@futdevpro/nts-dynamo 1.15.154 → 1.15.156

package/build/_modules/account-security/account-session.control-service.js

@@ -1,277 +1,277 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_AccountSession_ControlService = void 0;
-const crypto_1 = require("crypto");
-const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
-const global_settings_const_1 = require("../../_collections/global-settings.const");
-const account_refresh_token_state_type_enum_1 = require("./_enums/account-refresh-token-state.type-enum");
-const account_session_state_type_enum_1 = require("./_enums/account-session-state.type-enum");
-const DEFAULT_ACCESS_TTL_MS = 15 * 60 * 1000;
-const DEFAULT_REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-const DEFAULT_TOKEN_BYTES = 32;
-const DEFAULT_MAX_REFRESH_ROTATIONS = 100;
-/**
- * Opaque, server-revocable account session families with one-time refresh rotation and replay detection.
- */
-class DyNTS_AccountSession_ControlService {
-    adapter;
-    accessTtlMs;
-    refreshTtlMs;
-    tokenBytes;
-    maxRefreshRotations;
-    clock;
-    /** Creates a validated session service over an atomic persistence adapter. */
-    constructor(set) {
-        this.adapter = set.adapter;
-        this.accessTtlMs = set.accessTtlMs ?? DEFAULT_ACCESS_TTL_MS;
-        this.refreshTtlMs = set.refreshTtlMs ?? DEFAULT_REFRESH_TTL_MS;
-        this.tokenBytes = set.tokenBytes ?? DEFAULT_TOKEN_BYTES;
-        this.maxRefreshRotations = set.maxRefreshRotations ?? DEFAULT_MAX_REFRESH_ROTATIONS;
-        this.clock = set.clock ?? (() => new Date());
-        this.validateSettings();
-    }
-    /** Atomically persists a new session family before returning its raw credentials. */
-    async issueSession(subjectId, authorizationVersion, context) {
-        if (!subjectId
-            || subjectId.length > 256
-            || !Number.isSafeInteger(authorizationVersion)
-            || authorizationVersion < 0) {
-            throw this.buildUnauthorized('SESSION_SUBJECT_MISSING');
-        }
-        this.validateContext(context);
-        const now = this.clock();
-        const material = this.createMaterial({
-            subjectId: subjectId,
-            sessionId: (0, crypto_1.randomUUID)(),
-            familyId: (0, crypto_1.randomUUID)(),
-            generation: 0,
-            revision: 0,
-            authorizationVersion: authorizationVersion,
-            createdAt: now.toISOString(),
-            refreshExpiresAt: new Date(now.getTime() + this.refreshTtlMs).toISOString(),
-            materialCreatedAt: now.toISOString(),
-            context: context,
-        });
-        await this.adapter.createSession({
-            session: material.session,
-            refreshToken: material.refreshToken,
-        });
-        return this.toTokenPair(material);
-    }
-    /** Resolves an opaque access token through the server-side active-session record. */
-    async authenticateAccessToken(accessToken) {
-        if (!accessToken || accessToken.length > 512) {
-            throw this.buildUnauthorized('ACCESS_TOKEN_INVALID');
-        }
-        const now = this.clock();
-        const session = await this.adapter.findSessionByAccessTokenHash(this.hashToken(accessToken));
-        if (session?.state !== account_session_state_type_enum_1.DyNTS_AccountSessionState_Type.active
-            || session.accessTokenHash !== this.hashToken(accessToken)
-            || !this.isFutureDate(session.accessExpiresAt, now)
-            || !session.subjectId
-            || !session.sessionId
-            || !session.familyId
-            || !Number.isSafeInteger(session.authorizationVersion)
-            || session.authorizationVersion < 0) {
-            throw this.buildUnauthorized('ACCESS_TOKEN_INVALID');
-        }
-        return {
-            subjectId: session.subjectId,
-            sessionId: session.sessionId,
-            familyId: session.familyId,
-            authorizationVersion: session.authorizationVersion,
-        };
-    }
-    /** Rotates a one-time refresh token; replay revokes the complete token family. */
-    async rotateRefreshToken(refreshToken, context) {
-        if (!refreshToken || refreshToken.length > 512) {
-            throw this.buildUnauthorized('REFRESH_TOKEN_INVALID');
-        }
-        this.validateContext(context);
-        const now = this.clock();
-        const tokenHash = this.hashToken(refreshToken);
-        const token = await this.adapter.findRefreshTokenByHash(tokenHash);
-        if (!token) {
-            throw this.buildUnauthorized('REFRESH_TOKEN_INVALID');
-        }
