@getstrata/core 2.2.28 → 2.2.29

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @getstrata/core changelog
 
+## 2.2.29
+
+MFA recovery-code persistence atomically claims the validated snapshot and rejects stale requests before credential issuance. Basic authentication fails closed and consumes under the verified RLS identifier scope. Adds native SQLite/Postgres/MySQL concurrency and restricted-role regressions.
+
 ## 2.2.28
 
 Generated JSON and HTML password resets validate input before consuming signed links and atomically commit token consumption, password updates and credential revocation. Adds real generated-app failure, retry, replay and cookie/token/JWT revocation regressions.

package/dist/core/auth/basicAuthGuard.d.ts

@@ -4,6 +4,7 @@ import type { AuthGuard } from "./guard";
 declare class BasicAuthGuard implements AuthGuard {
     private readonly container;
     constructor(container: ServiceContainerLike);
+    private persistRecovery;
     resolve(request: Request): Promise<AuthUser | null>;
 }
 export { BasicAuthGuard };

package/dist/entries/auth/basicAuthGuard.js

@@ -99,6 +99,371 @@ var init_defaultConnection = __esm(() => {
   DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
 });
 
+// ../../src/core/tenant/tenantContext.ts
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+var tenantContext;
+var init_tenantContext = __esm(() => {
+  init_asyncContextStore();
+  tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+});
+
+// ../../src/core/events/eventBus.ts
+class EventBus {
+  constructor() {}
+  transactionalListeners = new Map;
+  listenTransactional(event, listener) {
+    const handlers = this.transactionalListeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.transactionalListeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (!handlers.size)
+        this.transactionalListeners.delete(event);
+    };
+  }
+  hasTransactionalListeners(event) {
+    return (this.transactionalListeners.get(event)?.size ?? 0) > 0;
+  }
+  async dispatchTransactional(event, payload) {
+    for (const listener of this.transactionalListeners.get(event) ?? [])
+      await listener(payload);
+  }
+  listeners = new Map;
+  on(event, listener) {
+    return this.listen(event, listener);
+  }
+  listen(event, listener) {
+    const handlers = this.listeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.listeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (handlers.size === 0) {
+        this.listeners.delete(event);
+      }
+    };
+  }
+  async emit(event, payload) {
+    await this.dispatch(event, payload);
+  }
+  async dispatch(event, payload) {
+    const handlers = this.listeners.get(event);
+    if (!handlers || handlers.size === 0) {
+      return;
+    }
+    for (const handler of handlers) {
+      await handler(payload);
+    }
+  }
+}
+function readSharedEventBus() {
+  const globalBus = globalThis[EVENT_BUS_KEY];
+  if (globalBus) {
+    return globalBus;
+  }
+  const bus = new EventBus;
+  globalThis[EVENT_BUS_KEY] = bus;
+  return bus;
+}
+var EVENT_BUS_KEY, eventBus;
+var init_eventBus = __esm(() => {
+  EVENT_BUS_KEY = Symbol.for("@getstrata/eventBus");
+  eventBus = readSharedEventBus();
+});
+
+// ../../src/core/database/transactionControl.ts
+function unwrapTransactionRollback(error, depth = 0) {
+  if (error instanceof TransactionRollback) {
+    return error;
+  }
+  if (depth >= 5 || !(error instanceof Error) || error.cause === undefined) {
+    return null;
+  }
+  return unwrapTransactionRollback(error.cause, depth + 1);
+}
+function hasActiveTransaction() {
+  return hasActiveDatabaseConnection() && (transactionScopes.getStore()?.rollback.length ?? 0) > 0;
+}
+function requestTransactionRollback() {
+  const state = transactionScopes.getStore();
+  const index = state ? state.rollback.length - 1 : -1;
+  if (!state || index < 0) {
+    return;
+  }
+  const flags = state.rollback;
+  const current = flags[index];
+  if (current === undefined) {
