@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/Password.js

@@ -1,19 +1,28 @@
 import { Context, Data, Duration, Effect, Encoding, Layer, Option, Redacted, Result, } from "effect";
+import { passwordEvidence } from "./Assurance.js";
 import { AuthFlow, AuthResult } from "./AuthFlow.js";
 import { Challenge } from "./Challenge.js";
 import { Crypto } from "./Crypto.js";
-import { CredentialId, Email, UserId } from "./Identifiers.js";
+import { EmailAcceptancePolicy, EmailAcceptancePolicyNoopLive, EmailNotAcceptedError, } from "./EmailRisk.js";
+import { CredentialId, Email, IdentityId, UserId } from "./Identifiers.js";
+import { IdentityKindRegistry } from "./Identity.js";
 import { addMillis, currentUnixMillis, timingSafeEqualString, } from "./Internal.js";
 import { AuthMailer } from "./Mailer.js";
-import { CredentialStore, SessionStore, UserStore } from "./Storage.js";
+import { enforcePasswordRisk, PasswordRiskPolicy, PasswordRiskPolicyNoopLive, } from "./PasswordRisk.js";
+import { CredentialStore, IdentityStore, RegistrationStore, SessionStore, UserStore, } from "./Storage.js";
 export class PasswordHashError extends Data.TaggedError("PasswordHashError") {
 }
 export class PasswordHasher extends Context.Service()("auth/PasswordHasher") {
 }
-(function (PasswordHasher) {
-    PasswordHasher.make = (service) => PasswordHasher.of(service);
-})(PasswordHasher || (PasswordHasher = {}));
 const textEncoder = new TextEncoder();
+export const defaultPasswordMaxBytes = 1024;
+export class PasswordTooLongError extends Data.TaggedError("PasswordTooLongError") {
+}
+const validatePasswordSize = (password, maximum = defaultPasswordMaxBytes) => textEncoder.encode(Redacted.value(password)).byteLength <= maximum
+    ? Effect.void
+    : Effect.fail(new PasswordTooLongError({
+        message: "Password does not meet policy requirements",
+    }));
 const passwordHashPrefix = "pbkdf2-sha256";
 const getWebCrypto = (options, operation) => Effect.gen(function* () {
     const crypto = options.webCrypto ?? globalThis.crypto;
@@ -72,7 +81,7 @@ export const makePbkdf2PasswordHasher = (dependencies) => {
     const iterations = dependencies.iterations ?? 210_000;
     const saltBytes = dependencies.saltBytes ?? 16;
     const hashBytes = dependencies.hashBytes ?? 32;
-    return PasswordHasher.make({
+    return PasswordHasher.of({
         hash: Effect.fn("auth.password_hash.pbkdf2.hash")(function* (input) {
             const webCrypto = yield* getWebCrypto(dependencies, "hash");
             const salt = yield* dependencies.crypto.randomBytes(saltBytes).pipe(Effect.mapError((cause) => new PasswordHashError({
@@ -130,15 +139,25 @@ export const Pbkdf2PasswordHasherLive = (options) => Layer.effect(PasswordHasher
         crypto,
     });
 }));
-export class PasswordLogin extends Context.Service()("auth/login/Password") {
+export class PasswordPrimaryFactor extends Context.Service()("auth/primary-factor/Password") {
 }
-(function (PasswordLogin) {
-    PasswordLogin.make = (service) => PasswordLogin.of(service);
-})(PasswordLogin || (PasswordLogin = {}));
-export const makePasswordLogin = (dependencies) => PasswordLogin.make({
-    signIn: Effect.fn("auth.password.sign_in")(function* (input) {
+export const makePasswordPrimaryFactor = (dependencies) => PasswordPrimaryFactor.of({
+    verify: Effect.fn("auth.password.primary_factor.verify")(function* (input) {
         yield* Effect.annotateCurrentSpan("auth.method", "password");
-        const user = yield* dependencies.users.findByEmail(input.email);
+        const normalizedOption = yield* dependencies.identityKinds
+            .normalize(input.identity)
+            .pipe(Effect.option);
+        if (Option.isNone(normalizedOption)) {
+            yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
+            return AuthResult.InvalidCredentials();
+        }
+        const normalized = normalizedOption.value;
+        const identity = yield* dependencies.identities.findByKindAndNormalizedValue(normalized);
+        if (Option.isNone(identity)) {
+            yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
+            return AuthResult.InvalidCredentials();
+        }
+        const user = yield* dependencies.users.findById(identity.value.userId);
         if (Option.isNone(user)) {
             yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
