@furystack/security 7.0.9 → 8.0.1

package/esm/password-credential-store.d.ts

@@ -0,0 +1,50 @@
+import { type StoreToken } from '@furystack/core';
+import { type DataSetToken } from '@furystack/repository';
+import { PasswordCredential } from './models/password-credential.js';
+import { PasswordResetToken } from './models/password-reset-token.js';
+/**
+ * Error thrown by the default factories of {@link PasswordCredentialStore}
+ * and {@link PasswordResetTokenStore} when they are resolved without a
+ * caller-provided override.
+ *
+ * Password credentials and reset tokens **must** survive process restarts,
+ * so security refuses to fall back to an in-memory store. Applications
+ * must bind a persistent implementation before resolving the
+ * {@link PasswordAuthenticator}.
+ */
+export declare class SecurityStoreNotConfiguredError extends Error {
+    constructor(storeName: string);
+}
+/**
+ * Store token for persisted {@link PasswordCredential} records. The default
+ * factory deliberately throws — applications are expected to rebind this
+ * token on their root injector with a persistent backing store before
+ * resolving any service that depends on it.
+ *
+ * @example
+ * ```ts
+ * injector.bind(PasswordCredentialStore, () => myPersistentCredentialStore)
+ * ```
+ */
+export declare const PasswordCredentialStore: StoreToken<PasswordCredential, 'userName'>;
+/**
+ * Store token for persisted {@link PasswordResetToken} records. Shares the
+ * throw-by-default contract with {@link PasswordCredentialStore}.
+ *
+ * @example
+ * ```ts
+ * injector.bind(PasswordResetTokenStore, () => myPersistentTokenStore)
+ * ```
+ */
+export declare const PasswordResetTokenStore: StoreToken<PasswordResetToken, 'token'>;
+/**
+ * Data set token over {@link PasswordCredentialStore}. The security services
+ * route all credential I/O through this dataset so authorization, hooks and
+ * change events can be layered on top of the raw store.
+ */
+export declare const PasswordCredentialDataSet: DataSetToken<PasswordCredential, 'userName'>;
+/**
+ * Data set token over {@link PasswordResetTokenStore}.
+ */
+export declare const PasswordResetTokenDataSet: DataSetToken<PasswordResetToken, 'token'>;
+//# sourceMappingURL=password-credential-store.d.ts.map

package/esm/password-credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-credential-store.d.ts","sourceRoot":"","sources":["../src/password-credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAErE;;;;;;;;;GASG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;gBAC5C,SAAS,EAAE,MAAM;CAM9B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAO7E,CAAA;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,kBAAkB,EAAE,OAAO,CAO1E,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,YAAY,CAAC,kBAAkB,EAAE,UAAU,CAGjF,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,EAAE,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAG9E,CAAA"}

