@endora-commerce/mod-customer-accounts 0.100.0

package/dist/backend/services/customer-account-ports.d.ts

@@ -0,0 +1,143 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type CustomerAccountCreateInput, type CustomerAccountLookupOptions, type CustomerAccountMemberWritePort, type CustomerAccountProfilePatch, type CustomerAccountReadPort, type CustomerAccountRecord, type CustomerAccountRole, type CustomerAuthPort, type CustomerPasswordStatePort, type CustomerPasswordVerificationPort, type CustomerRolePort } from '@endora-commerce/contracts';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import { CustomerAccount } from '../entities/customer-account.entity.js';
+import type { CustomerAuthService } from './customer-auth-service.js';
+import type { RoleService } from './role-service.js';
+import type { TwoFactorEnrolmentReader } from './two-factor-enrolments.js';
+/**
+ * The published face of `customer_accounts` (feature 075, Phase P).
+ *
+ * Nineteen modules read this module's table today, 51 of the sites on the
+ * entity class itself. What they ask for is narrow — an account by id, by ids,
+ * by e-mail, by organisation, and the two counting questions the "an
+ * organisation keeps at least one admin" rule is spelled with — so that is
+ * what the read port is, rather than the table.
+ *
+ * The mapping below is the point of the exercise and not ceremony:
+ * `passwordHash` does not survive it. It is read by exactly one module, and a
+ * record that carried it would turn every consumer into a place a credential
+ * can leak from.
+ */
+/**
+ * The published record, with `twoFactorEnabled` taken from `mfa` rather than
+ * from this module's `two_factor_confirmed_at` column.
+ *
+ * The second parameter is required and has no default on purpose. That column's
+ * only non-null writer was the superseded TOTP path deleted on 2026-08-25, so
+ * the field was a **provably constant `false`** — on the admin customer detail,
+ * on both organisation member panels, and on `GET /api/v1/me/customer`, which
+ * is the buyer's own account page telling them their account is unprotected. A
+ * default would let the next call site reintroduce that silently; making the
+ * caller answer means the compiler asks.
+ */
+export declare function toCustomerAccountRecord(account: CustomerAccount, twoFactorEnabled: boolean): CustomerAccountRecord;
+/**
+ * One `mfa` read for a whole page of accounts, rather than one per row.
+ *
+ * Every caller is a list or a single row, so batching here keeps the admin
+ * customer list at two queries instead of one per customer, and leaves the
+ * single-row callers spelling the same thing.
+ */
+export declare function toCustomerAccountRecords(twoFactorEnrolments: TwoFactorEnrolmentReader, accounts: readonly CustomerAccount[]): Promise<CustomerAccountRecord[]>;
+/** The single-row spelling of {@link toCustomerAccountRecords}. */
+export declare function toOneCustomerAccountRecord(twoFactorEnrolments: TwoFactorEnrolmentReader, account: CustomerAccount): Promise<CustomerAccountRecord>;
+export declare class CustomerAccountReadService implements CustomerAccountReadPort {
+    private readonly emFactory;
+    private readonly twoFactorEnrolments;
+    constructor(emFactory: () => EntityManager, twoFactorEnrolments: TwoFactorEnrolmentReader);
+    findById(id: string, options?: CustomerAccountLookupOptions): Promise<CustomerAccountRecord | null>;
+    findByIds(ids: readonly string[], options?: CustomerAccountLookupOptions): Promise<CustomerAccountRecord[]>;
+    findByEmail(email: string, options?: CustomerAccountLookupOptions): Promise<CustomerAccountRecord | null>;
+    findInOrganization(id: string, organizationId: string, options?: CustomerAccountLookupOptions): Promise<CustomerAccountRecord | null>;
+    listByOrganization(organizationId: string, options?: CustomerAccountLookupOptions): Promise<CustomerAccountRecord[]>;
+    countByOrganizationRole(organizationId: string, role: CustomerAccountRole, options?: {
+        excludeCustomerAccountId?: string;
+        activeOnly?: boolean;
+        notBlocked?: boolean;
+    }): Promise<number>;
+    searchByEmail(query: string, limit: number): Promise<CustomerAccountRecord[]>;
+    searchIdsByName(query: string): Promise<string[]>;
+    listAll(): Promise<CustomerAccountRecord[]>;
+}
+/**
+ * Issue #222 — the one credential fact that crosses this boundary, and it
+ * crosses as a date rather than as anything derived from the hash.
+ *
+ * Separate from {@link CustomerAccountReadService} on purpose: that read port
+ * is what nineteen modules resolve, and the mapping above deliberately drops
+ * `passwordHash`. "Does this account have a password its holder can use" is a
+ * question one module asks, so it gets a port one module resolves.
+ *
+ * An unknown id answers `null`, not a throw: the caller's question is about a
+ * credential, and "no account" and "no password on record" want the same
+ * refusal from every caller there could be.
