@camstack/server 1.2.593 → 1.2.594

package/dist/api/core/auth-device-cert.procedures.js

@@ -1,33 +1,28 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.toWireReason = toWireReason;
-exports.refusal = refusal;
-exports.createDeviceCertProcedures = createDeviceCertProcedures;
-const system_1 = require("@camstack/system");
-const types_1 = require("@camstack/types");
-const server_1 = require("@trpc/server");
-const zod_1 = require("zod");
-const session_mint_js_1 = require("../../auth/session-mint.js");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
-const user_error_js_1 = require("../trpc/user-error.js");
-const DeviceLoginResultSchema = zod_1.z.discriminatedUnion('ok', [
-    zod_1.z.object({
-        ok: zod_1.z.literal(true),
-        token: zod_1.z.string(),
-        user: zod_1.z.object({ id: zod_1.z.string(), username: zod_1.z.string(), isAdmin: zod_1.z.boolean() }),
-        expiresAt: zod_1.z.number().optional(),
-        sessionId: zod_1.z.string().optional(),
-        sessionExpiresAt: zod_1.z.number().optional(),
-        refreshToken: zod_1.z.string().optional(),
-        credentialId: zod_1.z.string(),
+import { getUserManagementInternal } from '@camstack/system';
+import { CompleteEnrollmentInputSchema, CompleteEnrollmentResultSchema, DEVICE_CERT_SIGNATURE, DeviceChallengeResultSchema, DeviceCredentialSchema, DeviceEnrollProofSchema, DeviceProofInputSchema, DeviceRefusalSchema, EnrollSelfInputSchema, formatDeviceRevoker, isDefinitiveDeviceRefusal, RenewDeviceCertificateResultSchema, RevokeOwnDeviceCertificateResultSchema, } from '@camstack/types';
+import { TRPCError } from '@trpc/server';
+import { z } from 'zod';
+import { SessionUserGoneError, } from '../../auth/session-mint.js';
+import { protectedProcedure } from '../trpc/trpc.middleware.js';
+import { assertReauthenticated, ReauthTokenInput } from './auth-reauth.procedures.js';
+import { trpcUserError } from '../trpc/user-error.js';
+const DeviceLoginResultSchema = z.discriminatedUnion('ok', [
+    z.object({
+        ok: z.literal(true),
+        token: z.string(),
+        user: z.object({ id: z.string(), username: z.string(), isAdmin: z.boolean() }),
+        expiresAt: z.number().optional(),
+        sessionId: z.string().optional(),
+        sessionExpiresAt: z.number().optional(),
+        refreshToken: z.string().optional(),
+        credentialId: z.string(),
         /** The certificate's expiry (epoch ms): the app renews when < 30 days remain. */
-        certNotAfter: zod_1.z.number(),
+        certNotAfter: z.number(),
     }),
-    types_1.DeviceRefusalSchema,
+    DeviceRefusalSchema,
 ]);
 /** Internal manager reason → the wire reason an app switches on. */
-function toWireReason(reason) {
+export function toWireReason(reason) {
     switch (reason) {
         case 'revoked':
         case 'unknown-credential':
@@ -58,11 +53,11 @@ function toWireReason(reason) {
             return 'superseded';
     }
 }
-function refusal(reason, retryAfterSeconds) {
+export function refusal(reason, retryAfterSeconds) {
     return {
         ok: false,
         reason,
-        definitive: (0, types_1.isDefinitiveDeviceRefusal)(reason),
+        definitive: isDefinitiveDeviceRefusal(reason),
         ...(retryAfterSeconds !== undefined ? { retryAfterSeconds } : {}),
     };
 }
@@ -70,13 +65,13 @@ function fromAddress(req, network) {
     const ip = network.clientAddress(req).ip;
     return ip ?? undefined;
 }
-function createDeviceCertProcedures(deps) {
+export function createDeviceCertProcedures(deps) {
     const internal = () => {
         const found = deps.registry === null
             ? null
-            : (0, system_1.getUserManagementInternal)(deps.registry.getSingleton('user-management'));
+            : getUserManagementInternal(deps.registry.getSingleton('user-management'));
         if (found === null) {
-            throw (0, user_error_js_1.trpcUserError)('PRECONDITION_FAILED', 'device.certificates-unavailable', undefined, 'Device certificates are not available');
+            throw trpcUserError('PRECONDITION_FAILED', 'device.certificates-unavailable', undefined, 'Device certificates are not available');
         }
         return found;
     };
@@ -111,13 +106,13 @@ function createDeviceCertProcedures(deps) {
     };