package/esm/password-credential-store.js

@@ -0,0 +1,73 @@
+import { defineStore } from '@furystack/core';
+import { defineDataSet } from '@furystack/repository';
+import { PasswordCredential } from './models/password-credential.js';
+import { PasswordResetToken } from './models/password-reset-token.js';
+/**
+ * Error thrown by the default factories of {@link PasswordCredentialStore}
+ * and {@link PasswordResetTokenStore} when they are resolved without a
+ * caller-provided override.
+ *
+ * Password credentials and reset tokens **must** survive process restarts,
+ * so security refuses to fall back to an in-memory store. Applications
+ * must bind a persistent implementation before resolving the
+ * {@link PasswordAuthenticator}.
+ */
+export class SecurityStoreNotConfiguredError extends Error {
+    constructor(storeName) {
+        super(`Security store '${storeName}' has not been configured. Bind a persistent PhysicalStore for ${storeName} before resolving the PasswordAuthenticator.`);
+        this.name = 'SecurityStoreNotConfiguredError';
+    }
+}
+/**
+ * Store token for persisted {@link PasswordCredential} records. The default
+ * factory deliberately throws — applications are expected to rebind this
+ * token on their root injector with a persistent backing store before
+ * resolving any service that depends on it.
+ *
+ * @example
+ * ```ts
+ * injector.bind(PasswordCredentialStore, () => myPersistentCredentialStore)
+ * ```
+ */
+export const PasswordCredentialStore = defineStore({
+    name: 'furystack/security/PasswordCredentialStore',
+    model: PasswordCredential,
+    primaryKey: 'userName',
+    factory: () => {
+        throw new SecurityStoreNotConfiguredError('PasswordCredentialStore');
+    },
+});
+/**
+ * Store token for persisted {@link PasswordResetToken} records. Shares the
+ * throw-by-default contract with {@link PasswordCredentialStore}.
+ *
+ * @example
+ * ```ts
+ * injector.bind(PasswordResetTokenStore, () => myPersistentTokenStore)
+ * ```
+ */
+export const PasswordResetTokenStore = defineStore({
+    name: 'furystack/security/PasswordResetTokenStore',
+    model: PasswordResetToken,
+    primaryKey: 'token',
+    factory: () => {
+        throw new SecurityStoreNotConfiguredError('PasswordResetTokenStore');
+    },
+});
+/**
+ * Data set token over {@link PasswordCredentialStore}. The security services
+ * route all credential I/O through this dataset so authorization, hooks and
+ * change events can be layered on top of the raw store.
+ */
+export const PasswordCredentialDataSet = defineDataSet({
+    name: 'furystack/security/PasswordCredentialDataSet',
+    store: PasswordCredentialStore,
+});
+/**
+ * Data set token over {@link PasswordResetTokenStore}.
+ */
+export const PasswordResetTokenDataSet = defineDataSet({
+    name: 'furystack/security/PasswordResetTokenDataSet',
+    store: PasswordResetTokenStore,
+});
+//# sourceMappingURL=password-credential-store.js.map

package/esm/password-credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-credential-store.js","sourceRoot":"","sources":["../src/password-credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAmB,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAqB,MAAM,uBAAuB,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,YAAY,SAAiB;QAC3B,KAAK,CACH,mBAAmB,SAAS,kEAAkE,SAAS,8CAA8C,CACtJ,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAA;IAC/C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA+C,WAAW,CAAC;IAC7F,IAAI,EAAE,4CAA4C;IAClD,KAAK,EAAE,kBAAkB;IACzB,UAAU,EAAE,UAAU;IACtB,OAAO,EAAE,GAAG,EAAE;QACZ,MAAM,IAAI,+BAA+B,CAAC,yBAAyB,CAAC,CAAA;IACtE,CAAC;CACF,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA4C,WAAW,CAAC;IAC1F,IAAI,EAAE,4CAA4C;IAClD,KAAK,EAAE,kBAAkB;IACzB,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,GAAG,EAAE;QACZ,MAAM,IAAI,+BAA+B,CAAC,yBAAyB,CAAC,CAAA;IACtE,CAAC;CACF,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAiD,aAAa,CAAC;IACnG,IAAI,EAAE,8CAA8C;IACpD,KAAK,EAAE,uBAAuB;CAC/B,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA8C,aAAa,CAAC;IAChG,IAAI,EAAE,8CAA8C;IACpD,KAAK,EAAE,uBAAuB;CAC/B,CAAC,CAAA"}

package/esm/password-credential-store.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=password-credential-store.spec.d.ts.map

package/esm/password-credential-store.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-credential-store.spec.d.ts","sourceRoot":"","sources":["../src/password-credential-store.spec.ts"],"names":[],"mappings":""}

