@h-ai/iam 0.1.0-alpha.74 → 0.1.0-alpha.76

package/dist/index.js

@@ -4,7 +4,7 @@ import { cache } from '@h-ai/cache';
 import { core, err, ok } from '@h-ai/core';
 import { crypto as crypto$1 } from '@h-ai/crypto';
 import { migrateSchema, reldb, schemaColumns, BaseReldbCrudRepository, HaiReldbError } from '@h-ai/reldb';
-import { createHash, randomBytes, randomInt } from 'crypto';
+import { randomUUID, createHash, randomBytes, randomInt } from 'crypto';
 import { isIP, BlockList } from 'net';
 import { verifySolution, pbkdf2, createChallenge } from 'altcha/lib';
 import { z } from 'zod';
@@ -641,6 +641,118 @@ var iamM = core.i18n.createMessageGetter({
   "ja-JP": ja_JP_default
 });
 
+// src/iam-cache.ts
+var revisionKey = "hai:iam:read_cache:revision";
+var transactions = /* @__PURE__ */ new WeakMap();
+var logger = core.logger.child({ module: "iam", scope: "read-cache" });
+var degraded = false;
+function failure() {
+  return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_sessionExpired"));
+}
+async function revision() {
+  const current = await cache.kv.get(revisionKey);
+  if (!current.success)
+    return current;
+  if (current.data)
+    return ok(current.data);
+  const created = await cache.kv.set(revisionKey, { epoch: randomUUID(), writers: 0 }, { nx: true });
+  if (!created.success)
+    return created;
+  const loaded = await cache.kv.get(revisionKey);
+  return loaded.success && loaded.data ? ok(loaded.data) : failure();
+}
+async function change(delta) {
+  for (let attempt = 0; attempt < 32; attempt++) {
+    const current = await revision();
+    if (!current.success)
+      return current;
+    const written = await cache.kv.compareAndSwap(revisionKey, current.data, { epoch: randomUUID(), writers: Math.max(0, current.data.writers + delta) });
+    if (!written.success)
+      return written;
+    if (written.data)
+      return ok(void 0);
+  }
+  return failure();
+}
+async function readIamCache(key, load) {
+  const before = await revision();
+  if (!before.success || before.data.writers)
+    return load();
+  const address = `hai:iam:read_cache:${before.data.epoch}:${key}`;
+  const cached = await cache.kv.get(address);
+  if (cached.success && cached.data) {
+    const after2 = await revision();
+    if (after2.success && !after2.data.writers && after2.data.epoch === before.data.epoch)
+      return ok(cached.data.value);
+    return load();
+  }
+  const result = await load();
+  if (!result.success)
+    return result;
+  const after = await revision();
+  if (after.success && !after.data.writers && after.data.epoch === before.data.epoch)
+    await cache.kv.set(address, { value: result.data }, { ex: 60 });
+  return result;
+}
+async function finish() {
+  const completed = await change(-1);
+  if (!completed.success && !degraded) {
+    degraded = true;
+    logger.warn("IAM cache invalidation incomplete; authorization reads use database", { code: completed.error.code });
+  }
+  if (completed.success)
+    degraded = false;
+}
+async function enroll(tx) {
+  const existing = transactions.get(tx);
+  if (existing)
+    return existing;
+  const pending = (async () => {
+    const started = await change(1);
+    if (!started.success)
+      return started;
+    const commit = tx.commit.bind(tx);
+    const rollback = tx.rollback.bind(tx);
+    tx.commit = async () => {
+      const result = await commit();
+      if (result.success)
+        await finish();
+      return result;
+    };
+    tx.rollback = async () => {
+      const result = await rollback();
+      if (result.success)
+        await finish();
+      return result;
+    };
+    return ok(void 0);
+  })();
+  transactions.set(tx, pending);
+  return pending;
+}
+function guardIamMutation(operation, txIndex) {
+  return async (...args) => {
+    const candidate = txIndex === void 0 ? void 0 : args[txIndex];
+    const tx = candidate;
+    let started;
+    try {
+      started = tx ? await enroll(tx) : await change(1);
+    } catch {
+      return failure();
+    }
+    if (!started.success)
+      return started;
+    try {
+      return await operation(...args);
+    } catch {
+      return failure();
+    } finally {
+      if (!tx)
+        await finish();
+    }
+  };
+}
+
 // src/authn/apikey/iam-authn-apikey-repository.ts
 var TABLE_NAME = "hai_iam_api_keys";
 var API_KEY_SORT_COLUMNS = {
@@ -742,6 +854,10 @@ async function createDbApiKeyRepository() {
     return apiKeyRepoInstance;
   const repo = new DbApiKeyRepository();
   await repo.count();
+  repo.removeById = guardIamMutation(repo.removeById.bind(repo), 1);
