@fuzdev/fuz_app 0.1.0

package/dist/auth/api_token_queries.d.ts

@@ -0,0 +1,80 @@
+/**
+ * API token query functions for token CRUD and validation.
+ *
+ * @module
+ */
+import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { QueryDeps } from '../db/query_deps.js';
+import type { ApiToken } from './account_schema.js';
+/** Extended deps for `query_validate_api_token` which needs a logger. */
+export interface ApiTokenQueryDeps extends QueryDeps {
+    log: Logger;
+}
+/**
+ * Store a new API token (the hash, not the raw token).
+ *
+ * @param deps - query dependencies
+ * @param id - the public token id (e.g. `tok_abc123`)
+ * @param account_id - the owning account
+ * @param name - human-readable name
+ * @param token_hash - blake3 hash of the raw token
+ * @param expires_at - optional expiration
+ * @returns the stored token record
+ */
+export declare const query_create_api_token: (deps: QueryDeps, id: string, account_id: string, name: string, token_hash: string, expires_at?: Date | null) => Promise<ApiToken>;
+/**
+ * Validate a raw API token and return the token record.
+ *
+ * Hashes the token with blake3, looks up the hash, and checks
+ * expiration. Updates `last_used_at` and `last_used_ip` on success
+ * (fire-and-forget — errors logged, never thrown).
+ *
+ * @param deps - query dependencies with logger
+ * @param raw_token - the raw API token from the Authorization header
+ * @param ip - the client IP address (for audit)
+ * @param pending_effects - optional array to register the usage-tracking effect for later awaiting
+ * @returns the token record if valid, or `undefined`
+ */
+export declare const query_validate_api_token: (deps: ApiTokenQueryDeps, raw_token: string, ip: string | undefined, pending_effects: Array<Promise<void>> | undefined) => Promise<ApiToken | undefined>;
+/**
+ * Revoke all tokens for an account.
+ *
+ * @param deps - query dependencies
+ * @param account_id - the account whose tokens to revoke
+ * @returns the number of tokens revoked
+ */
+export declare const query_revoke_all_api_tokens_for_account: (deps: QueryDeps, account_id: string) => Promise<number>;
+/**
+ * Revoke a token only if it belongs to the specified account.
+ *
+ * Prevents cross-account token revocation.
+ *
+ * @param deps - query dependencies
+ * @param id - the public token id
+ * @param account_id - the account that must own the token
+ * @returns `true` if a token was revoked, `false` if not found or wrong account
+ */
+export declare const query_revoke_api_token_for_account: (deps: QueryDeps, id: string, account_id: string) => Promise<boolean>;
+/**
+ * List all tokens for an account (does not include hashes).
+ *
+ * Columns are enumerated explicitly to exclude `token_hash`.
+ * Must be updated if the `api_token` table gains new columns.
+ */
+export declare const query_api_token_list_for_account: (deps: QueryDeps, account_id: string) => Promise<Array<Omit<ApiToken, "token_hash">>>;
+/**
+ * Enforce a per-account token limit by evicting the oldest tokens.
+ *
+ * Race safety: this function must run inside a transaction alongside the
+ * INSERT that created the new token. The caller (`POST /tokens/create`)
+ * uses the default `transaction: true` (framework-managed transaction
+ * wrapping in `apply_route_specs`), ensuring the INSERT + enforce_limit
+ * pair is atomic — concurrent token creation cannot interleave.
+ *
+ * @param deps - query dependencies (must be transaction-scoped)
+ * @param account_id - the account to enforce the limit for
+ * @param max_tokens - maximum number of tokens to keep
+ * @returns the number of tokens evicted
+ */
+export declare const query_api_token_enforce_limit: (deps: QueryDeps, account_id: string, max_tokens: number) => Promise<number>;
+//# sourceMappingURL=api_token_queries.d.ts.map

package/dist/auth/api_token_queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api_token_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/api_token_queries.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,qBAAqB,CAAC;AAGlD,yEAAyE;AACzE,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IACnD,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,YAAY,MAAM,EAClB,aAAa,IAAI,GAAG,IAAI,KACtB,OAAO,CAAC,QAAQ,CAQlB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,iBAAiB,EACvB,WAAW,MAAM,EACjB,IAAI,MAAM,GAAG,SAAS,EACtB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,KAC/C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAuB9B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAM7C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAYhB,CAAC"}