-        if (token.state !== account_refresh_token_state_type_enum_1.DyNTS_AccountRefreshTokenState_Type.active) {
-            await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-token-reuse');
-            throw this.buildUnauthorized('REFRESH_TOKEN_REUSE');
-        }
-        const session = await this.adapter.findSessionById(token.sessionId);
-        if (session?.state !== account_session_state_type_enum_1.DyNTS_AccountSessionState_Type.active
-            || session.familyId !== token.familyId
-            || session.subjectId !== token.subjectId
-            || session.generation !== token.generation
-            || token.tokenHash !== tokenHash
-            || !this.isFutureDate(token.expiresAt, now)
-            || !this.isFutureDate(session.refreshExpiresAt, now)) {
-            await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-token-invalid-state');
-            throw this.buildUnauthorized('REFRESH_TOKEN_INVALID');
-        }
-        if (session.generation >= this.maxRefreshRotations) {
-            await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-rotation-limit');
-            throw this.buildUnauthorized('REFRESH_ROTATION_LIMIT');
-        }
-        const material = this.createMaterial({
-            subjectId: session.subjectId,
-            sessionId: session.sessionId,
-            familyId: session.familyId,
-            generation: session.generation + 1,
-            revision: session.revision + 1,
-            authorizationVersion: session.authorizationVersion,
-            createdAt: session.createdAt,
-            refreshExpiresAt: session.refreshExpiresAt,
-            materialCreatedAt: now.toISOString(),
-            context: context,
-        });
-        const rotation = {
-            expectedSessionRevision: session.revision,
-            currentRefreshTokenHash: tokenHash,
-            usedAt: now.toISOString(),
-            replacementSession: material.session,
-            replacementRefreshToken: material.refreshToken,
-        };
-        const didRotate = await this.adapter.rotateSession(rotation);
-        if (!didRotate) {
-            const winner = await this.adapter.findRefreshTokenByHash(tokenHash);
-            if (winner?.state === account_refresh_token_state_type_enum_1.DyNTS_AccountRefreshTokenState_Type.used) {
-                await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-token-reuse-race');
-                throw this.buildUnauthorized('REFRESH_TOKEN_REUSE');
-            }
-            throw this.buildUnauthorized('REFRESH_TOKEN_CONFLICT');
-        }
-        return this.toTokenPair(material);
-    }
-    /** Revokes one server-side session. */
-    async revokeSession(sessionId, reasonCode) {
-        this.validateRevocation(sessionId, reasonCode);
-        await this.adapter.revokeSession(sessionId, this.clock().toISOString(), reasonCode);
-    }
-    /** Revokes every session belonging to one subject. */
-    async revokeAllSubjectSessions(subjectId, reasonCode) {
-        this.validateRevocation(subjectId, reasonCode);
-        await this.adapter.revokeSubject(subjectId, this.clock().toISOString(), reasonCode);
-    }
-    /** Returns a user-safe session projection without token hashes. */
-    async listSubjectSessions(subjectId) {
-        if (!subjectId || subjectId.length > 256) {
-            throw this.buildUnauthorized('SESSION_SUBJECT_MISSING');
-        }
-        const sessions = await this.adapter.listSubjectSessions(subjectId);
-        return sessions.map((session) => ({
-            sessionId: session.sessionId,
-            state: session.state,
-            createdAt: session.createdAt,
-            lastRotatedAt: session.lastRotatedAt,
-            accessExpiresAt: session.accessExpiresAt,
-            refreshExpiresAt: session.refreshExpiresAt,
-            context: { ...session.context },
-        }));
-    }
-    createMaterial(set) {
-        const rawAccessToken = (0, crypto_1.randomBytes)(this.tokenBytes).toString('base64url');
-        const rawRefreshToken = (0, crypto_1.randomBytes)(this.tokenBytes).toString('base64url');
-        const materialCreatedAt = new Date(set.materialCreatedAt);
-        const accessExpiresAt = new Date(materialCreatedAt.getTime() + this.accessTtlMs).toISOString();
-        const session = {
-            sessionId: set.sessionId,
-            familyId: set.familyId,
-            subjectId: set.subjectId,
-            accessTokenHash: this.hashToken(rawAccessToken),
-            accessExpiresAt: accessExpiresAt,
-            refreshExpiresAt: set.refreshExpiresAt,
-            state: account_session_state_type_enum_1.DyNTS_AccountSessionState_Type.active,