     const assertPerson = (user) => {
         if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
-            throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
+            throw trpcUserError('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
         }
     };
     const selfLimit = (userId, path) => {
         const verdict = deps.selfLimiter.check(`${path}:${userId}`);
         if (!verdict.allowed) {
-            throw new server_1.TRPCError({
+            throw new TRPCError({
                 code: 'TOO_MANY_REQUESTS',
                 message: `Too many attempts — retry in ${verdict.retryAfterSeconds}s`,
             });
@@ -126,8 +121,8 @@ function createDeviceCertProcedures(deps) {
     return {
         /** PUBLIC — redeem a QR enrollment code with the device's PUBLIC key; answers the certificate. */
         completeEnrollment: deps.publicProcedure
-            .input(types_1.CompleteEnrollmentInputSchema)
-            .output(types_1.CompleteEnrollmentResultSchema)
+            .input(CompleteEnrollmentInputSchema)
+            .output(CompleteEnrollmentResultSchema)
             .mutation(async ({ input, ctx }) => {
             const slow = limited(deps.credentialLimiter, 'completeEnrollment', ctx.req);
             if (slow !== null)
@@ -150,8 +145,8 @@ function createDeviceCertProcedures(deps) {
         }),
         /** PUBLIC — a single-use nonce (60 s), bound to the hub origin this request is entitled to. */
         getDeviceChallenge: deps.publicProcedure
-            .input(zod_1.z.void())
-            .output(types_1.DeviceChallengeResultSchema)
+            .input(z.void())
+            .output(DeviceChallengeResultSchema)
             .mutation(async ({ ctx }) => {
             const slow = limited(deps.ceremonyLimiter, 'getDeviceChallenge', ctx.req);
             if (slow !== null)
@@ -167,7 +162,7 @@ function createDeviceCertProcedures(deps) {
             if (origin === null)
                 return refusal('unavailable');
             const { nonce, expiresAt } = internal().deviceCredentials.issueNonce(origin, partition);
-            return { ok: true, nonce, origin, expiresAt, signature: types_1.DEVICE_CERT_SIGNATURE };
+            return { ok: true, nonce, origin, expiresAt, signature: DEVICE_CERT_SIGNATURE };
         }),
         /**
          * PUBLIC — sign in with the device certificate: chain to the device CA, not
@@ -175,7 +170,7 @@ function createDeviceCertProcedures(deps) {
          * Opens the SAME session a password login opens, carrying the credential id.
          */
         loginWithDeviceCertificate: deps.publicProcedure
-            .input(types_1.DeviceProofInputSchema.extend({ refreshable: zod_1.z.boolean().optional() }))
+            .input(DeviceProofInputSchema.extend({ refreshable: z.boolean().optional() }))
             .output(DeviceLoginResultSchema)
             .mutation(async ({ input, ctx }) => {
             const slow = limited(deps.credentialLimiter, 'loginWithDeviceCertificate', ctx.req);
@@ -220,7 +215,7 @@ function createDeviceCertProcedures(deps) {
                 };
             }
             catch (error) {
-                if (error instanceof session_mint_js_1.SessionUserGoneError) {
+                if (error instanceof SessionUserGoneError) {
                     deps.logger?.warn('Device certificate login refused: user-gone', {
                         tags: { credentialId: credential.id, userId: credential.userId },
                     });
@@ -231,8 +226,8 @@ function createDeviceCertProcedures(deps) {
         }),
         /** PUBLIC — a new leaf for the SAME public key, while the certificate is valid and not revoked. */
         renewDeviceCertificate: deps.publicProcedure
-            .input(types_1.DeviceProofInputSchema)
-            .output(types_1.RenewDeviceCertificateResultSchema)
+            .input(DeviceProofInputSchema)
+            .output(RenewDeviceCertificateResultSchema)
             .mutation(async ({ input, ctx }) => {
             const slow = limited(deps.credentialLimiter, 'renewDeviceCertificate', ctx.req);
             if (slow !== null)
@@ -261,8 +256,8 @@ function createDeviceCertProcedures(deps) {
          * purpose): works with no session. Ends every session the credential opened.