package/esm/password-credential-store.spec.js

@@ -0,0 +1,64 @@
+import { InMemoryStore } from '@furystack/core';
+import { createInjector } from '@furystack/inject';
+import { usingAsync } from '@furystack/utils';
+import { describe, expect, it } from 'vitest';
+import { PasswordCredential } from './models/password-credential.js';
+import { PasswordResetToken } from './models/password-reset-token.js';
+import { PasswordCredentialDataSet, PasswordCredentialStore, PasswordResetTokenDataSet, PasswordResetTokenStore, SecurityStoreNotConfiguredError, } from './password-credential-store.js';
+describe('PasswordCredentialStore', () => {
+    it('exposes the PasswordCredential model and userName primary key on the token', () => {
+        expect(PasswordCredentialStore.model).toBe(PasswordCredential);
+        expect(PasswordCredentialStore.primaryKey).toBe('userName');
+        expect(PasswordCredentialStore.lifetime).toBe('singleton');
+    });
+    it('throws SecurityStoreNotConfiguredError when resolved without an override', async () => {
+        await usingAsync(createInjector(), async (injector) => {
+            expect(() => injector.get(PasswordCredentialStore)).toThrow(SecurityStoreNotConfiguredError);
+            expect(() => injector.get(PasswordCredentialStore)).toThrow(/PasswordCredentialStore.*not been configured/);
+        });
+    });
+    it('returns the bound implementation after rebinding the token', async () => {
+        await usingAsync(createInjector(), async (injector) => {
+            const impl = new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' });
+            injector.bind(PasswordCredentialStore, () => impl);
+            expect(injector.get(PasswordCredentialStore)).toBe(impl);
+        });
+    });
+});
+describe('PasswordResetTokenStore', () => {
+    it('exposes the PasswordResetToken model and token primary key on the token', () => {
+        expect(PasswordResetTokenStore.model).toBe(PasswordResetToken);
+        expect(PasswordResetTokenStore.primaryKey).toBe('token');
+        expect(PasswordResetTokenStore.lifetime).toBe('singleton');
+    });
+    it('throws SecurityStoreNotConfiguredError when resolved without an override', async () => {
+        await usingAsync(createInjector(), async (injector) => {
+            expect(() => injector.get(PasswordResetTokenStore)).toThrow(SecurityStoreNotConfiguredError);
+            expect(() => injector.get(PasswordResetTokenStore)).toThrow(/PasswordResetTokenStore.*not been configured/);
+        });
+    });
+    it('returns the bound implementation after rebinding the token', async () => {
+        await usingAsync(createInjector(), async (injector) => {
+            const impl = new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' });
+            injector.bind(PasswordResetTokenStore, () => impl);
+            expect(injector.get(PasswordResetTokenStore)).toBe(impl);
+        });
+    });
+});
+describe('PasswordCredentialDataSet / PasswordResetTokenDataSet', () => {
+    it('mirror the backing store metadata onto the data-set token', () => {
+        expect(PasswordCredentialDataSet.model).toBe(PasswordCredential);
+        expect(PasswordCredentialDataSet.primaryKey).toBe('userName');
+        expect(PasswordResetTokenDataSet.model).toBe(PasswordResetToken);
+        expect(PasswordResetTokenDataSet.primaryKey).toBe('token');
+    });
+});
+describe('SecurityStoreNotConfiguredError', () => {
+    it('embeds the store name in the message and sets the error name', () => {
+        const error = new SecurityStoreNotConfiguredError('SomeStore');
+        expect(error.name).toBe('SecurityStoreNotConfiguredError');
+        expect(error.message).toContain('SomeStore');
+        expect(error).toBeInstanceOf(Error);
+    });
+});
+//# sourceMappingURL=password-credential-store.spec.js.map

package/esm/password-credential-store.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-credential-store.spec.js","sourceRoot":"","sources":["../src/password-credential-store.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,gCAAgC,CAAA;AAEvC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC9D,MAAM,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC3D,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACpD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAA;YAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAA;QAC7G,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACpD,MAAM,IAAI,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;YACrF,QAAQ,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YAClD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC9D,MAAM,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACpD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAA;YAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAA;QAC7G,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACpD,MAAM,IAAI,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;YAClF,QAAQ,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YAClD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAChE,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC7D,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAChE,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,KAAK,GAAG,IAAI,+BAA+B,CAAC,WAAW,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/esm/password-hasher.d.ts

@@ -1,6 +1,24 @@
 import type { PasswordCheckResult, PasswordCredential } from './models/index.js';
-export declare class PasswordHasher {
-    createCredential(_userName: string, _password: string): Promise<PasswordCredential>;
-    verifyCredential(_password: string, _credential: PasswordCredential): Promise<PasswordCheckResult>;
+/**
+ * Abstraction for hashing and verifying password credentials.
+ *
+ * Implementations are DI tokens that resolve to an object conforming to this
+ * interface. The default implementation shipped by `@furystack/security` is
+ * {@link CryptoPasswordHasher}; applications can swap in an alternative by
+ * binding the {@link SecurityPolicy.hasher} token (for example, to use a
+ * stronger KDF or a managed hashing service).
+ */
+export interface PasswordHasher {
+    /**
+     * Produces a fresh credential entry for the given user name and plain
+     * password. The returned record is suitable for persistence in the
+     * credential store.
+     */
+    createCredential(userName: string, password: string): Promise<PasswordCredential>;
+    /**
+     * Verifies a plain password against a stored credential. Implementations
+     * should be constant-time relative to the password to avoid timing leaks.
+     */
+    verifyCredential(password: string, credential: PasswordCredential): Promise<PasswordCheckResult>;
 }
 //# sourceMappingURL=password-hasher.d.ts.map