-            generation: set.generation,
-            revision: set.revision,
-            authorizationVersion: set.authorizationVersion,
-            createdAt: set.createdAt,
-            lastRotatedAt: set.materialCreatedAt,
-            revokedAt: '',
-            revocationReason: '',
-            context: { ...set.context },
-        };
-        const refreshTokenRecord = {
-            tokenHash: this.hashToken(rawRefreshToken),
-            sessionId: set.sessionId,
-            familyId: set.familyId,
-            subjectId: set.subjectId,
-            generation: set.generation,
-            state: account_refresh_token_state_type_enum_1.DyNTS_AccountRefreshTokenState_Type.active,
-            expiresAt: set.refreshExpiresAt,
-            usedAt: '',
-        };
-        return {
-            rawAccessToken: rawAccessToken,
-            rawRefreshToken: rawRefreshToken,
-            session: session,
-            refreshToken: refreshTokenRecord,
-        };
-    }
-    toTokenPair(material) {
-        return {
-            sessionId: material.session.sessionId,
-            accessToken: material.rawAccessToken,
-            refreshToken: material.rawRefreshToken,
-            accessExpiresAt: material.session.accessExpiresAt,
-            refreshExpiresAt: material.session.refreshExpiresAt,
-        };
-    }
-    hashToken(token) {
-        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
-    }
-    validateSettings() {
-        if (!this.adapter
-            || !Number.isSafeInteger(this.accessTtlMs)
-            || this.accessTtlMs < 1_000
-            || this.accessTtlMs > 24 * 60 * 60 * 1000
-            || !Number.isSafeInteger(this.refreshTtlMs)
-            || this.refreshTtlMs <= this.accessTtlMs
-            || this.refreshTtlMs > 366 * 24 * 60 * 60 * 1000
-            || !Number.isSafeInteger(this.tokenBytes)
-            || this.tokenBytes < 32
-            || this.tokenBytes > 128
-            || !Number.isSafeInteger(this.maxRefreshRotations)
-            || this.maxRefreshRotations < 1
-            || this.maxRefreshRotations > 10_000) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                status: 500,
-                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|SESSION_SETTINGS_INVALID`,
-                message: 'The account session settings are outside supported safe bounds.',
-                userMessage: 'The account security service is unavailable.',
-                issuerService: this.constructor.name,
-            });
-        }
-    }
-    validateContext(context) {
-        if (!context
-            || typeof context.deviceName !== 'string'
-            || typeof context.ipAddressHash !== 'string'
-            || typeof context.userAgentHash !== 'string'
-            || context.deviceName.length > 160
-            || context.ipAddressHash.length > 128
-            || context.userAgentHash.length > 128) {
-            throw this.buildUnauthorized('SESSION_CONTEXT_INVALID');
-        }
-    }
-    validateRevocation(targetId, reasonCode) {
-        if (!targetId || !reasonCode || reasonCode.length > 128) {
-            throw this.buildUnauthorized('SESSION_REVOCATION_INVALID');
-        }
-    }
-    isFutureDate(value, now) {
-        const timestamp = new Date(value).getTime();
-        return Number.isFinite(timestamp) && timestamp > now.getTime();
-    }
-    buildUnauthorized(errorCode) {
-        return new fsm_dynamo_1.DyFM_Error({
-            status: 401,
-            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|${errorCode}`,
-            message: 'Opaque account credential validation failed.',
-            userMessage: 'The session is invalid or has expired. Please sign in again.',
-            issuerService: this.constructor.name,
-        });
-    }
-}
-exports.DyNTS_AccountSession_ControlService = DyNTS_AccountSession_ControlService;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountSession_ControlService = void 0;
+const crypto_1 = require("crypto");
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+const account_refresh_token_state_type_enum_1 = require("./_enums/account-refresh-token-state.type-enum");
+const account_session_state_type_enum_1 = require("./_enums/account-session-state.type-enum");
+const DEFAULT_ACCESS_TTL_MS = 15 * 60 * 1000;
+const DEFAULT_REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const DEFAULT_TOKEN_BYTES = 32;
+const DEFAULT_MAX_REFRESH_ROTATIONS = 100;
+/**
+ * Opaque, server-revocable account session families with one-time refresh rotation and replay detection.
