@endora-commerce/mod-auth 0.0.0-stage → 0.100.0

package/dist/backend/services/session-service.js

@@ -0,0 +1,200 @@
+import { createHash, randomBytes } from 'crypto';
+import { Session } from '../entities/session.entity.js';
+/**
+ * Session lifecycle. Persists to Postgres as the source of truth; caches hot reads in
+ * Redis to cut per-request latency (R-11).
+ *
+ * Cookie format: `${sessionId}.${rawToken}`. We store the SHA-256 of rawToken as
+ * `tokenHash`. Lookups validate sessionId → row → timing-safe equal on the hash.
+ */
+const SESSION_TTL_SECONDS = 60 * 60 * 24 * 30; // 30 days
+const REDIS_KEY_PREFIX = 'session:';
+export class SessionService {
+    emFactory;
+    redis;
+    constructor(emFactory, redis) {
+        this.emFactory = emFactory;
+        this.redis = redis;
+    }
+    async createSession(input) {
+        // command-coverage-ignore: session lifecycle — mints an auth session; auth
+        // infrastructure (owned by SessionService), not an audited domain write.
+        const em = this.emFactory();
+        const rawToken = randomBytes(32).toString('base64url');
+        const tokenHash = sha256Hex(rawToken);
+        const expiresAt = new Date(Date.now() + SESSION_TTL_SECONDS * 1_000);
+        const session = em.create(Session, {
+            tokenHash,
+            expiresAt,
+            // Feature 040 — stamp activity at creation so a freshly-authenticated
+            // customer shows up in the admin "online" view immediately.
+            lastSeenAt: new Date(),
+            ...(input.customerAccountId !== undefined ? { customerAccountId: input.customerAccountId } : {}),
+            ...(input.adminUserId !== undefined ? { adminUserId: input.adminUserId } : {}),
+            ...(input.impersonatorAdminUserId !== undefined
+                ? { impersonatorAdminUserId: input.impersonatorAdminUserId }
+                : {}),
+            ...(input.ipAddress !== undefined ? { ipAddress: input.ipAddress } : {}),
+            ...(input.userAgent !== undefined ? { userAgent: input.userAgent } : {}),
+        });
+        await em.persistAndFlush(session);
+        await this.cache(session);
+        return {
+            cookieValue: `${session.id}.${rawToken}`,
+            expiresAt,
+            session,
+        };
+    }
+    async loadSession(cookieValue) {
+        const dot = cookieValue.indexOf('.');
+        if (dot === -1)
+            return null;
+        const sessionId = cookieValue.slice(0, dot);
+        const rawToken = cookieValue.slice(dot + 1);
+        if (!sessionId || !rawToken)
+            return null;
+        const expectedHash = sha256Hex(rawToken);
+        const cached = await this.redis.get(REDIS_KEY_PREFIX + sessionId);
+        if (cached) {
+            const parsed = JSON.parse(cached);
+            if (!timingSafeEqual(parsed.tokenHash, expectedHash))
+                return null;
+            if (new Date(parsed.expiresAt).getTime() <= Date.now())
+                return null;
+            return { session: deserialise(parsed.session), kind: deriveKind(parsed.session) };
+        }
+        const em = this.emFactory();
+        const session = await em.findOne(Session, { id: sessionId });
+        if (!session)
+            return null;
+        if (!timingSafeEqual(session.tokenHash, expectedHash))
+            return null;
+        if (session.expiresAt.getTime() <= Date.now())
+            return null;
+        await this.cache(session);
+        return { session, kind: deriveKind(session) };
+    }
+    async destroySession(sessionId) {
+        // command-coverage-ignore: session lifecycle — logout/session revoke; auth
+        // infrastructure, not an audited domain write.
+        const em = this.emFactory();
+        const session = await em.findOne(Session, { id: sessionId });
+        if (session) {
+            await em.removeAndFlush(session);
+        }
+        await this.redis.del(REDIS_KEY_PREFIX + sessionId);
+    }
+    /**
+     * Revoke every active session for a Customer — used when an account is
+     * blocked or soft-deleted so it loses access promptly (feature 040,
+     * FR-016/SC-002). Clears both the Postgres rows and their Redis caches.
+     */
+    async destroyAllForCustomer(customerAccountId) {
+        // command-coverage-ignore: session lifecycle — revokes all sessions for a
+        // customer; auth infrastructure, not an audited domain write.
