@camstack/server 1.2.604 → 1.2.606

package/dist/api/auth-whoami.js

@@ -1,55 +1,39 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveWhoami = resolveWhoami;
 exports.registerAuthWhoamiRoute = registerAuthWhoamiRoute;
+const trpc_context_js_1 = require("./trpc/trpc.context.js");
+/** The answer for `bearer`, or `null` when it authenticates nobody. */
+async function resolveWhoami(deps, bearer) {
+    const principal = await (0, trpc_context_js_1.hubCredentialVerifier)(deps).verify(bearer);
+    if (principal === null)
+        return null;
+    return {
+        ok: true,
+        kind: principal.userDelegated ? 'jwt' : 'scoped',
+        userId: principal.subjectId,
+        username: principal.username,
+        isAdmin: principal.isAdmin,
+        scopes: principal.scopes,
+        credentialId: principal.credentialId,
+        credential: principal.auditTag,
+    };
+}
 async function registerAuthWhoamiRoute(fastify, authService, addonRegistry) {
     fastify.get('/api/auth/whoami', async (request, reply) => {
         const authHeader = request.headers.authorization;
         if (!authHeader) {
-            return reply.status(401).send({ ok: false, error: 'No Authorization header' });
+            const refused = { ok: false, error: 'No Authorization header' };
+            return reply.status(401).send(refused);
         }
-        const token = authHeader.replace('Bearer ', '');
-        // JWT fast path — same logic as addon-upload auth chain.
-        try {
-            const payload = authService.verifyToken(token);
-            const ok = {
-                ok: true,
-                kind: 'jwt',
-                userId: payload.userId ?? 'unknown',
-                username: payload.username ?? 'unknown',
-                isAdmin: payload.isAdmin,
+        const answer = await resolveWhoami({ authService, addonRegistry }, authHeader.replace('Bearer ', ''));
+        if (answer === null) {
+            const refused = {
+                ok: false,
+                error: 'Token not recognised (revoked, expired, or never issued)',
             };
-            return reply.send(ok);
-        }
-        catch {
-            // Not a JWT — try scoped token via cap registry.
-        }
-        try {
-            const capRegistry = addonRegistry.getCapabilityRegistry();
-            const userMgmt = capRegistry.getSingleton('user-management');
-            if (!userMgmt) {
-                return reply.status(503).send({ ok: false, error: 'user-management cap not mounted' });
-            }
-            const record = await userMgmt.validateScopedToken({ token });
-            if (!record) {
-                return reply
-                    .status(401)
-                    .send({ ok: false, error: 'Token not recognised (revoked, expired, or never issued)' });
-            }
-            const ok = {
-                ok: true,
-                kind: 'scoped',
-                userId: record.userId,
-                username: record.userId,
-                tokenPrefix: record.tokenPrefix,
-                scopes: record.scopes,
-                expiresAt: record.expiresAt ?? null,
-                createdAt: record.createdAt,
-            };
-            return reply.send(ok);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            return reply.status(500).send({ ok: false, error: `Validation failed: ${msg}` });
+            return reply.status(401).send(refused);
         }
+        return reply.send(answer);
     });
 }

package/dist/api/core/auth-audit.procedures.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthAuditRecordSchema = void 0;
+exports.createAuthAuditProcedures = createAuthAuditProcedures;
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+exports.AuthAuditRecordSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    at: zod_1.z.number(),
+    action: zod_1.z.string(),
+    userId: zod_1.z.string().optional(),
+    ip: zod_1.z.string().optional(),
+    detail: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.number(), zod_1.z.boolean()])).optional(),
+});
+function createAuthAuditProcedures(deps) {
+    return {
+        /** ADMIN — the authentication audit trail, newest first. */
+        listAuthAudit: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z
+            .object({
+            limit: zod_1.z.number().int().min(1).max(500).optional(),
+            userId: zod_1.z.string().min(1).optional(),
+        })
+            .optional())
+            .output(zod_1.z.array(exports.AuthAuditRecordSchema))
+            .query(async ({ input }) => {
+            const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+            if (internal === null) {
+                throw new server_1.TRPCError({
+                    code: 'PRECONDITION_FAILED',
+                    message: 'User management is not available',
+                });
+            }
+            return [
+                ...(await internal.audit.list({
+                    ...(input?.limit !== undefined ? { limit: input.limit } : {}),
+                    ...(input?.userId !== undefined ? { userId: input.userId } : {}),
+                })),
+            ];
+        }),
+    };
+}