+  const update = repo.updateFields.bind(repo);
+  const protectedUpdate = guardIamMutation(update, 2);
+  repo.updateFields = (id, data, tx) => Object.keys(data).every((key) => key === "lastUsedAt") ? update(id, data, tx) : protectedUpdate(id, data, tx);
   apiKeyRepoInstance = repo;
   apiKeyRepoSqlOps = reldb.sql;
   return repo;
@@ -928,7 +1044,7 @@ function applySessionPatch(session, patch) {
 }
 
 // src/ticket/iam-ticket-functions.ts
-var logger = core.logger.child({ module: "iam", scope: "ticket" });
+var logger2 = core.logger.child({ module: "iam", scope: "ticket" });
 var TICKET_KEY_PREFIX = "hai:iam:ticket:";
 var DEFAULT_TICKET_TTL_MS = 3e4;
 function buildTicketKey(ticket) {
@@ -948,7 +1064,7 @@ function createTicketOperations() {
       };
       const saved = await cache.kv.set(buildTicketKey(ticket), record, { px: ttlMs, nx: true });
       if (!saved.success || !saved.data) {
-        logger.warn("Failed to issue ticket", { purpose: options.purpose });
+        logger2.warn("Failed to issue ticket", { purpose: options.purpose });
         return err(HaiIamError.TICKET_ISSUE_FAILED, iamM("iam_ticketIssueFailed"));
       }
       return ok({ ticket, expiresAt });
@@ -1152,6 +1268,12 @@ async function createDbUserRepository() {
     return userRepoInstance;
   const repo = new DbUserRepository();
   await repo.count();
+  repo.create = guardIamMutation(repo.create.bind(repo), 1);
+  repo.updateById = guardIamMutation(repo.updateById.bind(repo), 2);
+  repo.deleteById = guardIamMutation(repo.deleteById.bind(repo), 1);
+  repo.suspendInactive = guardIamMutation(repo.suspendInactive.bind(repo));
+  repo.setPassword = guardIamMutation(repo.setPassword.bind(repo));
+  repo.commitPasswordReset = guardIamMutation(repo.commitPasswordReset.bind(repo));
   userRepoInstance = repo;
   userRepoSqlOps = reldb.sql;
   return repo;
@@ -1422,7 +1544,7 @@ async function resetLoginFailures(userRepository, user, policy) {
 }
 
 // src/authn/apikey/iam-authn-apikey-strategy.ts
-var logger2 = core.logger.child({ module: "iam", scope: "apikey-strategy" });
+var logger3 = core.logger.child({ module: "iam", scope: "apikey-strategy" });
 var KEY_PREFIX_LENGTH = 12;
 function generateRawKey(prefix2) {
   const hex = randomBytes(32).toString("hex");
@@ -1448,7 +1570,7 @@ function createApiKeyStrategy(config) {
   const apikeyConfig = config.apikeyConfig ? ApiKeyConfigSchema.parse(config.apikeyConfig) : ApiKeyConfigSchema.parse({});
   const { userRepository, apiKeyRepository } = config;
   const passwordOps = crypto$1.password;
-  async function verifyRawKey(rawKey) {
+  async function loadRawKey(rawKey) {
     const prefix2 = extractKeyPrefix(rawKey);
     const candidatesResult = await apiKeyRepository.findByKeyPrefix(prefix2);
     if (!candidatesResult.success) {
@@ -1467,12 +1589,26 @@ function createApiKeyStrategy(config) {
         return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
       }
       apiKeyRepository.updateFields(candidate.id, { lastUsedAt: /* @__PURE__ */ new Date() }).catch(() => {
-        logger2.warn("Failed to update API Key lastUsedAt", { keyId: candidate.id });
+        logger3.warn("Failed to update API Key lastUsedAt", { keyId: candidate.id });
       });
       return ok(toApiKey(candidate));
     }
     return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
   }
+  async function verifyRawKey(rawKey) {
+    const fingerprint = createHash("sha256").update(rawKey).digest("hex");
+    const result = await readIamCache(`verified_apikey:${fingerprint}`, async () => {
+      const verified = await loadRawKey(rawKey);
+      return verified.success ? ok({ ...verified.data, expiresAt: verified.data.expiresAt?.getTime() ?? null, createdAt: verified.data.createdAt.getTime(), lastUsedAt: verified.data.lastUsedAt?.getTime() ?? null }) : verified;
+    });
+    if (!result.success)
+      return result;
+    if (!result.data.enabled)
+      return err(HaiIamError.APIKEY_DISABLED, iamM("iam_apikeyDisabled"));
+    if (result.data.expiresAt !== null && result.data.expiresAt <= Date.now())
+      return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
+    return ok({ ...result.data, expiresAt: result.data.expiresAt === null ? null : new Date(result.data.expiresAt), createdAt: new Date(result.data.createdAt), lastUsedAt: result.data.lastUsedAt === null ? null : new Date(result.data.lastUsedAt) });
+  }
   const strategy = {
     type: "apikey",
     name: "apikey-strategy",
@@ -1497,7 +1633,7 @@ function createApiKeyStrategy(config) {