             return AuthResult.InvalidCredentials();
@@ -147,7 +166,7 @@ export const makePasswordLogin = (dependencies) => PasswordLogin.make({
             yield* Effect.annotateCurrentSpan("auth.result", "AccountDisabled");
             return AuthResult.AccountDisabled();
         }
-        const credential = yield* dependencies.credentials.findPasswordByUserId(user.value.id);
+        const credential = yield* dependencies.credentials.findPasswordByUserId(identity.value.userId);
         if (Option.isNone(credential) ||
             credential.value.revokedAt !== undefined) {
             yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
@@ -161,83 +180,180 @@ export const makePasswordLogin = (dependencies) => PasswordLogin.make({
             yield* Effect.annotateCurrentSpan("auth.result", "InvalidCredentials");
             return AuthResult.InvalidCredentials();
         }
-        return yield* dependencies.authFlow.completePrimaryFactor({
+        yield* Effect.annotateCurrentSpan("auth.result", "Verified");
+        const verifiedAt = yield* currentUnixMillis;
+        return {
+            _tag: "Verified",
             userId: user.value.id,
-            email: user.value.email,
+            identity: {
+                identityId: identity.value.id,
+                kind: identity.value.kind,
+                verified: identity.value.verifiedAt !== undefined,
+            },
+            ...(identity.value.kind === "email"
+                ? {
+                    emailDestination: {
+                        identityId: identity.value.id,
+                        email: Email(identity.value.value),
+                    },
+                }
+                : {}),
             intent: "sign-in",
             method: "password",
-            amr: ["pwd"],
-            aal: "aal1",
-            claims: { emailVerified: user.value.emailVerified },
+            evidence: [
+                passwordEvidence({ credentialId: credential.value.id, verifiedAt }),
+            ],
+            claims: identity.value.verifiedAt === undefined
+                ? undefined
+                : { verifiedIdentityKinds: [identity.value.kind] },
             ...(input.trustedDeviceToken === undefined
                 ? {}
                 : { trustedDeviceToken: input.trustedDeviceToken }),
+            ...(input.deviceKey === undefined
+                ? {}
+                : { deviceKey: input.deviceKey }),
+            ...(input.locationKey === undefined
+                ? {}
+                : { locationKey: input.locationKey }),
             ...(input.request === undefined ? {} : { request: input.request }),
             ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
-        });
+        };
     }),
 });
+export const PasswordPrimaryFactorLive = Layer.effect(PasswordPrimaryFactor)(Effect.gen(function* () {
+    const users = yield* UserStore;
+    const identities = yield* IdentityStore;
+    const identityKinds = yield* IdentityKindRegistry;
+    const credentials = yield* CredentialStore;
+    const hasher = yield* PasswordHasher;
+    return makePasswordPrimaryFactor({
+        users,
+        identities,
+        identityKinds,
+        credentials,
+        hasher,
+    });
+}));
+export class PasswordLogin extends Context.Service()("auth/login/Password") {
+}
+export const makePasswordLogin = (dependencies) => {
+    const primaryFactor = makePasswordPrimaryFactor(dependencies);
+    return PasswordLogin.of({
+        signIn: Effect.fn("auth.password.sign_in")(function* (input) {
+            const verified = yield* primaryFactor.verify(input);
+            return verified._tag === "Verified"
+                ? yield* dependencies.authFlow.completePrimaryFactor(verified)
+                : verified;
+        }),
+    });
+};
 export const PasswordLoginLive = Layer.effect(PasswordLogin)(Effect.gen(function* () {
     const users = yield* UserStore;
+    const identities = yield* IdentityStore;
+    const identityKinds = yield* IdentityKindRegistry;
     const credentials = yield* CredentialStore;
     const hasher = yield* PasswordHasher;
     const authFlow = yield* AuthFlow;
     return makePasswordLogin({
         users,
+        identities,
+        identityKinds,
         credentials,
         hasher,
         authFlow,
     });
 }));
-export class EmailAlreadyRegisteredError extends Data.TaggedError("EmailAlreadyRegisteredError") {
