@byline/db-postgres 0.9.3

package/dist/modules/admin/admin-users-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-users-repository.js","sourceRoot":"","sources":["../../../src/modules/admin/admin-users-repository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGL,+BAA+B,GAChC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEhE,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAG1D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,cAAc,GAAG;IACrB,EAAE,EAAE,UAAU,CAAC,EAAE;IACjB,GAAG,EAAE,UAAU,CAAC,GAAG;IACnB,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,WAAW,EAAE,UAAU,CAAC,WAAW;IACnC,QAAQ,EAAE,UAAU,CAAC,QAAQ;IAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,WAAW,EAAE,UAAU,CAAC,WAAW;IACnC,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,aAAa,EAAE,UAAU,CAAC,aAAa;IACvC,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;IACvD,cAAc,EAAE,UAAU,CAAC,cAAc;IACzC,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;IAC/C,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,UAAU,EAAE,UAAU,CAAC,UAAU;CACzB,CAAA;AAEV,MAAM,YAAY,GAAG;IACnB,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,WAAW,EAAE,UAAU,CAAC,WAAW;IACnC,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;IAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,UAAU,EAAE,UAAU,CAAC,UAAU;CACzB,CAAA;AAEV,MAAM,UAAU,0BAA0B,CACxC,EAAiC;IAEjC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,UAAU,CAAC;iBAClB,MAAM,CAAC;gBACN,EAAE,EAAE,MAAM,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;gBAChC,QAAQ,EAAE,KAAK,CAAC,aAAa;gBAC7B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;gBACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK;gBAC7C,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK;gBACrC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK;aACpD,CAAC;iBACD,SAAS,CAAC,cAAc,CAAC,CAAA;YAC5B,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;YACpE,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YAC3F,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,cAAc,CAAC;iBACtB,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;YACnD,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,QAAQ;YAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,cAAc,CAAC;iBACtB,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC3C,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,GAAG,cAAc,EAAE,aAAa,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;iBACjE,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;YACnD,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,GAAG,cAAc,EAAE,aAAa,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;iBACjE,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YAC/B,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAA;YACpC,MAAM,MAAM,GACV,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,EAAE,CACA,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,MAAM,GAAG,CAAC,EACtC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,MAAM,GAAG,CAAC,EAC3C,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,MAAM,GAAG,CAAC,EAC5C,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,CAAC,CAC1C;gBACH,CAAC,CAAC,SAAS,CAAA;YAEf,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;YAEjE,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YACrD,OAAO,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3E,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,OAAO;YACjB,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACrC,MAAM,MAAM,GACV,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,EAAE,CACA,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,MAAM,GAAG,CAAC,EACtC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,MAAM,GAAG,CAAC,EAC3C,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,MAAM,GAAG,CAAC,EAC5C,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,CAAC,CAC1C;gBACH,CAAC,CAAC,SAAS,CAAA;YAEf,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACxD,OAAO,GAAG,EAAE,KAAK,IAAI,CAAC,CAAA;QACxB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK;YACjC,MAAM,SAAS,GAA4B;gBACzC,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,GAAG,EAAE,GAAG,CAAA,GAAG,UAAU,CAAC,GAAG,MAAM;aAChC,CAAA;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,SAAS,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;YAC3E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;gBAAE,SAAS,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;YAC9E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YACrE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;YAC1E,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;gBAAE,SAAS,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;YACvF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,SAAS,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;YAC3E,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;gBACvC,SAAS,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAA;YACvD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;gBAAE,SAAS,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;YAE9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,SAAS,CAAC;iBACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;iBAClE,SAAS,CAAC,cAAc,CAAC,CAAA;YAC5B,IAAI,CAAC,GAAG;gBAAE,MAAM,+BAA+B,EAAE,CAAA;YACjD,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY;YACjD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC;gBACH,QAAQ,EAAE,YAAY;gBACtB,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,GAAG,EAAE,GAAG,CAAA,GAAG,UAAU,CAAC,GAAG,MAAM;aAChC,CAAC;iBACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;iBAClE,SAAS,CAAC,cAAc,CAAC,CAAA;YAC5B,IAAI,CAAC,GAAG;gBAAE,MAAM,+BAA+B,EAAE,CAAA;YACjD,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO;YAC1B,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAA,GAAG,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC;iBACrF,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QACjC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE;YAC7B,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC;gBACH,UAAU,EAAE,IAAI,IAAI,EAAE;gBACtB,aAAa,EAAE,EAAE;gBACjB,qBAAqB,EAAE,CAAC;gBACxB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QACjC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE;YACzB,MAAM,EAAE;iBACL,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC;gBACH,qBAAqB,EAAE,GAAG,CAAA,GAAG,UAAU,CAAC,qBAAqB,MAAM;gBACnE,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QACjC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW;YAC1B,MAAM,MAAM,GAAG,MAAM,EAAE;iBACpB,MAAM,CAAC,UAAU,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;iBAClE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,+BAA+B,EAAE,CAAA;QAClE,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/admin/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * `@byline/db-postgres/admin` — Postgres implementations of the admin
+ * repository contracts declared in `@byline/admin`.