package/dist/auth/api_token_queries.js

@@ -0,0 +1,116 @@
+/**
+ * API token query functions for token CRUD and validation.
+ *
+ * @module
+ */
+import { assert_row } from '../db/assert_row.js';
+import { hash_api_token } from './api_token.js';
+/**
+ * Store a new API token (the hash, not the raw token).
+ *
+ * @param deps - query dependencies
+ * @param id - the public token id (e.g. `tok_abc123`)
+ * @param account_id - the owning account
+ * @param name - human-readable name
+ * @param token_hash - blake3 hash of the raw token
+ * @param expires_at - optional expiration
+ * @returns the stored token record
+ */
+export const query_create_api_token = async (deps, id, account_id, name, token_hash, expires_at) => {
+    const row = await deps.db.query_one(`INSERT INTO api_token (id, account_id, name, token_hash, expires_at)
+		 VALUES ($1, $2, $3, $4, $5)
+		 RETURNING *`, [id, account_id, name, token_hash, expires_at?.toISOString() ?? null]);
+    return assert_row(row, 'INSERT INTO api_token');
+};
+/**
+ * Validate a raw API token and return the token record.
+ *
+ * Hashes the token with blake3, looks up the hash, and checks
+ * expiration. Updates `last_used_at` and `last_used_ip` on success
+ * (fire-and-forget — errors logged, never thrown).
+ *
+ * @param deps - query dependencies with logger
+ * @param raw_token - the raw API token from the Authorization header
+ * @param ip - the client IP address (for audit)
+ * @param pending_effects - optional array to register the usage-tracking effect for later awaiting
+ * @returns the token record if valid, or `undefined`
+ */
+export const query_validate_api_token = async (deps, raw_token, ip, pending_effects) => {
+    const token_hash = hash_api_token(raw_token);
+    const row = await deps.db.query_one(`SELECT * FROM api_token
+		 WHERE token_hash = $1
+		   AND (expires_at IS NULL OR expires_at > NOW())`, [token_hash]);
+    if (!row)
+        return undefined;
+    // Fire-and-forget usage tracking
+    const p = deps.db
+        .query(`UPDATE api_token SET last_used_at = NOW(), last_used_ip = $1 WHERE id = $2`, [
+        ip ?? null,
+        row.id,
+    ])
+        .then(() => { }) // eslint-disable-line @typescript-eslint/no-empty-function
+        .catch((err) => {
+        deps.log.error('Failed to update last_used_at:', err);
+    });
+    pending_effects?.push(p);
+    return row;
+};
+/**
+ * Revoke all tokens for an account.
+ *
+ * @param deps - query dependencies
+ * @param account_id - the account whose tokens to revoke
+ * @returns the number of tokens revoked
+ */
+export const query_revoke_all_api_tokens_for_account = async (deps, account_id) => {
+    const rows = await deps.db.query(`DELETE FROM api_token WHERE account_id = $1 RETURNING id`, [account_id]);
+    return rows.length;
+};
+/**
+ * Revoke a token only if it belongs to the specified account.
+ *
+ * Prevents cross-account token revocation.
+ *
+ * @param deps - query dependencies
+ * @param id - the public token id
+ * @param account_id - the account that must own the token
+ * @returns `true` if a token was revoked, `false` if not found or wrong account
+ */
+export const query_revoke_api_token_for_account = async (deps, id, account_id) => {
+    const rows = await deps.db.query(`DELETE FROM api_token WHERE id = $1 AND account_id = $2 RETURNING id`, [id, account_id]);
+    return rows.length > 0;
+};
+/**
+ * List all tokens for an account (does not include hashes).
+ *
+ * Columns are enumerated explicitly to exclude `token_hash`.
+ * Must be updated if the `api_token` table gains new columns.
+ */
+export const query_api_token_list_for_account = async (deps, account_id) => {
+    return deps.db.query(`SELECT id, account_id, name, expires_at, last_used_at, last_used_ip, created_at
+		 FROM api_token WHERE account_id = $1 ORDER BY created_at DESC`, [account_id]);
+};
+/**
+ * Enforce a per-account token limit by evicting the oldest tokens.
+ *
+ * Race safety: this function must run inside a transaction alongside the
+ * INSERT that created the new token. The caller (`POST /tokens/create`)
+ * uses the default `transaction: true` (framework-managed transaction
+ * wrapping in `apply_route_specs`), ensuring the INSERT + enforce_limit
+ * pair is atomic — concurrent token creation cannot interleave.
+ *
+ * @param deps - query dependencies (must be transaction-scoped)
+ * @param account_id - the account to enforce the limit for
+ * @param max_tokens - maximum number of tokens to keep
+ * @returns the number of tokens evicted
+ */
+export const query_api_token_enforce_limit = async (deps, account_id, max_tokens) => {
+    const rows = await deps.db.query(`DELETE FROM api_token
+		 WHERE id IN (
+		   SELECT id FROM api_token
+		   WHERE account_id = $1
+		   ORDER BY created_at DESC
+		   OFFSET $2
+		 ) RETURNING id`, [account_id, max_tokens]);
+    return rows.length;
+};