+export class IdentityAlreadyRegisteredError extends Data.TaggedError("IdentityAlreadyRegisteredError") {
 }
 export class PasswordRegistration extends Context.Service()("auth/registration/Password") {
 }
-(function (PasswordRegistration) {
-    PasswordRegistration.make = (service) => PasswordRegistration.of(service);
-})(PasswordRegistration || (PasswordRegistration = {}));
 export const makePasswordRegistration = (dependencies) => {
     const userIdBytes = dependencies.userIdBytes ?? 16;
     const credentialIdBytes = dependencies.credentialIdBytes ?? 16;
-    return PasswordRegistration.make({
+    const identityIdBytes = dependencies.identityIdBytes ?? 16;
+    return PasswordRegistration.of({
         signUp: Effect.fn("auth.password.sign_up")(function* (input) {
             yield* Effect.annotateCurrentSpan("auth.method", "password");
-            const existing = yield* dependencies.users.findByEmail(input.email);
-            if (Option.isSome(existing)) {
-                yield* Effect.annotateCurrentSpan("auth.result", "EmailAlreadyRegistered");
-                return yield* new EmailAlreadyRegisteredError({ email: input.email });
+            yield* validatePasswordSize(input.password, dependencies.passwordMaxBytes);
+            const normalized = yield* dependencies.identityKinds.normalize(input.identity);
+            if (normalized.kind === "email" && dependencies.emailAcceptancePolicy) {
+                const decision = yield* dependencies.emailAcceptancePolicy.decide({
+                    email: Email(normalized.value),
+                    operation: "password-sign-up",
+                    metadata: input.metadata,
+                });
+                if (decision.type === "Deny") {
+                    return yield* new EmailNotAcceptedError({
+                        reason: "email-not-accepted",
+                    });
+                }
             }
+            yield* enforcePasswordRisk(dependencies.passwordRiskPolicy, {
+                password: input.password,
+                operation: "sign-up",
+            });
             const now = yield* currentUnixMillis;
-            const emailVerified = input.emailVerified ?? false;
             const userId = UserId(yield* dependencies.crypto.randomToken(userIdBytes));
+            const identityId = IdentityId(yield* dependencies.crypto.randomToken(identityIdBytes));
             const credentialId = CredentialId(yield* dependencies.crypto.randomToken(credentialIdBytes));
             const passwordHash = yield* dependencies.hasher.hash({
                 password: input.password,
             });
-            yield* dependencies.users.insert({
-                id: userId,
-                email: input.email,
-                emailVerified,
-                createdAt: now,
-                updatedAt: now,
-                metadata: input.metadata,
-            });
-            yield* dependencies.credentials.insertPassword({
-                id: credentialId,
-                userId,
-                passwordHash,
-                createdAt: now,
-                updatedAt: now,
-            });
+            const registered = yield* dependencies.registration
+                .create({
+                user: {
+                    id: userId,
+                    createdAt: now,
+                    updatedAt: now,
+                    metadata: input.metadata,
+                },
+                identity: {
+                    id: identityId,
+                    userId,
+                    scope: normalized.scope,
+                    kind: normalized.kind,
+                    value: normalized.value,
+                    normalizedValue: normalized.normalizedValue,
+                    isPrimaryLogin: true,
+                    createdAt: now,
+                },
+                passwordCredential: {
+                    id: credentialId,
+                    userId,
+                    passwordHash,
+                    createdAt: now,
+                    updatedAt: now,
+                },
+            })
+                .pipe(Effect.mapError((error) => error._tag === "RegistrationConflictError" &&
+                error.reason === "identity-value"
+                ? new IdentityAlreadyRegisteredError({ identity: normalized })
+                : error));
             yield* Effect.annotateCurrentSpan("auth.result", "registered");