+ *
+ * Most callers want `createAdminStore(db)` — it bundles all four
+ * repositories into the `AdminStore` shape that `@byline/admin` consumers
+ * (the built-in `JwtSessionProvider`, `seedSuperAdmin`, admin-user and
+ * admin-role commands) expect. Individual factories remain exported for
+ * unusual cases (custom wiring, partial testing).
+ *
+ * No session-provider code lives here — `JwtSessionProvider` moved to
+ * `@byline/admin/auth`. This package only supplies the adapter-shaped
+ * pieces it implements.
+ */
+export { createAdminPermissionsRepository } from './admin-permissions-repository.js';
+export { createAdminRolesRepository } from './admin-roles-repository.js';
+export { createAdminStore } from './admin-store.js';
+export { createAdminUsersRepository } from './admin-users-repository.js';
+export { createRefreshTokensRepository } from './refresh-tokens-repository.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/admin/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAA;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAA"}

package/dist/modules/admin/index.js

@@ -0,0 +1,27 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * `@byline/db-postgres/admin` — Postgres implementations of the admin
+ * repository contracts declared in `@byline/admin`.
+ *
+ * Most callers want `createAdminStore(db)` — it bundles all four
+ * repositories into the `AdminStore` shape that `@byline/admin` consumers
+ * (the built-in `JwtSessionProvider`, `seedSuperAdmin`, admin-user and
+ * admin-role commands) expect. Individual factories remain exported for
+ * unusual cases (custom wiring, partial testing).
+ *
+ * No session-provider code lives here — `JwtSessionProvider` moved to
+ * `@byline/admin/auth`. This package only supplies the adapter-shaped
+ * pieces it implements.
+ */
+export { createAdminPermissionsRepository } from './admin-permissions-repository.js';
+export { createAdminRolesRepository } from './admin-roles-repository.js';
+export { createAdminStore } from './admin-store.js';
+export { createAdminUsersRepository } from './admin-users-repository.js';
+export { createRefreshTokensRepository } from './refresh-tokens-repository.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/admin/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAA;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAA"}

package/dist/modules/admin/refresh-tokens-repository.d.ts

@@ -0,0 +1,16 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { RefreshTokensRepository } from '@byline/admin/auth';
+import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import type * as schema from '../../database/schema/index.js';
+/**
+ * Postgres implementation of `RefreshTokensRepository`, backing the
+ * built-in `JwtSessionProvider`.
+ */
+export declare function createRefreshTokensRepository(db: NodePgDatabase<typeof schema>): RefreshTokensRepository;
+//# sourceMappingURL=refresh-tokens-repository.d.ts.map

package/dist/modules/admin/refresh-tokens-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-tokens-repository.d.ts","sourceRoot":"","sources":["../../../src/modules/admin/refresh-tokens-repository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAmB,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAElF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAG/D,OAAO,KAAK,KAAK,MAAM,MAAM,gCAAgC,CAAA;AAE7D;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,EAAE,EAAE,cAAc,CAAC,OAAO,MAAM,CAAC,GAChC,uBAAuB,CAyIzB"}

package/dist/modules/admin/refresh-tokens-repository.js

@@ -0,0 +1,132 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { and, eq, isNull, lt } from 'drizzle-orm';
+import { adminRefreshTokens } from '../../database/schema/auth.js';
+/**
+ * Postgres implementation of `RefreshTokensRepository`, backing the
+ * built-in `JwtSessionProvider`.
