@fonderie/auth 7.4.0 → 7.6.0

package/brain/outcomes.md

@@ -150,6 +150,7 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | POST | `/auth/mfa/disable` | `requireAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.disable` |
 | POST | `/auth/mfa/setup` | `requireAuth → requireEmailLogin → requireVerified → mfa.setup` |
 | POST | `/auth/mfa/verify` | `ipLimit('mfaVerify') → requireAnyAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.verify` |
+| DELETE | `/auth/oauth/:provider` | `requireAuth → user.unlinkOauth` |
 | GET | `/auth/providers` | `async () => setApiResponse(HTTP.OK, 'AUTH_PROVIDERS', 'Sign-in methods available here', { providers: [...config.providers], })` |
 | POST | `/auth/refresh` | `validate(refreshSchema) → auth.refresh` |
 | POST | `/auth/register` | `ipLimit('register') → validate(registerSchema) → auth.register` |

package/brain/signatures.md

@@ -28,6 +28,7 @@ interface IUser {
     mfaEnabled: boolean;
     passwordHash: string | null;
     emailVerifiedAt: Date | null;
+    provider: string | null;
 }
 
 interface ISession {
@@ -99,11 +100,11 @@ interface IDataExportContributor {
 
 const AUTH_CONFIG_KEYS: { sessionDuration: string; verificationCooldown: string; mfa: string; requireVerification: string; }
 
-const MESSAGE_KEYS: { readonly emailRegistration: "email-registration"; readonly emailVerification: "email-verification"; readonly passwordReset: "password-reset"; readonly phoneOtp: "phone-otp"; readonly mfaEnabled: "mfa-enabled"; readonly mfaDisabled: "mfa-disabled"; readonly mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated"; readonly emailChanged: "email-changed"; readonly phoneChanged: "phone-changed"; }
+const MESSAGE_KEYS: { readonly emailRegistration: "email-registration"; readonly emailVerification: "email-verification"; readonly passwordReset: "password-reset"; readonly phoneOtp: "phone-otp"; readonly mfaEnabled: "mfa-enabled"; readonly mfaDisabled: "mfa-disabled"; readonly mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated"; readonly emailChanged: "email-changed"; readonly phoneChanged: "phone-changed"; readonly passwordRevoked: "password-revoked"; readonly oauthRegistration: "oauth-registration"; readonly oauthLinked: "oauth-linked"; readonly oauthUnlinked: "oauth-unlinked"; }
 
 type AuthMessageKey = (typeof MESSAGE_KEYS)[keyof typeof MESSAGE_KEYS];
 
-const DEFAULT_TEMPLATES: { "email-registration": { subject: string; html: string; text: string; }; "email-verification": { subject: string; html: string; text: string; }; "password-reset": { subject: string; html: string; text: string; }; "phone-otp": { text: string; }; "mfa-enabled": { subject: string; html: string; text: string; }; "mfa-disabled": { subject: string; html: string; text: string; }; "mfa-backup-codes-regenerated": { subject: string; html: string; text: string; }; "email-changed": { subject: string; html: string; text: string; }; "phone-changed": { subject: string; html: string; text: string; }; }
+const DEFAULT_TEMPLATES: { "email-registration": { subject: string; html: string; text: string; }; "email-verification": { subject: string; html: string; text: string; }; "password-reset": { subject: string; html: string; text: string; }; "phone-otp": { text: string; }; "mfa-enabled": { subject: string; html: string; text: string; }; "mfa-disabled": { subject: string; html: string; text: string; }; "mfa-backup-codes-regenerated": { subject: string; html: string; text: string; }; "email-changed": { subject: string; html: string; text: string; }; "phone-changed": { subject: string; html: string; text: string; }; "password-revoked": { subject: string; html: string; text: string; }; "oauth-registration": { subject: string; html: string; text: string; }; "oauth-linked": { subject: string; html: string; text: string; }; "oauth-unlinked": { subject: string; html: string; text: string; }; }
 
 interface IUserDTO {
     id: string;
@@ -118,6 +119,8 @@ interface IUserDTO {
     isEmailVerified: boolean;
     isPhoneVerified: boolean;
     mfaEnabled: boolean;
+    provider: string;
+    hasPassword: boolean;
     suspended: boolean;
     whitelist: boolean;
     ipWhitelist: string[];

package/dist/dtos/user.cjs

@@ -75,6 +75,8 @@ function toUserDTO(user, phoneVerified = false) {
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
     mfaEnabled: (0, import_core.booleanOrFalse)(user.mfaEnabled),
+    provider: (0, import_core.stringOrEmpty)(user.provider),
+    hasPassword: user.passwordHash !== null && user.passwordHash !== void 0,
     suspended: (0, import_core.booleanOrFalse)(user.suspended),
     whitelist: (0, import_core.booleanOrFalse)(user.whitelist),
     ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],