+ */
+class DyNTS_AccountSession_ControlService {
+    adapter;
+    accessTtlMs;
+    refreshTtlMs;
+    tokenBytes;
+    maxRefreshRotations;
+    clock;
+    /** Creates a validated session service over an atomic persistence adapter. */
+    constructor(set) {
+        this.adapter = set.adapter;
+        this.accessTtlMs = set.accessTtlMs ?? DEFAULT_ACCESS_TTL_MS;
+        this.refreshTtlMs = set.refreshTtlMs ?? DEFAULT_REFRESH_TTL_MS;
+        this.tokenBytes = set.tokenBytes ?? DEFAULT_TOKEN_BYTES;
+        this.maxRefreshRotations = set.maxRefreshRotations ?? DEFAULT_MAX_REFRESH_ROTATIONS;
+        this.clock = set.clock ?? (() => new Date());
+        this.validateSettings();
+    }
+    /** Atomically persists a new session family before returning its raw credentials. */
+    async issueSession(subjectId, authorizationVersion, context) {
+        if (!subjectId
+            || subjectId.length > 256
+            || !Number.isSafeInteger(authorizationVersion)
+            || authorizationVersion < 0) {
+            throw this.buildUnauthorized('SESSION_SUBJECT_MISSING');
+        }
+        this.validateContext(context);
+        const now = this.clock();
+        const material = this.createMaterial({
+            subjectId: subjectId,
+            sessionId: (0, crypto_1.randomUUID)(),
+            familyId: (0, crypto_1.randomUUID)(),
+            generation: 0,
+            revision: 0,
+            authorizationVersion: authorizationVersion,
+            createdAt: now.toISOString(),
+            refreshExpiresAt: new Date(now.getTime() + this.refreshTtlMs).toISOString(),
+            materialCreatedAt: now.toISOString(),
+            context: context,
+        });
+        await this.adapter.createSession({
+            session: material.session,
+            refreshToken: material.refreshToken,
+        });
+        return this.toTokenPair(material);
+    }
+    /** Resolves an opaque access token through the server-side active-session record. */
+    async authenticateAccessToken(accessToken) {
+        if (!accessToken || accessToken.length > 512) {
+            throw this.buildUnauthorized('ACCESS_TOKEN_INVALID');
+        }
+        const now = this.clock();
+        const session = await this.adapter.findSessionByAccessTokenHash(this.hashToken(accessToken));
+        if (session?.state !== account_session_state_type_enum_1.DyNTS_AccountSessionState_Type.active
+            || session.accessTokenHash !== this.hashToken(accessToken)
+            || !this.isFutureDate(session.accessExpiresAt, now)
+            || !session.subjectId
+            || !session.sessionId
+            || !session.familyId
+            || !Number.isSafeInteger(session.authorizationVersion)
+            || session.authorizationVersion < 0) {
+            throw this.buildUnauthorized('ACCESS_TOKEN_INVALID');
+        }
+        return {
+            subjectId: session.subjectId,
+            sessionId: session.sessionId,
+            familyId: session.familyId,
+            authorizationVersion: session.authorizationVersion,
+        };
+    }
+    /** Rotates a one-time refresh token; replay revokes the complete token family. */
+    async rotateRefreshToken(refreshToken, context) {
+        if (!refreshToken || refreshToken.length > 512) {
+            throw this.buildUnauthorized('REFRESH_TOKEN_INVALID');
+        }
+        this.validateContext(context);
+        const now = this.clock();
+        const tokenHash = this.hashToken(refreshToken);
+        const token = await this.adapter.findRefreshTokenByHash(tokenHash);
+        if (!token) {
+            throw this.buildUnauthorized('REFRESH_TOKEN_INVALID');
+        }
+        if (token.state !== account_refresh_token_state_type_enum_1.DyNTS_AccountRefreshTokenState_Type.active) {
+            await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-token-reuse');
+            throw this.buildUnauthorized('REFRESH_TOKEN_REUSE');
+        }
+        const session = await this.adapter.findSessionById(token.sessionId);
+        if (session?.state !== account_session_state_type_enum_1.DyNTS_AccountSessionState_Type.active
+            || session.familyId !== token.familyId