+ */
+export function createRefreshTokensRepository(db) {
+    return {
+        async issue(input) {
+            const [row] = await db
+                .insert(adminRefreshTokens)
+                .values({
+                id: input.id,
+                admin_user_id: input.admin_user_id,
+                token_hash: input.token_hash,
+                expires_at: input.expires_at,
+                user_agent: input.user_agent ?? null,
+                ip: input.ip ?? null,
+            })
+                .returning();
+            if (!row)
+                throw new Error('issueRefreshToken: insert returned no row');
+            return row;
+        },
+        async findByHash(tokenHash) {
+            const [row] = await db
+                .select()
+                .from(adminRefreshTokens)
+                .where(eq(adminRefreshTokens.token_hash, tokenHash));
+            return row ?? null;
+        },
+        async findById(id) {
+            const [row] = await db.select().from(adminRefreshTokens).where(eq(adminRefreshTokens.id, id));
+            return row ?? null;
+        },
+        async touch(id, at = new Date()) {
+            await db
+                .update(adminRefreshTokens)
+                .set({ last_used_at: at, updated_at: new Date() })
+                .where(eq(adminRefreshTokens.id, id));
+        },
+        async markRotated(oldId, newId, at = new Date()) {
+            await db
+                .update(adminRefreshTokens)
+                .set({ revoked_at: at, rotated_to_id: newId, updated_at: new Date() })
+                .where(eq(adminRefreshTokens.id, oldId));
+        },
+        async revoke(id, at = new Date()) {
+            await db
+                .update(adminRefreshTokens)
+                .set({ revoked_at: at, updated_at: new Date() })
+                .where(and(eq(adminRefreshTokens.id, id), isNull(adminRefreshTokens.revoked_at)));
+        },
+        async revokeChain(startId, at = new Date()) {
+            let cursor = startId;
+            let touched = 0;
+            // Bounded walk — chains in practice are short; 1000 is a safety ceiling.
+            for (let step = 0; cursor != null && step < 1000; step++) {
+                const [row] = await db
+                    .select({
+                    id: adminRefreshTokens.id,
+                    rotated_to_id: adminRefreshTokens.rotated_to_id,
+                    revoked_at: adminRefreshTokens.revoked_at,
+                })
+                    .from(adminRefreshTokens)
+                    .where(eq(adminRefreshTokens.id, cursor));
+                if (!row)
+                    break;
+                if (row.revoked_at == null) {
+                    await db
+                        .update(adminRefreshTokens)
+                        .set({ revoked_at: at, updated_at: new Date() })
+                        .where(eq(adminRefreshTokens.id, row.id));
+                    touched++;
+                }
+                cursor = row.rotated_to_id;
+            }
+            return touched;
+        },
+        async revokeAllForUser(adminUserId, at = new Date()) {
+            const result = await db
+                .update(adminRefreshTokens)
+                .set({ revoked_at: at, updated_at: new Date() })
+                .where(and(eq(adminRefreshTokens.admin_user_id, adminUserId), isNull(adminRefreshTokens.revoked_at)))
+                .returning({ id: adminRefreshTokens.id });
+            return result.length;
+        },
+        async purgeExpired(now = new Date()) {
+            const result = await db
+                .delete(adminRefreshTokens)
+                .where(lt(adminRefreshTokens.expires_at, now))
+                .returning({ id: adminRefreshTokens.id });
+            return result.length;
+        },
+        async listActiveForUser(adminUserId) {
+            return db
+                .select()
+                .from(adminRefreshTokens)
+                .where(and(eq(adminRefreshTokens.admin_user_id, adminUserId), isNull(adminRefreshTokens.revoked_at)));
+        },
+        async listAllForUser(adminUserId) {
+            return db
+                .select()
+                .from(adminRefreshTokens)
+                .where(eq(adminRefreshTokens.admin_user_id, adminUserId))
+                .orderBy(adminRefreshTokens.issued_at);
+        },
+        async listRotationChain(startId) {
+            const chain = [];
+            let cursor = startId;
+            for (let step = 0; cursor != null && step < 1000; step++) {
+                const [row] = await db
+                    .select()
+                    .from(adminRefreshTokens)
+                    .where(eq(adminRefreshTokens.id, cursor));
+                if (!row)
+                    break;
+                chain.push(row);
+                cursor = row.rotated_to_id;
+            }
+            return chain;
+        },
+    };
+}
+//# sourceMappingURL=refresh-tokens-repository.js.map