package/dist/dtos/user.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/dtos/user.ts"],"sourcesContent":["import { stringOrEmpty, booleanOrFalse, dateOrEmpty } from '@fonderie/core';\n\nimport type { IUser, IUserPreferences } from '../types';\n\nexport interface IUserDTO {\n\tid: string;\n\temail: string;\n\tfirstName: string;\n\tlastName: string;\n\tphone: string;\n\tprofileImageUrl: string;\n\tisActive: boolean;\n\tlastLogin: string;\n\tpreferences: IUserPreferences;\n\tisEmailVerified: boolean;\n\tisPhoneVerified: boolean;\n\tmfaEnabled: boolean;\n\tsuspended: boolean;\n\twhitelist: boolean;\n\tipWhitelist: string[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nconst DEFAULT_PREFERENCES: IUserPreferences = {\n\tlocale: 'en-US',\n\ttimezone: 'UTC',\n\tnotifications: { email: true, inApp: true, sms: false, push: false },\n\temailDigest: 'immediate',\n\tdateFormat: 'MM/DD/YYYY',\n\ttimeFormat: 'hh:mm A',\n};\n\n// Historical rows may hold garbage preferences (the update schema accepted\n// `unknown` for four keys until it was typed). Only well-typed values\n// survive into the DTO, and notifications deep-merge over the defaults so a\n// partial stored object can't shrink the shape the client type promises.\nfunction cleanPreferences(prefs: IUserPreferences): Partial<IUserPreferences> {\n\tconst out: Partial<IUserPreferences> = {};\n\tif (typeof prefs.locale === 'string') out.locale = prefs.locale;\n\tif (typeof prefs.timezone === 'string') out.timezone = prefs.timezone;\n\tif (typeof prefs.emailDigest === 'string') out.emailDigest = prefs.emailDigest;\n\tif (typeof prefs.dateFormat === 'string') out.dateFormat = prefs.dateFormat;\n\tif (typeof prefs.timeFormat === 'string') out.timeFormat = prefs.timeFormat;\n\treturn out;\n}\n\nfunction cleanNotifications(value: unknown): Partial<IUserPreferences['notifications']> {\n\tif (!value || typeof value !== 'object') return {};\n\tconst out: Partial<IUserPreferences['notifications']> = {};\n\tfor (const key of ['email', 'inApp', 'sms', 'push'] as const) {\n\t\tconst v = (value as Record<string, unknown>)[key];\n\t\tif (typeof v === 'boolean') out[key] = v;\n\t}\n\treturn out;\n}\n\nexport function toUserDTO(user: IUser, phoneVerified = false): IUserDTO {\n\tconst prefs = user.preferences ?? ({} as IUserPreferences);\n\tconst cleaned = cleanPreferences(prefs);\n\treturn {\n\t\tid: stringOrEmpty(user.id),\n\t\temail: stringOrEmpty(user.email),\n\t\tfirstName: stringOrEmpty(user.firstName),\n\t\tlastName: stringOrEmpty(user.lastName),\n\t\tphone: stringOrEmpty(user.phone),\n\t\tprofileImageUrl: stringOrEmpty(user.profileImageUrl),\n\t\tisActive: typeof user.isActive === 'boolean' ? user.isActive : true,\n\t\tlastLogin: dateOrEmpty(user.lastLogin),\n\t\tpreferences: {\n\t\t\t...DEFAULT_PREFERENCES,\n\t\t\t...cleaned,\n\t\t\tnotifications: {\n\t\t\t\t...DEFAULT_PREFERENCES.notifications,\n\t\t\t\t...cleanNotifications(prefs.notifications),\n\t\t\t},\n\t\t\tlocale: user.locale || cleaned.locale || 'en-US',\n\t\t\ttimezone: user.timezone || cleaned.timezone || 'UTC',\n\t\t},\n\t\tisEmailVerified: user.emailVerifiedAt !== null,\n\t\tisPhoneVerified: phoneVerified,\n\t\tmfaEnabled: booleanOrFalse(user.mfaEnabled),\n\t\tsuspended: booleanOrFalse(user.suspended),\n\t\twhitelist: booleanOrFalse(user.whitelist),\n\t\tipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],\n\t\tcreatedAt: dateOrEmpty(user.createdAt),\n\t\tupdatedAt: dateOrEmpty(user.updatedAt),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA2D;AAwB3D,IAAM,sBAAwC;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EACnE,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AACb;AAMA,SAAS,iBAAiB,OAAoD;AAC7E,QAAM,MAAiC,CAAC;AACxC,MAAI,OAAO,MAAM,WAAW,SAAU,KAAI,SAAS,MAAM;AACzD,MAAI,OAAO,MAAM,aAAa,SAAU,KAAI,WAAW,MAAM;AAC7D,MAAI,OAAO,MAAM,gBAAgB,SAAU,KAAI,cAAc,MAAM;AACnE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,SAAO;AACR;AAEA,SAAS,mBAAmB,OAA4D;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC;AACjD,QAAM,MAAkD,CAAC;AACzD,aAAW,OAAO,CAAC,SAAS,SAAS,OAAO,MAAM,GAAY;AAC7D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,OAAO,MAAM,UAAW,KAAI,GAAG,IAAI;AAAA,EACxC;AACA,SAAO;AACR;AAEO,SAAS,UAAU,MAAa,gBAAgB,OAAiB;AACvE,QAAM,QAAQ,KAAK,eAAgB,CAAC;AACpC,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO;AAAA,IACN,QAAI,2BAAc,KAAK,EAAE;AAAA,IACzB,WAAO,2BAAc,KAAK,KAAK;AAAA,IAC/B,eAAW,2BAAc,KAAK,SAAS;AAAA,IACvC,cAAU,2BAAc,KAAK,QAAQ;AAAA,IACrC,WAAO,2BAAc,KAAK,KAAK;AAAA,IAC/B,qBAAiB,2BAAc,KAAK,eAAe;AAAA,IACnD,UAAU,OAAO,KAAK,aAAa,YAAY,KAAK,WAAW;AAAA,IAC/D,eAAW,yBAAY,KAAK,SAAS;AAAA,IACrC,aAAa;AAAA,MACZ,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACd,GAAG,oBAAoB;AAAA,QACvB,GAAG,mBAAmB,MAAM,aAAa;AAAA,MAC1C;AAAA,MACA,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAAA,MACzC,UAAU,KAAK,YAAY,QAAQ,YAAY;AAAA,IAChD;AAAA,IACA,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,iBAAiB;AAAA,IACjB,gBAAY,4BAAe,KAAK,UAAU;AAAA,IAC1C,eAAW,4BAAe,KAAK,SAAS;AAAA,IACxC,eAAW,4BAAe,KAAK,SAAS;AAAA,IACxC,aAAa,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,IACnE,eAAW,yBAAY,KAAK,SAAS;AAAA,IACrC,eAAW,yBAAY,KAAK,SAAS;AAAA,EACtC;AACD;","names":[]}