+        const em = this.emFactory();
+        const sessions = await em.find(Session, { customerAccountId });
+        if (sessions.length === 0)
+            return;
+        for (const session of sessions) {
+            await this.redis.del(REDIS_KEY_PREFIX + session.id);
+        }
+        await em.removeAndFlush(sessions);
+    }
+    /**
+     * Revoke every session an admin user holds — both the sessions they signed
+     * in with and the impersonations they started, which carry the admin id in
+     * `impersonatorAdminUserId` and a customer id in `customerAccountId`. Used
+     * when a peer resets their password (issue #252): a session that survives
+     * the reset is a credential the reset did not withdraw, which is exactly
+     * what the compromised-account case needs withdrawn.
+     */
+    async destroyAllForAdmin(adminUserId) {
+        // command-coverage-ignore: session lifecycle — revokes all sessions for an
+        // admin; auth infrastructure. The domain-state write that triggers it is
+        // audited by its own caller (`admin_user.change_password`).
+        const em = this.emFactory();
+        const sessions = await em.find(Session, {
+            $or: [{ adminUserId }, { impersonatorAdminUserId: adminUserId }],
+        });
+        if (sessions.length === 0)
+            return;
+        for (const session of sessions) {
+            await this.redis.del(REDIS_KEY_PREFIX + session.id);
+        }
+        await em.removeAndFlush(sessions);
+    }
+    /**
+     * Feature 040 — stamp activity, throttled to at most once per minute per
+     * session (Redis marker) to avoid write amplification on every request.
+     */
+    async touchLastSeen(sessionId) {
+        // command-coverage-ignore: session lifecycle — refreshes last-seen presence;
+        // high-volume auth bookkeeping, not an audited domain write.
+        const marker = `seen:${sessionId}`;
+        const set = await this.redis.set(marker, '1', 'EX', 60, 'NX');
+        if (set === null)
+            return; // touched within the last minute
+        const em = this.emFactory();
+        await em.nativeUpdate(Session, { id: sessionId }, { lastSeenAt: new Date() });
+    }
+    /**
+     * Feature 040 — distinct customer ids whose session was active within the
+     * freshness window, for the admin "online customers" view.
+     */
+    async listRecentlyActiveCustomers(windowMinutes) {
+        const em = this.emFactory();
+        const cutoff = new Date(Date.now() - windowMinutes * 60 * 1000);
+        const rows = await em.find(Session, { customerAccountId: { $ne: null }, lastSeenAt: { $gte: cutoff } }, { fields: ['customerAccountId'] });
+        return [...new Set(rows.map((r) => r.customerAccountId).filter((x) => !!x))];
+    }
+    async cache(session) {
+        const ttl = Math.max(1, Math.floor((session.expiresAt.getTime() - Date.now()) / 1_000));
+        const payload = {
+            tokenHash: session.tokenHash,
+            expiresAt: session.expiresAt.toISOString(),
+            session: serialise(session),
+        };
+        await this.redis.set(REDIS_KEY_PREFIX + session.id, JSON.stringify(payload), 'EX', ttl);
+    }
+}
+function serialise(session) {
+    return {
+        id: session.id,
+        tokenHash: session.tokenHash,
+        customerAccountId: session.customerAccountId ?? null,
+        adminUserId: session.adminUserId ?? null,
+        impersonatorAdminUserId: session.impersonatorAdminUserId ?? null,
+        expiresAt: session.expiresAt.toISOString(),
+    };
+}
+function deserialise(s) {
+    const session = new Session();
+    session.id = s.id;
+    session.tokenHash = s.tokenHash;
+    session.customerAccountId = s.customerAccountId;
+    session.adminUserId = s.adminUserId;
+    session.impersonatorAdminUserId = s.impersonatorAdminUserId;
+    session.expiresAt = new Date(s.expiresAt);
+    return session;
+}
+function deriveKind(session) {
+    if (session.impersonatorAdminUserId)
+        return 'impersonation';
+    if (session.adminUserId)
+        return 'admin';
+    return 'customer';
+}
+function sha256Hex(input) {
+    return createHash('sha256').update(input, 'utf8').digest('hex');
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=session-service.js.map

package/dist/backend/services/session-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-service.js","sourceRoot":"","sources":["../../../src/backend/services/session-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAGjD,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAExD;;;;;;GAMG;AAEH,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACzD,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAwBpC,MAAM,OAAO,cAAc;IAEN;IACA;IAFnB,YACmB,SAA8B,EAC9B,KAAY;QADZ,cAAS,GAAT,SAAS,CAAqB;QAC9B,UAAK,GAAL,KAAK,CAAO;IAC5B,CAAC;IAEJ,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,GAAG,KAAK,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;YACjC,SAAS;YACT,SAAS;YACT,sEAAsE;YACtE,4DAA4D;YAC5D,UAAU,EAAE,IAAI,IAAI,EAAE;YACtB,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,EAAE;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE1B,OAAO;YACL,WAAW,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,QAAQ,EAAE;YACxC,SAAS;YACT,OAAO;SACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB;QACnC