package/dist/modules/admin/refresh-tokens-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-tokens-repository.js","sourceRoot":"","sources":["../../../src/modules/admin/refresh-tokens-repository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAGlE;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,EAAiC;IAEjC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,kBAAkB,CAAC;iBAC1B,MAAM,CAAC;gBACN,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;aACrB,CAAC;iBACD,SAAS,EAAE,CAAA;YACd,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YACtE,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,SAAS;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,EAAE;iBACR,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;YACtD,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE;YACf,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YAC7F,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE;YAC7B,MAAM,EAAE;iBACL,MAAM,CAAC,kBAAkB,CAAC;iBAC1B,GAAG,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACjD,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QACzC,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE;YAC7C,MAAM,EAAE;iBACL,MAAM,CAAC,kBAAkB,CAAC;iBAC1B,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACrE,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;QAC5C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE;YAC9B,MAAM,EAAE;iBACL,MAAM,CAAC,kBAAkB,CAAC;iBAC1B,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC/C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACrF,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE;YACxC,IAAI,MAAM,GAAkB,OAAO,CAAA;YACnC,IAAI,OAAO,GAAG,CAAC,CAAA;YACf,yEAAyE;YACzE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,MAAM,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;gBACzD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;qBACnB,MAAM,CAAC;oBACN,EAAE,EAAE,kBAAkB,CAAC,EAAE;oBACzB,aAAa,EAAE,kBAAkB,CAAC,aAAa;oBAC/C,UAAU,EAAE,kBAAkB,CAAC,UAAU;iBAC1C,CAAC;qBACD,IAAI,CAAC,kBAAkB,CAAC;qBACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;gBAC3C,IAAI,CAAC,GAAG;oBAAE,MAAK;gBAEf,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;oBAC3B,MAAM,EAAE;yBACL,MAAM,CAAC,kBAAkB,CAAC;yBAC1B,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;yBAC/C,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;oBAC3C,OAAO,EAAE,CAAA;gBACX,CAAC;gBAED,MAAM,GAAG,GAAG,CAAC,aAAa,CAAA;YAC5B,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE;iBACpB,MAAM,CAAC,kBAAkB,CAAC;iBAC1B,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC/C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,aAAa,EAAE,WAAW,CAAC,EACjD,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CACtC,CACF;iBACA,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAA;YAC3C,OAAO,MAAM,CAAC,MAAM,CAAA;QACtB,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;YACjC,MAAM,MAAM,GAAG,MAAM,EAAE;iBACpB,MAAM,CAAC,kBAAkB,CAAC;iBAC1B,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;iBAC7C,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAA;YAC3C,OAAO,MAAM,CAAC,MAAM,CAAA;QACtB,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,WAAW;YACjC,OAAO,EAAE;iBACN,MAAM,EAAE;iBACR,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,aAAa,EAAE,WAAW,CAAC,EACjD,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CACtC,CACF,CAAA;QACL,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,WAAW;YAC9B,OAAO,EAAE;iBACN,MAAM,EAAE;iBACR,IAAI,CAAC,kBAAkB,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;iBACxD,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;QAC1C,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,OAAO;YAC7B,MAAM,KAAK,GAAsB,EAAE,CAAA;YACnC,IAAI,MAAM,GAAkB,OAAO,CAAA;YACnC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,MAAM,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;gBACzD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;qBACnB,MAAM,EAAE;qBACR,IAAI,CAAC,kBAAkB,CAAC;qBACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;gBAC3C,IAAI,CAAC,GAAG;oBAAE,MAAK;gBACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACf,MAAM,GAAG,GAAG,CAAC,aAAa,CAAA;YAC5B,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/admin/tests/auth-integration.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};
+//# sourceMappingURL=auth-integration.test.d.ts.map

package/dist/modules/admin/tests/auth-integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-integration.test.d.ts","sourceRoot":"","sources":["../../../../src/modules/admin/tests/auth-integration.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/modules/admin/tests/auth-integration.test.js

@@ -0,0 +1,392 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import assert from 'node:assert';
+import { after, afterEach, before, describe, it } from 'node:test';
+import { seedSuperAdmin } from '@byline/admin/admin-users';
+import { hashPassword, resolveActor, verifyPassword } from '@byline/admin/auth';
+import { AdminAuth } from '@byline/auth';
+import { eq, inArray } from 'drizzle-orm';
+import { adminPermissions, adminRoleAdminUser, adminRoles, adminUsers, } from '../../../database/schema/auth.js';
+import { setupTestDB, teardownTestDB } from '../../../lib/test-helper.js';
+import { createAdminStore } from '../admin-store.js';
+// ---------------------------------------------------------------------------
+// Track-and-clean fixtures
+// ---------------------------------------------------------------------------
+//
+// Integration tests share the dev database with the running webapp, so
+// blanket `DELETE FROM admin_users` wipes would take out whichever
+// super-admin the developer signed in with. Instead, every admin-user
+// and admin-role row a test creates flows through `createUser` or
+// `createRole` helpers that push the new id into a per-suite tracking
+// set. `afterEach` deletes only those ids; `ON DELETE CASCADE` on
+// `adminPermissions`, `adminRoleAdminUser`, and `adminRefreshTokens`
+// handles the dependent rows automatically.