+            || session.subjectId !== token.subjectId
+            || session.generation !== token.generation
+            || token.tokenHash !== tokenHash
+            || !this.isFutureDate(token.expiresAt, now)
+            || !this.isFutureDate(session.refreshExpiresAt, now)) {
+            await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-token-invalid-state');
+            throw this.buildUnauthorized('REFRESH_TOKEN_INVALID');
+        }
+        if (session.generation >= this.maxRefreshRotations) {
+            await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-rotation-limit');
+            throw this.buildUnauthorized('REFRESH_ROTATION_LIMIT');
+        }
+        const material = this.createMaterial({
+            subjectId: session.subjectId,
+            sessionId: session.sessionId,
+            familyId: session.familyId,
+            generation: session.generation + 1,
+            revision: session.revision + 1,
+            authorizationVersion: session.authorizationVersion,
+            createdAt: session.createdAt,
+            refreshExpiresAt: session.refreshExpiresAt,
+            materialCreatedAt: now.toISOString(),
+            context: context,
+        });
+        const rotation = {
+            expectedSessionRevision: session.revision,
+            currentRefreshTokenHash: tokenHash,
+            usedAt: now.toISOString(),
+            replacementSession: material.session,
+            replacementRefreshToken: material.refreshToken,
+        };
+        const didRotate = await this.adapter.rotateSession(rotation);
+        if (!didRotate) {
+            const winner = await this.adapter.findRefreshTokenByHash(tokenHash);
+            if (winner?.state === account_refresh_token_state_type_enum_1.DyNTS_AccountRefreshTokenState_Type.used) {
+                await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-token-reuse-race');
+                throw this.buildUnauthorized('REFRESH_TOKEN_REUSE');
+            }
+            throw this.buildUnauthorized('REFRESH_TOKEN_CONFLICT');
+        }
+        return this.toTokenPair(material);
+    }
+    /** Revokes one server-side session. */
+    async revokeSession(sessionId, reasonCode) {
+        this.validateRevocation(sessionId, reasonCode);
+        await this.adapter.revokeSession(sessionId, this.clock().toISOString(), reasonCode);
+    }
+    /** Revokes every session belonging to one subject. */
+    async revokeAllSubjectSessions(subjectId, reasonCode) {
+        this.validateRevocation(subjectId, reasonCode);
+        await this.adapter.revokeSubject(subjectId, this.clock().toISOString(), reasonCode);
+    }
+    /** Returns a user-safe session projection without token hashes. */
+    async listSubjectSessions(subjectId) {
+        if (!subjectId || subjectId.length > 256) {
+            throw this.buildUnauthorized('SESSION_SUBJECT_MISSING');
+        }
+        const sessions = await this.adapter.listSubjectSessions(subjectId);
+        return sessions.map((session) => ({
+            sessionId: session.sessionId,
+            state: session.state,
+            createdAt: session.createdAt,
+            lastRotatedAt: session.lastRotatedAt,
+            accessExpiresAt: session.accessExpiresAt,
+            refreshExpiresAt: session.refreshExpiresAt,
+            context: { ...session.context },
+        }));
+    }
+    createMaterial(set) {
+        const rawAccessToken = (0, crypto_1.randomBytes)(this.tokenBytes).toString('base64url');
+        const rawRefreshToken = (0, crypto_1.randomBytes)(this.tokenBytes).toString('base64url');
+        const materialCreatedAt = new Date(set.materialCreatedAt);
+        const accessExpiresAt = new Date(materialCreatedAt.getTime() + this.accessTtlMs).toISOString();
+        const session = {
+            sessionId: set.sessionId,
+            familyId: set.familyId,
+            subjectId: set.subjectId,
+            accessTokenHash: this.hashToken(rawAccessToken),
+            accessExpiresAt: accessExpiresAt,
+            refreshExpiresAt: set.refreshExpiresAt,
+            state: account_session_state_type_enum_1.DyNTS_AccountSessionState_Type.active,