             return yield* dependencies.authFlow.completePrimaryFactor({
                 userId,
-                email: input.email,
+                identity: {
+                    identityId: registered.identity.id,
+                    kind: registered.identity.kind,
+                    verified: false,
+                },
+                ...(registered.identity.kind === "email"
+                    ? {
+                        emailDestination: {
+                            identityId: registered.identity.id,
+                            email: Email(registered.identity.value),
+                        },
+                    }
+                    : {}),
                 intent: "sign-up",
                 method: "password",
-                amr: ["pwd"],
-                aal: "aal1",
-                claims: { emailVerified },
+                evidence: [passwordEvidence({ credentialId, verifiedAt: now })],
+                ...(input.deviceKey === undefined
+                    ? {}
+                    : { deviceKey: input.deviceKey }),
+                ...(input.locationKey === undefined
+                    ? {}
+                    : { locationKey: input.locationKey }),
                 ...(input.request === undefined ? {} : { request: input.request }),
                 ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
             });
@@ -245,17 +361,21 @@ export const makePasswordRegistration = (dependencies) => {
     });
 };
 export const PasswordRegistrationLive = Layer.effect(PasswordRegistration)(Effect.gen(function* () {
-    const users = yield* UserStore;
-    const credentials = yield* CredentialStore;
+    const registration = yield* RegistrationStore;
+    const identityKinds = yield* IdentityKindRegistry;
     const hasher = yield* PasswordHasher;
     const authFlow = yield* AuthFlow;
     const crypto = yield* Crypto;
+    const passwordRiskPolicy = yield* PasswordRiskPolicy;
+    const emailAcceptancePolicy = yield* EmailAcceptancePolicy;
     return makePasswordRegistration({
-        users,
-        credentials,
+        registration,
+        identityKinds,
         hasher,
         authFlow,
         crypto,
+        passwordRiskPolicy,
+        emailAcceptancePolicy,
     });
 }));
 export class PasswordResetStartError extends Data.TaggedError("PasswordResetStartError") {
@@ -264,15 +384,23 @@ export class PasswordResetVerifyError extends Data.TaggedError("PasswordResetVer
 }
 export class PasswordReset extends Context.Service()("auth/password/Reset") {
 }
-(function (PasswordReset) {
-    PasswordReset.make = (service) => PasswordReset.of(service);
-})(PasswordReset || (PasswordReset = {}));
 export const defaultPasswordResetTtl = Duration.minutes(15);
 export const defaultPasswordResetSecretBytes = 32;
-const passwordResetUserIdFromMetadata = (metadata) => {
+const passwordResetBindingFromMetadata = (metadata) => {
     const userId = metadata?.userId;
-    return typeof userId === "string" && userId.length > 0
-        ? UserId(userId)
+    const identityId = metadata?.identityId;
+    const normalizedValue = metadata?.normalizedValue;
+    return typeof userId === "string" &&
+        userId.length > 0 &&
+        typeof identityId === "string" &&
+        identityId.length > 0 &&
+        typeof normalizedValue === "string" &&
+        normalizedValue.length > 0
+        ? {
+            userId: UserId(userId),
+            identityId: IdentityId(identityId),
+            normalizedValue,
+        }
         : undefined;
 };
 const passwordResetTtlMillis = (ttl) => {
@@ -307,22 +435,45 @@ export const makePasswordReset = (dependencies) => {
     const ttl = dependencies.ttl ?? defaultPasswordResetTtl;
     const secretBytes = dependencies.secretBytes ?? defaultPasswordResetSecretBytes;
     const credentialIdBytes = dependencies.credentialIdBytes ?? 16;
-    return PasswordReset.make({
+    return PasswordReset.of({
         start: Effect.fn("auth.password_reset.start")(function* (input) {
             yield* Effect.annotateCurrentSpan("auth.method", "password-reset");
             const resolvedTtl = input.ttl ?? ttl;
             const expiresIn = yield* passwordResetTtlMillis(resolvedTtl);
             const now = yield* currentUnixMillis;
+            const normalized = yield* dependencies.identityKinds
+                .normalize(input.identity)