       if (!isUserActive(userResult.data)) {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       }
-      logger2.debug("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
+      logger3.debug("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
       return ok({ user: { ...toUser(userResult.data), credentialVersion: userResult.data.credentialVersion ?? "" }, apiKey });
     }
   };
@@ -1534,7 +1670,7 @@ function createApiKeyStrategy(config) {
         const insertResult = await apiKeyRepository.insert(storedApiKey);
         if (!insertResult.success)
           return insertResult;
-        logger2.info("API Key created", { userId, keyId: id, name: options.name });
+        logger3.info("API Key created", { userId, keyId: id, name: options.name });
         return ok({ apiKey: toApiKey(storedApiKey), rawKey });
       } catch (error) {
         return err(HaiIamError.INTERNAL_ERROR, iamM("iam_apikeyCreateFailed", { params: { message: String(error) } }), error);
@@ -1556,7 +1692,7 @@ function createApiKeyStrategy(config) {
       const result = await apiKeyRepository.removeById(keyId);
       if (!result.success)
         return result;
-      logger2.info("API Key revoked", { keyId });
+      logger3.info("API Key revoked", { keyId });
       return ok(void 0);
     },
     async verifyApiKey(rawKey) {
@@ -1607,7 +1743,7 @@ function createLoginAccessCheck(policy) {
     return ok(void 0);
   };
 }
-var logger3 = core.logger.child({ module: "iam", scope: "captcha" });
+var logger4 = core.logger.child({ module: "iam", scope: "captcha" });
 var prefix = "hai:iam:captcha:";
 var operationSchema = z.enum(["login", "register", "sendOtp", "passwordReset", "renewPassword"]);
 var proofSchema = z.object({
@@ -1639,7 +1775,7 @@ async function createIamCaptcha(config, input) {
       return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
     return ok({ id, challenge });
   } catch (error) {
-    logger3.error("Captcha challenge generation failed", { operation: operation.data, error });
+    logger4.error("Captcha challenge generation failed", { operation: operation.data, error });
     return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
   }
 }
@@ -1675,7 +1811,7 @@ async function verifyIamCaptcha(config, operation, proof) {
       return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
     return removed.data === 1 ? ok(void 0) : err(HaiIamError.CAPTCHA_INVALID, iamM("iam_captchaInvalid"));
   } catch (error) {
-    logger3.error("Captcha verification failed", { operation, error });
+    logger4.error("Captcha verification failed", { operation, error });
     return err(HaiIamError.CAPTCHA_UNAVAILABLE, iamM("iam_captchaUnavailable"));
   }
 }
@@ -1733,7 +1869,7 @@ async function loadLdapClientFactory() {
     }
   };
 }
-var logger4 = core.logger.child({ module: "iam", scope: "ldap-strategy" });
+var logger5 = core.logger.child({ module: "iam", scope: "ldap-strategy" });
 function escapeLdapFilterValue(value) {
   return value.replace(/[\\*()/\0]/g, (ch) => {
     const hex = ch.charCodeAt(0).toString(16).padStart(2, "0");
@@ -1836,7 +1972,7 @@ function createLdapStrategy(config) {
             if (!failureResult.success)
               return failureResult;
           }
-          logger4.warn("LDAP authentication failed", { username });
+          logger5.warn("LDAP authentication failed", { username });
           return err(
             HaiIamError.INVALID_CREDENTIALS,
             iamM("iam_passwordWrong")
@@ -1874,7 +2010,7 @@ function createLdapStrategy(config) {
                 return assigned;
               }
             } catch (callbackError) {
-              logger4.warn("onUserAutoRegistered callback failed", { userId: storedUser?.id, error: callbackError });
+              logger5.warn("onUserAutoRegistered callback failed", { userId: storedUser?.id, error: callbackError });
             }
           }
         } else if (storedUser && syncUser) {
@@ -1899,7 +2035,7 @@ function createLdapStrategy(config) {
         const resetResult = await resetLoginFailures(userRepository, storedUser, failurePolicy);
         if (!resetResult.success)
           return resetResult;
-        logger4.debug("LDAP authentication succeeded", { userId: storedUser.id });
+        logger5.debug("LDAP authentication succeeded", { userId: storedUser.id });
         return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
       } finally {
         await client.unbind();
@@ -1919,7 +2055,7 @@ function createCacheOtpRepository() {
   if (otpRepoInstance)
     return otpRepoInstance;