+ */
+export declare class CustomerPasswordStateService implements CustomerPasswordStatePort {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    passwordSetAt(customerAccountId: string): Promise<Date | null>;
+}
+/**
+ * Step-up re-verification, for `mfa` (feature 080, T052).
+ *
+ * The read is this module's own row and the comparison is the platform
+ * hasher's, so both halves are on this side of the seam. The composition roots
+ * held them instead: each read `passwordHash` off the entity and called
+ * `verifyPassword` itself, which is a credential column and a hash comparison
+ * living in a file that owns neither.
+ *
+ * The hash never leaves this class — that is the difference between this port
+ * and a `passwordHash` field on `CustomerAccountRecord`, and it is the whole
+ * reason the port exists.
+ */
+export declare class CustomerPasswordVerificationService implements CustomerPasswordVerificationPort {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    verifyPassword(customerAccountId: string, password: string): Promise<boolean>;
+}
+/**
+ * The member lifecycle `organizations` runs over this module's table
+ * (feature 075, Phase C).
+ *
+ * It ran it by creating and mutating the `CustomerAccount` entity in its own
+ * services and route handlers — seven write sites across five files. They are
+ * six methods here, each one unit of work on this table alone, because a write
+ * port that took the caller's `EntityManager` would publish the coupling
+ * instead of removing it (D-78).
+ *
+ * **Each write audits itself**, in the same unit of work, exactly as
+ * `RoleService` and `addresses`' `AddressService` — the two write surfaces
+ * `organizations` already reaches across this boundary — have always done. The
+ * host's own row is a different fact and stays where it is: "an operator edited
+ * this member on the organisation panel" is not "this account's e-mail
+ * changed", and the role endpoint has recorded both for as long as it has
+ * existed.
+ */
+export declare class CustomerAccountMemberWriteService implements CustomerAccountMemberWritePort {
+    #private;
+    private readonly emFactory;
+    private readonly twoFactorEnrolments;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, twoFactorEnrolments: TwoFactorEnrolmentReader, auditLog?: AuditPort | undefined);
+    create(input: CustomerAccountCreateInput): Promise<CustomerAccountRecord>;
+    updateProfile(customerAccountId: string, patch: CustomerAccountProfilePatch): Promise<CustomerAccountRecord>;
+    setSubtreeRollup(customerAccountId: string, enabled: boolean): Promise<CustomerAccountRecord>;
+    promoteToOrganizationAdmin(customerAccountId: string): Promise<CustomerAccountRecord>;
+    markEmailVerified(customerAccountId: string, verifiedAt: Date): Promise<CustomerAccountRecord>;
+    attachToOrganization(customerAccountId: string, organizationId: string): Promise<CustomerAccountRecord>;
+}
+/**
+ * `CustomerAuthService.login` resolves to a `LoginResult` carrying the
+ * `CustomerAccount` entity. The port hands back the record instead — the same
+ * substitution the read service makes, for the same reason.
+ *
+ * The service arrives as a **getter** rather than a value so the adapter reads
+ * it from the container per call. Constructing a second `CustomerAuthService`
+ * here is precisely the divergence this module's conversion removed: the two
+ * composition roots each built one, and their MFA argument differed.
+ */
+export declare function createCustomerAuthPort(getService: () => CustomerAuthService, twoFactorEnrolments: TwoFactorEnrolmentReader): CustomerAuthPort;
+/** Same substitution for the member-management surface `organizations` calls. */
+export declare function createCustomerRolePort(getService: () => RoleService, twoFactorEnrolments: TwoFactorEnrolmentReader): CustomerRolePort;
+//# sourceMappingURL=customer-account-ports.d.ts.map

package/dist/backend/services/customer-account-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-account-ports.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-account-ports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,gBAAgB,EACtB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,gBAAgB,EAAE,OAAO,GACxB,qBAAqB,CAyBvB;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,mBAAmB,EAAE,wBAAwB,EAC7C,QAAQ,EAAE,SAAS,eAAe,EAAE,GACnC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAIlC;AAED,mEAAmE;AACnE,wBAAsB,0BAA0B,CAC9C,mBAAmB,EAAE,wBAAwB,EAC7C,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAOD,qBAAa,0BAA2B,YAAW,uBAAuB;IAEtE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBADnB,SAAS,EAAE,MAAM,aAAa,EAC9B,mBAAmB,EAAE,wBAAwB;IAG1D,QAAQ,CACZ,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,4BAA4B,GACrC,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAQlC,SAAS,CACb,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,OAAO,CAAC,EAAE,4BAA4B,GACrC,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAS7B,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,4BAA4B,GACrC,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAYlC,kBAAkB,CACtB,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,4BAA4B,GACrC,