package/dist/api/core/auth-device-cert.procedures.js

@@ -110,7 +110,7 @@ function createDeviceCertProcedures(deps) {
         }
     };
     const assertPerson = (user) => {
-        if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
+        if (user.userDelegated !== true) {
             throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
         }
     };

package/dist/api/core/auth-reauth.procedures.js

@@ -31,7 +31,7 @@ function isPasswordChecker(value) {
 }
 /** Real user sessions only: a scoped or share token cannot prove a password. */
 function assertPerson(user) {
-    if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
+    if (user.userDelegated !== true) {
         throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
     }
 }

package/dist/api/core/auth-revoke-credentials.procedures.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RevokeSkipReasonSchema = exports.RevocableCredentialKindSchema = exports.REVOKE_CREDENTIALS_MAX = void 0;
+exports.RevokeSkipReasonSchema = exports.REVOKE_CREDENTIALS_MAX = void 0;
 exports.createRevokeCredentialsProcedures = createRevokeCredentialsProcedures;
 const server_1 = require("@trpc/server");
 const zod_1 = require("zod");
@@ -8,18 +8,9 @@ const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 /** Upper bound of one bulk call — a page of a table, several times over. */
 exports.REVOKE_CREDENTIALS_MAX = 500;
-/** What a bulk revoke can target. Each has a per-row revoke on the server. */
-exports.RevocableCredentialKindSchema = zod_1.z.enum([
-    'share-link',
-    'admin-token',
-    'login-session',
-    'scoped-token',
-    'oauth-session',
-]);
 exports.RevokeSkipReasonSchema = zod_1.z.enum(['current-session', 'not-active']);
 const RevokeCredentialsInputSchema = zod_1.z
     .object({
-    kind: exports.RevocableCredentialKindSchema,
     ids: zod_1.z.array(zod_1.z.string().min(1)).min(1).max(exports.REVOKE_CREDENTIALS_MAX),
     /** The count the operator confirmed. Must equal `ids.length`. */
     confirmCount: zod_1.z.number().int().min(1),
@@ -35,53 +26,35 @@ const RevokeCredentialsOutputSchema = zod_1.z.object({
 /** Keep the audit row bounded; the ids beyond this are counted, not listed. */
 const AUDIT_IDS_MAX_CHARS = 4000;
 function assertSignedInAdminSession(user) {
-    if (user.isScoped === true ||
-        user.shareView !== undefined ||
-        user.credential !== undefined ||
-        user.adminTokenId !== undefined) {
+    if (user.interactive !== true) {
         throw new server_1.TRPCError({
             code: 'FORBIDDEN',
             message: 'Revoking credentials in bulk needs a signed-in admin session',
         });
     }
 }
-function requireInternal(registry) {
-    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
-    if (internal === null) {
-        throw new server_1.TRPCError({
-            code: 'PRECONDITION_FAILED',
-            message: 'User management is not available',
-        });
-    }
-    return internal;
-}
-/** The per-row revoke for `kind`, bound to the caller. `null` = revoked. */
-function revokerFor(kind, caller, deps) {
-    if (kind === 'share-link') {
-        const service = deps.shareTokens;
-        if (service === null) {
-            throw new server_1.TRPCError({ code: 'PRECONDITION_FAILED', message: 'Share links are not available' });
-        }
-        return async (id) => (await service.revoke({ id, callerUserId: caller.id, callerIsAdmin: true }))
-            ? null
-            : 'not-active';
-    }
-    const internal = requireInternal(deps.registry);
-    if (kind === 'admin-token') {
-        return async (id) => ((await internal.adminTokens.revoke(id)) ? null : 'not-active');
-    }
-    if (kind === 'scoped-token') {
-        return async (id) => ((await internal.scopedTokens.revoke(id)) ? null : 'not-active');
-    }
-    if (kind === 'oauth-session') {
-        return async (id) => ((await internal.oauthSessions.revoke(id)) ? null : 'not-active');
-    }
+/**
+ * Revoke one credential BY ITS ID, whatever it is (D892). Every store is asked
+ * in turn; ids are random UUIDs per store, so at most one knows it. The
+ * caller's own credential is never revoked here.
+ */
+function revokerById(caller, deps) {
+    const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
     return async (id) => {
-        if (id === caller.sessionId)
+        if (id === caller.sessionId || id === caller.credentialId)
             return 'current-session';
-        if (internal.sessions.check(id).state !== 'active')
-            return 'not-active';
-        return (await internal.sessions.revoke(id, 'revoked-by-admin')) ? null : 'not-active';
+        const tokens = deps.credentialTokens ?? null;
+        if (tokens !== null && (await tokens.get(id)) !== null) {
+            return (await tokens.revoke(id)) ? null : 'not-active';
+        }
+        if (internal !== null) {
+            if (internal.sessions.check(id).state === 'active') {
+                return (await internal.sessions.revoke(id, 'revoked-by-admin')) ? null : 'not-active';
+            }
+            if (await internal.oauthSessions.revoke(id))
+                return null;
+        }
+        return 'not-active';
     };
 }
 function auditIds(ids) {
@@ -90,7 +63,7 @@ function auditIds(ids) {
 }
 function createRevokeCredentialsProcedures(deps) {
     return {
-        /** ADMIN — revoke exactly `ids` of one kind; see the module header. */
+        /** ADMIN — revoke exactly `ids`, by credential id; see the module header. */
         revokeCredentials: trpc_middleware_js_1.adminProcedure
             .input(RevokeCredentialsInputSchema)
             .output(RevokeCredentialsOutputSchema)
@@ -102,7 +75,7 @@ function createRevokeCredentialsProcedures(deps) {
                     message: `Confirmed ${input.confirmCount} but ${input.ids.length} were listed — nothing was revoked`,
                 });
             }
-            const revokeOne = revokerFor(input.kind, ctx.user, deps);
+            const revokeOne = revokerById(ctx.user, deps);
             const revoked = [];
             const skipped = [];
             // Sequential on purpose: the stores are single-writer, and a partial
@@ -122,7 +95,7 @@ function createRevokeCredentialsProcedures(deps) {
                     userId: ctx.user.id,
                     ...(ip !== null ? { ip } : {}),
                     detail: {
-                        kind: input.kind,
+                        kind: 'by-id',
                         requested: input.ids.length,
                         revoked: revoked.length,
                         skipped: skipped.length,