+                .pipe(Effect.mapError((cause) => new PasswordResetStartError({
+                message: "Invalid password reset identity",
+                cause,
+            })));
+            if (normalized.kind !== "email" || normalized.scope.type !== "global") {
+                return yield* new PasswordResetStartError({
+                    message: "Password reset requires a global email identity",
+                });
+            }
             const genericStarted = {
-                email: input.email,
+                email: Email(normalized.value),
                 expiresAt: addMillis(now, expiresIn),
             };
-            const userOption = yield* dependencies.users.findByEmail(input.email).pipe(Effect.mapError((cause) => new PasswordResetStartError({
+            const identityOption = yield* dependencies.identities
+                .findByKindAndNormalizedValue(normalized)
+                .pipe(Effect.mapError((cause) => new PasswordResetStartError({
+                message: "Failed to load identity for password reset",
+                cause,
+            })));
+            if (Option.isNone(identityOption)) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PasswordResetIgnored");
+                return genericStarted;
+            }
+            const identity = identityOption.value;
+            const userOption = yield* dependencies.users
+                .findById(identity.userId)
+                .pipe(Effect.mapError((cause) => new PasswordResetStartError({
                 message: "Failed to load user for password reset",
                 cause,
             })));
             if (Option.isNone(userOption)) {
-                yield* Effect.annotateCurrentSpan("auth.result", "PasswordResetIgnored");
                 return genericStarted;
             }
             const user = userOption.value;
@@ -345,12 +496,14 @@ export const makePasswordReset = (dependencies) => {
             const issued = yield* dependencies.challenge
                 .issue({
                 type: "reset-password",
-                subject: user.email,
+                subject: identity.value,
                 ttl: resolvedTtl,
                 secret,
                 metadata: {
                     ...input.metadata,
                     userId: user.id,
+                    identityId: identity.id,
+                    normalizedValue: identity.normalizedValue,
                 },
             })
                 .pipe(Effect.mapError((cause) => new PasswordResetStartError({
@@ -358,7 +511,7 @@ export const makePasswordReset = (dependencies) => {
                 cause,
             })));
             const started = {
-                email: user.email,
+                email: Email(identity.value),
                 expiresAt: issued.expiresAt,
             };
             const url = yield* makePasswordResetUrl(dependencies, {
@@ -374,7 +527,7 @@ export const makePasswordReset = (dependencies) => {
             yield* dependencies.authMailer
                 .send({
                 _tag: "PasswordReset",
-                to: user.email,
+                to: Email(identity.value),
                 challengeId: issued.id,
                 url,
                 expiresAt: issued.expiresAt,
@@ -393,6 +546,10 @@ export const makePasswordReset = (dependencies) => {
         }),
         verify: Effect.fn("auth.password_reset.verify")(function* (input) {
             yield* Effect.annotateCurrentSpan("auth.method", "password-reset");
+            yield* validatePasswordSize(input.password, dependencies.passwordMaxBytes).pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                message: "Password does not meet policy requirements",
+                cause,
+            })));
             const verified = yield* dependencies.challenge
                 .verify({
                 challengeId: input.challengeId,
@@ -403,25 +560,39 @@ export const makePasswordReset = (dependencies) => {
                 message: "Invalid password reset challenge",
                 cause,
             })));
-            const userId = passwordResetUserIdFromMetadata(verified.metadata);
-            if (userId === undefined) {
+            const binding = passwordResetBindingFromMetadata(verified.metadata);
+            if (binding === undefined) {
                 return yield* new PasswordResetVerifyError({