+            generation: set.generation,
+            revision: set.revision,
+            authorizationVersion: set.authorizationVersion,
+            createdAt: set.createdAt,
+            lastRotatedAt: set.materialCreatedAt,
+            revokedAt: '',
+            revocationReason: '',
+            context: { ...set.context },
+        };
+        const refreshTokenRecord = {
+            tokenHash: this.hashToken(rawRefreshToken),
+            sessionId: set.sessionId,
+            familyId: set.familyId,
+            subjectId: set.subjectId,
+            generation: set.generation,
+            state: account_refresh_token_state_type_enum_1.DyNTS_AccountRefreshTokenState_Type.active,
+            expiresAt: set.refreshExpiresAt,
+            usedAt: '',
+        };
+        return {
+            rawAccessToken: rawAccessToken,
+            rawRefreshToken: rawRefreshToken,
+            session: session,
+            refreshToken: refreshTokenRecord,
+        };
+    }
+    toTokenPair(material) {
+        return {
+            sessionId: material.session.sessionId,
+            accessToken: material.rawAccessToken,
+            refreshToken: material.rawRefreshToken,
+            accessExpiresAt: material.session.accessExpiresAt,
+            refreshExpiresAt: material.session.refreshExpiresAt,
+        };
+    }
+    hashToken(token) {
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+    }
+    validateSettings() {
+        if (!this.adapter
+            || !Number.isSafeInteger(this.accessTtlMs)
+            || this.accessTtlMs < 1_000
+            || this.accessTtlMs > 24 * 60 * 60 * 1000
+            || !Number.isSafeInteger(this.refreshTtlMs)
+            || this.refreshTtlMs <= this.accessTtlMs
+            || this.refreshTtlMs > 366 * 24 * 60 * 60 * 1000
+            || !Number.isSafeInteger(this.tokenBytes)
+            || this.tokenBytes < 32
+            || this.tokenBytes > 128
+            || !Number.isSafeInteger(this.maxRefreshRotations)
+            || this.maxRefreshRotations < 1
+            || this.maxRefreshRotations > 10_000) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 500,
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|SESSION_SETTINGS_INVALID`,
+                message: 'The account session settings are outside supported safe bounds.',
+                userMessage: 'The account security service is unavailable.',
+                issuerService: this.constructor.name,
+            });
+        }
+    }
+    validateContext(context) {
+        if (!context
+            || typeof context.deviceName !== 'string'
+            || typeof context.ipAddressHash !== 'string'
+            || typeof context.userAgentHash !== 'string'
+            || context.deviceName.length > 160
+            || context.ipAddressHash.length > 128
+            || context.userAgentHash.length > 128) {
+            throw this.buildUnauthorized('SESSION_CONTEXT_INVALID');
+        }
+    }
+    validateRevocation(targetId, reasonCode) {
+        if (!targetId || !reasonCode || reasonCode.length > 128) {
+            throw this.buildUnauthorized('SESSION_REVOCATION_INVALID');
+        }
+    }
+    isFutureDate(value, now) {
+        const timestamp = new Date(value).getTime();
+        return Number.isFinite(timestamp) && timestamp > now.getTime();
+    }
+    buildUnauthorized(errorCode) {
+        return new fsm_dynamo_1.DyFM_Error({
+            status: 401,
+            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|${errorCode}`,
+            message: 'Opaque account credential validation failed.',
+            userMessage: 'The session is invalid or has expired. Please sign in again.',
+            issuerService: this.constructor.name,
+        });
+    }
+}
+exports.DyNTS_AccountSession_ControlService = DyNTS_AccountSession_ControlService;
 //# sourceMappingURL=account-session.control-service.js.map

package/build/_modules/account-security/index.d.ts

@@ -1,24 +1,24 @@
-export { DyNTS_AccountPassword_ControlService } from './account-password.control-service';
-export { DyNTS_AccountChallenge_ControlService } from './account-challenge.control-service';
-export { DyNTS_AccountSession_ControlService } from './account-session.control-service';