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IASlC,kBAAkB,CACtB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,4BAA4B,GACrC,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAS7B,uBAAuB,CAC3B,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE;QACR,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,MAAM,CAAC;IAYZ,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAU7E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkBjD,OAAO,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;CAQlD;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,4BAA6B,YAAW,yBAAyB;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,aAAa,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAOrE;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,mCAAoC,YAAW,gCAAgC;IAC9E,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,cAAc,CAAC,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAMpF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,iCAAkC,YAAW,8BAA8B;;IAEpF,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAFT,SAAS,EAAE,MAAM,aAAa,EAC9B,mBAAmB,EAAE,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,SAAS,YAAA;IAGjC,MAAM,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAgDzE,aAAa,CACjB,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,qBAAqB,CAAC;IAkC3B,gBAAgB,CACpB,iBAAiB,EAAE,MAAM,EACzB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,qBAAqB,CAAC;IAY3B,0BAA0B,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAYrF,iBAAiB,CACrB,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,IAAI,GACf,OAAO,CAAC,qBAAqB,CAAC;IAmB3B,oBAAoB,CACxB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,qBAAqB,CAAC;CAuClC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,mBAAmB,EACrC,mBAAmB,EAAE,wBAAwB,GAC5C,gBAAgB,CAmBlB;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,WAAW,EAC7B,mBAAmB,EAAE,wBAAwB,GAC5C,gBAAgB,CAiBlB"}

package/dist/backend/services/customer-account-ports.js

@@ -0,0 +1,422 @@
+import { UniqueConstraintViolationException } from '@mikro-orm/core';
+import { ERROR_CODES, normalizeEmailAddress, } from '@endora-commerce/contracts';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+import { HttpError } from '@endora-commerce/platform/http';
+import { hashPassword, verifyPassword } from '@endora-commerce/platform/kernel';
+import { CustomerAccount } from '../entities/customer-account.entity.js';
+/**
+ * The published face of `customer_accounts` (feature 075, Phase P).
+ *
+ * Nineteen modules read this module's table today, 51 of the sites on the
+ * entity class itself. What they ask for is narrow — an account by id, by ids,
+ * by e-mail, by organisation, and the two counting questions the "an
+ * organisation keeps at least one admin" rule is spelled with — so that is
+ * what the read port is, rather than the table.
+ *
+ * The mapping below is the point of the exercise and not ceremony:
+ * `passwordHash` does not survive it. It is read by exactly one module, and a
+ * record that carried it would turn every consumer into a place a credential
+ * can leak from.
+ */
+/**
+ * The published record, with `twoFactorEnabled` taken from `mfa` rather than
+ * from this module's `two_factor_confirmed_at` column.
+ *
+ * The second parameter is required and has no default on purpose. That column's
+ * only non-null writer was the superseded TOTP path deleted on 2026-08-25, so
+ * the field was a **provably constant `false`** — on the admin customer detail,
+ * on both organisation member panels, and on `GET /api/v1/me/customer`, which
+ * is the buyer's own account page telling them their account is unprotected. A
+ * default would let the next call site reintroduce that silently; making the
+ * caller answer means the compiler asks.
+ */
+export function toCustomerAccountRecord(account, twoFactorEnabled) {
+    return {
+        id: account.id,
+        organizationId: account.organizationId ?? null,
+        email: account.email,
+        firstName: account.firstName,
+        lastName: account.lastName,
+        role: account.role,
+        emailVerifiedAt: account.emailVerifiedAt ?? null,
+        twoFactorEnabled,
+        lastLoginAt: account.lastLoginAt ?? null,
+        createdAt: account.createdAt,
+        updatedAt: account.updatedAt,
+        customFieldValues: account.customFieldValues ?? {},
+        deletedAt: account.deletedAt ?? null,
+        customerGroupId: account.customerGroupId ?? null,
+        subtreeRollupEnabled: account.subtreeRollupEnabled,
+        blockedAt: account.blockedAt ?? null,
+        blockReason: account.blockReason ?? null,
+        blockSource: account.blockSource ?? null,
+        blockedByAdminUserId: account.blockedByAdminUserId ?? null,
+        blockedByCustomerAccountId: account.blockedByCustomerAccountId ?? null,
+        deletionRequestedByAdminUserId: account.deletionRequestedByAdminUserId ?? null,
+        anonymizedAt: account.anonymizedAt ?? null,
+    };
+}
+/**
+ * One `mfa` read for a whole page of accounts, rather than one per row.
+ *
+ * Every caller is a list or a single row, so batching here keeps the admin
+ * customer list at two queries instead of one per customer, and leaves the
+ * single-row callers spelling the same thing.