package/dist/auth/app_settings_queries.d.ts

@@ -0,0 +1,33 @@
+/**
+ * App settings database queries.
+ *
+ * Single-row table queries for global app configuration.
+ *
+ * @module
+ */
+import type { QueryDeps } from '../db/query_deps.js';
+import type { AppSettings, AppSettingsWithUsernameJson } from './app_settings_schema.js';
+/**
+ * Load the current app settings.
+ *
+ * @param deps - query dependencies
+ * @returns the app settings row
+ */
+export declare const query_app_settings_load: (deps: QueryDeps) => Promise<AppSettings>;
+/**
+ * Load the current app settings with resolved updater username.
+ *
+ * @param deps - query dependencies
+ * @returns the app settings with `updated_by_username`
+ */
+export declare const query_app_settings_load_with_username: (deps: QueryDeps) => Promise<AppSettingsWithUsernameJson>;
+/**
+ * Update app settings and return the updated row.
+ *
+ * @param deps - query dependencies
+ * @param open_signup - new value for the open_signup toggle
+ * @param actor_id - the actor making the change
+ * @returns the updated app settings row
+ */
+export declare const query_app_settings_update: (deps: QueryDeps, open_signup: boolean, actor_id: string) => Promise<AppSettings>;
+//# sourceMappingURL=app_settings_queries.d.ts.map

package/dist/auth/app_settings_queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app_settings_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/app_settings_queries.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAC,WAAW,EAAE,2BAA2B,EAAC,MAAM,0BAA0B,CAAC;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,WAAW,CAQlF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,KACb,OAAO,CAAC,2BAA2B,CAWrC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,aAAa,OAAO,EACpB,UAAU,MAAM,KACd,OAAO,CAAC,WAAW,CASrB,CAAC"}

package/dist/auth/app_settings_queries.js

@@ -0,0 +1,51 @@
+/**
+ * App settings database queries.
+ *
+ * Single-row table queries for global app configuration.
+ *
+ * @module
+ */
+/**
+ * Load the current app settings.
+ *
+ * @param deps - query dependencies
+ * @returns the app settings row
+ */
+export const query_app_settings_load = async (deps) => {
+    const row = await deps.db.query_one(`SELECT open_signup, updated_at, updated_by FROM app_settings WHERE id = 1`);
+    if (!row) {
+        throw new Error('app_settings row not found — migration may not have run');
+    }
+    return row;
+};
+/**
+ * Load the current app settings with resolved updater username.
+ *
+ * @param deps - query dependencies
+ * @returns the app settings with `updated_by_username`
+ */
+export const query_app_settings_load_with_username = async (deps) => {
+    const row = await deps.db.query_one(`SELECT s.open_signup, s.updated_at, s.updated_by, act.name AS updated_by_username
+		 FROM app_settings s
+		 LEFT JOIN actor act ON act.id = s.updated_by
+		 WHERE s.id = 1`);
+    if (!row) {
+        throw new Error('app_settings row not found — migration may not have run');
+    }
+    return row;
+};
+/**
+ * Update app settings and return the updated row.
+ *
+ * @param deps - query dependencies
+ * @param open_signup - new value for the open_signup toggle
+ * @param actor_id - the actor making the change
+ * @returns the updated app settings row
+ */
+export const query_app_settings_update = async (deps, open_signup, actor_id) => {
+    const row = await deps.db.query_one(`UPDATE app_settings SET open_signup = $1, updated_at = NOW(), updated_by = $2 WHERE id = 1 RETURNING open_signup, updated_at, updated_by`, [open_signup, actor_id]);
+    if (!row) {
+        throw new Error('app_settings row not found — migration may not have run');
+    }
+    return row;
+};

