@fonderie/auth 7.7.4 → 7.8.1

package/dist/index.d.cts

@@ -1,10 +1,12 @@
-export { IMfaChallenge, ISession, IUser } from './types.cjs';
-import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
+import { IUser } from './types.cjs';
+export { IMfaChallenge, ISession } from './types.cjs';
+import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
 import { I as IAuthConfig } from './session-Bv4qu9xV.cjs';
 export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Bv4qu9xV.cjs';
-export { IUserDTO, toUserDTO } from './dtos/user.cjs';
+import { IUserDTO } from './dtos/user.cjs';
+export { toUserDTO } from './dtos/user.cjs';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
 import '@fonderie/rate-limit';
@@ -15,6 +17,7 @@ declare class AuthModule implements IFonderieModule {
     private bus?;
     readonly name = "@fonderie/auth";
     constructor(store: IStoreAdapter, config: IAuthConfig, bus?: EventBus | undefined);
+    describeAdmin(): IAdminDescription;
     checkReadiness(): IReadinessProblem[];
     install(app: IFonderieApp): void;
 }
@@ -233,4 +236,12 @@ declare function startUserRetention(store: IStoreAdapter, options: IUserRetentio
 
 declare function validateAuthConfig(config: IAuthConfig): void;
 
-export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, type ISessionDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, validateAuthConfig };
+interface IAdminUserDTO extends IUserDTO {
+    suspended: boolean;
+    deletedAt: string | null;
+    createdAt: string;
+}
+declare function toAdminUserDTO(user: IUser): IAdminUserDTO;
+declare function describeAuthAdminRoutes(store: IStoreAdapter): IAdminRoute[];
+
+export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, type IAdminUserDTO, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, type ISessionDTO, IUser, IUserDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, describeAuthAdminRoutes, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, toAdminUserDTO, validateAuthConfig };

package/dist/index.d.ts

@@ -1,10 +1,12 @@
-export { IMfaChallenge, ISession, IUser } from './types.js';
-import { IFonderieModule, IReadinessProblem, IFonderieApp } from '@fonderie/core';
+import { IUser } from './types.js';
+export { IMfaChallenge, ISession } from './types.js';
+import { IFonderieModule, IAdminDescription, IReadinessProblem, IFonderieApp, IAdminRoute } from '@fonderie/core';
 import { IStoreAdapter } from '@fonderie/store';
 import { EventBus } from '@fonderie/events';
 import { I as IAuthConfig } from './session-Bv4qu9xV.js';
 export { A as AUTH_CONFIG_KEYS, a as AuthLimitedRoute, b as AuthMessageKey, c as IAuthRateLimitConfig, d as IAuthRuntimeConfig, e as IAuthSecrets, f as IDataExportContributor, M as MESSAGE_KEYS, g as buildAuthAccountLimiter, h as buildAuthIpLimiter, w as withSession } from './session-Bv4qu9xV.js';
-export { IUserDTO, toUserDTO } from './dtos/user.js';
+import { IUserDTO } from './dtos/user.js';
+export { toUserDTO } from './dtos/user.js';
 export { requireAuth, validate } from '@fonderie/core/middlewares';
 import { z } from 'zod';
 import '@fonderie/rate-limit';
@@ -15,6 +17,7 @@ declare class AuthModule implements IFonderieModule {
     private bus?;
     readonly name = "@fonderie/auth";
     constructor(store: IStoreAdapter, config: IAuthConfig, bus?: EventBus | undefined);
+    describeAdmin(): IAdminDescription;
     checkReadiness(): IReadinessProblem[];
     install(app: IFonderieApp): void;
 }
@@ -233,4 +236,12 @@ declare function startUserRetention(store: IStoreAdapter, options: IUserRetentio
 
 declare function validateAuthConfig(config: IAuthConfig): void;
 
-export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, type ISessionDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, validateAuthConfig };
+interface IAdminUserDTO extends IUserDTO {
+    suspended: boolean;
+    deletedAt: string | null;
+    createdAt: string;
+}
+declare function toAdminUserDTO(user: IUser): IAdminUserDTO;
+declare function describeAuthAdminRoutes(store: IStoreAdapter): IAdminRoute[];
+
+export { AuthModule, type ChangePasswordInput, DEFAULT_TEMPLATES, type IAdminUserDTO, IAuthConfig, type IImportUser, type ILoginEventDTO, type ILoginHistoryPageDTO, type IPurgeOptions, type ISessionDTO, IUser, IUserDTO, type IUserRetentionScheduleOptions, type LoginInput, type RegisterInput, type ResetPasswordInput, describeAuthAdminRoutes, importUser, normalizeEmail, normalizeEmailSafe, purgeSoftDeletedUsers, schemas, startUserRetention, toAdminUserDTO, validateAuthConfig };

package/dist/index.js

@@ -646,6 +646,15 @@ var UserModel = class {
       [id]
     );
   }
+  // The operator's lock: login, refresh and the session middleware all refuse a
+  // suspended user. Returns false when there is no such user.
+  async setSuspended(id, suspended) {
+    const rows = await this.store.query(
+      `UPDATE fonderie_users SET suspended = $2, updated_at = now() WHERE id = $1 AND deleted_at IS NULL RETURNING id`,
+      [id, suspended]
+    );
+    return rows.length > 0;
+  }
   async softDelete(id) {
     await this.store.query(
       `UPDATE fonderie_users SET deleted_at = now(), updated_at = now() WHERE id = $1`,
@@ -3182,6 +3191,115 @@ function extractToken(request) {
   return match?.[1] ?? null;
 }
 
