user_id: string;
     token_hash: string;
+    /** Account generation observed under the native issuance lock. */
+    session_version: number;
     expires_at: Date;
     user_agent?: string | null;
     ip?: string | null;
@@ -43,19 +50,15 @@ export interface RefreshTokensRepository {
     /** Stamp `last_used_at` for observability. */
     touch(id: string, at?: Date): Promise<void>;
     /**
-     * Atomically revoke `oldId` and set its `rotated_to_id` to `newId`.
-     * Caller is responsible for inserting the new row (via `issue`) before
-     * calling this — ordering is a contract.
+     * Revoke `oldId` and set its `rotated_to_id` to `newId`. This is not
+     * independently a compare-and-swap. Native callers must hold the account
+     * lock, reread the predecessor, and insert the successor before this write,
+     * all through the same `withSessionLock` transaction.
      */
     markRotated(oldId: string, newId: string, at?: Date): Promise<void>;
     /** Revoke a single token. Idempotent. */
     revoke(id: string, at?: Date): Promise<void>;
-    /**
-     * Walk the rotation chain starting at `startId` and revoke every token
-     * in it. Called when a rotated token is replayed — indicates the chain
-     * has been compromised and every descendant is suspect. Returns the
-     * number of rows touched.
-     */
+    /** Revoke all refresh rows sharing the start member's sid, without traversal. */
     revokeChain(startId: string, at?: Date): Promise<number>;
     /** Revoke every non-revoked token for a user. Used on password change / sign-out everywhere. */
     revokeAllForUser(adminUserId: string, at?: Date): Promise<number>;

package/dist/modules/auth/resolve-actor.d.ts

@@ -7,6 +7,7 @@
  */
 import { AdminAuth } from '@byline/auth';
 import type { AdminStore } from '../../store.js';
+import type { AdminUserRow } from '../admin-users/repository.js';
 /**
  * Build an `AdminAuth` from a user id by reading the admin-users row and
  * collecting the distinct abilities granted through every role the user
@@ -22,3 +23,5 @@ import type { AdminStore } from '../../store.js';
  * `AdminStore` bundle; adapter-agnostic.
  */
 export declare function resolveActor(store: AdminStore, adminUserId: string): Promise<AdminAuth | null>;
+/** Internal helper: reuse the account snapshot already checked by native authentication. */
+export declare function resolveActorFromUser(store: AdminStore, user: AdminUserRow | null): Promise<AdminAuth | null>;

package/dist/modules/auth/resolve-actor.js

@@ -1,13 +1,16 @@
 import { AdminAuth } from "@byline/auth";
 async function resolveActor(store, adminUserId) {
     const user = await store.adminUsers.getById(adminUserId);
+    return resolveActorFromUser(store, user);
+}
+async function resolveActorFromUser(store, user) {
     if (!user) return null;
     if (!user.is_enabled) return null;
-    const abilities = await store.adminPermissions.listAbilitiesForUser(adminUserId);
+    const abilities = await store.adminPermissions.listAbilitiesForUser(user.id);
     return new AdminAuth({
         id: user.id,
         abilities,
         isSuperAdmin: user.is_super_admin
     });
 }
-export { resolveActor };
+export { resolveActor, resolveActorFromUser };

package/dist/modules/auth/sign-in-rate-limiter.d.ts

@@ -0,0 +1,48 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { PasswordSignInLimiter } from '@byline/auth';
+import type { RecurringTaskDefinition } from '@byline/core';
+export interface SignInRateLimitStore {
+    /** Atomically increment, saturating at limit + 1; true only for the first limit calls. */
+    consume(key: string, limit: number, expiresAt: Date): Promise<boolean>;
+    /** Remove at most 100 expired counters and return the number removed. */
+    purgeExpired(before: Date): Promise<number>;
+}
+export interface SignInRateLimitPolicy {
+    account: {
+        limit: number;
+        windowSeconds: number;
+    };
+    ip: {
+        limit: number;
+        windowSeconds: number;
+    };
+}
+export interface SignInSecurityEvent {
+    type: 'admitted' | 'denied' | 'capacity' | 'store-error' | 'cleanup-error' | 'success' | 'failure';
+    scope?: 'account' | 'ip';
+    /** Stable, pseudonymous digests for cross-network correlation. Never passwords or raw IPs. */
+    account?: string;
+    network?: string;
+}
+export interface SignInLimiterOptions {
+    onEvent?: (event: SignInSecurityEvent) => void;
+    slots?: number;
+    maxQueue?: number;
+    queueTimeoutMs?: number;
+    /** Also bounds counter creation when the provider or a denial completes very quickly. */
+    minimumSlotMs?: number;
+}
+/**
+ * Instantiate once per process. Acquire before consume and release in finally after verification.
+ * Network admission precedes account-plus-network admission. There is no account-wide lockout.
+ */
+export declare function createPasswordSignInLimiter(store: SignInRateLimitStore, secret: string | Uint8Array, policy?: SignInRateLimitPolicy, now?: () => number, options?: SignInLimiterOptions): PasswordSignInLimiter & {
+    cleanupTask: RecurringTaskDefinition;
+    dispose(): void;
+};