          */
         revokeOwnDeviceCertificate: deps.publicProcedure
-            .input(types_1.DeviceProofInputSchema)
-            .output(types_1.RevokeOwnDeviceCertificateResultSchema)
+            .input(DeviceProofInputSchema)
+            .output(RevokeOwnDeviceCertificateResultSchema)
             .mutation(async ({ input, ctx }) => {
             const slow = limited(deps.credentialLimiter, 'revokeOwnDeviceCertificate', ctx.req);
             if (slow !== null)
@@ -276,7 +271,7 @@ function createDeviceCertProcedures(deps) {
             if (!checked.ok)
                 return refusal(toWireReason(checked.reason));
             const id = checked.credential.id;
-            await internal().deviceCredentials.revoke(id, (0, types_1.formatDeviceRevoker)({ kind: 'device' }));
+            await internal().deviceCredentials.revoke(id, formatDeviceRevoker({ kind: 'device' }));
             const sessionsEnded = await internal().sessions.revokeByCredential(id);
             await audit('device-credential-revoked', checked.credential.userId, ctx.req, {
                 credentialId: id,
@@ -287,9 +282,9 @@ function createDeviceCertProcedures(deps) {
         }),
         // ── Signed-in legs ───────────────────────────────────────────────
         /** The caller's own device credentials (live ones, and revoked when asked). */
-        listOwnDeviceCredentials: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ includeRevoked: zod_1.z.boolean().optional() }).optional())
-            .output(zod_1.z.array(types_1.DeviceCredentialSchema))
+        listOwnDeviceCredentials: protectedProcedure
+            .input(z.object({ includeRevoked: z.boolean().optional() }).optional())
+            .output(z.array(DeviceCredentialSchema))
             .query(({ ctx, input }) => {
             assertPerson(ctx.user);
             const manager = internal().deviceCredentials;
@@ -317,9 +312,9 @@ function createDeviceCertProcedures(deps) {
             }));
         }),
         /** Revoke one of the caller's OWN credentials by id, from a session (e.g. a lost phone). */
-        revokeOwnDeviceCredential: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ revoked: zod_1.z.boolean(), sessionsEnded: zod_1.z.number().int() }))
+        revokeOwnDeviceCredential: protectedProcedure
+            .input(z.object({ id: z.string().min(1) }))
+            .output(z.object({ revoked: z.boolean(), sessionsEnded: z.number().int() }))
             .mutation(async ({ ctx, input }) => {
             assertPerson(ctx.user);
             selfLimit(ctx.user.id, 'revokeOwnDeviceCredential');
@@ -331,7 +326,7 @@ function createDeviceCertProcedures(deps) {
                 });
                 return { revoked: false, sessionsEnded: 0 };
             }
-            const revoked = await internal().deviceCredentials.revoke(input.id, (0, types_1.formatDeviceRevoker)({ kind: 'user', userId: ctx.user.id }));
+            const revoked = await internal().deviceCredentials.revoke(input.id, formatDeviceRevoker({ kind: 'user', userId: ctx.user.id }));
             const sessionsEnded = await internal().sessions.revokeByCredential(input.id);
             if (revoked) {
                 await audit('device-credential-revoked', ctx.user.id, ctx.req, {
@@ -343,16 +338,16 @@ function createDeviceCertProcedures(deps) {
             return { revoked, sessionsEnded };
         }),
         /** Step-up, password / passkey: turn a fresh `reauthenticate` proof into a single-use device-enroll proof. */
-        deviceEnrollProofFromReauth: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput }))
-            .output(types_1.DeviceEnrollProofSchema)
+        deviceEnrollProofFromReauth: protectedProcedure
+            .input(z.object({ reauthToken: ReauthTokenInput }))
+            .output(DeviceEnrollProofSchema)
             .mutation(({ ctx, input }) => {
             assertPerson(ctx.user);
             selfLimit(ctx.user.id, 'deviceEnrollProofFromReauth');
-            (0, auth_reauth_procedures_js_1.assertReauthenticated)(deps.auth, ctx.user, input.reauthToken);
+            assertReauthenticated(deps.auth, ctx.user, input.reauthToken);
             // One reauthentication, one proof (or one step-up handoff code).
             if (!deps.enrollProofs.consumeReauth(input.reauthToken)) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'FORBIDDEN',
                     message: 'This re-authentication was already used - confirm it is you again',
                 });
@@ -364,13 +359,13 @@ function createDeviceCertProcedures(deps) {
          * `code` is a handoff code minted with purpose `step-up` by a browser sign-in
          * of the SAME user. Opens no session and replaces none.