+ */
+export async function toCustomerAccountRecords(twoFactorEnrolments, accounts) {
+    if (accounts.length === 0)
+        return [];
+    const enrolled = await twoFactorEnrolments(accounts.map((account) => account.id));
+    return accounts.map((account) => toCustomerAccountRecord(account, enrolled.has(account.id)));
+}
+/** The single-row spelling of {@link toCustomerAccountRecords}. */
+export async function toOneCustomerAccountRecord(twoFactorEnrolments, account) {
+    return (await toCustomerAccountRecords(twoFactorEnrolments, [account]))[0];
+}
+/** `{ deletedAt: null }` when the caller asked for it, nothing otherwise. */
+function activeFilter(options) {
+    return options?.activeOnly ? { deletedAt: null } : {};
+}
+export class CustomerAccountReadService {
+    emFactory;
+    twoFactorEnrolments;
+    constructor(emFactory, twoFactorEnrolments) {
+        this.emFactory = emFactory;
+        this.twoFactorEnrolments = twoFactorEnrolments;
+    }
+    async findById(id, options) {
+        const account = await this.emFactory().findOne(CustomerAccount, {
+            id,
+            ...activeFilter(options),
+        });
+        return account ? toOneCustomerAccountRecord(this.twoFactorEnrolments, account) : null;
+    }
+    async findByIds(ids, options) {
+        if (ids.length === 0)
+            return [];
+        const accounts = await this.emFactory().find(CustomerAccount, {
+            id: { $in: [...ids] },
+            ...activeFilter(options),
+        });
+        return toCustomerAccountRecords(this.twoFactorEnrolments, accounts);
+    }
+    async findByEmail(email, options) {
+        // The fold is here rather than at the four callers: this is the one
+        // question "is this address taken" is asked through, and a caller that
+        // folded its own way (or forgot to) is what made a registered account
+        // unfindable by the address its holder had typed.
+        const account = await this.emFactory().findOne(CustomerAccount, {
+            email: normalizeEmailAddress(email),
+            ...activeFilter(options),
+        });
+        return account ? toOneCustomerAccountRecord(this.twoFactorEnrolments, account) : null;
+    }
+    async findInOrganization(id, organizationId, options) {
+        const account = await this.emFactory().findOne(CustomerAccount, {
+            id,
+            organizationId,
+            ...activeFilter(options),
+        });
+        return account ? toOneCustomerAccountRecord(this.twoFactorEnrolments, account) : null;
+    }
+    async listByOrganization(organizationId, options) {
+        const accounts = await this.emFactory().find(CustomerAccount, { organizationId, ...activeFilter(options) }, { orderBy: { role: 'asc', createdAt: 'asc' } });
+        return toCustomerAccountRecords(this.twoFactorEnrolments, accounts);
+    }
+    async countByOrganizationRole(organizationId, role, options) {
+        return this.emFactory().count(CustomerAccount, {
+            organizationId,
+            role,
+            ...(options?.activeOnly ? { deletedAt: null } : {}),
+            ...(options?.notBlocked ? { blockedAt: null } : {}),
+            ...(options?.excludeCustomerAccountId
+                ? { id: { $ne: options.excludeCustomerAccountId } }
+                : {}),
+        });
+    }
+    async searchByEmail(query, limit) {
+        const trimmed = query.trim();
+        const accounts = await this.emFactory().find(CustomerAccount, trimmed ? { email: { $ilike: `%${trimmed}%` } } : {}, { orderBy: { email: 'asc' }, limit });
+        return toCustomerAccountRecords(this.twoFactorEnrolments, accounts);
+    }
+    async searchIdsByName(query) {
+        const trimmed = query.trim();
+        if (!trimmed)
+            return [];
+        const like = `%${trimmed}%`;
+        const accounts = await this.emFactory().find(CustomerAccount, {
+            $or: [
+                { email: { $ilike: like } },
+                { firstName: { $ilike: like } },
+                { lastName: { $ilike: like } },
+            ],
+        }, { fields: ['id'] });
+        return accounts.map((account) => account.id);
+    }
+    async listAll() {
+        const accounts = await this.emFactory().find(CustomerAccount, {}, { orderBy: { email: 'asc' } });
+        return toCustomerAccountRecords(this.twoFactorEnrolments, accounts);
+    }
+}
+/**
+ * Issue #222 — the one credential fact that crosses this boundary, and it
+ * crosses as a date rather than as anything derived from the hash.
+ *
+ * Separate from {@link CustomerAccountReadService} on purpose: that read port
+ * is what nineteen modules resolve, and the mapping above deliberately drops
+ * `passwordHash`. "Does this account have a password its holder can use" is a
+ * question one module asks, so it gets a port one module resolves.
+ *
+ * An unknown id answers `null`, not a throw: the caller's question is about a
+ * credential, and "no account" and "no password on record" want the same
+ * refusal from every caller there could be.
+ */
+export class CustomerPasswordStateService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async passwordSetAt(customerAccountId) {
+        // A full load rather than a projection: a partially-loaded entity in the
+        // identity map is a hazard for whatever flushes next in the same unit of
+        // work, and only the date leaves this method either way.