+    return;
+  }
+  flags[index] = true;
+}
+function scopeRequestsRollback() {
+  const state = transactionScopes.getStore();
+  if (!state || state.rollback.length === 0) {
+    return false;
+  }
+  return state.rollback[state.rollback.length - 1] === true;
+}
+async function commitOrRollbackScope(result) {
+  if (scopeRequestsRollback()) {
+    throw new TransactionRollback(result);
+  }
+  return result;
+}
+async function settleTransaction(work) {
+  try {
+    return await work();
+  } catch (error) {
+    const rollback = unwrapTransactionRollback(error);
+    if (rollback) {
+      return rollback.result;
+    }
+    throw error;
+  }
+}
+async function runWithTransactionScope(callback) {
+  const existing = transactionScopes.getStore();
+  if (existing) {
+    existing.rollback.push(false);
+    try {
+      return await callback();
+    } finally {
+      existing.rollback.pop();
+    }
+  }
+  const state = { rollback: [false] };
+  return await transactionScopes.run(state, callback);
+}
+var TransactionRollback, transactionScopes;
+var init_transactionControl = __esm(() => {
+  init_asyncContextStore();
+  init_connectionContext();
+  TransactionRollback = class TransactionRollback extends Error {
+    result;
+    constructor(result) {
+      super("Transaction rolled back");
+      this.name = "TransactionRollback";
+      this.result = result;
+    }
+  };
+  transactionScopes = createAsyncContextStore("@getstrata/transactionScopes");
+});
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  const raw = env.TENANCY_DRIVER?.trim();
+  if (raw === undefined || raw === "") {
+    return "rls";
+  }
+  if (TENANCY_DRIVERS.includes(raw)) {
+    return raw;
+  }
+  throw new Error(`TENANCY_DRIVER must be one of ${TENANCY_DRIVERS.join(", ")}; received "${raw}".`);
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
+var TENANCY_DRIVERS;
+var init_tenancyConfig = __esm(() => {
+  TENANCY_DRIVERS = ["rls", "column", "none"];
+});
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  const outerTenant = currentTenant();
+  if (hasActiveDatabaseConnection() && outerTenant && outerTenant.id !== tenant.id) {
+    throw new Error("Cannot switch tenants inside an active database transaction.");
+  }
+  if (!isTenancyEnabled() || !isRlsTenancy()) {
+    return await runWithTenant(tenant, callback);
+  }
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool2());
+    return await runWithScopedTenantTransaction(() => applyTenantContextToTransaction(activeConnection, tenant.id), () => runWithTenant(tenant, callback));
+  }
+  const pool = getDefaultDatabasePool2();
+  const begin = pool.begin;
+  if (typeof begin !== "function") {
+    throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await begin.bind(pool)(AsyncLocalStorage2.bind(async (transaction) => {
+      await applyTenantContextToTransaction(transaction, tenant.id);
+      return await runWithDatabaseConnection(transaction, async () => {
+        return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
+      });
+    }));
+  }));
+}
+function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
+  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
+}
+var init_tenantDatabaseScope = __esm(() => {
+  init_connectionContext();
+  init_transactionControl();
+  init_deferredModelEvents();
+  init_databaseTenantContext();
+  init_tenancyConfig();
+  init_tenantContext();
+});
+
+// ../../src/core/events/deferredModelEvents.ts
+function sameTenant(left, right) {
+  if (left === null && right === null) {
+    return true;
+  }
+  if (left === null || right === null) {
+    return false;
+  }
+  return left.id === right.id;
+}
+function groupQueuedModelEvents(queued) {
+  const groups = [];
+  for (const item of queued) {
+    const lastGroup = groups[groups.length - 1];
+    const last = lastGroup?.[lastGroup.length - 1];
+    if (!lastGroup || !last || !sameTenant(last.tenant, item.tenant)) {
+      groups.push([item]);