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;QAClE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAyE,CAAC;YAC1G,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpF,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAE3D,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,2EAA2E;QAC3E,+CAA+C;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,qBAAqB,CAAC,iBAAyB;QACnD,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,WAAmB;QAC1C,2EAA2E;QAC3E,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACtC,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,uBAAuB,EAAE,WAAW,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,6EAA6E;QAC7E,6DAA6D;QAC7D,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,CAAC,iCAAiC;QAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAAC,aAAqB;QACrD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CACxB,OAAO,EACP,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAClE,EAAE,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAClC,CAAC;QACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAAgB;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC;SAC5B,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;CACF;AAWD,SAAS,SAAS,CAAC,OAAgB;IACjC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;QACpD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,IAAI,IAAI;QAChE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAoB;IACvC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAClB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAChC,OAAO,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;IAChD,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACpC,OAAO,CAAC,uBAAuB,GAAG,CAAC,CAAC,uBAAuB,CAAC;IAC5D,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAuF;IACzG,IAAI,OAAO,CAAC,uBAAuB;QAAE,OAAO,eAAe,CAAC;IAC5D,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Auth module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ */
+export declare const manifest: {
+    id: string;
+    name: string;
+    version: string;
+    dependencies: string[];
+    description?: string | undefined;
+    acknowledgedDependencies?: {
+        moduleId: string;
+        port: string;
+        reason: string;
+    }[] | undefined;
+    nonBindingDependencies?: {
+        moduleId: string;
+        name: string;
+        kind: "contributes-to" | "degrades-without" | "refuses-without";
+        reason: string;
+        whenAbsent?: string | undefined;
+    }[] | undefined;
+    activation?: {
+        settingCode: string;
+        default: boolean;
+    } | {
+        nonDeactivatable: true;
+        reason: string;
+    } | undefined;
+    settings?: {
+        moduleCode: string;
+        groups: {
+            code: string;
+            name: string;
+            salesChannelCodes?: string[] | undefined;
+            isSystemProtected?: boolean | undefined;
+        }[];
+        settings: {
+            code: string;
+            name: string;
+            valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+            defaultValue: unknown;
+            description?: string | undefined;
+            groupCode?: string | undefined;
+            previousDefaultValues?: unknown[] | undefined;
+            salesChannelCodes?: string[] | undefined;
+            enumOptions?: string[] | undefined;
+            configurationType?: string | undefined;
+            hidden?: boolean | undefined;
+        }[];
+    } | undefined;
+    i18n?: {
+        bundlesDir: string;
+    } | undefined;
+    docs?: false | {
+        dir: string;
+    } | undefined;
+    demo?: false | {
+        summary: string;
+        seed: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoSeedResult>;
+        reset: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoResetResult>;
+        after?: readonly string[] | undefined;
+        package?: string | undefined;
+    } | undefined;
+    actions?: {
+        id: string;
+        labelKey: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        targetRoute: string;
+        keywords: string[];
+        weight: number;
+        descriptionKey?: string | undefined;
+        requiredPermission?: string | undefined;
+    }[] | undefined;
+    permissions?: {
+        code: string;
+        label: string;
+        module?: string | undefined;
+        description?: string | undefined;
+        requires?: string[] | undefined;
+    }[] | undefined;
+    transactionalEmails?: {
+        code: string;
+        name: string;
+        variables: {
+            key: string;
+            label: string;
+            sampleValue?: string | undefined;
+            description?: string | undefined;
+        }[];
+        description?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    capabilities?: string[] | undefined;
+    exclusiveCapabilities?: {
+        key: string;
+        errorCode: string;
+    }[] | undefined;
+    errorCodes?: {
+        code: string;
+        tokens?: string[] | undefined;
+    }[] | undefined;
+    blocks?: {
+        name: string;
+        labelKey: string;
+        category: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        fields: Record<string, {
+            type: "number" | "object" | "array" | "text" | "textarea" | "select" | "radio" | "external" | "uuid" | "richtext";
+            label?: string | undefined;