+{"version":3,"sources":["../../src/dtos/user.ts"],"sourcesContent":["import { stringOrEmpty, booleanOrFalse, dateOrEmpty } from '@fonderie/core';\n\nimport type { IUser, IUserPreferences } from '../types';\n\nexport interface IUserDTO {\n\tid: string;\n\temail: string;\n\tfirstName: string;\n\tlastName: string;\n\tphone: string;\n\tprofileImageUrl: string;\n\tisActive: boolean;\n\tlastLogin: string;\n\tpreferences: IUserPreferences;\n\tisEmailVerified: boolean;\n\tisPhoneVerified: boolean;\n\tmfaEnabled: boolean;\n\t// OAuth provider linked to this account ('google', 'apple'), or '' if none.\n\tprovider: string;\n\t// Whether a password is set. Together with `provider` this is everything a\n\t// settings screen needs to render sign-in methods AND to know that\n\t// disconnecting the provider is possible — an account with no password has\n\t// no other credential, so unlinking is refused (409 PASSWORD_REQUIRED).\n\t// Exposed as a boolean precisely so the hash never can be.\n\thasPassword: boolean;\n\tsuspended: boolean;\n\twhitelist: boolean;\n\tipWhitelist: string[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nconst DEFAULT_PREFERENCES: IUserPreferences = {\n\tlocale: 'en-US',\n\ttimezone: 'UTC',\n\tnotifications: { email: true, inApp: true, sms: false, push: false },\n\temailDigest: 'immediate',\n\tdateFormat: 'MM/DD/YYYY',\n\ttimeFormat: 'hh:mm A',\n};\n\n// Historical rows may hold garbage preferences (the update schema accepted\n// `unknown` for four keys until it was typed). Only well-typed values\n// survive into the DTO, and notifications deep-merge over the defaults so a\n// partial stored object can't shrink the shape the client type promises.\nfunction cleanPreferences(prefs: IUserPreferences): Partial<IUserPreferences> {\n\tconst out: Partial<IUserPreferences> = {};\n\tif (typeof prefs.locale === 'string') out.locale = prefs.locale;\n\tif (typeof prefs.timezone === 'string') out.timezone = prefs.timezone;\n\tif (typeof prefs.emailDigest === 'string') out.emailDigest = prefs.emailDigest;\n\tif (typeof prefs.dateFormat === 'string') out.dateFormat = prefs.dateFormat;\n\tif (typeof prefs.timeFormat === 'string') out.timeFormat = prefs.timeFormat;\n\treturn out;\n}\n\nfunction cleanNotifications(value: unknown): Partial<IUserPreferences['notifications']> {\n\tif (!value || typeof value !== 'object') return {};\n\tconst out: Partial<IUserPreferences['notifications']> = {};\n\tfor (const key of ['email', 'inApp', 'sms', 'push'] as const) {\n\t\tconst v = (value as Record<string, unknown>)[key];\n\t\tif (typeof v === 'boolean') out[key] = v;\n\t}\n\treturn out;\n}\n\nexport function toUserDTO(user: IUser, phoneVerified = false): IUserDTO {\n\tconst prefs = user.preferences ?? ({} as IUserPreferences);\n\tconst cleaned = cleanPreferences(prefs);\n\treturn {\n\t\tid: stringOrEmpty(user.id),\n\t\temail: stringOrEmpty(user.email),\n\t\tfirstName: stringOrEmpty(user.firstName),\n\t\tlastName: stringOrEmpty(user.lastName),\n\t\tphone: stringOrEmpty(user.phone),\n\t\tprofileImageUrl: stringOrEmpty(user.profileImageUrl),\n\t\tisActive: typeof user.isActive === 'boolean' ? user.isActive : true,\n\t\tlastLogin: dateOrEmpty(user.lastLogin),\n\t\tpreferences: {\n\t\t\t...DEFAULT_PREFERENCES,\n\t\t\t...cleaned,\n\t\t\tnotifications: {\n\t\t\t\t...DEFAULT_PREFERENCES.notifications,\n\t\t\t\t...cleanNotifications(prefs.notifications),\n\t\t\t},\n\t\t\tlocale: user.locale || cleaned.locale || 'en-US',\n\t\t\ttimezone: user.timezone || cleaned.timezone || 'UTC',\n\t\t},\n\t\tisEmailVerified: user.emailVerifiedAt !== null,\n\t\tisPhoneVerified: phoneVerified,\n\t\tmfaEnabled: booleanOrFalse(user.mfaEnabled),\n\t\tprovider: stringOrEmpty(user.provider),\n\t\thasPassword: user.passwordHash !== null && user.passwordHash !== undefined,\n\t\tsuspended: booleanOrFalse(user.suspended),\n\t\twhitelist: booleanOrFalse(user.whitelist),\n\t\tipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],\n\t\tcreatedAt: dateOrEmpty(user.createdAt),\n\t\tupdatedAt: dateOrEmpty(user.updatedAt),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA2D;AAgC3D,IAAM,sBAAwC;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EACnE,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AACb;AAMA,SAAS,iBAAiB,OAAoD;AAC7E,QAAM,MAAiC,CAAC;AACxC,MAAI,OAAO,MAAM,WAAW,SAAU,KAAI,SAAS,MAAM;AACzD,MAAI,OAAO,MAAM,aAAa,SAAU,KAAI,WAAW,MAAM;AAC7D,MAAI,OAAO,MAAM,gBAAgB,SAAU,KAAI,cAAc,MAAM;AACnE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,SAAO;AACR;AAEA,SAAS,mBAAmB,OAA4D;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC;AACjD,QAAM,MAAkD,CAAC;AACzD,aAAW,OAAO,CAAC,SAAS,SAAS,OAAO,MAAM,GAAY;AAC7D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,OAAO,MAAM,UAAW,KAAI,GAAG,IAAI;AAAA,EACxC;AACA,SAAO;AACR;AAEO,SAAS,UAAU,MAAa,gBAAgB,OAAiB;AACvE,QAAM,QAAQ,KAAK,eAAgB,CAAC;AACpC,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO;AAAA,IACN,QAAI,2BAAc,KAAK,EAAE;AAAA,IACzB,WAAO,2BAAc,KAAK,KAAK;AAAA,IAC/B,eAAW,2BAAc,KAAK,SAAS;AAAA,IACvC,cAAU,2BAAc,KAAK,QAAQ;AAAA,IACrC,WAAO,2BAAc,KAAK,KAAK;AAAA,IAC/B,qBAAiB,2BAAc,KAAK,eAAe;AAAA,IACnD,UAAU,OAAO,KAAK,aAAa,YAAY,KAAK,WAAW;AAAA,IAC/D,eAAW,yBAAY,KAAK,SAAS;AAAA,IACrC,aAAa;AAAA,MACZ,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACd,GAAG,oBAAoB;AAAA,QACvB,GAAG,mBAAmB,MAAM,aAAa;AAAA,MAC1C;AAAA,MACA,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAAA,MACzC,UAAU,KAAK,YAAY,QAAQ,YAAY;AAAA,IAChD;AAAA,IACA,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,iBAAiB;AAAA,IACjB,gBAAY,4BAAe,KAAK,UAAU;AAAA,IAC1C,cAAU,2BAAc,KAAK,QAAQ;AAAA,IACrC,aAAa,KAAK,iBAAiB,QAAQ,KAAK,iBAAiB;AAAA,IACjE,eAAW,4BAAe,KAAK,SAAS;AAAA,IACxC,eAAW,4BAAe,KAAK,SAAS;AAAA,IACxC,aAAa,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,IACnE,eAAW,yBAAY,KAAK,SAAS;AAAA,IACrC,eAAW,yBAAY,KAAK,SAAS;AAAA,EACtC;AACD;","names":[]}