+//
+// To guard against a crashed prior run leaving a stale row with a test
+// email, the helpers pre-delete any existing row with the same email or
+// machine_name before inserting. Keeps the suite re-runnable without
+// manual cleanup.
+let db;
+let store;
+const trackedUserIds = new Set();
+const trackedRoleIds = new Set();
+function trackUser(id) {
+    trackedUserIds.add(id);
+}
+function trackRole(id) {
+    trackedRoleIds.add(id);
+}
+async function createUser(input) {
+    const email = input.email.toLowerCase();
+    // Clear any stale row left by a crashed prior run.
+    await db.delete(adminUsers).where(eq(adminUsers.email, email));
+    const password_hash = await hashPassword(input.password);
+    const row = await store.adminUsers.create({
+        email: input.email,
+        password_hash,
+        given_name: input.given_name,
+        is_enabled: input.is_enabled,
+        is_super_admin: input.is_super_admin,
+    });
+    trackUser(row.id);
+    return row;
+}
+async function createRole(input) {
+    await db.delete(adminRoles).where(eq(adminRoles.machine_name, input.machine_name));
+    const row = await store.adminRoles.create(input);
+    trackRole(row.id);
+    return row;
+}
+async function cleanupTrackedRows() {
+    if (trackedUserIds.size > 0) {
+        await db.delete(adminUsers).where(inArray(adminUsers.id, [...trackedUserIds]));
+    }
+    if (trackedRoleIds.size > 0) {
+        await db.delete(adminRoles).where(inArray(adminRoles.id, [...trackedRoleIds]));
+    }
+    trackedUserIds.clear();
+    trackedRoleIds.clear();
+}
+// ---------------------------------------------------------------------------
+describe('auth integration', () => {
+    before(() => {
+        const testDB = setupTestDB([]);
+        db = testDB.db;
+        store = createAdminStore(db);
+    });
+    afterEach(async () => {
+        await cleanupTrackedRows();
+    });
+    after(async () => {
+        await cleanupTrackedRows();
+        await teardownTestDB();
+    });
+    // -------------------------------------------------------------------------
+    // Admin users
+    // -------------------------------------------------------------------------
+    describe('admin users repository', () => {
+        it('creates, reads, and hides the password hash from public rows', async () => {
+            const created = await createUser({
+                email: 'alice@example.com',
+                password: 'alice-password',
+                given_name: 'Alice',
+            });
+            assert.ok(created.id);
+            assert.strictEqual(created.email, 'alice@example.com');
+            assert.strictEqual(created.given_name, 'Alice');
+            assert.strictEqual(created.is_enabled, false); // default false
+            assert.strictEqual(created.is_super_admin, false);
+            // Public columns: password_hash is never returned
+            assert.strictEqual(created.password_hash, undefined);
+            const fetched = await store.adminUsers.getById(created.id);
+            assert.strictEqual(fetched?.email, 'alice@example.com');
+        });
+        it('lowercases the email on insert and on lookup', async () => {
+            await createUser({ email: 'Alice@Example.COM', password: 'pw' });
+            const byMixed = await store.adminUsers.getByEmail('ALICE@example.com');
+            assert.ok(byMixed);
+            assert.strictEqual(byMixed.email, 'alice@example.com');
+        });
+        it('returns the password hash only via getByEmailForSignIn', async () => {
+            await createUser({ email: 'b@example.com', password: 'pw-value' });
+            const plain = await store.adminUsers.getByEmail('b@example.com');
+            assert.strictEqual(plain?.password_hash, undefined);
+            const withPw = await store.adminUsers.getByEmailForSignIn('b@example.com');
+            assert.ok(withPw);
+            assert.ok(await verifyPassword('pw-value', withPw.password_hash));
+        });
+        it('update applies partial patches and bumps vid', async () => {
+            const created = await createUser({ email: 'c@example.com', password: 'pw' });
+            assert.strictEqual(created.vid, 1);
+            const updated = await store.adminUsers.update(created.id, created.vid, {
+                given_name: 'Charlie',
+                is_enabled: true,
+            });
+            assert.strictEqual(updated.given_name, 'Charlie');
+            assert.strictEqual(updated.is_enabled, true);
+            // Unchanged fields remain
+            assert.strictEqual(updated.email, 'c@example.com');
+            assert.strictEqual(updated.vid, created.vid + 1);
+        });
+        it('update throws VERSION_CONFLICT on a stale vid', async () => {
+            const created = await createUser({ email: 'c2@example.com', password: 'pw' });
+            // First update succeeds and bumps vid.