          */
-        deviceEnrollProofFromHandoff: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            code: zod_1.z.string().min(1).max(256),
-            codeVerifier: zod_1.z.string().min(1).max(256).optional(),
-            state: zod_1.z.string().min(1).max(256).optional(),
+        deviceEnrollProofFromHandoff: protectedProcedure
+            .input(z.object({
+            code: z.string().min(1).max(256),
+            codeVerifier: z.string().min(1).max(256).optional(),
+            state: z.string().min(1).max(256).optional(),
         }))
-            .output(types_1.DeviceEnrollProofSchema)
+            .output(DeviceEnrollProofSchema)
             .mutation(({ ctx, input }) => {
             assertPerson(ctx.user);
             selfLimit(ctx.user.id, 'deviceEnrollProofFromHandoff');
@@ -386,7 +381,7 @@ function createDeviceCertProcedures(deps) {
                         reason: reason ?? (grant?.purpose !== 'step-up' ? 'wrong-purpose' : 'other-user'),
                     },
                 });
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'UNAUTHORIZED',
                     message: 'Invalid, expired or mismatched step-up code — sign in again',
                 });
@@ -399,9 +394,9 @@ function createDeviceCertProcedures(deps) {
          * a merely refreshed session can never mint a permanent credential.
          * Hub-wide `deviceCertificates.selfEnrollment = disabled` refuses.
          */
-        enrollSelf: trpc_middleware_js_1.protectedProcedure
-            .input(types_1.EnrollSelfInputSchema)
-            .output(types_1.CompleteEnrollmentResultSchema)
+        enrollSelf: protectedProcedure
+            .input(EnrollSelfInputSchema)
+            .output(CompleteEnrollmentResultSchema)
             .mutation(async ({ ctx, input }) => {
             assertPerson(ctx.user);
             selfLimit(ctx.user.id, 'enrollSelf');

package/dist/api/core/auth-limits.js

@@ -1,12 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROCESS_AUTH_LIMITERS = void 0;
-exports.createAuthLimiters = createAuthLimiters;
-exports.tooMany = tooMany;
-exports.limitByClient = limitByClient;
-exports.assertAccountNotLocked = assertAccountNotLocked;
-exports.recordAccountFailure = recordAccountFailure;
-exports.limitByUser = limitByUser;
 /**
  * Rate limits of the public auth surface, in one place.
  *
@@ -29,29 +20,29 @@ exports.limitByUser = limitByUser;
  *
  * Mesh-internal calls (no originating request) are never limited.
  */
-const server_1 = require("@trpc/server");
-const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
-const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
-function createAuthLimiters(now) {
+import { TRPCError } from '@trpc/server';
+import { DEFAULT_AUTH_NETWORK_POLICY, } from '../../auth/auth-network-policy.js';
+import { createRateLimiter } from '../../auth/auth-rate-limit.js';
+export function createAuthLimiters(now) {
     const clock = now !== undefined ? { now } : {};
     return {
-        credential: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10, ...clock }),
-        ceremony: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 30, ...clock }),
-        accountFailures: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 15 * 60_000, max: 20, ...clock }),
-        link: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 5, ...clock }),
-        reauth: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10, ...clock }),
+        credential: createRateLimiter({ windowMs: 60_000, max: 10, ...clock }),
+        ceremony: createRateLimiter({ windowMs: 60_000, max: 30, ...clock }),
+        accountFailures: createRateLimiter({ windowMs: 15 * 60_000, max: 20, ...clock }),
+        link: createRateLimiter({ windowMs: 60_000, max: 5, ...clock }),
+        reauth: createRateLimiter({ windowMs: 60_000, max: 10, ...clock }),
     };
 }
 /** The process-wide limiters: router rebuilds must not reset an attacker's budget. */
-exports.PROCESS_AUTH_LIMITERS = createAuthLimiters();
-function tooMany(retryAfterSeconds) {
-    return new server_1.TRPCError({
+export const PROCESS_AUTH_LIMITERS = createAuthLimiters();
+export function tooMany(retryAfterSeconds) {
+    return new TRPCError({
         code: 'TOO_MANY_REQUESTS',
         message: `Too many attempts — retry in ${retryAfterSeconds}s`,
     });
 }
 /** Count one attempt from the request's client address; throws when over. */
-function limitByClient(limiter, bucket, req, network = auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY) {
+export function limitByClient(limiter, bucket, req, network = DEFAULT_AUTH_NETWORK_POLICY) {
     const ip = network.clientAddress(req).ip;
     if (ip === null)
         return;
@@ -60,17 +51,17 @@ function limitByClient(limiter, bucket, req, network = auth_network_policy_js_1.