package/dist/dtos/user.d.cts

@@ -13,6 +13,8 @@ interface IUserDTO {
     isEmailVerified: boolean;
     isPhoneVerified: boolean;
     mfaEnabled: boolean;
+    provider: string;
+    hasPassword: boolean;
     suspended: boolean;
     whitelist: boolean;
     ipWhitelist: string[];

package/dist/dtos/user.d.ts

@@ -13,6 +13,8 @@ interface IUserDTO {
     isEmailVerified: boolean;
     isPhoneVerified: boolean;
     mfaEnabled: boolean;
+    provider: string;
+    hasPassword: boolean;
     suspended: boolean;
     whitelist: boolean;
     ipWhitelist: string[];

package/dist/dtos/user.js

@@ -51,6 +51,8 @@ function toUserDTO(user, phoneVerified = false) {
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
     mfaEnabled: booleanOrFalse(user.mfaEnabled),
+    provider: stringOrEmpty(user.provider),
+    hasPassword: user.passwordHash !== null && user.passwordHash !== void 0,
     suspended: booleanOrFalse(user.suspended),
     whitelist: booleanOrFalse(user.whitelist),
     ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],

package/dist/dtos/user.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/dtos/user.ts"],"sourcesContent":["import { stringOrEmpty, booleanOrFalse, dateOrEmpty } from '@fonderie/core';\n\nimport type { IUser, IUserPreferences } from '../types';\n\nexport interface IUserDTO {\n\tid: string;\n\temail: string;\n\tfirstName: string;\n\tlastName: string;\n\tphone: string;\n\tprofileImageUrl: string;\n\tisActive: boolean;\n\tlastLogin: string;\n\tpreferences: IUserPreferences;\n\tisEmailVerified: boolean;\n\tisPhoneVerified: boolean;\n\tmfaEnabled: boolean;\n\tsuspended: boolean;\n\twhitelist: boolean;\n\tipWhitelist: string[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nconst DEFAULT_PREFERENCES: IUserPreferences = {\n\tlocale: 'en-US',\n\ttimezone: 'UTC',\n\tnotifications: { email: true, inApp: true, sms: false, push: false },\n\temailDigest: 'immediate',\n\tdateFormat: 'MM/DD/YYYY',\n\ttimeFormat: 'hh:mm A',\n};\n\n// Historical rows may hold garbage preferences (the update schema accepted\n// `unknown` for four keys until it was typed). Only well-typed values\n// survive into the DTO, and notifications deep-merge over the defaults so a\n// partial stored object can't shrink the shape the client type promises.\nfunction cleanPreferences(prefs: IUserPreferences): Partial<IUserPreferences> {\n\tconst out: Partial<IUserPreferences> = {};\n\tif (typeof prefs.locale === 'string') out.locale = prefs.locale;\n\tif (typeof prefs.timezone === 'string') out.timezone = prefs.timezone;\n\tif (typeof prefs.emailDigest === 'string') out.emailDigest = prefs.emailDigest;\n\tif (typeof prefs.dateFormat === 'string') out.dateFormat = prefs.dateFormat;\n\tif (typeof prefs.timeFormat === 'string') out.timeFormat = prefs.timeFormat;\n\treturn out;\n}\n\nfunction cleanNotifications(value: unknown): Partial<IUserPreferences['notifications']> {\n\tif (!value || typeof value !== 'object') return {};\n\tconst out: Partial<IUserPreferences['notifications']> = {};\n\tfor (const key of ['email', 'inApp', 'sms', 'push'] as const) {\n\t\tconst v = (value as Record<string, unknown>)[key];\n\t\tif (typeof v === 'boolean') out[key] = v;\n\t}\n\treturn out;\n}\n\nexport function toUserDTO(user: IUser, phoneVerified = false): IUserDTO {\n\tconst prefs = user.preferences ?? ({} as IUserPreferences);\n\tconst cleaned = cleanPreferences(prefs);\n\treturn {\n\t\tid: stringOrEmpty(user.id),\n\t\temail: stringOrEmpty(user.email),\n\t\tfirstName: stringOrEmpty(user.firstName),\n\t\tlastName: stringOrEmpty(user.lastName),\n\t\tphone: stringOrEmpty(user.phone),\n\t\tprofileImageUrl: stringOrEmpty(user.profileImageUrl),\n\t\tisActive: typeof user.isActive === 'boolean' ? user.isActive : true,\n\t\tlastLogin: dateOrEmpty(user.lastLogin),\n\t\tpreferences: {\n\t\t\t...DEFAULT_PREFERENCES,\n\t\t\t...cleaned,\n\t\t\tnotifications: {\n\t\t\t\t...DEFAULT_PREFERENCES.notifications,\n\t\t\t\t...cleanNotifications(prefs.notifications),\n\t\t\t},\n\t\t\tlocale: user.locale || cleaned.locale || 'en-US',\n\t\t\ttimezone: user.timezone || cleaned.timezone || 'UTC',\n\t\t},\n\t\tisEmailVerified: user.emailVerifiedAt !