+    } else {
+      lastGroup.push(item);
+    }
+  }
+  return groups;
+}
+async function dispatchEventBatch(batch) {
+  for (const item of batch) {
+    await eventBus.dispatch(item.event, item.payload);
+  }
+}
+async function dispatchQueuedModelEvents(queued) {
+  if (queued.length === 0) {
+    return;
+  }
+  await Promise.resolve().then(() => init_tenantDatabaseScope());
+  for (const batch of groupQueuedModelEvents(queued)) {
+    const tenant = batch[0]?.tenant ?? null;
+    if (tenant) {
+      await runWithTenantDatabase(tenant, () => dispatchEventBatch(batch));
+    } else {
+      await dispatchEventBatch(batch);
+    }
+  }
+}
+async function runWithDeferredModelEvents(callback) {
+  const existing = deferredModelEvents.getStore();
+  if (existing) {
+    existing.frames.push([]);
+    existing.rollbackFrames.push([]);
+    try {
+      const result = await callback();
+      const nested = existing.frames.pop() ?? [];
+      const rollback = existing.rollbackFrames.pop() ?? [];
+      existing.rollbackFrames.at(-1)?.push(...rollback);
+      const parent = existing.frames[existing.frames.length - 1];
+      if (parent) {
+        parent.push(...nested);
+      }
+      return result;
+    } catch (error) {
+      existing.frames.pop();
+      for (const rollback of (existing.rollbackFrames.pop() ?? []).reverse())
+        rollback();
+      throw error;
+    }
+  }
+  const state = { frames: [[]], rollbackFrames: [[]] };
+  let result;
+  try {
+    result = await deferredModelEvents.run(state, callback);
+  } catch (error) {
+    for (const rollback of (state.rollbackFrames[0] ?? []).reverse())
+      rollback();
+    throw error;
+  }
+  await dispatchQueuedModelEvents(state.frames[0] ?? []);
+  return result;
+}
+var deferredModelEvents;
+var init_deferredModelEvents = __esm(() => {
+  init_asyncContextStore();
+  init_tenantContext();
+  init_eventBus();
+  deferredModelEvents = createAsyncContextStore("@getstrata/deferredModelEvents");
+});
+
+// ../../src/core/database/acquisitionMetrics.ts
+async function observeTransactionAcquisition(metrics, acquire, signal) {
+  const state = states.get(metrics);
+  if (!state)
+    throw new TypeError("Transaction acquisition metrics must be created by the framework factory.");
+  const started = performance.now();
+  state.inflight++;
+  let outcome = "acquired";
+  try {
+    return await acquire();
+  } catch (error) {
+    outcome = signal?.aborted ? "aborted" : "failed";
+    throw error;
+  } finally {
+    state.inflight--;
+    const elapsed = Math.max(0, performance.now() - started) / 1000;
+    const histogram = state.outcomes[outcomes.indexOf(outcome)];
+    if (histogram) {
+      histogram.count++;
+      histogram.sumSeconds += elapsed;
+      for (let index = 0;index < ACQUISITION_BUCKETS_SECONDS.length; index++) {
+        const bound = ACQUISITION_BUCKETS_SECONDS[index];
+        if (bound !== undefined && elapsed <= bound)
+          histogram.buckets[index] = (histogram.buckets[index] ?? 0) + 1;
+      }
+    }
+  }
+}
+var ACQUISITION_BUCKETS_SECONDS, outcomes, metricsBrand, states;
+var init_acquisitionMetrics = __esm(() => {
+  ACQUISITION_BUCKETS_SECONDS = [
+    0.001,
+    0.005,
+    0.01,
+    0.025,
+    0.05,
+    0.1,
+    0.25,
+    0.5,
+    1,
+    2.5,
+    5,
+    10
+  ];
+  outcomes = ["acquired", "failed", "aborted"];
+  metricsBrand = Symbol("transaction acquisition metrics");
+  states = new WeakMap;
+});
+
+// ../../src/core/database/connection.ts
+function createDatabaseConnection(source) {
+  return {
+    async unsafe(query, params = []) {
+      return await source.unsafe(query, params);
+    }
+  };
+}
+var init_connection = () => {};
+
 // ../../src/core/database/schema/driver.ts
 function normalizeConnectionName(connection) {
   const normalized = connection.trim().toLowerCase();
@@ -300,6 +665,216 @@ var init_dialect = __esm(() => {
   dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
 });
 