         throw tooMany(verdict.retryAfterSeconds);
 }
 /** Refuse before checking a secret when `account` already failed too often. */
-function assertAccountNotLocked(limiters, account) {
+export function assertAccountNotLocked(limiters, account) {
     const verdict = limiters.accountFailures.peek(`account:${account.toLowerCase()}`);
     if (!verdict.allowed)
         throw tooMany(verdict.retryAfterSeconds);
 }
 /** Count one failed secret against `account`. */
-function recordAccountFailure(limiters, account) {
+export function recordAccountFailure(limiters, account) {
     limiters.accountFailures.check(`account:${account.toLowerCase()}`);
 }
 /** Count one call of an authenticated leg against the user; throws when over. */
-function limitByUser(limiter, bucket, userId) {
+export function limitByUser(limiter, bucket, userId) {
     const verdict = limiter.check(`${bucket}:${userId}`);
     if (!verdict.allowed)
         throw tooMany(verdict.retryAfterSeconds);

package/dist/api/core/auth-reauth.procedures.js

@@ -1,28 +1,23 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.REAUTH_REQUIRED_MESSAGE = exports.ReauthTokenInput = void 0;
-exports.assertReauthenticated = assertReauthenticated;
-exports.createReauthProcedures = createReauthProcedures;
-const server_1 = require("@trpc/server");
-const zod_1 = require("zod");
-const passkey_provider_js_1 = require("../../auth/passkey-provider.js");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const auth_limits_js_1 = require("./auth-limits.js");
-const user_error_js_1 = require("../trpc/user-error.js");
+import { TRPCError } from '@trpc/server';
+import { z } from 'zod';
+import { OptionsJsonSchema, resolvePasskeyProvider } from '../../auth/passkey-provider.js';
+import { protectedProcedure } from '../trpc/trpc.middleware.js';
+import { assertAccountNotLocked, limitByUser, recordAccountFailure, } from './auth-limits.js';
+import { trpcUserError } from '../trpc/user-error.js';
 /** The input field a re-auth-gated procedure takes. */
-exports.ReauthTokenInput = zod_1.z.string().min(1).max(4096);
-exports.REAUTH_REQUIRED_MESSAGE = 'Confirm it is you first: re-enter your password or use a passkey (update the app if it cannot ask).';
+export const ReauthTokenInput = z.string().min(1).max(4096);
+export const REAUTH_REQUIRED_MESSAGE = 'Confirm it is you first: re-enter your password or use a passkey (update the app if it cannot ask).';
 /**
  * Throw unless `reauthToken` is a live proof by THIS user, made in THIS
  * session. A missing token is the same refusal: the action needs one.
  */
-function assertReauthenticated(auth, user, reauthToken) {
+export function assertReauthenticated(auth, user, reauthToken) {
     const claims = reauthToken === undefined ? null : auth.verifyReauthToken(reauthToken);
     const valid = claims !== null &&
         claims.userId === user.id &&
         (user.sessionId === undefined || claims.sessionId === user.sessionId);
     if (!valid)
-        throw new server_1.TRPCError({ code: 'FORBIDDEN', message: exports.REAUTH_REQUIRED_MESSAGE });
+        throw new TRPCError({ code: 'FORBIDDEN', message: REAUTH_REQUIRED_MESSAGE });
 }
 function isPasswordChecker(value) {
     return (value !== null &&
@@ -32,19 +27,19 @@ function isPasswordChecker(value) {
 /** Real user sessions only: a scoped or share token cannot prove a password. */
 function assertPerson(user) {
     if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
-        throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
+        throw trpcUserError('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
     }
 }
-function createReauthProcedures(deps) {
+export function createReauthProcedures(deps) {
     return {
         /** Passkey re-authentication, step 1: assertion options for the caller's own credentials. */
-        reauthBeginPasskey: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
-            .output(passkey_provider_js_1.OptionsJsonSchema)
+        reauthBeginPasskey: protectedProcedure
+            .input(z.void())
+            .output(OptionsJsonSchema)
             .mutation(async ({ ctx }) => {
             assertPerson(ctx.user);
-            (0, auth_limits_js_1.limitByUser)(deps.limiters.reauth, 'auth.reauthBeginPasskey', ctx.user.id);
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(deps.registry, deps.moleculer);
+            limitByUser(deps.limiters.reauth, 'auth.reauthBeginPasskey', ctx.user.id);
+            const provider = resolvePasskeyProvider(deps.registry, deps.moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             return provider.beginAuthentication({ userId: ctx.user.id });
@@ -54,20 +49,20 @@ function createReauthProcedures(deps) {
          * `reauthBeginPasskey`. Answers a 5-minute proof for the re-auth-gated
          * actions, valid only for this user in this session.