package/esm/password-hasher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-hasher.d.ts","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEhF,qBACa,cAAc;IAClB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAInF,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAG1G"}
+{"version":3,"file":"password-hasher.d.ts","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEhF;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAEjF;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;CACjG"}

package/esm/password-hasher.js

@@ -1,20 +1,2 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-import { Injectable } from '@furystack/inject';
-let PasswordHasher = class PasswordHasher {
-    createCredential(_userName, _password) {
-        throw Error('Set up hasher - TODO');
-    }
-    verifyCredential(_password, _credential) {
-        throw Error('Set up hasher - TODO');
-    }
-};
-PasswordHasher = __decorate([
-    Injectable({ lifetime: 'singleton' })
-], PasswordHasher);
-export { PasswordHasher };
+export {};
 //# sourceMappingURL=password-hasher.js.map

package/esm/password-hasher.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-hasher.js","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAIvC,IAAM,cAAc,GAApB,MAAM,cAAc;IAClB,gBAAgB,CAAC,SAAiB,EAAE,SAAiB;QAC1D,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;IAEM,gBAAgB,CAAC,SAAiB,EAAE,WAA+B;QACxE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;CACF,CAAA;AARY,cAAc;IAD1B,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,cAAc,CAQ1B"}
+{"version":3,"file":"password-hasher.js","sourceRoot":"","sources":["../src/password-hasher.ts"],"names":[],"mappings":""}

package/esm/security-policy-manager.d.ts

@@ -1,22 +1,54 @@
+import { type Token } from '@furystack/inject';
 import type { PasswordCredential, PasswordResetToken } from './models/index.js';
 import { SecurityPolicy } from './security-policy.js';
-export declare class SecurityPolicyManager {
+/**
+ * Result of a successful password complexity check — no rule reported a
+ * failure.
+ */
+export type PasswordComplexityMatch = {
+    match: true;
+};
+/**
+ * Result of a failed password complexity check along with the individual
+ * rule failures for user-facing reporting.
+ */
+export type PasswordComplexityMismatch = {
+    match: false;
+    errors: Array<{
+        message: string;
+        rule: string;
+    }>;
+};
+/**
+ * Runtime checker for the active {@link SecurityPolicy}. Applies complexity
+ * rules to candidate passwords and determines whether stored credentials
+ * and reset tokens have expired.
+ */
+export interface SecurityPolicyManager {
+    /** The active {@link SecurityPolicy} snapshot captured at resolve time. */
+    readonly policy: SecurityPolicy;
     /**
-     * @param password The Plain password string
-     * @returns whether the password matches the complexity rules
+     * Evaluates every complexity rule against `password` and aggregates the
+     * result. `match: true` means the password is acceptable.
+     */
+    matchPasswordComplexityRules(password: string): Promise<PasswordComplexityMatch | PasswordComplexityMismatch>;
+    /**
+     * Returns `true` when `credential.creationDate` plus
+     * `policy.passwordExpirationDays` is in the past. Always `false` when the
+     * policy sets `passwordExpirationDays` to `0`.
      */
-    matchPasswordComplexityRules(password: string): Promise<{
-        match: false;
-        errors: Array<{
-            message: string;
-            rule: string;
-        }>;
-    } | {
-        match: true;
-        errors?: undefined;
-    }>;
     hasPasswordExpired(credential: PasswordCredential): boolean;
+    /**
+     * Returns `true` when `token.createdAt` plus
+     * `policy.resetTokenExpirationSeconds` is in the past. Always `false`
+     * when the policy sets `resetTokenExpirationSeconds` to `0`.
+     */
     hasTokenExpired(token: PasswordResetToken): boolean;
-    readonly policy: SecurityPolicy;
 }
+/**
+ * DI token for the singleton {@link SecurityPolicyManager}. Resolves the
+ * current {@link SecurityPolicy} once and closes over it for the lifetime
+ * of the owning injector.
+ */
+export declare const SecurityPolicyManager: Token<SecurityPolicyManager, 'singleton'>;
 //# sourceMappingURL=security-policy-manager.d.ts.map