+        const account = await this.emFactory().findOne(CustomerAccount, { id: customerAccountId });
+        return account?.passwordSetAt ?? null;
+    }
+}
+/**
+ * Step-up re-verification, for `mfa` (feature 080, T052).
+ *
+ * The read is this module's own row and the comparison is the platform
+ * hasher's, so both halves are on this side of the seam. The composition roots
+ * held them instead: each read `passwordHash` off the entity and called
+ * `verifyPassword` itself, which is a credential column and a hash comparison
+ * living in a file that owns neither.
+ *
+ * The hash never leaves this class — that is the difference between this port
+ * and a `passwordHash` field on `CustomerAccountRecord`, and it is the whole
+ * reason the port exists.
+ */
+export class CustomerPasswordVerificationService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async verifyPassword(customerAccountId, password) {
+        const account = await this.emFactory().findOne(CustomerAccount, { id: customerAccountId });
+        // The bare call is the imported hasher: a class method is not in scope as
+        // an identifier, so it shadows nothing.
+        return account ? verifyPassword(account.passwordHash, password) : false;
+    }
+}
+/**
+ * The member lifecycle `organizations` runs over this module's table
+ * (feature 075, Phase C).
+ *
+ * It ran it by creating and mutating the `CustomerAccount` entity in its own
+ * services and route handlers — seven write sites across five files. They are
+ * six methods here, each one unit of work on this table alone, because a write
+ * port that took the caller's `EntityManager` would publish the coupling
+ * instead of removing it (D-78).
+ *
+ * **Each write audits itself**, in the same unit of work, exactly as
+ * `RoleService` and `addresses`' `AddressService` — the two write surfaces
+ * `organizations` already reaches across this boundary — have always done. The
+ * host's own row is a different fact and stays where it is: "an operator edited
+ * this member on the organisation panel" is not "this account's e-mail
+ * changed", and the role endpoint has recorded both for as long as it has
+ * existed.
+ */
+export class CustomerAccountMemberWriteService {
+    emFactory;
+    twoFactorEnrolments;
+    auditLog;
+    constructor(emFactory, twoFactorEnrolments, auditLog) {
+        this.emFactory = emFactory;
+        this.twoFactorEnrolments = twoFactorEnrolments;
+        this.auditLog = auditLog;
+    }
+    async create(input) {
+        const em = this.emFactory();
+        const email = normalizeEmailAddress(input.email);
+        const existing = await em.findOne(CustomerAccount, { email });
+        if (existing) {
+            throw new HttpError(409, ERROR_CODES.EMAIL_ALREADY_REGISTERED, 'An account with this email already exists.');
+        }
+        const account = em.create(CustomerAccount, {
+            organizationId: input.organizationId,
+            email,
+            passwordHash: await hashPassword(input.password),
+            // Issue #222 — a password somebody supplied, so the account has one on
+            // record from its first moment. This is the write both organisation
+            // registration (the holder typed it) and the member admin surface (an
+            // operator set it and hands it over) go through.
+            passwordSetAt: new Date(),
+            firstName: input.firstName,
+            lastName: input.lastName,
+            role: input.role,
+            ...(input.emailVerified ? { emailVerifiedAt: new Date() } : {}),
+        });
+        this.#audit(em, 'customer_account.create', account.id, null, {
+            organizationId: account.organizationId ?? null,
+            email: account.email,
+            role: account.role,
+        });
+        try {
+            await em.persistAndFlush(account);
+        }
+        catch (err) {
+            // The unique index is the real arbiter; the pre-check above only buys a
+            // better message for the common case. Two registrations racing on one
+            // address must both answer 409 rather than one answering 500.