package/dist/auth/app_settings_routes.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Admin app settings route specs.
+ *
+ * GET and PATCH routes for managing global app settings (e.g. open signup toggle).
+ * All routes require the `admin` role.
+ *
+ * @module
+ */
+import { type RouteSpec } from '../http/route_spec.js';
+import { type AppSettings } from './app_settings_schema.js';
+import type { RouteFactoryDeps } from './deps.js';
+/**
+ * Per-factory configuration for app settings route specs.
+ */
+export interface AppSettingsRouteOptions {
+    /** Mutable ref to the in-memory app settings — mutated on PATCH. */
+    app_settings: AppSettings;
+}
+/**
+ * Create admin app settings route specs.
+ *
+ * @param deps - stateless capabilities (log, on_audit_event)
+ * @param options - per-factory configuration
+ * @returns route specs for app settings management
+ */
+export declare const create_app_settings_route_specs: (deps: Pick<RouteFactoryDeps, "log" | "on_audit_event">, options: AppSettingsRouteOptions) => Array<RouteSpec>;
+//# sourceMappingURL=app_settings_routes.d.ts.map

package/dist/auth/app_settings_routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app_settings_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/app_settings_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAkB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAQtE,OAAO,EAGN,KAAK,WAAW,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,oEAAoE;IACpE,YAAY,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,gBAAgB,CAAC,EACtD,SAAS,uBAAuB,KAC9B,KAAK,CAAC,SAAS,CAoDjB,CAAC"}

package/dist/auth/app_settings_routes.js

@@ -0,0 +1,66 @@
+/**
+ * Admin app settings route specs.
+ *
+ * GET and PATCH routes for managing global app settings (e.g. open signup toggle).
+ * All routes require the `admin` role.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { get_route_input } from '../http/route_spec.js';
+import { require_request_context } from './request_context.js';
+import { get_client_ip } from '../http/proxy.js';
+import { audit_log_fire_and_forget } from './audit_log_queries.js';
+import { query_app_settings_load_with_username, query_app_settings_update, } from './app_settings_queries.js';
+import { AppSettingsWithUsernameJson, UpdateAppSettingsInput, } from './app_settings_schema.js';
+/**
+ * Create admin app settings route specs.
+ *
+ * @param deps - stateless capabilities (log, on_audit_event)
+ * @param options - per-factory configuration
+ * @returns route specs for app settings management
+ */
+export const create_app_settings_route_specs = (deps, options) => {
+    const { app_settings } = options;
+    return [
+        {
+            method: 'GET',
+            path: '/settings',
+            auth: { type: 'role', role: 'admin' },
+            description: 'Get app settings',
+            input: z.null(),
+            output: z.strictObject({ settings: AppSettingsWithUsernameJson }),
+            handler: async (c, route) => {
+                const settings = await query_app_settings_load_with_username(route);
+                return c.json({ settings });
+            },
+        },
+        {
+            method: 'PATCH',
+            path: '/settings',
+            auth: { type: 'role', role: 'admin' },
+            description: 'Update app settings',
+            input: UpdateAppSettingsInput,
+            output: z.strictObject({ ok: z.literal(true), settings: AppSettingsWithUsernameJson }),
+            handler: async (c, route) => {
+                const ctx = require_request_context(c);
+                const { open_signup } = get_route_input(c);
+                const old_value = app_settings.open_signup;
+                const updated = await query_app_settings_update(route, open_signup, ctx.actor.id);
+                // Mutate the in-memory ref so GET reads are consistent
+                app_settings.open_signup = updated.open_signup;
+                app_settings.updated_at = updated.updated_at;
+                app_settings.updated_by = updated.updated_by;
+                void audit_log_fire_and_forget(route, {
+                    event_type: 'app_settings_update',
+                    actor_id: ctx.actor.id,
+                    account_id: ctx.account.id,
+                    ip: get_client_ip(c),
+                    metadata: { setting: 'open_signup', old_value, new_value: open_signup },
+                }, deps.log, deps.on_audit_event);
+                const settings_with_username = await query_app_settings_load_with_username(route);
+                return c.json({ ok: true, settings: settings_with_username });
+            },
+        },
+    ];
+};