package/esm/security-policy-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-policy-manager.d.ts","sourceRoot":"","sources":["../src/security-policy-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,qBACa,qBAAqB;IAChC;;;OAGG;IACU,4BAA4B,CAAC,QAAQ,EAAE,MAAM;;gBAMsC,KAAK,CAAC;YAC9F,OAAO,EAAE,MAAM,CAAA;YACf,IAAI,EAAE,MAAM,CAAA;SACb,CAAC;;;;;IASD,kBAAkB,CAAC,UAAU,EAAE,kBAAkB;IAUjD,eAAe,CAAC,KAAK,EAAE,kBAAkB;IAUhD,SACwB,MAAM,EAAE,cAAc,CAAA;CAC/C"}
+{"version":3,"file":"security-policy-manager.d.ts","sourceRoot":"","sources":["../src/security-policy-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,CAAA;AAErD;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,KAAK,CAAA;IACZ,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjD,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B;;;OAGG;IACH,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,0BAA0B,CAAC,CAAA;IAC7G;;;;OAIG;IACH,kBAAkB,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAA;IAC3D;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAA;CACpD;AAcD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,WAAW,CAoC1E,CAAA"}

package/esm/security-policy-manager.js

@@ -1,57 +1,53 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
+import { defineService } from '@furystack/inject';
+import { SecurityPolicy } from './security-policy.js';
+const addDays = (base, days) => {
+    const result = new Date(base);
+    result.setDate(result.getDate() + days);
+    return result;
 };
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+const addSeconds = (base, seconds) => {
+    const result = new Date(base);
+    result.setSeconds(result.getSeconds() + seconds);
+    return result;
 };
-import { Injectable, Injected } from '@furystack/inject';
-import { SecurityPolicy } from './security-policy.js';
-let SecurityPolicyManager = class SecurityPolicyManager {
-    /**
-     * @param password The Plain password string
-     * @returns whether the password matches the complexity rules
-     */
-    async matchPasswordComplexityRules(password) {
-        const result = await Promise.all(this.policy.passwordComplexityRules.map((rule) => rule.check(password)));
-        const failed = result.filter((r) => r.success === false);
-        if (failed.length) {
-            return {
-                match: false,
-                errors: failed.map((f) => f.success === false && { message: f.message, rule: f.rule }),
-            };
-        }
+/**
+ * DI token for the singleton {@link SecurityPolicyManager}. Resolves the
+ * current {@link SecurityPolicy} once and closes over it for the lifetime
+ * of the owning injector.
+ */
+export const SecurityPolicyManager = defineService({
+    name: 'furystack/security/SecurityPolicyManager',
+    lifetime: 'singleton',
+    factory: ({ inject }) => {
+        const policy = inject(SecurityPolicy);
         return {
-            match: true,
+            policy,
+            matchPasswordComplexityRules: async (password) => {
+                const outcomes = await Promise.all(policy.passwordComplexityRules.map((rule) => rule.check(password)));
+                const failed = outcomes.filter((outcome) => outcome.success === false);
+                if (failed.length === 0) {
+                    return { match: true };
+                }
+                return {
+                    match: false,
+                    errors: failed.map((outcome) => outcome.success === false ? { message: outcome.message, rule: outcome.rule } : { message: '', rule: '' }),
+                };
+            },
+            hasPasswordExpired: (credential) => {
+                if (!policy.passwordExpirationDays) {
+                    return false;
+                }
+                const expiration = addDays(new Date(credential.creationDate), policy.passwordExpirationDays);
+                return new Date() > expiration;
+            },
+            hasTokenExpired: (token) => {
+                if (!policy.resetTokenExpirationSeconds) {
+                    return false;
+                }
+                const expiration = addSeconds(new Date(token.createdAt), policy.resetTokenExpirationSeconds);
+                return new Date() > expiration;
+            },
         };
-    }
-    hasPasswordExpired(credential) {
-        if (!this.policy.passwordExpirationDays) {
-            return false;
-        }
-        const credentialExpiration = new Date(credential.creationDate);
-        credentialExpiration.setDate(credentialExpiration.getDate() + this.policy.passwordExpirationDays);
-        const now = new Date();
-        return now > credentialExpiration;
-    }
-    hasTokenExpired(token) {
-        if (!this.policy.resetTokenExpirationSeconds) {
-            return false;
-        }
-        const tokenExpiration = new Date(token.createdAt);
-        tokenExpiration.setSeconds(tokenExpiration.getSeconds() + this.policy.resetTokenExpirationSeconds);
-        const now = new Date();
-        return now > tokenExpiration;
-    }
-};
-__decorate([
-    Injected(SecurityPolicy),
-    __metadata("design:type", SecurityPolicy)
-], SecurityPolicyManager.prototype, "policy", void 0);
-SecurityPolicyManager = __decorate([
-    Injectable({ lifetime: 'singleton' })
-], SecurityPolicyManager);
-export { SecurityPolicyManager };
+    },
+});
 //# sourceMappingURL=security-policy-manager.js.map