package/dist/api/core/auth-sessions.procedures.js

@@ -51,7 +51,7 @@ function requireSessions(registry) {
 }
 /** Real user sessions only — a scoped or share token has no login session to manage. */
 function assertLoginSession(user) {
-    if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
+    if (user.userDelegated !== true) {
         throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
     }
 }

package/dist/api/core/auth-tokens.procedures.js

@@ -0,0 +1,283 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenSummarySchema = exports.ExtendTokenInputSchema = exports.ListTokensInputSchema = exports.MintTokenInputSchema = exports.TokenExpiresInSchema = exports.TOKEN_MAX_LIFETIME_SEC = void 0;
+exports.summarizeToken = summarizeToken;
+exports.requireCredentialTokens = requireCredentialTokens;
+exports.mintFor = mintFor;
+exports.createTokenProcedures = createTokenProcedures;
+exports.daysToSeconds = daysToSeconds;
+const types_1 = require("@camstack/types");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const scope_escalation_js_1 = require("../../auth/scope-escalation.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+const DAY_MS = 86_400_000;
+/** Every token's longest lifetime — the admin token's bound, now everyone's (D816). */
+exports.TOKEN_MAX_LIFETIME_SEC = 90 * 86_400;
+const TOKEN_MIN_LIFETIME_SEC = 60;
+const MAX_SCOPES = 32;
+exports.TokenExpiresInSchema = zod_1.z.union([
+    zod_1.z.number().int().min(TOKEN_MIN_LIFETIME_SEC).max(exports.TOKEN_MAX_LIFETIME_SEC),
+    zod_1.z.literal('never'),
+]);
+exports.MintTokenInputSchema = zod_1.z.object({
+    scopes: zod_1.z.array(types_1.CredentialScopeSchema).min(1).max(MAX_SCOPES),
+    /** Seconds until expiry, or `'never'` (a share-view token only). */
+    expiresIn: exports.TokenExpiresInSchema,
+    label: zod_1.z.string().trim().min(1).max(80),
+    /** Required when `scopes` holds `'*'`. */
+    reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
+    /**
+     * The user the token acts for — an admin only; omitted, the caller. Its
+     * scopes are cut to what that user holds at every verify (a token never
+     * outgrows its subject).
+     */
+    subjectId: zod_1.z.string().min(1).optional(),
+});
+exports.ListTokensInputSchema = zod_1.z
+    .object({
+    /** Only the tokens with exactly this label — how a client finds the one it minted. */
+    label: zod_1.z.string().trim().min(1).max(80).optional(),
+})
+    .optional();
+exports.ExtendTokenInputSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1),
+    /** Seconds from now, or `'never'` (a lone share-view token only). */
+    expiresIn: exports.TokenExpiresInSchema,
+});
+exports.TokenSummarySchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    subjectId: zod_1.z.string(),
+    label: zod_1.z.string(),
+    scopes: zod_1.z.array(types_1.CredentialScopeSchema),
+    createdAt: zod_1.z.number(),
+    expiresAt: zod_1.z.number().nullable(),
+    lastUsedAt: zod_1.z.number().nullable(),
+    revokedAt: zod_1.z.number().nullable(),
+});
+function summarizeToken(record) {
+    return {
+        id: record.id,
+        subjectId: record.subjectId,
+        label: record.label,
+        scopes: [...record.scopes],
+        createdAt: record.createdAt,
+        expiresAt: record.expiresAt,
+        lastUsedAt: record.lastUsedAt,
+        revokedAt: record.revokedAt,
+    };
+}
+function requireCredentialTokens(service) {
+    if (service === null) {
+        throw new server_1.TRPCError({ code: 'PRECONDITION_FAILED', message: 'Tokens are not available' });
+    }
+    return service;
+}
+/**
+ * May `user` mint (or extend) a token carrying `scopes`? A person's login
+ * session may mint anything within its reach; an account link only a lone
+ * share-view grant (D895 — the reach the share-link route always gave it);
+ * a minted token never.
+ */
+function provenanceAllows(user, scopes) {
+    if (user.interactive === true)
+        return true;
+    return user.userDelegated === true && scopes.length === 1 && (0, types_1.shareViewGrantOf)(scopes) !== null;
+}
+/** The lifetime rules every mint and every extend obey. Throws a BAD_REQUEST. */
+function assertLifetime(scopes, expiresIn) {
+    if (expiresIn === 'never' && (0, types_1.shareViewGrantOf)(scopes) === null) {