+            if (err instanceof UniqueConstraintViolationException) {
+                throw new HttpError(409, ERROR_CODES.EMAIL_ALREADY_REGISTERED, 'An account with this email already exists.');
+            }
+            throw err;
+        }
+        return toOneCustomerAccountRecord(this.twoFactorEnrolments, account);
+    }
+    async updateProfile(customerAccountId, patch) {
+        const em = this.emFactory();
+        const account = await this.#loadLive(em, customerAccountId);
+        const before = {
+            email: account.email,
+            firstName: account.firstName,
+            lastName: account.lastName,
+        };
+        if (patch.email !== undefined) {
+            const nextEmail = normalizeEmailAddress(patch.email);
+            if (nextEmail !== account.email) {
+                const taken = await em.findOne(CustomerAccount, { email: nextEmail, deletedAt: null });
+                if (taken && taken.id !== account.id) {
+                    throw new HttpError(409, ERROR_CODES.EMAIL_ALREADY_REGISTERED, 'That email is already used by another account.');
+                }
+                account.email = nextEmail;
+                account.emailVerifiedAt = null;
+            }
+        }
+        if (patch.firstName !== undefined)
+            account.firstName = patch.firstName;
+        if (patch.lastName !== undefined)
+            account.lastName = patch.lastName;
+        this.#audit(em, 'customer_account.update_profile', account.id, before, {
+            email: account.email,
+            firstName: account.firstName,
+            lastName: account.lastName,
+        });
+        await em.flush();
+        return toOneCustomerAccountRecord(this.twoFactorEnrolments, account);
+    }
+    async setSubtreeRollup(customerAccountId, enabled) {
+        const em = this.emFactory();
+        const account = await this.#loadLive(em, customerAccountId);
+        const before = { subtreeRollupEnabled: account.subtreeRollupEnabled };
+        account.subtreeRollupEnabled = enabled;
+        this.#audit(em, 'customer_account.set_subtree_rollup', account.id, before, {
+            subtreeRollupEnabled: enabled,
+        });
+        await em.flush();
+        return toOneCustomerAccountRecord(this.twoFactorEnrolments, account);
+    }
+    async promoteToOrganizationAdmin(customerAccountId) {
+        const em = this.emFactory();
+        const account = await this.#loadLive(em, customerAccountId);
+        const before = { role: account.role };
+        account.role = 'organization_admin';
+        this.#audit(em, 'customer_account.promote_organization_admin', account.id, before, {
+            role: account.role,
+        });
+        await em.flush();
+        return toOneCustomerAccountRecord(this.twoFactorEnrolments, account);
+    }
+    async markEmailVerified(customerAccountId, verifiedAt) {
+        const em = this.emFactory();
+        const account = await em.findOne(CustomerAccount, { id: customerAccountId });
+        if (!account) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Customer account not found.');
+        }
+        // Idempotent: a retried verification keeps the first timestamp, and records
+        // nothing the second time — an audit row per retry would say a change
+        // happened that did not.
+        if (!account.emailVerifiedAt) {
+            account.emailVerifiedAt = verifiedAt;
+            this.#audit(em, 'customer_account.email_verified', account.id, { emailVerifiedAt: null }, {
+                emailVerifiedAt: verifiedAt.toISOString(),
+            });
+            await em.flush();
+        }
+        return toOneCustomerAccountRecord(this.twoFactorEnrolments, account);
+    }
+    async attachToOrganization(customerAccountId, organizationId) {
+        const em = this.emFactory();
+        const account = await em.findOne(CustomerAccount, { id: customerAccountId });
+        if (!account) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Customer account not found.');
+        }
+        const before = { organizationId: account.organizationId ?? null };
+        account.organizationId = organizationId;
+        this.#audit(em, 'customer_account.attach_organization', account.id, before, {
+            organizationId,
+        });
+        await em.flush();
+        return toOneCustomerAccountRecord(this.twoFactorEnrolments, account);
+    }
+    #audit(em, action, objectId, stateBefore, stateAfter) {
+        if (!this.auditLog)
+            return;
+        recordAuditFromContext(this.auditLog, em, {
+            action,
+            objectType: 'customer_account',
+            objectId,
+            stateBefore,
+            stateAfter,
+        });
+    }
+    async #loadLive(em, id) {
+        const account = await em.findOne(CustomerAccount, { id, deletedAt: null });
+        if (!account) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Customer account not found.');
+        }
+        return account;
+    }
+}
+/**
+ * `CustomerAuthService.login` resolves to a `LoginResult` carrying the
+ * `CustomerAccount` entity. The port hands back the record instead — the same
+ * substitution the read service makes, for the same reason.
+ *
+ * The service arrives as a **getter** rather than a value so the adapter reads
+ * it from the container per call. Constructing a second `CustomerAuthService`
+ * here is precisely the divergence this module's conversion removed: the two
+ * composition roots each built one, and their MFA argument differed.