== null,\n\t\tisPhoneVerified: phoneVerified,\n\t\tmfaEnabled: booleanOrFalse(user.mfaEnabled),\n\t\tsuspended: booleanOrFalse(user.suspended),\n\t\twhitelist: booleanOrFalse(user.whitelist),\n\t\tipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],\n\t\tcreatedAt: dateOrEmpty(user.createdAt),\n\t\tupdatedAt: dateOrEmpty(user.updatedAt),\n\t};\n}\n"],"mappings":";AAAA,SAAS,eAAe,gBAAgB,mBAAmB;AAwB3D,IAAM,sBAAwC;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EACnE,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AACb;AAMA,SAAS,iBAAiB,OAAoD;AAC7E,QAAM,MAAiC,CAAC;AACxC,MAAI,OAAO,MAAM,WAAW,SAAU,KAAI,SAAS,MAAM;AACzD,MAAI,OAAO,MAAM,aAAa,SAAU,KAAI,WAAW,MAAM;AAC7D,MAAI,OAAO,MAAM,gBAAgB,SAAU,KAAI,cAAc,MAAM;AACnE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,SAAO;AACR;AAEA,SAAS,mBAAmB,OAA4D;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC;AACjD,QAAM,MAAkD,CAAC;AACzD,aAAW,OAAO,CAAC,SAAS,SAAS,OAAO,MAAM,GAAY;AAC7D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,OAAO,MAAM,UAAW,KAAI,GAAG,IAAI;AAAA,EACxC;AACA,SAAO;AACR;AAEO,SAAS,UAAU,MAAa,gBAAgB,OAAiB;AACvE,QAAM,QAAQ,KAAK,eAAgB,CAAC;AACpC,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO;AAAA,IACN,IAAI,cAAc,KAAK,EAAE;AAAA,IACzB,OAAO,cAAc,KAAK,KAAK;AAAA,IAC/B,WAAW,cAAc,KAAK,SAAS;AAAA,IACvC,UAAU,cAAc,KAAK,QAAQ;AAAA,IACrC,OAAO,cAAc,KAAK,KAAK;AAAA,IAC/B,iBAAiB,cAAc,KAAK,eAAe;AAAA,IACnD,UAAU,OAAO,KAAK,aAAa,YAAY,KAAK,WAAW;AAAA,IAC/D,WAAW,YAAY,KAAK,SAAS;AAAA,IACrC,aAAa;AAAA,MACZ,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACd,GAAG,oBAAoB;AAAA,QACvB,GAAG,mBAAmB,MAAM,aAAa;AAAA,MAC1C;AAAA,MACA,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAAA,MACzC,UAAU,KAAK,YAAY,QAAQ,YAAY;AAAA,IAChD;AAAA,IACA,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,iBAAiB;AAAA,IACjB,YAAY,eAAe,KAAK,UAAU;AAAA,IAC1C,WAAW,eAAe,KAAK,SAAS;AAAA,IACxC,WAAW,eAAe,KAAK,SAAS;AAAA,IACxC,aAAa,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,IACnE,WAAW,YAAY,KAAK,SAAS;AAAA,IACrC,WAAW,YAAY,KAAK,SAAS;AAAA,EACtC;AACD;","names":[]}
+{"version":3,"sources":["../../src/dtos/user.ts"],"sourcesContent":["import { stringOrEmpty, booleanOrFalse, dateOrEmpty } from '@fonderie/core';\n\nimport type { IUser, IUserPreferences } from '../types';\n\nexport interface IUserDTO {\n\tid: string;\n\temail: string;\n\tfirstName: string;\n\tlastName: string;\n\tphone: string;\n\tprofileImageUrl: string;\n\tisActive: boolean;\n\tlastLogin: string;\n\tpreferences: IUserPreferences;\n\tisEmailVerified: boolean;\n\tisPhoneVerified: boolean;\n\tmfaEnabled: boolean;\n\t// OAuth provider linked to this account ('google', 'apple'), or '' if none.\n\tprovider: string;\n\t// Whether a password is set. Together with `provider` this is everything a\n\t// settings screen needs to render sign-in methods AND to know that\n\t// disconnecting the provider is possible — an account with no password has\n\t// no other credential, so unlinking is refused (409 PASSWORD_REQUIRED).\n\t// Exposed as a boolean precisely so the hash never can be.\n\thasPassword: boolean;\n\tsuspended: boolean;\n\twhitelist: boolean;\n\tipWhitelist: string[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nconst DEFAULT_PREFERENCES: IUserPreferences = {\n\tlocale: 'en-US',\n\ttimezone: 'UTC',\n\tnotifications: { email: true, inApp: true, sms: false, push: false },\n\temailDigest: 'immediate',\n\tdateFormat: 'MM/DD/YYYY',\n\ttimeFormat: 'hh:mm A',\n};\n\n// Historical rows may hold garbage preferences (the update schema accepted\n// `unknown` for four keys until it was typed). Only well-typed values\n// survive into the DTO, and notifications deep-merge over the defaults so a\n// partial stored object can't shrink the shape the client type promises.