+            await store.adminUsers.update(created.id, created.vid, { given_name: 'First' });
+            // Replaying the same vid must conflict.
+            await assert.rejects(() => store.adminUsers.update(created.id, created.vid, { given_name: 'Second' }), (err) => err.code === 'admin.users.versionConflict');
+        });
+        it('setPasswordHash rehashes, bumps vid, and returns the fresh row', async () => {
+            const created = await createUser({ email: 'd@example.com', password: 'old' });
+            const updated = await store.adminUsers.setPasswordHash(created.id, created.vid, await hashPassword('new-password'));
+            assert.strictEqual(updated.id, created.id);
+            assert.strictEqual(updated.vid, created.vid + 1);
+            const signIn = await store.adminUsers.getByEmailForSignIn('d@example.com');
+            assert.ok(signIn);
+            assert.ok(await verifyPassword('new-password', signIn.password_hash));
+            assert.strictEqual(await verifyPassword('old', signIn.password_hash), false);
+            assert.strictEqual(signIn.vid, created.vid + 1);
+        });
+        it('setPasswordHash throws VERSION_CONFLICT on a stale vid', async () => {
+            const created = await createUser({ email: 'd2@example.com', password: 'pw' });
+            await store.adminUsers.update(created.id, created.vid, { given_name: 'D' });
+            await assert.rejects(() => store.adminUsers.setPasswordHash(created.id, created.vid, '$argon2id$stale-hash'), (err) => err.code === 'admin.users.versionConflict');
+        });
+        it('recordLoginSuccess resets failed_login_attempts and stamps last_login', async () => {
+            const created = await createUser({ email: 'e@example.com', password: 'pw' });
+            await store.adminUsers.recordLoginFailure(created.id);
+            await store.adminUsers.recordLoginFailure(created.id);
+            let row = await store.adminUsers.getById(created.id);
+            assert.strictEqual(row?.failed_login_attempts, 2);
+            await store.adminUsers.recordLoginSuccess(created.id, '10.0.0.1');
+            row = await store.adminUsers.getById(created.id);
+            assert.strictEqual(row?.failed_login_attempts, 0);
+            assert.strictEqual(row?.last_login_ip, '10.0.0.1');
+            assert.ok(row?.last_login);
+        });
+        it('delete removes the row when vid matches', async () => {
+            const created = await createUser({ email: 'f@example.com', password: 'pw' });
+            await store.adminUsers.delete(created.id, created.vid);
+            const fetched = await store.adminUsers.getById(created.id);
+            assert.strictEqual(fetched, null);
+        });
+        it('delete throws VERSION_CONFLICT on a stale vid', async () => {
+            const created = await createUser({ email: 'f2@example.com', password: 'pw' });
+            await store.adminUsers.update(created.id, created.vid, { given_name: 'F' });
+            await assert.rejects(() => store.adminUsers.delete(created.id, created.vid), (err) => err.code === 'admin.users.versionConflict');
+            // Row should still be present.
+            assert.ok(await store.adminUsers.getById(created.id));
+        });
+        it('list applies pagination, order, and query filter', async () => {
+            await createUser({ email: 'list1@example.com', password: 'pw', given_name: 'Aaron' });
+            await createUser({ email: 'list2@example.com', password: 'pw', given_name: 'Bea' });
+            await createUser({ email: 'list3@example.com', password: 'pw', given_name: 'Casey' });
+            // Query filters against a stable, unique-to-this-test needle so
+            // other test or dev rows don't skew the totals.