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getActiveDatabaseConnection(getBoundDatabaseConnection() ?? getDefaultDatabaseQuery());
+}
+function compileTaggedSql(strings, values) {
+  const dialect = currentSqlDialect();
+  let query = strings[0] ?? "";
+  const params = [];
+  for (let index = 0;index < values.length; index += 1) {
+    params.push(values[index]);
+    query += `${dialect.placeholder(params.length)}${strings[index + 1] ?? ""}`;
+  }
+  return { query, params };
+}
+function isTaggedStrings(value) {
+  if (!Array.isArray(value) || typeof value[0] !== "string") {
+    return false;
+  }
+  return typeof value.raw !== "undefined";
+}
+function runOnConnection(connection, args) {
+  if (typeof connection === "function") {
+    return connection(...args);
+  }
+  if (typeof connection.unsafe !== "function") {
+    throw new Error("Database connection cannot run SQL.");
+  }
+  const strings = args[0];
+  if (!isTaggedStrings(strings)) {
+    throw new Error("Database connection cannot run tagged SQL.");
+  }
+  const compiled = compileTaggedSql(strings, args.slice(1));
+  return connection.unsafe(compiled.query, compiled.params);
+}
+var repositoryConnection;
+var init_repositoryConnection = __esm(() => {
+  init_boundConnection();
+  init_connectionContext();
+  init_defaultConnection();
+  init_dialect();
+  repositoryConnection = new Proxy(function repositoryConnection() {}, {
+    apply(_target, _thisArg, args) {
+      return runOnConnection(resolveRepositoryConnection(), args);
+    },
+    get(_target, property) {
+      const connection = resolveRepositoryConnection();
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+});
+
+// ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+async function runInSavepoint(connection, operation) {
+  const inherited = transactionFrame.getStore();
+  let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
+  if (!parent) {
+    parent = { connection, childActive: false };
+    outerFrames.set(connection, parent);
+  }
+  if (parent.childActive) {
+    throw new Error("Concurrent nested transactions on one connection are not supported. Await each transaction before starting the next.");
+  }
+  parent.childActive = true;
+  const name = `strata_${crypto.randomUUID().replaceAll("-", "")}`;
+  try {
+    return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+      await connection.unsafe(`SAVEPOINT ${name}`);
+      try {
+        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(createDatabaseConnection(connection)))));
+        await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
+        return result;
+      } catch (error) {
+        await connection.unsafe(`ROLLBACK TO SAVEPOINT ${name}`);
+        await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
+        throw error;
+      }
+    }));
+  } finally {
+    parent.childActive = false;
+  }
+}
+function supportsTransactions(connection) {
+  return typeof connection.begin === "function";
+}
+async function runInTransaction(operation, options = {}) {
+  const signal = options.acquisitionSignal;
+  signal?.throwIfAborted();
+  const admittedOperation = (connection) => {
+    signal?.throwIfAborted();
+    return operation(connection);
+  };
+  const pool = resolveRepositoryConnection();
+  if (hasActiveDatabaseConnection()) {
+    return await runInSavepoint(getActiveDatabaseConnection(pool), admittedOperation);
+  }
+  if (!supportsTransactions(pool)) {
+    throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    let reserved;
+    if (signal || options.acquisitionMetrics) {
+      if (!pool.reserve)
+        throw new Error(signal ? "Active database connection does not support cancellable transaction acquisition." : "Active database connection does not support observable transaction acquisition.");
+      const reserve = pool.reserve.bind(pool);
+      reserved = options.acquisitionMetrics ? await observeTransactionAcquisition(options.acquisitionMetrics, () => reserve({ signal }), signal) : await reserve({ signal });
+    }
+    const connection = reserved ?? pool;
+    try {
+      signal?.throwIfAborted();
+      if (!supportsTransactions(connection))
+        throw new Error("Reserved database connection does not support transactions.");
+      return await connection.begin(AsyncLocalStorage3.bind(async (transaction) => {
+        return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
+      }));
+    } finally {
+      await reserved?.release();
+    }
+  }));
+}
+var transactionFrame, outerFrames;
+var init_transaction = __esm(() => {
+  init_deferredModelEvents();
+  init_asyncContextStore();
+  init_acquisitionMetrics();
+  init_connection();
+  init_connectionContext();
+  init_repositoryConnection();
+  init_transactionControl();
+  init_acquisitionMetrics();
+  transactionFrame = createAsyncContextStore("@getstrata/transactionFrame");
+  outerFrames = new WeakMap;
+});
+
+// ../../src/core/tenant/databaseTenantContext.ts
+import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+async function applyBypassToTransaction(transaction, bypass) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
+    bypass ? "true" : "false"
+  ]);
+}
+function stringifyBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    return String(identifier);
+  }
+  return identifier.trim();
+}
+async function applyIdentifierToTransaction(transaction, identifier) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_identifier', $1, true)`, [
+    stringifyBypassIdentifier(identifier)
+  ]);
+}
+function assertBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    if (!Number.isInteger(identifier) || identifier <= 0) {
+      throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+    }
+    return;
+  }
+  if (typeof identifier === "string" && identifier.trim() !== "") {
+    return;
+  }
+  throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+}
+async function runWithScopedTenantTransaction(apply, callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
+  if (hasActiveDatabaseConnection()) {
+    const connection = getActiveDatabaseConnection(getDefaultDatabasePool3());
+    return await runInTransaction(async () => {
+      const [previous] = await connection.unsafe(`SELECT current_setting('app.tenant_id', true) AS tenant_id,
+        current_setting('app.bypass_rls', true) AS bypass_rls,
+        current_setting('app.bypass_identifier', true) AS bypass_identifier`);
+      await apply(connection);
+      const result = await callback();
+      await connection.unsafe(`SELECT set_config('app.tenant_id', $1, true),
+        set_config('app.bypass_rls', $2, true), set_config('app.bypass_identifier', $3, true)`, [previous?.tenant_id ?? "", previous?.bypass_rls ?? "", previous?.bypass_identifier ?? ""]);
+      return result;
+    });
+  }
+  const pool = getDefaultDatabasePool3();
+  const begin = pool.begin;
+  if (typeof begin !== "function") {
+    throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
+      await apply(transaction);
+      return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
+    }));
+  }));
+}
+async function runWithMigrationBypass(callback) {
+  return await runWithScopedTenantTransaction((transaction) => applyBypassToTransaction(transaction, true), callback);
+}
+async function runWithMigrationBypassForIdentifier(identifier, callback) {
+  assertBypassIdentifier(identifier);
+  return await runWithScopedTenantTransaction((transaction) => applyIdentifierToTransaction(transaction, identifier), callback);
+}
+var init_databaseTenantContext = __esm(() => {
+  init_connectionContext();
+  init_transaction();
+  init_transactionControl();
+  init_deferredModelEvents();
+  init_tenancyConfig();
+});
+
 // ../../src/core/contracts/container.ts
 function createServiceToken(key) {
   if (!key.trim())
@@ -428,8 +1003,26 @@ function resolveAuthUserDirectory(container) {
 