          */
-        reauthenticate: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.union([
-            zod_1.z.object({ password: zod_1.z.string().min(1).max(1024) }),
-            zod_1.z.object({ passkeyResponse: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }),
+        reauthenticate: protectedProcedure
+            .input(z.union([
+            z.object({ password: z.string().min(1).max(1024) }),
+            z.object({ passkeyResponse: z.record(z.string(), z.unknown()) }),
         ]))
-            .output(zod_1.z.object({
-            reauthToken: zod_1.z.string(),
-            expiresAt: zod_1.z.number(),
-            method: zod_1.z.enum(['password', 'passkey']),
+            .output(z.object({
+            reauthToken: z.string(),
+            expiresAt: z.number(),
+            method: z.enum(['password', 'passkey']),
         }))
             .mutation(async ({ ctx, input }) => {
             assertPerson(ctx.user);
-            (0, auth_limits_js_1.limitByUser)(deps.limiters.reauth, 'auth.reauthenticate', ctx.user.id);
-            (0, auth_limits_js_1.assertAccountNotLocked)(deps.limiters, ctx.user.username);
+            limitByUser(deps.limiters.reauth, 'auth.reauthenticate', ctx.user.id);
+            assertAccountNotLocked(deps.limiters, ctx.user.username);
             let method;
             if ('password' in input) {
                 const userMgmt = deps.registry?.getSingleton('user-management');
@@ -79,13 +74,13 @@ function createReauthProcedures(deps) {
                     password: input.password,
                 });
                 if (record === null || record.id !== ctx.user.id) {
-                    (0, auth_limits_js_1.recordAccountFailure)(deps.limiters, ctx.user.username);
-                    throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.password-incorrect', undefined, 'Password is incorrect');
+                    recordAccountFailure(deps.limiters, ctx.user.username);
+                    throw trpcUserError('UNAUTHORIZED', 'auth.password-incorrect', undefined, 'Password is incorrect');
                 }
                 method = 'password';
             }
             else {
-                const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(deps.registry, deps.moleculer);
+                const provider = resolvePasskeyProvider(deps.registry, deps.moleculer);
                 if (!provider)
                     throw new Error('Passkey authentication is not available');
                 const result = await provider.finishAuthentication({
@@ -93,8 +88,8 @@ function createReauthProcedures(deps) {
                     response: input.passkeyResponse,
                 });
                 if (!result.verified) {
-                    (0, auth_limits_js_1.recordAccountFailure)(deps.limiters, ctx.user.username);
-                    throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.passkey-verification-failed', undefined, 'Passkey verification failed');
+                    recordAccountFailure(deps.limiters, ctx.user.username);
+                    throw trpcUserError('UNAUTHORIZED', 'auth.passkey-verification-failed', undefined, 'Passkey verification failed');
                 }
                 method = 'passkey';
             }

package/dist/api/core/auth-revoke-credentials.procedures.js

@@ -1,36 +1,32 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RevokeSkipReasonSchema = exports.RevocableCredentialKindSchema = exports.REVOKE_CREDENTIALS_MAX = void 0;
-exports.createRevokeCredentialsProcedures = createRevokeCredentialsProcedures;
-const server_1 = require("@trpc/server");
-const zod_1 = require("zod");
-const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+import { TRPCError } from '@trpc/server';
+import { z } from 'zod';
+import { userManagementInternal } from '../../auth/hub-sessions.js';
+import { adminProcedure } from '../trpc/trpc.middleware.js';
 /** Upper bound of one bulk call — a page of a table, several times over. */
-exports.REVOKE_CREDENTIALS_MAX = 500;
+export const REVOKE_CREDENTIALS_MAX = 500;
 /** What a bulk revoke can target. Each has a per-row revoke on the server. */
-exports.RevocableCredentialKindSchema = zod_1.z.enum([
+export const RevocableCredentialKindSchema = z.enum([