                     message: "Password reset challenge is missing user metadata",
                 });
             }
-            const userOption = yield* dependencies.users.findById(userId).pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+            const identityOption = yield* dependencies.identities
+                .findById(binding.identityId)
+                .pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                message: "Failed to load identity for password reset",
+                cause,
+            })));
+            const userOption = yield* dependencies.users
+                .findById(binding.userId)
+                .pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
                 message: "Failed to load user for password reset",
                 cause,
             })));
-            if (Option.isNone(userOption) ||
-                userOption.value.disabledAt !== undefined ||
-                userOption.value.email !== Email(verified.subject)) {
+            if (Option.isNone(identityOption) ||
+                identityOption.value.revokedAt !== undefined ||
+                identityOption.value.userId !== binding.userId ||
+                identityOption.value.kind !== "email" ||
+                identityOption.value.scope.type !== "global" ||
+                identityOption.value.normalizedValue !== binding.normalizedValue ||
+                identityOption.value.value !== verified.subject ||
+                Option.isNone(userOption) ||
+                userOption.value.disabledAt !== undefined) {
                 return yield* new PasswordResetVerifyError({
                     message: "Invalid password reset challenge",
                 });
             }
             const credentialOption = yield* dependencies.credentials
-                .findPasswordByUserId(userId)
+                .findPasswordByUserId(binding.userId)
                 .pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
                 message: "Failed to load password credential for reset",
                 cause,
@@ -432,6 +603,14 @@ export const makePasswordReset = (dependencies) => {
                     message: "Password credential not found",
                 });
             }
+            yield* enforcePasswordRisk(dependencies.passwordRiskPolicy, {
+                password: input.password,
+                operation: "reset",
+            }).pipe(Effect.mapError((cause) => new PasswordResetVerifyError({
+                message: "Password does not meet policy requirements",
+                cause,
+            })));
+            const { userId } = binding;
             const now = yield* currentUnixMillis;
             const passwordHash = yield* dependencies.hasher
                 .hash({ password: input.password })
@@ -491,25 +670,31 @@ export const makePasswordReset = (dependencies) => {
 export const PasswordResetLive = (options) => Layer.effect(PasswordReset)(Effect.gen(function* () {
     const challenge = yield* Challenge;
     const users = yield* UserStore;
+    const identities = yield* IdentityStore;
+    const identityKinds = yield* IdentityKindRegistry;
     const credentials = yield* CredentialStore;
     const hasher = yield* PasswordHasher;
     const crypto = yield* Crypto;
     const authMailer = yield* AuthMailer;
     const sessionStore = yield* SessionStore;
+    const passwordRiskPolicy = yield* PasswordRiskPolicy;
     return makePasswordReset({
         ...options,
         challenge,
         users,
+        identities,
+        identityKinds,
         credentials,
         hasher,
         crypto,
         authMailer,
         sessionStore,
+        passwordRiskPolicy,
     });
 }));
-export const PasswordResetFeatureLive = (options) => {
+export const PasswordResetDefaultLive = (options, passwordRiskPolicy = PasswordRiskPolicyNoopLive) => {
     const { passwordHasher, ...resetOptions } = options;
-    return PasswordResetLive(resetOptions).pipe(Layer.provideMerge(Pbkdf2PasswordHasherLive(passwordHasher)));
+    return PasswordResetLive(resetOptions).pipe(Layer.provideMerge(Pbkdf2PasswordHasherLive(passwordHasher)), Layer.provideMerge(passwordRiskPolicy));
 };
 export class PasswordSetError extends Data.TaggedError("PasswordSetError") {
 }
@@ -517,13 +702,15 @@ export class PasswordChangeError extends Data.TaggedError("PasswordChangeError")
 }