-export { DyNTS_AccountChallengePurpose_Type } from './_enums/account-challenge-purpose.type-enum';
-export { DyNTS_AccountRefreshTokenState_Type } from './_enums/account-refresh-token-state.type-enum';
-export { DyNTS_AccountSessionState_Type } from './_enums/account-session-state.type-enum';
-export { DyNTS_AccountRefreshTokenRecord_Interface } from './_models/account-refresh-token-record.interface';
-export { DyNTS_AccountChallengeAdapter_Interface } from './_models/account-challenge-adapter.interface';
-export { DyNTS_AccountChallengeIssued_Interface } from './_models/account-challenge-issued.interface';
-export { DyNTS_AccountChallengeRecord_Interface } from './_models/account-challenge-record.interface';
-export { DyNTS_AccountChallengeResult_Interface } from './_models/account-challenge-result.interface';
-export { DyNTS_AccountChallengeSettings_Interface } from './_models/account-challenge-settings.interface';
-export { DyNTS_AccountSessionAdapter_Interface } from './_models/account-session-adapter.interface';
-export { DyNTS_AccountSessionCreate_Interface } from './_models/account-session-create.interface';
-export { DyNTS_AccountSessionRotate_Interface } from './_models/account-session-rotate.interface';
-export { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
-export { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
-export { DyNTS_AccountSessionRecord_Interface } from './_models/account-session-record.interface';
-export { DyNTS_AccountSessionSettings_Interface } from './_models/account-session-settings.interface';
-export { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
-export { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
-export { DyNTS_AccountPasswordPolicy_Interface } from './_models/account-password-policy.interface';
-export { DyNTS_AccountPasswordVerification_Interface } from './_models/account-password-verification.interface';
+export { DyNTS_AccountPassword_ControlService } from './account-password.control-service';
+export { DyNTS_AccountChallenge_ControlService } from './account-challenge.control-service';
+export { DyNTS_AccountSession_ControlService } from './account-session.control-service';
+export { DyNTS_AccountChallengePurpose_Type } from './_enums/account-challenge-purpose.type-enum';
+export { DyNTS_AccountRefreshTokenState_Type } from './_enums/account-refresh-token-state.type-enum';
+export { DyNTS_AccountSessionState_Type } from './_enums/account-session-state.type-enum';
+export { DyNTS_AccountRefreshTokenRecord_Interface } from './_models/account-refresh-token-record.interface';
+export { DyNTS_AccountChallengeAdapter_Interface } from './_models/account-challenge-adapter.interface';
+export { DyNTS_AccountChallengeIssued_Interface } from './_models/account-challenge-issued.interface';
+export { DyNTS_AccountChallengeRecord_Interface } from './_models/account-challenge-record.interface';
+export { DyNTS_AccountChallengeResult_Interface } from './_models/account-challenge-result.interface';
+export { DyNTS_AccountChallengeSettings_Interface } from './_models/account-challenge-settings.interface';
+export { DyNTS_AccountSessionAdapter_Interface } from './_models/account-session-adapter.interface';
+export { DyNTS_AccountSessionCreate_Interface } from './_models/account-session-create.interface';
+export { DyNTS_AccountSessionRotate_Interface } from './_models/account-session-rotate.interface';
+export { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
+export { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
+export { DyNTS_AccountSessionRecord_Interface } from './_models/account-session-record.interface';
+export { DyNTS_AccountSessionSettings_Interface } from './_models/account-session-settings.interface';
+export { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
+export { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
+export { DyNTS_AccountPasswordPolicy_Interface } from './_models/account-password-policy.interface';
+export { DyNTS_AccountPasswordVerification_Interface } from './_models/account-password-verification.interface';
 //# sourceMappingURL=index.d.ts.map