package/esm/security-policy-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-policy-manager.js","sourceRoot":"","sources":["../src/security-policy-manager.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAG9C,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC;;;OAGG;IACI,KAAK,CAAC,4BAA4B,CAAC,QAAgB;QACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QACzG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAA;QACxD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO;gBACL,KAAK,EAAE,KAAc;gBACrB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAGnF;aACH,CAAA;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAa;SACrB,CAAA;IACH,CAAC;IAEM,kBAAkB,CAAC,UAA8B;QACtD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACxC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,oBAAoB,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;QAC9D,oBAAoB,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACjG,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,OAAO,GAAG,GAAG,oBAAoB,CAAA;IACnC,CAAC;IAEM,eAAe,CAAC,KAAyB;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACjD,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAClG,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,OAAO,GAAG,GAAG,eAAe,CAAA;IAC9B,CAAC;CAIF,CAAA;AADyB;IADvB,QAAQ,CAAC,cAAc,CAAC;8BACO,cAAc;qDAAA;AA5CnC,qBAAqB;IADjC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;GACzB,qBAAqB,CA6CjC"}
+{"version":3,"file":"security-policy-manager.js","sourceRoot":"","sources":["../src/security-policy-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAc,MAAM,mBAAmB,CAAA;AAE7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AA4CrD,MAAM,OAAO,GAAG,CAAC,IAAU,EAAE,IAAY,EAAQ,EAAE;IACjD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IACvC,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,OAAe,EAAQ,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,CAAA;IAChD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA8C,aAAa,CAAC;IAC5F,IAAI,EAAE,0CAA0C;IAChD,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAyB,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CAAA;QACrC,OAAO;YACL,MAAM;YACN,4BAA4B,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;gBACtG,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAA;gBACtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;gBACxB,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC7B,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CACzG;iBACF,CAAA;YACH,CAAC;YACD,kBAAkB,EAAE,CAAC,UAAU,EAAE,EAAE;gBACjC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;oBACnC,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAA;gBAC5F,OAAO,IAAI,IAAI,EAAE,GAAG,UAAU,CAAA;YAChC,CAAC;YACD,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;gBACzB,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;oBACxC,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,2BAA2B,CAAC,CAAA;gBAC5F,OAAO,IAAI,IAAI,EAAE,GAAG,UAAU,CAAA;YAChC,CAAC;SACF,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/esm/security-policy-manager.spec.js