+        throw new server_1.TRPCError({
+            code: 'BAD_REQUEST',
+            message: 'Only a share link may be minted without an expiry',
+        });
+    }
+}
+function expiryOf(expiresIn) {
+    return expiresIn === 'never' ? null : Date.now() + expiresIn * 1000;
+}
+/**
+ * The one mint behind `auth.mintToken`. Refuses; never trims.
+ */
+async function mintFor(deps, ctx, request) {
+    const user = ctx.user;
+    if (!provenanceAllows(user, request.scopes)) {
+        throw new server_1.TRPCError({
+            code: 'FORBIDDEN',
+            message: 'A token can only be minted from a signed-in session',
+        });
+    }
+    const share = (0, types_1.shareViewGrantOf)(request.scopes);
+    if (share !== null && request.scopes.length !== 1) {
+        throw new server_1.TRPCError({
+            code: 'BAD_REQUEST',
+            message: 'A share-view grant must be the token’s only scope',
+        });
+    }
+    assertLifetime(request.scopes, request.expiresIn);
+    const verdict = (0, scope_escalation_js_1.scopesWithin)(request.scopes, user.scopes ?? [], ctx.deviceScopeLookup);
+    if (!verdict.ok) {
+        throw new server_1.TRPCError({
+            code: 'FORBIDDEN',
+            message: `A token cannot carry more than you hold: ${verdict.reason}`,
+        });
+    }
+    if ((0, types_1.scopesGrantAdmin)(request.scopes)) {
+        (0, auth_reauth_procedures_js_1.assertReauthenticated)(deps.auth, user, request.reauthToken);
+    }
+    const subjectId = request.subjectId ?? user.id;
+    if (subjectId !== user.id && !user.isAdmin) {
+        throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Only an admin mints for another user' });
+    }
+    if (subjectId !== user.id && (0, types_1.scopesGrantAdmin)(request.scopes)) {
+        throw new server_1.TRPCError({
+            code: 'BAD_REQUEST',
+            message: "A '*' token acts for the admin who mints it, never for another user",
+        });
+    }
+    const service = requireCredentialTokens(deps.credentialTokens);
+    const minted = await service.mint({
+        subjectId,
+        createdBy: user.id,
+        label: request.label,
+        scopes: request.scopes,
+        expiresAt: expiryOf(request.expiresIn),
+    });
+    const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+    if (internal !== null) {
+        const ip = deps.network.clientAddress(ctx.req).ip;
+        await internal.audit
+            .record({
+            // An admin-capable token keeps the action the audit page already words.
+            action: (0, types_1.scopesGrantAdmin)(request.scopes) ? 'admin-token-created' : 'token-minted',
+            userId: user.id,
+            ...(ip !== null ? { ip } : {}),
+            detail: {
+                tokenId: minted.record.id,
+                name: minted.record.label,
+                subjectId,
+                scopes: request.scopes.length,
+                ...(minted.record.expiresAt !== null ? { expiresAt: minted.record.expiresAt } : {}),
+            },
+        })
+            .catch(() => { });
+    }
+    return minted;
+}
+function createTokenProcedures(deps) {
+    return {
+        /** Issue a token carrying `scopes` (see the module header). Shown once. */
+        mintToken: trpc_middleware_js_1.protectedProcedure
+            .input(exports.MintTokenInputSchema)
+            .output(zod_1.z.object({ token: zod_1.z.string(), record: exports.TokenSummarySchema }))
+            .mutation(async ({ ctx, input }) => {
+            const minted = await mintFor(deps, ctx, {
+                scopes: input.scopes,
+                expiresIn: input.expiresIn,
+                label: input.label,
+                ...(input.reauthToken !== undefined ? { reauthToken: input.reauthToken } : {}),
+                ...(input.subjectId !== undefined ? { subjectId: input.subjectId } : {}),
+            });
+            return { token: minted.token, record: summarizeToken(minted.record) };
+        }),
+        /**
+         * The caller's tokens (an admin: everyone's). No secret is ever listed.
+         */
+        listTokens: trpc_middleware_js_1.protectedProcedure
+            .input(exports.ListTokensInputSchema)