 export class PasswordManagement extends Context.Service()("auth/password/Management") {
 }
-(function (PasswordManagement) {
-    PasswordManagement.make = (service) => PasswordManagement.of(service);
-})(PasswordManagement || (PasswordManagement = {}));
 export const makePasswordManagement = (dependencies) => {
     const credentialIdBytes = dependencies.credentialIdBytes ?? 16;
-    return PasswordManagement.make({
+    return PasswordManagement.of({
         set: Effect.fn("auth.password.set")(function* (input) {
+            yield* validatePasswordSize(input.password, dependencies.passwordMaxBytes).pipe(Effect.mapError((cause) => new PasswordSetError({
+                reason: "password_policy_rejected",
+                message: "Password does not meet policy requirements",
+                cause,
+            })));
             const credential = yield* dependencies.credentials
                 .findPasswordByUserId(input.userId)
                 .pipe(Effect.mapError((cause) => new PasswordSetError({
@@ -539,6 +726,14 @@ export const makePasswordManagement = (dependencies) => {
                     message: "Password credential already exists",
                 });
             }
+            yield* enforcePasswordRisk(dependencies.passwordRiskPolicy, {
+                password: input.password,
+                operation: "set",
+            }).pipe(Effect.mapError((cause) => new PasswordSetError({
+                reason: "password_policy_rejected",
+                message: "Password does not meet policy requirements",
+                cause,
+            })));
             const now = yield* currentUnixMillis;
             const credentialId = CredentialId(yield* dependencies.crypto.randomToken(credentialIdBytes).pipe(Effect.mapError((cause) => new PasswordSetError({
                 reason: "internal",
@@ -568,6 +763,11 @@ export const makePasswordManagement = (dependencies) => {
             })));
         }),
         change: Effect.fn("auth.password.change")(function* (input) {
+            yield* validatePasswordSize(input.newPassword, dependencies.passwordMaxBytes).pipe(Effect.mapError((cause) => new PasswordChangeError({
+                reason: "password_policy_rejected",
+                message: "Password does not meet policy requirements",
+                cause,
+            })));
             const credential = yield* dependencies.credentials
                 .findPasswordByUserId(input.userId)
                 .pipe(Effect.mapError((cause) => new PasswordChangeError({
@@ -603,6 +803,14 @@ export const makePasswordManagement = (dependencies) => {
                     message: "Current password is invalid",
                 });
             }
+            yield* enforcePasswordRisk(dependencies.passwordRiskPolicy, {
+                password: input.newPassword,
+                operation: "change",
+            }).pipe(Effect.mapError((cause) => new PasswordChangeError({
+                reason: "password_policy_rejected",
+                message: "Password does not meet policy requirements",
+                cause,
+            })));
             const now = yield* currentUnixMillis;
             const passwordHash = yield* dependencies.hasher
                 .hash({ password: input.newPassword })
@@ -635,7 +843,13 @@ export const PasswordManagementLive = Layer.effect(PasswordManagement)(Effect.ge
     const credentials = yield* CredentialStore;
     const hasher = yield* PasswordHasher;
     const crypto = yield* Crypto;
-    return makePasswordManagement({ credentials, hasher, crypto });
+    const passwordRiskPolicy = yield* PasswordRiskPolicy;
+    return makePasswordManagement({
+        credentials,
+        hasher,
+        crypto,
+        passwordRiskPolicy,
+    });
 }));
-export const PasswordFeatureLive = (options) => Layer.mergeAll(PasswordLoginLive, PasswordRegistrationLive, PasswordManagementLive).pipe(Layer.provideMerge(Pbkdf2PasswordHasherLive(options)));
+export const PasswordDefaultLive = (options, passwordRiskPolicy = PasswordRiskPolicyNoopLive, emailAcceptancePolicy = EmailAcceptancePolicyNoopLive) => Layer.mergeAll(PasswordPrimaryFactorLive, PasswordLoginLive, PasswordRegistrationLive, PasswordManagementLive).pipe(Layer.provideMerge(Pbkdf2PasswordHasherLive(options)), Layer.provideMerge(passwordRiskPolicy), Layer.provideMerge(emailAcceptancePolicy));
 //# sourceMappingURL=Password.js.map