@@ -1,16 +1,67 @@
-import { Injector } from '@furystack/inject';
+import { createInjector } from '@furystack/inject';
 import { usingAsync } from '@furystack/utils';
 import { describe, expect, it } from 'vitest';
 import { usePasswordPolicy } from './helpers.js';
 import { SecurityPolicyManager } from './security-policy-manager.js';
 describe('SecurityPolicyManager', () => {
-    it('Should return false when no token expiration has been set', async () => {
-        await usingAsync(new Injector(), async (i) => {
+    it('returns a cached manager backed by the current policy', async () => {
+        await usingAsync(createInjector(), async (i) => {
+            usePasswordPolicy(i, { passwordExpirationDays: 30 });
+            const manager = i.get(SecurityPolicyManager);
+            expect(manager.policy.passwordExpirationDays).toBe(30);
+        });
+    });
+    it('never considers a token expired when resetTokenExpirationSeconds is 0', async () => {
+        await usingAsync(createInjector(), async (i) => {
             usePasswordPolicy(i, { resetTokenExpirationSeconds: 0 });
-            const result = i
-                .getInstance(SecurityPolicyManager)
-                .hasTokenExpired({ createdAt: new Date().toISOString(), token: 'token', userName: 'user' });
-            expect(result).toBeFalsy();
+            const expired = i
+                .get(SecurityPolicyManager)
+                .hasTokenExpired({ createdAt: new Date(0).toISOString(), token: 'token', userName: 'user' });
+            expect(expired).toBe(false);
+        });
+    });
+    it('flags a token as expired once its lifetime has elapsed', async () => {
+        await usingAsync(createInjector(), async (i) => {
+            usePasswordPolicy(i, { resetTokenExpirationSeconds: 1 });
+            const pastCreatedAt = new Date();
+            pastCreatedAt.setSeconds(pastCreatedAt.getSeconds() - 10);
+            const expired = i
+                .get(SecurityPolicyManager)
+                .hasTokenExpired({ createdAt: pastCreatedAt.toISOString(), token: 'token', userName: 'user' });
+            expect(expired).toBe(true);
+        });
+    });
+    it('never considers a credential expired when passwordExpirationDays is 0', async () => {
+        await usingAsync(createInjector(), async (i) => {
+            usePasswordPolicy(i, { passwordExpirationDays: 0 });
+            const expired = i.get(SecurityPolicyManager).hasPasswordExpired({
+                userName: 'user',
+                passwordHash: 'hash',
+                salt: 'salt',
+                creationDate: new Date(0).toISOString(),
+            });
+            expect(expired).toBe(false);
+        });
+    });
+    it('flags a credential as expired once its lifetime has elapsed', async () => {
+        await usingAsync(createInjector(), async (i) => {
+            usePasswordPolicy(i, { passwordExpirationDays: 1 });
+            const pastCreationDate = new Date();
+            pastCreationDate.setDate(pastCreationDate.getDate() - 5);
+            const expired = i.get(SecurityPolicyManager).hasPasswordExpired({
+                userName: 'user',
+                passwordHash: 'hash',
+                salt: 'salt',
+                creationDate: pastCreationDate.toISOString(),
+            });
+            expect(expired).toBe(true);
+        });
+    });
+    it('reports match=true when no complexity rules are configured', async () => {
+        await usingAsync(createInjector(), async (i) => {
+            usePasswordPolicy(i);
+            const result = await i.get(SecurityPolicyManager).matchPasswordComplexityRules('anything');
+            expect(result.match).toBe(true);
         });
     });
 });

package/esm/security-policy-manager.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-policy-manager.spec.js","sourceRoot":"","sources":["../src/security-policy-manager.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3C,iBAAiB,CAAC,CAAC,EAAE,EAAE,2BAA2B,EAAE,CAAC,EAAE,CAAC,CAAA;YACxD,MAAM,MAAM,GAAG,CAAC;iBACb,WAAW,CAAC,qBAAqB,CAAC;iBAClC,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7F,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"security-policy-manager.spec.js","sourceRoot":"","sources":["../src/security-policy-manager.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,iBAAiB,CAAC,CAAC,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,CAAA;YACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAA;YAC5C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,iBAAiB,CAAC,CAAC,EAAE,EAAE,2BAA2B,EAAE,CAAC,EAAE,CAAC,CAAA;YACxD,MAAM,OAAO,GAAG,CAAC;iBACd,GAAG,CAAC,qBAAqB,CAAC;iBAC1B,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAC9F,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,iBAAiB,CAAC,CAAC,EAAE,EAAE,2BAA2B,EAAE,CAAC,EAAE,CAAC,CAAA;YACxD,MAAM,aAAa,GAAG,IAAI,IAAI,EAAE,CAAA;YAChC,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;YACzD,MAAM,OAAO,GAAG,CAAC;iBACd,GAAG,CAAC,qBAAqB,CAAC;iBAC1B,eAAe,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAChG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,iBAAiB,CAAC,CAAC,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC,CAAA;YACnD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC;gBAC9D,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,MAAM;gBACZ,YAAY,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;aACxC,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,iBAAiB,CAAC,CAAC,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC,CAAA;YACnD,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAA;YACnC,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;YACxD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC;gBAC9D,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,MAAM;gBACpB,IAAI,EAAE,MAAM;gBACZ,YAAY,EAAE,gBAAgB,CAAC,WAAW,EAAE;aAC7C,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,iBAAiB,CAAC,CAAC,CAAC,CAAA;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAA;YAC1F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/esm/security-policy.d.ts