package/build/_modules/account-security/index.js

@@ -1,16 +1,16 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_AccountSessionState_Type = exports.DyNTS_AccountRefreshTokenState_Type = exports.DyNTS_AccountChallengePurpose_Type = exports.DyNTS_AccountSession_ControlService = exports.DyNTS_AccountChallenge_ControlService = exports.DyNTS_AccountPassword_ControlService = void 0;
-var account_password_control_service_1 = require("./account-password.control-service");
-Object.defineProperty(exports, "DyNTS_AccountPassword_ControlService", { enumerable: true, get: function () { return account_password_control_service_1.DyNTS_AccountPassword_ControlService; } });
-var account_challenge_control_service_1 = require("./account-challenge.control-service");
-Object.defineProperty(exports, "DyNTS_AccountChallenge_ControlService", { enumerable: true, get: function () { return account_challenge_control_service_1.DyNTS_AccountChallenge_ControlService; } });
-var account_session_control_service_1 = require("./account-session.control-service");
-Object.defineProperty(exports, "DyNTS_AccountSession_ControlService", { enumerable: true, get: function () { return account_session_control_service_1.DyNTS_AccountSession_ControlService; } });
-var account_challenge_purpose_type_enum_1 = require("./_enums/account-challenge-purpose.type-enum");
-Object.defineProperty(exports, "DyNTS_AccountChallengePurpose_Type", { enumerable: true, get: function () { return account_challenge_purpose_type_enum_1.DyNTS_AccountChallengePurpose_Type; } });
-var account_refresh_token_state_type_enum_1 = require("./_enums/account-refresh-token-state.type-enum");
-Object.defineProperty(exports, "DyNTS_AccountRefreshTokenState_Type", { enumerable: true, get: function () { return account_refresh_token_state_type_enum_1.DyNTS_AccountRefreshTokenState_Type; } });
-var account_session_state_type_enum_1 = require("./_enums/account-session-state.type-enum");
-Object.defineProperty(exports, "DyNTS_AccountSessionState_Type", { enumerable: true, get: function () { return account_session_state_type_enum_1.DyNTS_AccountSessionState_Type; } });
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountSessionState_Type = exports.DyNTS_AccountRefreshTokenState_Type = exports.DyNTS_AccountChallengePurpose_Type = exports.DyNTS_AccountSession_ControlService = exports.DyNTS_AccountChallenge_ControlService = exports.DyNTS_AccountPassword_ControlService = void 0;
+var account_password_control_service_1 = require("./account-password.control-service");
+Object.defineProperty(exports, "DyNTS_AccountPassword_ControlService", { enumerable: true, get: function () { return account_password_control_service_1.DyNTS_AccountPassword_ControlService; } });
+var account_challenge_control_service_1 = require("./account-challenge.control-service");
+Object.defineProperty(exports, "DyNTS_AccountChallenge_ControlService", { enumerable: true, get: function () { return account_challenge_control_service_1.DyNTS_AccountChallenge_ControlService; } });
+var account_session_control_service_1 = require("./account-session.control-service");
+Object.defineProperty(exports, "DyNTS_AccountSession_ControlService", { enumerable: true, get: function () { return account_session_control_service_1.DyNTS_AccountSession_ControlService; } });
+var account_challenge_purpose_type_enum_1 = require("./_enums/account-challenge-purpose.type-enum");
+Object.defineProperty(exports, "DyNTS_AccountChallengePurpose_Type", { enumerable: true, get: function () { return account_challenge_purpose_type_enum_1.DyNTS_AccountChallengePurpose_Type; } });
+var account_refresh_token_state_type_enum_1 = require("./_enums/account-refresh-token-state.type-enum");
+Object.defineProperty(exports, "DyNTS_AccountRefreshTokenState_Type", { enumerable: true, get: function () { return account_refresh_token_state_type_enum_1.DyNTS_AccountRefreshTokenState_Type; } });
+var account_session_state_type_enum_1 = require("./_enums/account-session-state.type-enum");
+Object.defineProperty(exports, "DyNTS_AccountSessionState_Type", { enumerable: true, get: function () { return account_session_state_type_enum_1.DyNTS_AccountSessionState_Type; } });
 //# sourceMappingURL=index.js.map