+ */
+export function createCustomerAuthPort(getService, twoFactorEnrolments) {
+    return {
+        async login(input) {
+            const outcome = await getService().login(input);
+            if (outcome.status !== 'authenticated')
+                return outcome;
+            return {
+                status: 'authenticated',
+                customerAccount: await toOneCustomerAccountRecord(twoFactorEnrolments, outcome.customerAccount),
+                sessionCookieValue: outcome.sessionCookieValue,
+                sessionExpiresAt: outcome.sessionExpiresAt,
+            };
+        },
+        changePassword: (customerAccountId, currentPassword, newPassword) => getService().changePassword(customerAccountId, currentPassword, newPassword),
+        logout: (sessionId) => getService().logout(sessionId),
+    };
+}
+/** Same substitution for the member-management surface `organizations` calls. */
+export function createCustomerRolePort(getService, twoFactorEnrolments) {
+    return {
+        async listMembers(organizationId) {
+            return toCustomerAccountRecords(twoFactorEnrolments, await getService().listMembers(organizationId));
+        },
+        async changeRole(organizationId, targetCustomerAccountId, newRole) {
+            return toOneCustomerAccountRecord(twoFactorEnrolments, await getService().changeRole(organizationId, targetCustomerAccountId, newRole));
+        },
+        removeMember: (organizationId, targetCustomerAccountId) => getService().removeMember(organizationId, targetCustomerAccountId),
+    };
+}
+//# sourceMappingURL=customer-account-ports.js.map

package/dist/backend/services/customer-account-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-account-ports.js","sourceRoot":"","sources":["../../../src/backend/services/customer-account-ports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kCAAkC,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,WAAW,EACX,qBAAqB,GAYtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAKzE;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAwB,EACxB,gBAAyB;IAEzB,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;QAChD,gBAAgB;QAChB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;QAClD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;QAChD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,IAAI;QAC1D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B,IAAI,IAAI;QACtE,8BAA8B,EAAE,OAAO,CAAC,8BAA8B,IAAI,IAAI;QAC9E,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,mBAA6C,EAC7C,QAAoC;IAEpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,mBAA6C,EAC7C,OAAwB;IAExB,OAAO,CAAC,MAAM,wBAAwB,CAAC,mBAAmB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;AAC9E,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,OAAsC;IAC1D,OAAO,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,OAAO,0BAA0B;IAElB;IACA;IAFnB,YACmB,SAA8B,EAC9B,mBAA6C;QAD7C,cAAS,GAAT,SAAS,CAAqB;QAC9B,wBAAmB,GAAnB,mBAAmB,CAA0B;IAC7D,CAAC;IAEJ,KAAK,CAAC,QAAQ,CACZ,EAAU,EACV,OAAsC;QAEtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YAC9D,EAAE;YACF,GAAG,YAAY,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAsB,EACtB,OAAsC;QAEtC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE;YAC5D,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE;YACrB,GAAG,YAAY,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QACH,OAAO,wBAAwB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAa,EACb,OAAsC;QAEtC,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YAC9D,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC;YACnC,GAAG,YAAY,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,EAAU,EACV,cAAsB,EACtB,OAAsC;QAEtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YAC9D,EAAE;YACF,cAAc;YACd,GAAG,YAAY,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,cAAsB,EACtB,OAAsC;QAEtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAC1C,eAAe,EACf,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,EAC5C,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAC/C,CAAC;QACF,OAAO,wBAAwB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,cAAsB,EACtB,IAAyB,EACzB,OAIC;QAED,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE;YAC7C,cAAc;YACd,IAAI;YACJ,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,EAAE,wBAAwB;gBACnC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,wBAAwB,EAAE,EAAE;gBACnD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAa;QAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAC1C,eAAe,EACf,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EACpD,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CACrC,CAAC;QACF,OAAO,wBAAwB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAC1C,eAAe,EACf;YACE,GAAG,EAAE;gBACH,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBAC3B,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBAC/B,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;aAC/B;SACF,EACD,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CACnB,CAAC;QACF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAC1C,eAAe,EACf,EAAE,EACF,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAC9B,CAAC;QACF,OAAO,wBAAwB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,4BAA4B;IACV;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,aAAa,CAAC,iBAAyB;QAC3C,yEAAyE;QACzE,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,OAAO,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mCAAmC;IACjB;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,cAAc,CAAC,iBAAyB,EAAE,QAAgB;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,0EAA0E;QAC1E,wCAAwC;QACxC,OAAO,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1E,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,iCAAiC;IAEzB;IACA;IACA;IAHnB,YACmB,SAA8B,EAC9B,mBAA6C,EAC7C,QAAoB;QAFpB,cAAS,GAAT,SAAS,CAAqB;QAC9B,wBAAmB,GAAnB,mBAAmB,CAA0B;QAC7C,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,KAAiC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE;YACzC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK;YACL,YAAY,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC;YAChD,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,iDAAiD;YACjD,aAAa,EAAE,IAAI,IAAI,EAAE;YACzB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,yBAAyB,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE;YAC3D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,sEAAsE;YACtE,8DAA8D;YAC9D,IAAI,GAAG,YAAY,kCAAkC,EAAE,CAAC;gBACtD