+            required?: boolean | undefined;
+            options?: {
+                label: string;
+                value: string | number;
+            }[] | undefined;
+            refKind?: string | undefined;
+        }>;
+        descriptionKey?: string | undefined;
+        defaultProps?: Record<string, unknown> | undefined;
+        responsiveFields?: string[] | undefined;
+        previewIcon?: string | undefined;
+        weight?: number | undefined;
+    }[] | undefined;
+    blockCategories?: {
+        key: string;
+        titleKey: string;
+        contexts: ("invoice" | "email" | "cms" | "newsletter")[];
+        weight?: number | undefined;
+        visible?: boolean | undefined;
+    }[] | undefined;
+    env?: {
+        name: string;
+        describes: {
+            en: string;
+            pl: string;
+        };
+        requirement: {
+            kind: "required";
+        } | {
+            kind: "requiredWhen";
+            input: string;
+            equals: string;
+        } | {
+            kind: "optional";
+            without: {
+                en: string;
+                pl: string;
+            };
+        };
+        secret: boolean;
+        generable: boolean;
+        owner: {
+            kind: "platform";
+        } | {
+            kind: "application";
+            application: "admin" | "backend" | "storefront";
+        } | {
+            kind: "module";
+            moduleId: string;
+        };
+        consumers: ("admin" | "backend" | "storefront")[];
+        addressOf: "admin" | "backend" | "storefront" | null;
+    }[] | undefined;
+};
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEnB,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,71 @@
+import { defineModuleManifest } from '@endora-commerce/contracts';
+/**
+ * Auth module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ */
+export const manifest = defineModuleManifest({
+    id: 'auth',
+    docs: { dir: 'docs' },
+    name: 'Auth',
+    description: 'Authentication primitives — session cookies, bearer-token resolution, and request actor binding.',
+    version: '1.0.0',
+    // Feature 072, D-32 — `auth` owns the one `requireAdmin` implementation, and
+    // that guard checks a permission through `admin_roles`' PermissionService.
+    // The edge existed in the code long before it existed in the manifest; it is
+    // one of the 261 imported-but-undeclared dependencies F3 will finish fixing.
+    dependencies: ['admin_roles'],
+    /**
+     * The customer-organization lookup the request actor is bound with (issue
+     * #90). `customer_accounts` owns it and declares `auth`, so declaring it back
+     * closes a cycle — the mutual shape `acknowledgedDependencies` exists for.
+     * With `customer_accounts` absent the resolution fails closed, so a signed-in
+     * customer the platform cannot place in an Organization is refused rather than
+     * bound to none — which is the cost of the edge, and the sort of thing a
+     * reason can state without copying a fact the build re-derives (D-100).
+     *
+     * The read stayed invisible until `check-port-dependencies` learned to follow
+     * a module-local cradle alias, which is how a real port edge in the request
+     * hook of the one module every request passes through went undeclared.
+     */
+    acknowledgedDependencies: [
+        {
+            moduleId: 'customer_accounts',
+            port: 'customerOrgResolver',
+            reason: 'Binding request.actor for a signed-in customer resolves their Organization through ' +
+                'customer_accounts, which declares auth — declaring it back closes a cycle. With ' +
+                'customer_accounts absent the gated port refuses, so actor binding fails closed rather ' +
+                'than treating a signed-in customer as belonging to no Organization.',
+        },
+    ],
+    // D-44 — real to the container, binding on no operator.
+    nonBindingDependencies: [
+        {
+            moduleId: 'api_keys',
+            name: 'apiKeyResolver',
+            kind: 'degrades-without',
+            whenAbsent: 'requests presenting an API key are not authenticated',
+            reason: 'The request hook binds `request.actor` from a bearer API key when one is presented. ' +
+                '`api_keys` declares this module, so the ordinary declaration closes a cycle, and ' +
+                'acknowledging it would put `auth` — present in every deployment — among the ' +
+                'dependents that refuse the flip, making an integration surface permanently ' +
+                'unswitchable. The hook has a defined behaviour instead: it probes presence, and an ' +
+                'API key presented to a deployment with the module off authenticates nobody, exactly ' +
+                'as a request carrying no key does. Every session-authenticated request is untouched.',
+        },
+    ],
+    // Feature 072/073 (Constitution XVII) — `auth` resolves `request.actor` for
+    // every request and owns the `requireAdmin` port that gates 205 call sites in
+    // 60 modules. A deployment with it switched off has no admin surface and no
+    // customer session, which is not a smaller platform but a broken one. The
+    // orchestrator refuses to disable it, with no `--force`.