package/dist/auth/app_settings_schema.d.ts

@@ -0,0 +1,35 @@
+/**
+ * App settings types and client-safe schemas.
+ *
+ * Single-row table for global app configuration (e.g. open signup toggle).
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** App settings row from the database. */
+export interface AppSettings {
+    open_signup: boolean;
+    updated_at: string | null;
+    updated_by: string | null;
+}
+/** Zod schema for client-safe app settings data. */
+export declare const AppSettingsJson: z.ZodObject<{
+    open_signup: z.ZodBoolean;
+    updated_at: z.ZodNullable<z.ZodString>;
+    updated_by: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type AppSettingsJson = z.infer<typeof AppSettingsJson>;
+/** Zod schema for admin app settings with resolved updater username. */
+export declare const AppSettingsWithUsernameJson: z.ZodObject<{
+    open_signup: z.ZodBoolean;
+    updated_at: z.ZodNullable<z.ZodString>;
+    updated_by: z.ZodNullable<z.ZodString>;
+    updated_by_username: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type AppSettingsWithUsernameJson = z.infer<typeof AppSettingsWithUsernameJson>;
+/** Zod schema for updating app settings. */
+export declare const UpdateAppSettingsInput: z.ZodObject<{
+    open_signup: z.ZodBoolean;
+}, z.core.$strict>;
+export type UpdateAppSettingsInput = z.infer<typeof UpdateAppSettingsInput>;
+//# sourceMappingURL=app_settings_schema.d.ts.map

package/dist/auth/app_settings_schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app_settings_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/app_settings_schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,oDAAoD;AACpD,eAAO,MAAM,eAAe;;;;kBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,wEAAwE;AACxE,eAAO,MAAM,2BAA2B;;;;;kBAEtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/auth/app_settings_schema.js

@@ -0,0 +1,22 @@
+/**
+ * App settings types and client-safe schemas.
+ *
+ * Single-row table for global app configuration (e.g. open signup toggle).
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** Zod schema for client-safe app settings data. */
+export const AppSettingsJson = z.strictObject({
+    open_signup: z.boolean(),
+    updated_at: z.string().nullable(),
+    updated_by: z.string().nullable(),
+});
+/** Zod schema for admin app settings with resolved updater username. */
+export const AppSettingsWithUsernameJson = AppSettingsJson.extend({
+    updated_by_username: z.string().nullable(),
+});
+/** Zod schema for updating app settings. */
+export const UpdateAppSettingsInput = z.strictObject({
+    open_signup: z.boolean(),
+});