     'share-link',
     'admin-token',
     'login-session',
     'scoped-token',
     'oauth-session',
 ]);
-exports.RevokeSkipReasonSchema = zod_1.z.enum(['current-session', 'not-active']);
-const RevokeCredentialsInputSchema = zod_1.z
+export const RevokeSkipReasonSchema = z.enum(['current-session', 'not-active']);
+const RevokeCredentialsInputSchema = z
     .object({
-    kind: exports.RevocableCredentialKindSchema,
-    ids: zod_1.z.array(zod_1.z.string().min(1)).min(1).max(exports.REVOKE_CREDENTIALS_MAX),
+    kind: RevocableCredentialKindSchema,
+    ids: z.array(z.string().min(1)).min(1).max(REVOKE_CREDENTIALS_MAX),
     /** The count the operator confirmed. Must equal `ids.length`. */
-    confirmCount: zod_1.z.number().int().min(1),
+    confirmCount: z.number().int().min(1),
 })
     .refine((input) => new Set(input.ids).size === input.ids.length, {
     message: 'Each id may be listed once',
     path: ['ids'],
 });
-const RevokeCredentialsOutputSchema = zod_1.z.object({
-    revoked: zod_1.z.array(zod_1.z.string()),
-    skipped: zod_1.z.array(zod_1.z.object({ id: zod_1.z.string(), reason: exports.RevokeSkipReasonSchema })),
+const RevokeCredentialsOutputSchema = z.object({
+    revoked: z.array(z.string()),
+    skipped: z.array(z.object({ id: z.string(), reason: RevokeSkipReasonSchema })),
 });
 /** Keep the audit row bounded; the ids beyond this are counted, not listed. */
 const AUDIT_IDS_MAX_CHARS = 4000;
@@ -39,16 +35,16 @@ function assertSignedInAdminSession(user) {
         user.shareView !== undefined ||
         user.credential !== undefined ||
         user.adminTokenId !== undefined) {
-        throw new server_1.TRPCError({
+        throw new TRPCError({
             code: 'FORBIDDEN',
             message: 'Revoking credentials in bulk needs a signed-in admin session',
         });
     }
 }
 function requireInternal(registry) {
-    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+    const internal = registry === null ? null : userManagementInternal(registry);
     if (internal === null) {
-        throw new server_1.TRPCError({
+        throw new TRPCError({
             code: 'PRECONDITION_FAILED',
             message: 'User management is not available',
         });
@@ -60,7 +56,7 @@ function revokerFor(kind, caller, deps) {
     if (kind === 'share-link') {
         const service = deps.shareTokens;
         if (service === null) {
-            throw new server_1.TRPCError({ code: 'PRECONDITION_FAILED', message: 'Share links are not available' });
+            throw new TRPCError({ code: 'PRECONDITION_FAILED', message: 'Share links are not available' });
         }
         return async (id) => (await service.revoke({ id, callerUserId: caller.id, callerIsAdmin: true }))
             ? null
@@ -88,16 +84,16 @@ function auditIds(ids) {
     const joined = ids.join(',');
     return joined.length <= AUDIT_IDS_MAX_CHARS ? joined : `${joined.slice(0, AUDIT_IDS_MAX_CHARS)}…`;
 }
-function createRevokeCredentialsProcedures(deps) {
+export function createRevokeCredentialsProcedures(deps) {
     return {
         /** ADMIN — revoke exactly `ids` of one kind; see the module header. */
-        revokeCredentials: trpc_middleware_js_1.adminProcedure
+        revokeCredentials: adminProcedure
             .input(RevokeCredentialsInputSchema)
             .output(RevokeCredentialsOutputSchema)
             .mutation(async ({ ctx, input }) => {
             assertSignedInAdminSession(ctx.user);
             if (input.confirmCount !== input.ids.length) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'BAD_REQUEST',
                     message: `Confirmed ${input.confirmCount} but ${input.ids.length} were listed — nothing was revoked`,
                 });
@@ -114,7 +110,7 @@ function createRevokeCredentialsProcedures(deps) {
                 else
                     skipped.push({ id, reason });
             }
-            const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+            const internal = deps.registry === null ? null : userManagementInternal(deps.registry);
             if (internal !== null) {
                 const ip = deps.network.clientAddress(ctx.req).ip;
                 await internal.audit.record({