+            const filtered = await store.adminUsers.list({
+                page: 1,
+                pageSize: 10,
+                query: 'list',
+                order: 'email',
+                desc: false,
+            });
+            assert.strictEqual(filtered.length, 3);
+            const named = await store.adminUsers.list({
+                page: 1,
+                pageSize: 10,
+                query: 'Bea',
+                order: 'email',
+                desc: false,
+            });
+            assert.strictEqual(named.length, 1);
+            assert.strictEqual(named[0]?.given_name, 'Bea');
+            const total = await store.adminUsers.count({ query: 'list' });
+            assert.strictEqual(total, 3);
+        });
+    });
+    // -------------------------------------------------------------------------
+    // Admin roles + assignments
+    // -------------------------------------------------------------------------
+    describe('admin roles repository', () => {
+        it('creates and reads a role', async () => {
+            const role = await createRole({
+                name: 'Editor',
+                machine_name: 'test-editor',
+                description: 'Can edit content',
+            });
+            assert.strictEqual(role.machine_name, 'test-editor');
+            const byMachine = await store.adminRoles.getByMachineName('test-editor');
+            assert.strictEqual(byMachine?.id, role.id);
+        });
+        it('assignToUser is idempotent and listRolesForUser returns the role', async () => {
+            const user = await createUser({ email: 'g@example.com', password: 'pw' });
+            const role = await createRole({ name: 'test-r', machine_name: 'test-r' });
+            await store.adminRoles.assignToUser(role.id, user.id);
+            await store.adminRoles.assignToUser(role.id, user.id); // idempotent
+            const userRoles = await store.adminRoles.listRolesForUser(user.id);
+            assert.strictEqual(userRoles.length, 1);
+            assert.strictEqual(userRoles[0]?.machine_name, 'test-r');
+            const usersForRole = await store.adminRoles.listUsersForRole(role.id);
+            assert.deepStrictEqual(usersForRole, [user.id]);
+        });
+        it('unassignFromUser removes the assignment', async () => {
+            const user = await createUser({ email: 'h@example.com', password: 'pw' });
+            const role = await createRole({ name: 'test-r', machine_name: 'test-r' });
+            await store.adminRoles.assignToUser(role.id, user.id);
+            await store.adminRoles.unassignFromUser(role.id, user.id);
+            assert.strictEqual((await store.adminRoles.listRolesForUser(user.id)).length, 0);
+        });
+        it('delete cascades to permissions and role-user assignments', async () => {
+            const user = await createUser({ email: 'i@example.com', password: 'pw' });
+            const role = await createRole({ name: 'test-r', machine_name: 'test-r' });
+            await store.adminPermissions.grantAbility(role.id, 'a.one');
+            await store.adminRoles.assignToUser(role.id, user.id);
+            await store.adminRoles.delete(role.id, role.vid);
+            // The role is gone…
+            assert.strictEqual(await store.adminRoles.getById(role.id), null);
+            // …and its grants are gone…
+            const grantsForRole = await db
+                .select()
+                .from(adminPermissions)
+                .where(eq(adminPermissions.admin_role_id, role.id));
+            assert.strictEqual(grantsForRole.length, 0);
+            // …and no assignment for the role remains.
+            const assignsForRole = await db
+                .select()
+                .from(adminRoleAdminUser)
+                .where(eq(adminRoleAdminUser.admin_role_id, role.id));
+            assert.strictEqual(assignsForRole.length, 0);
+            // The user still exists.
+            assert.ok(await store.adminUsers.getById(user.id));
+        });
+    });
+    // -------------------------------------------------------------------------
+    // Admin permissions
+    // -------------------------------------------------------------------------
+    describe('admin permissions repository', () => {
+        it('grantAbility is idempotent', async () => {
+            const role = await createRole({ name: 'test-r', machine_name: 'test-r' });
+            await store.adminPermissions.grantAbility(role.id, 'collections.pages.publish');
+            await store.adminPermissions.grantAbility(role.id, 'collections.pages.publish');
+            const abilities = await store.adminPermissions.listAbilities(role.id);
+            assert.deepStrictEqual(abilities, ['collections.pages.publish']);
+        });
+        it('revokeAbility removes the grant', async () => {
+            const role = await createRole({ name: 'test-r', machine_name: 'test-r' });
+            await store.adminPermissions.grantAbility(role.id, 'a.one');
+            await store.adminPermissions.grantAbility(role.id, 'a.two');
+            await store.adminPermissions.revokeAbility(role.id, 'a.one');
+            const abilities = await store.adminPermissions.listAbilities(role.id);
+            assert.deepStrictEqual(abilities.sort(), ['a.two']);
+        });
+        it('setAbilities replaces the ability set wholesale', async () => {
+            const role = await createRole({ name: 'test-r', machine_name: 'test-r' });
+            await store.adminPermissions.grantAbility(role.id, 'a.one');
+            await store.adminPermissions.grantAbility(role.id, 'a.two');
+            await store.adminPermissions.setAbilities(role.id, ['a.three', 'a.four']);
+            const abilities = await store.adminPermissions.listAbilities(role.id);
+            assert.deepStrictEqual(abilities.sort(), ['a.four', 'a.three']);
+        });
+    });
+    // -------------------------------------------------------------------------
+    // resolveActor
+    // -------------------------------------------------------------------------
+    describe('resolveActor', () => {
+        it('returns null for unknown user ids', async () => {
+            const actor = await resolveActor(store, '00000000-0000-7000-8000-000000000000');
+            assert.strictEqual(actor, null);
+        });
+        it('returns null for disabled users', async () => {
+            const user = await createUser({ email: 'j@example.com', password: 'pw' });
+            // Created with is_enabled: false by default
+            const actor = await resolveActor(store, user.id);
+            assert.strictEqual(actor, null);
+        });
+        it('builds an AdminAuth with the union of abilities across roles', async () => {
+            const user = await createUser({
+                email: 'k@example.com',
+                password: 'pw',
+                is_enabled: true,
+            });
+            const roleA = await createRole({ name: 'A', machine_name: 'test-a' });
+            const roleB = await createRole({ name: 'B', machine_name: 'test-b' });
+            await store.adminPermissions.grantAbility(roleA.id, 'collections.pages.read');
+            await store.adminPermissions.grantAbility(roleA.id, 'collections.pages.update');
+            // Duplicate across roles — should collapse.