package/dist/auth/audit_log_queries.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Audit log database queries.
+ *
+ * Records and retrieves auth mutation events for security monitoring.
+ * All write operations should use `audit_log_fire_and_forget` to
+ * ensure audit logging never blocks or breaks auth flows.
+ *
+ * Rollback resilience: `audit_log_fire_and_forget` writes to `background_db`
+ * (pool-level), not the handler's transaction-scoped `db`, so audit entries
+ * persist even when the request transaction rolls back.
+ *
+ * @module
+ */
+import type { Logger } from '@fuzdev/fuz_util/log.js';
+import type { QueryDeps } from '../db/query_deps.js';
+import type { RouteContext } from '../http/route_spec.js';
+import { type AuditEventType, type AuditLogEvent, type AuditLogInput, type AuditLogListOptions, type AuditLogEventWithUsernamesJson, type PermitHistoryEventJson } from './audit_log_schema.js';
+/** Default limit for audit log listings. */
+export declare const AUDIT_LOG_DEFAULT_LIMIT = 50;
+/**
+ * Insert an audit log entry.
+ *
+ * Uses `RETURNING *` to return the full inserted row including
+ * DB-assigned fields (`id`, `seq`, `created_at`).
+ *
+ * In DEV mode, validates metadata against the per-event-type schema
+ * before writing (warns on mismatch, never throws).
+ *
+ * @param deps - query dependencies
+ * @param input - the audit event to record
+ * @returns the inserted audit log row
+ */
+export declare const query_audit_log: <T extends AuditEventType>(deps: QueryDeps, input: AuditLogInput<T>) => Promise<AuditLogEvent>;
+/**
+ * List audit log entries, newest first.
+ *
+ * @param deps - query dependencies
+ * @param options - filters and pagination
+ * @returns matching audit log entries
+ */
+export declare const query_audit_log_list: (deps: QueryDeps, options?: AuditLogListOptions) => Promise<Array<AuditLogEvent>>;
+/**
+ * List audit log entries with resolved usernames, newest first.
+ *
+ * @param deps - query dependencies
+ * @param options - filters and pagination
+ * @returns matching audit log entries with `username` and `target_username`
+ */
+export declare const query_audit_log_list_with_usernames: (deps: QueryDeps, options?: AuditLogListOptions) => Promise<Array<AuditLogEventWithUsernamesJson>>;
+/**
+ * List audit log entries related to an account (as actor or target).
+ *
+ * @param deps - query dependencies
+ * @param account_id - the account to query for
+ * @param limit - maximum entries to return
+ */
+export declare const query_audit_log_list_for_account: (deps: QueryDeps, account_id: string, limit?: number) => Promise<Array<AuditLogEvent>>;
+/**
+ * List permit grant/revoke events with resolved usernames.
+ *
+ * @param deps - query dependencies
+ * @param limit - maximum entries to return
+ * @param offset - number of entries to skip
+ * @returns permit history events with `username` and `target_username`
+ */
+export declare const query_audit_log_list_permit_history: (deps: QueryDeps, limit?: number, offset?: number) => Promise<Array<PermitHistoryEventJson>>;
+/**
+ * Delete audit log entries older than the given date.
+ *
+ * @param deps - query dependencies
+ * @param before - delete entries created before this date
+ * @returns the number of entries deleted
+ */
+export declare const query_audit_log_cleanup_before: (deps: QueryDeps, before: Date) => Promise<number>;
+/**
+ * Log an audit event without blocking the caller.
+ *
+ * Errors are logged to console — audit logging never breaks auth flows.
+ * Uses `background_db` so audit entries persist even if the request transaction rolls back.
+ * Write failures and `on_event` callback failures are logged separately
+ * so the error message indicates which phase failed.
+ *
+ * @param route - `background_db` and `pending_effects` from the route context
+ * @param input - the audit event to record
+ * @param log - the logger instance
+ * @param on_event - callback invoked with the inserted row after a successful write
+ * @returns the settled promise (callers may ignore it — fire-and-forget semantics preserved)
+ */
+export declare const audit_log_fire_and_forget: <T extends AuditEventType>(route: Pick<RouteContext, "background_db" | "pending_effects">, input: AuditLogInput<T>, log: Logger, on_event: (event: AuditLogEvent) => void) => Promise<void>;
+//# sourceMappingURL=audit_log_queries.d.ts.map

package/dist/auth/audit_log_queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_log_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAGpD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,CAAC,SAAS,cAAc,EAC7D,MAAM,SAAS,EACf,OAAO,aAAa,CAAC,CAAC,CAAC,KACrB,OAAO,CAAC,aAAa,CAuBvB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAwC9B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,UAAU,mBAAmB,KAC3B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CA8C/C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAA+B,KAC7B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAO9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,cAA+B,EAC/B,eAAU,KACR,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAYvC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,QAAQ,IAAI,KACV,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,cAAc,EACjE,OAAO,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,iBAAiB,CAAC,EAC9D,OAAO,aAAa,CAAC,CAAC,CAAC,EACvB,KAAK,MAAM,EACX,UAAU,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,KACtC,OAAO,CAAC,IAAI,CAcd,CAAC"}