+    activation: {
+        nonDeactivatable: true,
+        reason: 'Resolves the actor for every request and owns the requireAdmin guard; switched off, the ' +
+            'platform has no admin surface and no customer sessions.',
+    },
+});
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB,IAAI,EAAE,MAAM;IACZ,WAAW,EACT,kGAAkG;IACpG,OAAO,EAAE,OAAO;IAChB,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,YAAY,EAAE,CAAC,aAAa,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,wBAAwB,EAAE;QACxB;YACE,QAAQ,EAAE,mBAAmB;YAC7B,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EACJ,qFAAqF;gBACrF,kFAAkF;gBAClF,wFAAwF;gBACxF,qEAAqE;SACxE;KACF;IACD,wDAAwD;IACxD,sBAAsB,EAAE;QACtB;YACE,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE,sDAAsD;YAClE,MAAM,EACJ,sFAAsF;gBACtF,mFAAmF;gBACnF,8EAA8E;gBAC9E,6EAA6E;gBAC7E,qFAAqF;gBACrF,sFAAsF;gBACtF,sFAAsF;SACzF;KACF;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,yDAAyD;IACzD,UAAU,EAAE;QACV,gBAAgB,EAAE,IAAI;QACtB,MAAM,EACJ,0FAA0F;YAC1F,yDAAyD;KAC5D;CACF,CAAC,CAAC"}

package/docs/auth.md

@@ -0,0 +1,42 @@
+---
+title: auth
+description: Customer + admin sessions, password hashing, TOTP
+---
+
+# `auth`
+
+Shared session, password-hashing, and TOTP primitives consumed by both
+`customer_accounts` and `admin_users`. One of the two singular module
+folders permitted by the naming conventions (alongside `example`).
+
+## What it owns
+
+- **Sessions** — `session-service.ts` persists session rows in Postgres
+  with a Redis cache layer for hot reads; cookies signed via
+  `@fastify/cookie`.
+- **Password hashing** — `password-hasher.ts` wraps argon2id; defaults are
+  tuned for the target hardware (see the **Hardware & system requirements**
+  section of `README.md` at the repository root).
+- **TOTP** — the platform's `kernel/crypto/totp` wraps `otpauth` + a backup-code pool.
+- **Fastify plugin** — `plugin.ts` parses the session cookie and attaches
+  `request.actor = { kind, id, ... }` plus `request.adminActor`.
+- **Route guards** — `requireAdmin(permission?)`, `requireAdminAny(codes)` and
+  `requireCustomer`, provided as ports from `backend.ts` and resolved by every
+  module that gates a route. They were Fastify decorators on the plugin once;
+  they were turned into ports so production and the test harness run the same
+  implementation instead of one each.
+
+## No HTTP routes of its own
+
+`auth` is a primitive module — login/logout/2FA endpoints belong to the
+customer-facing `customer_accounts` and admin-facing `admin_users`
+modules.
+
+## Extension points
+
+- **Session storage** — `session-service` is constructed with `(em, redis)`;
+  alternative caches plug in here.
+- **Custom actor kinds** — extend the `request.actor` discriminated union
+  and update the `requireX` pre-handlers; existing callers keep working
+  because the routes only use the `requireX` factory they already
+  consume.

package/package.json

@@ -1,6 +1,63 @@
 {
   "name": "@endora-commerce/mod-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.100.0",
+  "type": "module",
+  "sideEffects": false,
+  "description": "Authentication primitives — session cookies, bearer-token resolution, and request actor binding.",
+  "license": "MIT",
+  "endora": {
+    "type": "module",
+    "id": "auth"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/endora-commerce/endora-commerce.git",
+    "directory": "packages/modules/auth"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./backend": {
+      "types": "./dist/backend/index.d.ts",
+      "default": "./dist/backend/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "docs"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "peerDependencies": {
+    "@mikro-orm/core": "^6",
+    "@mikro-orm/postgresql": "^6",
+    "fastify": "^5",
+    "fastify-plugin": "^5",
+    "ioredis": "^5",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "devDependencies": {
+    "@mikro-orm/core": "^6.6.13",
+    "@mikro-orm/postgresql": "^6.6.13",
+    "@types/node": "^22.9.0",
+    "fastify": "^5.12.5",
+    "fastify-plugin": "^5.1.0",
+    "ioredis": "^5.10.1",
+    "typescript": "^5.9.3",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json",
+    "lint": "eslint src"
+  }
 }