+            await store.adminPermissions.grantAbility(roleB.id, 'collections.pages.update');
+            await store.adminPermissions.grantAbility(roleB.id, 'collections.pages.publish');
+            await store.adminRoles.assignToUser(roleA.id, user.id);
+            await store.adminRoles.assignToUser(roleB.id, user.id);
+            const actor = await resolveActor(store, user.id);
+            assert.ok(actor instanceof AdminAuth);
+            assert.strictEqual(actor.id, user.id);
+            assert.strictEqual(actor.isSuperAdmin, false);
+            assert.strictEqual(actor.hasAbility('collections.pages.read'), true);
+            assert.strictEqual(actor.hasAbility('collections.pages.update'), true);
+            assert.strictEqual(actor.hasAbility('collections.pages.publish'), true);
+            assert.strictEqual(actor.hasAbility('collections.pages.delete'), false);
+            // Distinct — duplicates across roles collapse
+            assert.strictEqual(actor.abilities.size, 3);
+        });
+        it('honours the is_super_admin flag', async () => {
+            const user = await createUser({
+                email: 'test-root@example.com',
+                password: 'pw',
+                is_super_admin: true,
+                is_enabled: true,
+            });
+            const actor = await resolveActor(store, user.id);
+            assert.ok(actor);
+            assert.strictEqual(actor.isSuperAdmin, true);
+            // Even without granting any abilities, super-admins pass every check
+            assert.strictEqual(actor.hasAbility('anything.at.all'), true);
+        });
+    });
+    // -------------------------------------------------------------------------
+    // seedSuperAdmin
+    //
+    // These tests use a test-specific role machine_name and email so the
+    // idempotency assertions are not affected by (and do not affect) a
+    // real dev-environment super-admin seed.
+    // -------------------------------------------------------------------------
+    describe('seedSuperAdmin', () => {
+        const seedInput = {
+            email: 'test-seed-super@example.com',
+            password: 'initial-password',
+            roleMachineName: 'test-seed-super-admin',
+            roleName: 'Test Seed Super Admin',
+        };
+        it('creates role + user + assignment on first run', async () => {
+            // Pre-clean in case a prior run left the seed in place.
+            await db.delete(adminUsers).where(eq(adminUsers.email, seedInput.email));
+            await db.delete(adminRoles).where(eq(adminRoles.machine_name, seedInput.roleMachineName));
+            const result = await seedSuperAdmin(store, seedInput);
+            trackUser(result.userId);
+            trackRole(result.roleId);
+            assert.ok(result.userId);
+            assert.ok(result.roleId);
+            assert.deepStrictEqual(result.created, { user: true, role: true, assignment: true });
+            const actor = await resolveActor(store, result.userId);
+            assert.ok(actor);
+            assert.strictEqual(actor.isSuperAdmin, true);
+        });
+        it('is idempotent — second run reports nothing newly created', async () => {
+            await db.delete(adminUsers).where(eq(adminUsers.email, seedInput.email));
+            await db.delete(adminRoles).where(eq(adminRoles.machine_name, seedInput.roleMachineName));
+            const first = await seedSuperAdmin(store, seedInput);
+            trackUser(first.userId);
+            trackRole(first.roleId);
+            const second = await seedSuperAdmin(store, seedInput);
+            assert.deepStrictEqual(second.created, {
+                user: false,
+                role: false,
+                assignment: false,
+            });
+        });
+    });
+});
+//# sourceMappingURL=auth-integration.test.js.map