+            .output(zod_1.z.array(exports.TokenSummarySchema))
+            .query(async ({ ctx, input }) => {
+            if (ctx.user.userDelegated !== true) {
+                throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Requires a signed-in user session' });
+            }
+            const rows = await requireCredentialTokens(deps.credentialTokens).list(ctx.user.isAdmin ? undefined : ctx.user.id);
+            const label = input?.label;
+            // An account link manages share links only, so it lists only those.
+            const shareOnly = ctx.user.interactive !== true;
+            return rows
+                .filter((row) => label === undefined || row.label === label)
+                .filter((row) => !shareOnly || provenanceAllows(ctx.user, row.scopes))
+                .map(summarizeToken);
+        }),
+        /**
+         * Move one live token's expiry, in place: the same token keeps working
+         * with the new lifetime, so a client renews instead of minting another.
+         * The owner or an admin; the same provenance and lifetime rules as a mint
+         * (an account link renews only its share links; `'never'` only for one).
+         * Shortening is allowed; a revoked or expired token is NOT_FOUND.
+         */
+        extendToken: trpc_middleware_js_1.protectedProcedure
+            .input(exports.ExtendTokenInputSchema)
+            .output(exports.TokenSummarySchema)
+            .mutation(async ({ ctx, input }) => {
+            const service = requireCredentialTokens(deps.credentialTokens);
+            const record = await service.get(input.id);
+            if (record === null) {
+                throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Token not found: ${input.id}` });
+            }
+            if (!ctx.user.isAdmin && record.subjectId !== ctx.user.id) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'Only the owner or an admin extends a token',
+                });
+            }
+            if (!provenanceAllows(ctx.user, record.scopes)) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'A token can only be extended from a signed-in session',
+                });
+            }
+            assertLifetime(record.scopes, input.expiresIn);
+            const moved = await service.setExpiry(input.id, expiryOf(input.expiresIn));
+            if (moved === null) {
+                throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Token expired or revoked: ${input.id}` });
+            }
+            return summarizeToken(moved);
+        }),
+        /** Revoke one token: its owner or an admin. It stops working at once. */
+        revokeToken: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            if (ctx.user.userDelegated !== true) {
+                throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Requires a signed-in user session' });
+            }
+            const service = requireCredentialTokens(deps.credentialTokens);
+            const record = await service.get(input.id);
+            if (record === null)
+                return { success: false };
+            if (!ctx.user.isAdmin && record.subjectId !== ctx.user.id) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'Only the owner or an admin revokes a token',
+                });
+            }
+            if (!provenanceAllows(ctx.user, record.scopes)) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'An account link revokes only its share links',
+                });
+            }
+            const success = await service.revoke(input.id);
+            const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+            if (success && internal !== null) {
+                const ip = deps.network.clientAddress(ctx.req).ip;
+                await internal.audit
+                    .record({
+                    action: 'token-revoked',
+                    userId: ctx.user.id,
+                    ...(ip !== null ? { ip } : {}),
+                    detail: { tokenId: input.id },
+                })
+                    .catch(() => { });
+            }
+            return { success };
+        }),
+    };
+}
+/** Days → the `expiresIn` seconds the mint takes. */
+function daysToSeconds(days) {
+    return (days * DAY_MS) / 1000;
+}