+// src/admin.ts
+import { HTTP as HTTP7, setApiResponse as setApiResponse7 } from "@fonderie/core";
+function toAdminUserDTO(user) {
+  return {
+    ...toUserDTO(user),
+    suspended: Boolean(user.suspended),
+    deletedAt: user.deletedAt ? user.deletedAt.toISOString() : null,
+    createdAt: user.createdAt.toISOString()
+  };
+}
+var ADMIN_PREFIX = "/_admin";
+var idOf = (ctx) => ctx.meta.params?.["id"] ?? "";
+var NOT_FOUND = () => setApiResponse7(HTTP7.NOT_FOUND, "NOT_FOUND", "No such user");
+function adminRouteTable(store) {
+  const users = new UserModel(store);
+  const sessions = new SessionModel(store);
+  const events = new LoginEventModel(store);
+  const setSuspended = (suspended) => async (ctx) => {
+    const ok = await users.setSuspended(idOf(ctx), suspended);
+    if (!ok) return NOT_FOUND();
+    const user = await users.findById(idOf(ctx));
+    return user ? setApiResponse7(
+      HTTP7.OK,
+      suspended ? "USER_SUSPENDED" : "USER_UNSUSPENDED",
+      suspended ? "User suspended" : "User unsuspended",
+      toAdminUserDTO(user)
+    ) : NOT_FOUND();
+  };
+  return [
+    [
+      "GET",
+      "/_admin/users",
+      async (ctx) => {
+        const email2 = new URL(ctx.request.url).searchParams.get("email")?.trim().toLowerCase();
+        if (!email2)
+          return setApiResponse7(HTTP7.UNPROCESSABLE, "INVALID_PARAMETER", "email is required");
+        const user = await users.findByEmail(email2);
+        return user ? setApiResponse7(HTTP7.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
+      }
+    ],
+    [
+      "GET",
+      "/_admin/users/:id",
+      async (ctx) => {
+        const user = await users.findById(idOf(ctx));
+        return user ? setApiResponse7(HTTP7.OK, "USER", "User", toAdminUserDTO(user)) : NOT_FOUND();
+      }
+    ],
+    [
+      "GET",
+      "/_admin/users/:id/sessions",
+      async (ctx) => {
+        if (!await users.findById(idOf(ctx))) return NOT_FOUND();
+        const rows = await sessions.listLiveByUser(idOf(ctx));
+        return setApiResponse7(
+          HTTP7.OK,
+          "SESSIONS",
+          "Live sessions",
+          rows.map((r) => toSessionDTO(r, null))
+        );
+      }
+    ],
+    // Signs the user out everywhere. The one write support reaches for first.
+    [
+      "DELETE",
+      "/_admin/users/:id/sessions",
+      async (ctx) => {
+        if (!await users.findById(idOf(ctx))) return NOT_FOUND();
+        await sessions.deleteByUser(idOf(ctx));
+        return setApiResponse7(HTTP7.OK, "SESSIONS_REVOKED", "All sessions revoked");
+      }
+    ],
+    [
+      "GET",
+      "/_admin/users/:id/login-history",
+      async (ctx) => {
+        if (!await users.findById(idOf(ctx))) return NOT_FOUND();
+        const params = new URL(ctx.request.url).searchParams;
+        const rawLimit = Number(params.get("limit") ?? 50);
+        const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50;
+        const cursorParam = params.get("cursor");
+        const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null;
+        if (cursorParam && !cursor)
+          return setApiResponse7(HTTP7.UNPROCESSABLE, "INVALID_PARAMETER", "Invalid cursor");
+        const page = await events.listByUser({
+          userId: idOf(ctx),
+          limit,
+          ...cursor ? { cursor } : {}
+        });
+        return setApiResponse7(
+          HTTP7.OK,
+          "LOGIN_HISTORY",
+          "Login history",
+          toLoginHistoryPageDTO(page)
+        );
+      }
+    ],
+    ["POST", "/_admin/users/:id/suspend", setSuspended(true)],
+    ["POST", "/_admin/users/:id/unsuspend", setSuspended(false)]
+  ];
+}
+function describeAuthAdminRoutes(store) {
+  return adminRouteTable(store).map(([method, path, h]) => ({
+    method,
+    path: path.slice(ADMIN_PREFIX.length),
+    handlers: [h]
+  }));
+}
+
 // src/module.ts
 var AuthModule = class {
   constructor(store, config, bus) {
@@ -3194,6 +3312,10 @@ var AuthModule = class {
   config;
   bus;
   name = "@fonderie/auth";
+  // Users, sessions, login history, suspend — only through @fonderie/admin.
+  describeAdmin() {
+    return { routes: describeAuthAdminRoutes(this.store) };
+  }
   // Report config problems for app.checkProductionReadiness() (data, not throw).
   checkReadiness() {
     return collectAuthConfigProblems(this.config);
@@ -3460,6 +3582,7 @@ export {
   MESSAGE_KEYS,
   buildAuthAccountLimiter,
   buildAuthIpLimiter,
+  describeAuthAdminRoutes,
   importUser,
   normalizeEmail,
   normalizeEmailSafe,
@@ -3467,6 +3590,7 @@ export {
   requireAuth2 as requireAuth,
   schemas_exports as schemas,
   startUserRetention,
+  toAdminUserDTO,
   toUserDTO,
   validate,
   validateAuthConfig,