\nfunction cleanPreferences(prefs: IUserPreferences): Partial<IUserPreferences> {\n\tconst out: Partial<IUserPreferences> = {};\n\tif (typeof prefs.locale === 'string') out.locale = prefs.locale;\n\tif (typeof prefs.timezone === 'string') out.timezone = prefs.timezone;\n\tif (typeof prefs.emailDigest === 'string') out.emailDigest = prefs.emailDigest;\n\tif (typeof prefs.dateFormat === 'string') out.dateFormat = prefs.dateFormat;\n\tif (typeof prefs.timeFormat === 'string') out.timeFormat = prefs.timeFormat;\n\treturn out;\n}\n\nfunction cleanNotifications(value: unknown): Partial<IUserPreferences['notifications']> {\n\tif (!value || typeof value !== 'object') return {};\n\tconst out: Partial<IUserPreferences['notifications']> = {};\n\tfor (const key of ['email', 'inApp', 'sms', 'push'] as const) {\n\t\tconst v = (value as Record<string, unknown>)[key];\n\t\tif (typeof v === 'boolean') out[key] = v;\n\t}\n\treturn out;\n}\n\nexport function toUserDTO(user: IUser, phoneVerified = false): IUserDTO {\n\tconst prefs = user.preferences ?? ({} as IUserPreferences);\n\tconst cleaned = cleanPreferences(prefs);\n\treturn {\n\t\tid: stringOrEmpty(user.id),\n\t\temail: stringOrEmpty(user.email),\n\t\tfirstName: stringOrEmpty(user.firstName),\n\t\tlastName: stringOrEmpty(user.lastName),\n\t\tphone: stringOrEmpty(user.phone),\n\t\tprofileImageUrl: stringOrEmpty(user.profileImageUrl),\n\t\tisActive: typeof user.isActive === 'boolean' ? user.isActive : true,\n\t\tlastLogin: dateOrEmpty(user.lastLogin),\n\t\tpreferences: {\n\t\t\t...DEFAULT_PREFERENCES,\n\t\t\t...cleaned,\n\t\t\tnotifications: {\n\t\t\t\t...DEFAULT_PREFERENCES.notifications,\n\t\t\t\t...cleanNotifications(prefs.notifications),\n\t\t\t},\n\t\t\tlocale: user.locale || cleaned.locale || 'en-US',\n\t\t\ttimezone: user.timezone || cleaned.timezone || 'UTC',\n\t\t},\n\t\tisEmailVerified: user.emailVerifiedAt !== null,\n\t\tisPhoneVerified: phoneVerified,\n\t\tmfaEnabled: booleanOrFalse(user.mfaEnabled),\n\t\tprovider: stringOrEmpty(user.provider),\n\t\thasPassword: user.passwordHash !== null && user.passwordHash !== undefined,\n\t\tsuspended: booleanOrFalse(user.suspended),\n\t\twhitelist: booleanOrFalse(user.whitelist),\n\t\tipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],\n\t\tcreatedAt: dateOrEmpty(user.createdAt),\n\t\tupdatedAt: dateOrEmpty(user.updatedAt),\n\t};\n}\n"],"mappings":";AAAA,SAAS,eAAe,gBAAgB,mBAAmB;AAgC3D,IAAM,sBAAwC;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,MAAM;AAAA,EACnE,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AACb;AAMA,SAAS,iBAAiB,OAAoD;AAC7E,QAAM,MAAiC,CAAC;AACxC,MAAI,OAAO,MAAM,WAAW,SAAU,KAAI,SAAS,MAAM;AACzD,MAAI,OAAO,MAAM,aAAa,SAAU,KAAI,WAAW,MAAM;AAC7D,MAAI,OAAO,MAAM,gBAAgB,SAAU,KAAI,cAAc,MAAM;AACnE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,MAAI,OAAO,MAAM,eAAe,SAAU,KAAI,aAAa,MAAM;AACjE,SAAO;AACR;AAEA,SAAS,mBAAmB,OAA4D;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO,CAAC;AACjD,QAAM,MAAkD,CAAC;AACzD,aAAW,OAAO,CAAC,SAAS,SAAS,OAAO,MAAM,GAAY;AAC7D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,OAAO,MAAM,UAAW,KAAI,GAAG,IAAI;AAAA,EACxC;AACA,SAAO;AACR;AAEO,SAAS,UAAU,MAAa,gBAAgB,OAAiB;AACvE,QAAM,QAAQ,KAAK,eAAgB,CAAC;AACpC,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO;AAAA,IACN,IAAI,cAAc,KAAK,EAAE;AAAA,IACzB,OAAO,cAAc,KAAK,KAAK;AAAA,IAC/B,WAAW,cAAc,KAAK,SAAS;AAAA,IACvC,UAAU,cAAc,KAAK,QAAQ;AAAA,IACrC,OAAO,cAAc,KAAK,KAAK;AAAA,IAC/B,iBAAiB,cAAc,KAAK,eAAe;AAAA,IACnD,UAAU,OAAO,KAAK,aAAa,YAAY,KAAK,WAAW;AAAA,IAC/D,WAAW,YAAY,KAAK,SAAS;AAAA,IACrC,aAAa;AAAA,MACZ,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACd,GAAG,oBAAoB;AAAA,QACvB,GAAG,mBAAmB,MAAM,aAAa;AAAA,MAC1C;AAAA,MACA,QAAQ,KAAK,UAAU,QAAQ,UAAU;AAAA,MACzC,UAAU,KAAK,YAAY,QAAQ,YAAY;AAAA,IAChD;AAAA,IACA,iBAAiB,KAAK,oBAAoB;AAAA,IAC1C,iBAAiB;AAAA,IACjB,YAAY,eAAe,KAAK,UAAU;AAAA,IAC1C,UAAU,cAAc,KAAK,QAAQ;AAAA,IACrC,aAAa,KAAK,iBAAiB,QAAQ,KAAK,iBAAiB;AAAA,IACjE,WAAW,eAAe,KAAK,SAAS;AAAA,IACxC,WAAW,eAAe,KAAK,SAAS;AAAA,IACxC,aAAa,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC;AAAA,IACnE,WAAW,YAAY,KAAK,SAAS;AAAA,IACrC,WAAW,YAAY,KAAK,SAAS;AAAA,EACtC;AACD;","names":[]}