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,iBAAyB,EACzB,KAAkC;QAElC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,SAAS,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvF,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;oBACrC,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,gDAAgD,CACjD,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;gBAC1B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YACjC,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACvE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,iCAAiC,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;YACrE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,iBAAyB,EACzB,OAAgB;QAEhB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACtE,OAAO,CAAC,oBAAoB,GAAG,OAAO,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,qCAAqC,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;YACzE,oBAAoB,EAAE,OAAO;SAC9B,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,iBAAyB;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,6CAA6C,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;YACjF,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,iBAAyB,EACzB,UAAgB;QAEhB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;QACjF,CAAC;QACD,4EAA4E;QAC5E,sEAAsE;QACtE,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,OAAO,CAAC,eAAe,GAAG,UAAU,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,iCAAiC,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE;gBACxF,eAAe,EAAE,UAAU,CAAC,WAAW,EAAE;aAC1C,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,OAAO,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,iBAAyB,EACzB,cAAsB;QAEtB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;QAClE,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,sCAAsC,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;YAC1E,cAAc;SACf,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CACJ,EAAiB,EACjB,MAAc,EACd,QAAgB,EAChB,WAA2C,EAC3C,UAA0C;QAE1C,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3B,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;YACxC,MAAM;YACN,UAAU,EAAE,kBAAkB;YAC9B,QAAQ;YACR,WAAW;YACX,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAiB,EAAE,EAAU;QAC3C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAqC,EACrC,mBAA6C;IAE7C,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;gBAAE,OAAO,OAAO,CAAC;YACvD,OAAO;gBACL,MAAM,EAAE,eAAe;gBACvB,eAAe,EAAE,MAAM,0BAA0B,CAC/C,mBAAmB,EACnB,OAAO,CAAC,eAAe,CACxB;gBACD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;gBAC9C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;aAC3C,CAAC;QACJ,CAAC;QACD,cAAc,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,CAClE,UAAU,EAAE,CAAC,cAAc,CAAC,iBAAiB,EAAE,eAAe,EAAE,WAAW,CAAC;QAC9E,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CACpC,UAA6B,EAC7B,mBAA6C;IAE7C,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,cAAc;YAC9B,OAAO,wBAAwB,CAC7B,mBAAmB,EACnB,MAAM,UAAU,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,CAC/C,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,EAAE,OAAO;YAC/D,OAAO,0BAA0B,CAC/B,mBAAmB,EACnB,MAAM,UAAU,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,EAAE,OAAO,CAAC,CAChF,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,CAAC,cAAc,EAAE,uBAAuB,EAAE,EAAE,CACxD,UAAU,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,uBAAuB,CAAC;KACrE,CAAC;AACJ,CAAC"}

package/dist/backend/services/customer-auth-service.d.ts

@@ -0,0 +1,62 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type AuthSessionPort, type MfaLoginPort } from '@endora-commerce/contracts';
+import { CustomerAccount } from '../entities/customer-account.entity.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * Customer-side auth flows (T119; two-step login added in feature 042).
+ *
+ * - login: email + password → first factor. When an `MfaLoginPort` is injected
+ *   and the account has active 2FA (or 2FA is enforced for the scope), login
+ *   returns an `mfaRequired` / `mfaSetupRequired` outcome WITHOUT a session;
+ *   the second step is completed by the MFA module's verify endpoint. When no
+ *   port is present (or it returns `proceed`), login issues the session exactly
+ *   as before (password-only fallback, FR-033).
+ * - logout: destroy session.
+ * - changePassword: argon2 verify of `currentPassword`; reject with
+ *   401 CURRENT_PASSWORD_INVALID otherwise; rehash + persist.
+ *
+ * Feature 075, Phase C — the three things this service needed from `auth` are
+ * now named where they belong rather than in `auth`'s directory. Sessions come
+ * over {@link AuthSessionPort}, so a session is minted or destroyed through the
+ * surface `auth` publishes and never through its `Session` entity. The MFA seam
+ * is `auth`'s *shape* implemented by `mfa`, published in `@endora-commerce/contracts` so
+ * this service depends on neither module for it. And the password hash is a
+ * pure function that moved to `src/kernel/crypto/`: an operator switching a
+ * module off must not make "hash this string" answer 503.
+ */
+export interface LoginResult {
+    customerAccount: CustomerAccount;
+    /** Value to put into the Set-Cookie header. */
+    sessionCookieValue: string;
+    sessionExpiresAt: Date;
+}
+/** Discriminated outcome of the first login step (feature 042). */
+export type CustomerLoginOutcome = ({
+    status: 'authenticated';
+} & LoginResult) | {
+    status: 'mfaRequired';
+    challengeId: string;
+} | {
+    status: 'mfaSetupRequired';
+    setupTicket: string;
+};
+export declare class CustomerAuthService {
+    private readonly emFactory;
+    private readonly sessionService;
+    /** Lazily resolved so composition can late-bind the MFA module. */
+    private readonly getMfaLoginPort?;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, sessionService: AuthSessionPort, 
+    /** Lazily resolved so composition can late-bind the MFA module. */
+    getMfaLoginPort?: (() => MfaLoginPort | undefined) | undefined, auditLog?: AuditPort | undefined);
+    login(input: {
+        email: string;
+        password: string;
+        ip?: string;
+        userAgent?: string;
+        salesChannelId?: string | null;
+    }): Promise<CustomerLoginOutcome>;
+    changePassword(customerAccountId: string, currentPassword: string, newPassword: string): Promise<void>;
+    logout(sessionId: string): Promise<void>;
+}
+//# sourceMappingURL=customer-auth-service.d.ts.map