 // ../../src/core/auth/basicAuthGuard.ts
 init_boundConnection();
+init_connectionContext();
 init_defaultConnection();
 
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
 // ../../src/core/http/statelessAuth.ts
 function authorizationScheme(request) {
   const header = request.headers.get("authorization")?.trim() ?? "";
@@ -472,6 +1065,9 @@ function readBasicCredentials(request) {
   }
 }
 
+// ../../src/core/auth/basicAuthGuard.ts
+init_databaseTenantContext();
+
 // ../../src/core/auth/password.ts
 async function hashPassword(password) {
   return await Bun.password.hash(password, {
@@ -986,11 +1582,17 @@ async function persistConsumedRecoveryHash(sql, userId, currentRaw, consumedHash
   if (!consumedHash) {
     return;
   }
+  const hashes = parseRecoveryHashes(currentRaw);
+  if (typeof currentRaw !== "string" || !hashes.includes(consumedHash)) {
+    throw new UnprocessableEntityError("mfa_invalid");
+  }
   const dialect = currentSqlDialect();
-  await sql.unsafe(`UPDATE users SET mfa_recovery_codes = ${dialect.placeholder(1)} WHERE id = ${dialect.placeholder(2)}`, [
-    JSON.stringify(parseRecoveryHashes(currentRaw).filter((hash) => hash !== consumedHash)),
-    userId
-  ]);
+  const returning = dialect.returningClause("id");
+  const rows = await sql.unsafe(`UPDATE users SET mfa_recovery_codes = ${dialect.placeholder(1)} WHERE id = ${dialect.placeholder(2)} AND mfa_recovery_codes = ${dialect.placeholder(3)}${returning}`, [JSON.stringify(hashes.filter((hash) => hash !== consumedHash)), userId, currentRaw]);
+  const header = rows[0];
+  const affected = returning ? rows.length : typeof header === "object" && header !== null && ("affectedRows" in header) ? Number(header.affectedRows) : 0;
+  if (affected !== 1)
+    throw new UnprocessableEntityError("mfa_invalid");
 }
 
 // ../../src/core/auth/basicAuthGuard.ts
@@ -999,6 +1601,18 @@ class BasicAuthGuard {
   constructor(container) {
     this.container = container;
   }
+  async persistRecovery(record, hash) {
+    try {
+      await runWithMigrationBypassForIdentifier(record.id, async () => {
+        await persistConsumedRecoveryHash(getActiveDatabaseConnection(getBoundDatabaseConnection() ?? getDefaultDatabasePool()), record.id, record.mfa_recovery_codes, hash);
+      });
+      return true;
+    } catch (error) {
+      if (error instanceof UnprocessableEntityError && error.message === "mfa_invalid")
+        return false;
+      throw error;
+    }
+  }
   async resolve(request) {
     const credentials = readBasicCredentials(request);
     if (!credentials) {
@@ -1020,7 +1634,8 @@ class BasicAuthGuard {
         return null;
       }
       if (mfa.consumedRecoveryHash) {
-        await persistConsumedRecoveryHash(getBoundDatabaseConnection() ?? getDefaultDatabasePool(), record.id, record.mfa_recovery_codes, mfa.consumedRecoveryHash);
+        if (!await this.persistRecovery(record, mfa.consumedRecoveryHash))
+          return null;
       }
       return {
         id: record.id,
@@ -1048,7 +1663,8 @@ class BasicAuthGuard {
         return null;
       }
       if (mfa.consumedRecoveryHash) {
-        await persistConsumedRecoveryHash(getBoundDatabaseConnection() ?? getDefaultDatabasePool(), record.id, record.mfa_recovery_codes, mfa.consumedRecoveryHash);
+        if (!await this.persistRecovery(record, mfa.consumedRecoveryHash))
+          return null;
       }
       return user;
     }