package/dist/index.cjs

@@ -296,7 +296,21 @@ var MESSAGE_KEYS = {
   mfaDisabled: "mfa-disabled",
   mfaBackupCodesRegenerated: "mfa-backup-codes-regenerated",
   emailChanged: "email-changed",
-  phoneChanged: "phone-changed"
+  phoneChanged: "phone-changed",
+  // Changing HOW an account can be signed into is a security event for the
+  // account's owner, who may not be the person doing it. Both directions are
+  // notified for the same reason password changes are.
+  // A password was REVOKED because the account it sat on had never been
+  // verified and an OAuth identity proved ownership of the mailbox. The
+  // recipient is now known to own that address, so this reaches the right
+  // person — and it is the only way they learn a password stopped working.
+  passwordRevoked: "password-revoked",
+  // Welcome for an account CREATED by an OAuth sign-in. Distinct from
+  // emailRegistration, which carries a verification PIN — an OAuth signup
+  // arrives already verified by the provider and has nothing to confirm.
+  oauthRegistration: "oauth-registration",
+  oauthLinked: "oauth-linked",
+  oauthUnlinked: "oauth-unlinked"
 };
 var EVENT_KEYS = {
   userRegistered: "fonderie.user.registered",
@@ -528,6 +542,8 @@ function toUserDTO(user, phoneVerified = false) {
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
     mfaEnabled: (0, import_core3.booleanOrFalse)(user.mfaEnabled),
+    provider: (0, import_core3.stringOrEmpty)(user.provider),
+    hasPassword: user.passwordHash !== null && user.passwordHash !== void 0,
     suspended: (0, import_core3.booleanOrFalse)(user.suspended),
     whitelist: (0, import_core3.booleanOrFalse)(user.whitelist),
     ipWhitelist: Array.isArray(user.ipWhitelist) ? user.ipWhitelist : [],
@@ -555,6 +571,7 @@ var USER_COLUMNS = `
 	ip_whitelist       AS "ipWhitelist",
 	mfa_enabled        AS "mfaEnabled",
 	email_verified_at  AS "emailVerifiedAt",
+	provider,
 	deleted_at         AS "deletedAt",
 	created_at         AS "createdAt",
 	updated_at         AS "updatedAt"
@@ -632,6 +649,31 @@ var UserModel = class {
     );
     return row ?? null;
   }
+  /**
+   * Clear the OAuth provider, but ONLY when the account can still be signed
+   * into afterwards.
+   *
+   * An account created through Google has no password. Unlinking it without
+   * checking would not be "removing a sign-in method" — it would be locking
+   * the owner out permanently, which is account deletion wearing a friendlier
+   * label. The guard lives in the WHERE clause so the check and the write are
+   * one atomic statement: a password cannot be removed between them.
+   *
+   * Returns false when the account has no password (nothing was changed) so
+   * the caller can say why rather than reporting a silent success.
+   */
+  async clearProvider(id) {
+    const rows = await this.store.query(
+      `UPDATE fonderie_users
+			    SET provider = NULL, provider_id = NULL
+			  WHERE id = $1
+			    AND password_hash IS NOT NULL
+			    AND provider IS NOT NULL
+			 RETURNING id`,
+      [id]
+    );
+    return rows.length > 0;
+  }
   async updatePassword(id, passwordHash) {
     await this.store.query(`UPDATE fonderie_users SET password_hash = $1 WHERE id = $2`, [
       passwordHash,
@@ -732,14 +774,71 @@ var UserModel = class {
     );
     return row?.mfa_secret ?? null;
   }
+  /**
+   * Link an OAuth identity to the account owning `email`, creating it if there
+   * is none.
+   *
+   * Returns what HAPPENED, not just who it happened to. Three outcomes hide
+   * behind one upsert, and callers must tell them apart:
+   *
+   *   • `inserted` — a brand-new account. Whoever provisions on signup (the
+   *     personal workspace, a wallet, a welcome email) must run, exactly as
+   *     it does for a password registration. This is the case that was
+   *     previously invisible: the upsert returned an id and looked identical
+   *     to a returning user signing in, so OAuth signups silently skipped
+   *     every signup side effect.
+   *   • `previousProvider` differs — an existing account gained, or switched,
+   *     a way to sign in. A security event for the owner.
+   *   • `previousProvider` is the same — an ordinary login. Nothing to do, and
+   *     notifying here would email the user on every single sign-in.
+   *
+   * The prior state is read in a CTE of the SAME statement, so it sees the
+   * snapshot from before the insert. Reading it in a separate query would
+   * race two concurrent logins into both seeing "new".
+   *
+   * SECURITY — linking is BY EMAIL, so this merges into whatever row already
+   * holds the address. If that row was never verified, its password was never
+   * proven to belong to the mailbox; anyone can register an address they do
+   * not own. The provider HAS proven ownership. So an unverified password is
+   * revoked at the moment of linking: without that, linking sets
+   * email_verified_at and the earlier registrant is left holding a working
+   * password on an account now treated as verified.
+   *
+   * The legitimate user loses nothing but a password reset — they own the
+   * mailbox. Someone who does not own it cannot receive that mail.
+   */
   async upsertByProvider(email2, provider, providerId) {
     const [row] = await this.store.query(
-      `INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
-			VALUES ($1, now(), $2, $3)
-			ON CONFLICT (email) DO UPDATE
-			SET provider = $2, provider_id = $3,
-			    email_verified_at = COALESCE(fonderie_users.email_verified_at, now())
-			RETURNING id`,
+      `WITH prior AS (
+				SELECT provider, email_verified_at, password_hash IS NOT NULL AS had_password
+				  FROM fonderie_users WHERE email = $1
+			), upserted AS (
+				INSERT INTO fonderie_users (email, email_verified_at, provider, provider_id)
+				VALUES ($1, now(), $2, $3)
+				ON CONFLICT (email) DO UPDATE
+				SET provider = $2, provider_id = $3,
+				    email_verified_at = COALESCE(fonderie_users.email_verified_at, now()),
+				    -- A password on an UNVERIFIED account is a claim, not a
+				    -- credential: nobody ever proved that mailbox belongs to
+				    -- whoever set it. The provider has now proven it belongs to
+				    -- the person signing in. Drop the unproven claim rather than
+				    -- promote it \u2014 otherwise linking marks the account verified
+				    -- and silently hands the earlier registrant a working
+				    -- password on a now-trusted account.
+				    password_hash = CASE
+				      WHEN fonderie_users.email_verified_at IS NULL THEN NULL
+				      ELSE fonderie_users.password_hash
+				    END
+				RETURNING id
+			)
+			SELECT upserted.id,
+			       NOT EXISTS (SELECT 1 FROM prior)   AS inserted,
+			       (SELECT provider FROM prior)       AS "previousProvider",
+			       -- True only when a password was actually revoked, so the
+			       -- caller can tell the owner their sign-in method changed.
+			       COALESCE((SELECT had_password AND email_verified_at IS NULL FROM prior), false)
+			         AS "clearedUnverifiedPassword"
+			FROM upserted`,
       [email2, provider, providerId]
     );
     return row ?? null;
@@ -2232,6 +2331,50 @@ function userController(store, config, bus) {
       await sessions.deleteByUser(ctx.user.id);
       return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
+    /**
+     * Remove an OAuth provider from the account.
+     *
+     * Refuses when the account has no password, because unlinking would
+     * then leave NO way to sign in — that is account deletion, not a
+     * settings toggle, and a user clicking "disconnect Google" is not
+     * asking for it. The check is inside the UPDATE's WHERE clause, so a
+     * password cannot disappear between the check and the write.
+     *
+     * Notifies the account's email either way: changing how an account can
+     * be signed into is a security event for its owner, who is not
+     * necessarily the person doing it.
+     */
+    unlinkOauth: async (ctx) => {
+      const provider = String(ctx.meta["params"]?.["provider"] ?? "");
+      const current = await users.findById(ctx.user.id);
+      if (!current?.provider) {
+        return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_LINKED", "No sign-in provider is linked.");
+      }
+      if (provider && provider.toLowerCase() !== current.provider.toLowerCase()) {
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.NOT_FOUND,
+          "NOT_LINKED",
+          `This account is not linked to ${provider}.`
+        );
+      }
+      const removed = await users.clearProvider(ctx.user.id);
+      if (!removed) {
+        return (0, import_core8.setApiResponse)(
+          import_core8.HTTP.CONFLICT,
+          "PASSWORD_REQUIRED",
+          "Set a password before disconnecting this provider \u2014 it is currently the only way to sign in."
+        );
+      }
+      if (ctx.user.email) {
+        await (0, import_core8.background)(bus?.emit(import_events3.NOTIFICATION_EVENT, {
+          type: MESSAGE_KEYS.oauthUnlinked,
+          locale: ctx.user.locale,
+          data: { provider: current.provider },
+          recipient: { email: ctx.user.email, phone: null, deviceToken: null }
+        }));
+      }
+      return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "OAUTH_UNLINKED", "Sign-in provider removed.");
+    },
     deleteMe: async (ctx) => {
       const userId = ctx.user.id;
       await users.softDelete(userId);
@@ -2292,6 +2435,7 @@ function userController(store, config, bus) {
 var import_node_crypto7 = require("crypto");
 var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
 var import_core9 = require("@fonderie/core");
+var import_events4 = require("@fonderie/events");
 