@@ -1,26 +1,52 @@
-import type { Constructable } from '@furystack/inject';
+import { type Token } from '@furystack/inject';
 import type { PasswordComplexityRule } from './models/password-complexity-rule.js';
 import type { PasswordHasher } from './password-hasher.js';
-export declare class SecurityPolicy {
+/**
+ * Application-wide policy that governs password hashing, complexity rules,
+ * expiration and second-factor requirements.
+ *
+ * The default policy shipped by `@furystack/security` uses
+ * {@link CryptoPasswordHasher}, enforces no complexity rules, disables
+ * password and reset-token expiration by default and does not require
+ * second factor authentication. Override via {@link usePasswordPolicy}.
+ */
+export type SecurityPolicy = {
     /**
-     * A Hasher instance for password hash generation
+     * Token resolving to the {@link PasswordHasher} used for generating and
+     * verifying password credentials.
      */
-    hasher: Constructable<PasswordHasher>;
+    hasher: Token<PasswordHasher, 'singleton'>;
     /**
-     * Array of password complexity rules to apply
+     * Ordered list of password complexity rules applied to every new or
+     * changed password.
      */
     passwordComplexityRules: PasswordComplexityRule[];
     /**
-     * The password expiration in days
+     * Number of days after which a stored password credential is considered
+     * expired. `0` disables expiration entirely.
      */
     passwordExpirationDays: number;
     /**
-     * Defines if the login needs a second factor authentication
+     * Second-factor authentication policy. `'always'` forces a second factor
+     * on every login; `'never'` disables it. Trusted-device-aware policies
+     * are not yet implemented.
      */
     requireSecondFactor: 'never' | 'always';
     /**
-     * The Password Reset Token expiration in seconds
+     * Lifetime of a password reset token in seconds.
      */
     resetTokenExpirationSeconds: number;
-}
+};
+/**
+ * Returns a fresh copy of the default {@link SecurityPolicy}. Useful as a
+ * starting point for `Object.assign`-style overrides or spec fixtures.
+ */
+export declare const defaultSecurityPolicy: () => SecurityPolicy;
+/**
+ * DI token that resolves the current {@link SecurityPolicy}. Rebind this
+ * token via {@link usePasswordPolicy} (preferred) or directly through
+ * {@link Injector.bind} to customise the policy per-application or
+ * per-scope.
+ */
+export declare const SecurityPolicy: Token<SecurityPolicy, 'singleton'>;
 //# sourceMappingURL=security-policy.d.ts.map

package/esm/security-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-policy.d.ts","sourceRoot":"","sources":["../src/security-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,qBACa,cAAc;IACzB;;OAEG;IACH,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,CAAuB;IAE5D;;OAEG;IACH,uBAAuB,EAAE,sBAAsB,EAAE,CAAK;IAEtD;;OAEG;IACH,sBAAsB,SAAI;IAE1B;;OAEG;IACH,mBAAmB,EAAE,OAAO,GAAG,QAAQ,CAAU;IAEjD;;OAEG;IACH,2BAA2B,SAAK;CACjC"}
+{"version":3,"file":"security-policy.d.ts","sourceRoot":"","sources":["../src/security-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B;;;OAGG;IACH,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;IAC1C;;;OAGG;IACH,uBAAuB,EAAE,sBAAsB,EAAE,CAAA;IACjD;;;OAGG;IACH,sBAAsB,EAAE,MAAM,CAAA;IAC9B;;;;OAIG;IACH,mBAAmB,EAAE,OAAO,GAAG,QAAQ,CAAA;IACvC;;OAEG;IACH,2BAA2B,EAAE,MAAM,CAAA;CACpC,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAO,cAMvC,CAAA;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW,CAI5D,CAAA"}