 // src/models/consumed-token.model.ts
 var ConsumedTokenModel = class {
@@ -2392,11 +2536,68 @@ async function verifyAppleIdToken(idToken, opts) {
   }
 }
 var appleEmailVerified = (c) => c.email_verified === true || c.email_verified === "true";
-function oauthController(store, config) {
+function oauthController(store, config, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const loginEvents = new LoginEventModel(store);
   const consumedTokens = new ConsumedTokenModel(store);
+  const announceOAuthUpsert = async (ctx, upserted, provider, user) => {
+    if (!bus) return;
+    const reqId = ctx.meta["requestId"];
+    const reqOpts = reqId !== void 0 ? { requestId: reqId } : void 0;
+    const label = provider.charAt(0).toUpperCase() + provider.slice(1);
+    const recipient = { email: user.email, phone: null, deviceToken: null };
+    if (upserted.clearedUnverifiedPassword && user.email) {
+      await (0, import_core9.background)(bus.emit(
+        import_events4.NOTIFICATION_EVENT,
+        {
+          type: MESSAGE_KEYS.passwordRevoked,
+          locale: user.locale,
+          data: { provider: label },
+          recipient
+        },
+        reqOpts
+      ));
+    }
+    if (upserted.inserted) {
+      await (0, import_core9.background)(bus.emit(
+        EVENT_KEYS.userRegistered,
+        {
+          userId: upserted.id,
+          email: user.email,
+          firstName: user.firstName,
+          lastName: user.lastName,
+          loginMethod: provider
+        },
+        reqOpts
+      ));
+      if (user.email) {
+        await (0, import_core9.background)(bus.emit(
+          import_events4.NOTIFICATION_EVENT,
+          {
+            type: MESSAGE_KEYS.oauthRegistration,
+            locale: user.locale,
+            data: { provider: label, appName: config.appName ?? "Fonderie" },
+            recipient
+          },
+          reqOpts
+        ));
+      }
+      return;
+    }
+    if (upserted.previousProvider !== provider && user.email) {
+      await (0, import_core9.background)(bus.emit(
+        import_events4.NOTIFICATION_EVENT,
+        {
+          type: MESSAGE_KEYS.oauthLinked,
+          locale: user.locale,
+          data: { provider: label },
+          recipient
+        },
+        reqOpts
+      ));
+    }
+  };
   const completeAppleLogin = async (ctx, claims) => {
     const meta = requestMeta(ctx);
     if (!claims.email) {
@@ -2425,6 +2626,7 @@ function oauthController(store, config) {
     if (!fullUser) {
       return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "Apple login failed");
     }
+    await announceOAuthUpsert(ctx, upserted, "apple", fullUser);
     const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, { loginMethod: "apple" });
     await sessions.create(upserted.id, refreshToken, refreshTokenExpiry(refreshToken), sid, meta);
     await loginEvents.recordSafe({
@@ -2575,6 +2777,7 @@ function oauthController(store, config) {
       if (!fullUser) {
         return (0, import_core9.setApiResponse)(import_core9.HTTP.SERVER_ERROR, "SERVER_ERROR", "OAuth login failed");
       }
+      await announceOAuthUpsert(ctx, upserted, "google", fullUser);
       const { accessToken, refreshToken, sid } = issueTokenPair(upserted.id, config, {
         loginMethod: "google"
       });
@@ -2739,7 +2942,7 @@ function oauthController(store, config) {
 function buildAuthRoutes(store, config, bus) {
   const user = userController(store, config, bus);
   const auth = authController(store, config, bus);
-  const oauth = oauthController(store, config);
+  const oauth = oauthController(store, config, bus);
   const mfa = mfaController(store, config, config.appName ?? "Fonderie", bus);
   const verifyGate = config.requireVerification ? import_middlewares2.requireVerified : (_ctx, next) => next();
   const passthrough = (_ctx, next) => next();
@@ -2797,6 +3000,9 @@ function buildAuthRoutes(store, config, bus) {
     R("updateEmail", "PUT", "/users/email", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updateEmailSchema), user.updateEmail),
     R("updatePhone", "PUT", "/users/phone", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePhoneSchema), user.updatePhone),
     R("changePassword", "PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword),
+    // Disconnect an OAuth provider. requireAuth only — the controller
+    // refuses when it would leave the account with no way to sign in.
+    R("unlinkOauth", "DELETE", "/auth/oauth/:provider", import_middlewares2.requireAuth, user.unlinkOauth),
     R("deleteMe", "DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe),
     R("exportMe", "GET", "/users/export", import_middlewares2.requireAuth, user.exportMe),
     // Security surfaces (Protected; the caller's own login history + sessions).
@@ -3109,9 +3315,66 @@ If you made this change, you're all set. If not, contact support right away \u20
 The phone number on your account was just updated.
 
 If you made this change, you're all set. If not, contact support right away \u2014 someone may have access to your account.`
+  },
+  [MESSAGE_KEYS.passwordRevoked]: {
+    subject: "The password on your account was removed",
+    html: `<h1>Your password was removed</h1>
+<p>You just signed in with <strong>{{provider}}</strong>. A password had been set on this account, but this email address had never been confirmed &mdash; so we could not tell who set it, and it has been removed.</p>
+<p>Signing in with {{provider}} works as before. If you want a password as well, set one from your account settings.</p>
+<p class="muted">If you never set a password here, someone else may have tried to register with your address. Nothing further is needed &mdash; the account is yours.</p>`,
+    text: `Your password was removed
+
+You just signed in with {{provider}}. A password had been set on this account,
+but this email address had never been confirmed \u2014 so we could not tell who set
+it, and it has been removed.
+
+Signing in with {{provider}} works as before. If you want a password as well,
+set one from your account settings.
+
+If you never set a password here, someone else may have tried to register with
+your address. Nothing further is needed \u2014 the account is yours.`
+  },
+  [MESSAGE_KEYS.oauthRegistration]: {
+    subject: "Welcome to {{appName}}",
+    html: `<h1>Welcome to {{appName}}</h1>
+<p>Your account was created using <strong>{{provider}}</strong>. Sign in any time with the same {{provider}} account &mdash; there is no password to remember.</p>
+<p class="muted">If you did not create this account, contact support.</p>`,
+    text: `Welcome
+
+Your account was created using {{provider}}. Sign in any time with the same
+{{provider}} account \u2014 there is no password to remember.
+
+If you did not create this account, contact support.`
+  },
+  [MESSAGE_KEYS.oauthLinked]: {
+    subject: "A new sign-in method was added to your account",
+    html: `<h1>{{provider}} sign-in was added</h1>
+<p>Your account can now also be signed into with <strong>{{provider}}</strong>.</p>
+<p class="muted">If you did this, nothing more is needed. If not, contact support right away and change your password &mdash; someone else may be able to sign in as you.</p>`,
+    text: `{{provider}} sign-in was added
+
+Your account can now also be signed into with {{provider}}.
+
+If you did this, nothing more is needed. If not, contact support right away and
+change your password \u2014 someone else may be able to sign in as you.`
+  },
+  [MESSAGE_KEYS.oauthUnlinked]: {
+    subject: "A sign-in method was removed from your account",
+    html: `<h1>{{provider}} sign-in was removed</h1>
+<p><strong>{{provider}}</strong> can no longer be used to sign in. Your email and password still work.</p>
+<p class="muted">If you did this, you&rsquo;re all set. If not, contact support right away.</p>`,
+    text: `{{provider}} sign-in was removed
+
+{{provider}} can no longer be used to sign in. Your email and password still work.
+
+If you did this, you're all set. If not, contact support right away.`
   }
 };
 var SAMPLE_PAYLOADS = {
+  [MESSAGE_KEYS.passwordRevoked]: { provider: "Google" },
+  [MESSAGE_KEYS.oauthRegistration]: { provider: "Google", appName: "Fonderie" },
+  [MESSAGE_KEYS.oauthLinked]: { provider: "Google" },
+  [MESSAGE_KEYS.oauthUnlinked]: { provider: "Google" },
   [MESSAGE_KEYS.emailRegistration]: { firstName: "", pin: "123456" },
   [MESSAGE_KEYS.emailVerification]: { firstName: "Ada", pin: "123456" },
   [MESSAGE_KEYS.passwordReset]: {