   const keyFor = (identifier) => `hai:iam:otp:${normalizeOtpIdentifier(identifier)}`;
-  const failure = () => err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"));
+  const failure2 = () => err(HaiIamError.REPOSITORY_ERROR, iamM("iam_securityStateFailed"));
   const invalid = () => err(HaiIamError.OTP_INVALID, iamM("iam_otpNotExistOrExpired"));
   otpRepoInstance = {
     async issueOtp(input) {
@@ -1934,7 +2070,7 @@ function createCacheOtpRepository() {
       const key = keyFor(input.identifier);
       const current = await cache.kv.get(key);
       if (!current.success)
-        return failure();
+        return failure2();
       if (current.data && current.data.cooldownUntil > Date.now()) {
         return err(HaiIamError.OTP_RESEND_TOO_FAST, iamM("iam_otpResendTooFast", { params: { seconds: Math.ceil((current.data.cooldownUntil - Date.now()) / 1e3) } }));
       }
@@ -1942,7 +2078,7 @@ function createCacheOtpRepository() {
         return invalid();
       const published = await cache.kv.compareAndSwap(key, current.data ?? void 0, state, { px: Math.max(state.expiresAt, state.cooldownUntil) - Date.now() });
       if (!published.success)
-        return failure();
+        return failure2();
       if (!published.data)
         return err(HaiIamError.SECURITY_BUSY, iamM("iam_securityBusy"));
       if (Date.now() >= state.expiresAt)
@@ -1955,7 +2091,7 @@ function createCacheOtpRepository() {
       for (let attempt = 0; attempt < 16; attempt++) {
         const current = await cache.kv.get(key);
         if (!current.success)
-          return failure();
+          return failure2();
         const state = current.data;
         if (!state || state.code === null || state.expiresAt <= Date.now() || state.attempts >= maxAttempts || version && state.version !== version)
           return invalid();
@@ -1965,7 +2101,7 @@ function createCacheOtpRepository() {
         const next = { ...state, attempts, code: correct || attempts >= maxAttempts ? null : state.code };
         const committed = await cache.kv.compareAndSwap(key, state, next, { keepTtl: true });
         if (!committed.success)
-          return failure();
+          return failure2();
         if (!committed.data)
           continue;
         if (!correct || state.expiresAt <= Date.now())
@@ -1977,7 +2113,7 @@ function createCacheOtpRepository() {
   };
   return otpRepoInstance;
 }
-var logger5 = core.logger.child({ module: "iam", scope: "otp-strategy" });
+var logger6 = core.logger.child({ module: "iam", scope: "otp-strategy" });
 var PHONE_IDENTIFIER_REGEX = /^\+?\d{8,}$/;
 var PHONE_SEPARATOR_REGEX = /[\s-]/g;
 function generateOtpCode(length) {
@@ -2075,7 +2211,7 @@ function createOtpStrategy(config) {
               return assigned;
             }
           } catch (callbackError) {
-            logger5.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
+            logger6.warn("onUserAutoRegistered callback failed", { userId: storedUser.id, error: callbackError });
           }
         }
       }
@@ -2087,7 +2223,7 @@ function createOtpStrategy(config) {
       const resetResult = await resetLoginFailures(config.userRepository, storedUser, failurePolicy);
       if (!resetResult.success)
         return resetResult;
-      logger5.debug("OTP authentication succeeded", { userId: storedUser.id });
+      logger6.debug("OTP authentication succeeded", { userId: storedUser.id });
       return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
@@ -2131,12 +2267,12 @@ function createOtpStrategy(config) {
       );
     }
     const result = { expiresAt };
-    logger5.debug("OTP challenge sent", { identifier, expiresAt });
+    logger6.debug("OTP challenge sent", { identifier, expiresAt });
     return ok(result);
   }
   return { strategy, challenge };
 }
-var logger6 = core.logger.child({ module: "iam", scope: "password-strategy" });
+var logger7 = core.logger.child({ module: "iam", scope: "password-strategy" });
 var PASSWORD_UPPERCASE_REGEX = /[A-Z]/;
 var PASSWORD_LOWERCASE_REGEX = /[a-z]/;
 var PASSWORD_DIGIT_REGEX = /\d/;
@@ -2216,7 +2352,7 @@ function createPasswordStrategy(config) {
       const failureResult = await recordLoginFailure(config.userRepository, user, failurePolicy);
       if (!failureResult.success)
         return failureResult;
-      logger6.warn("Password verification failed", { userId: user.id });
+      logger7.warn("Password verification failed", { userId: user.id });
       return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
     }
     return ok(void 0);
@@ -2250,7 +2386,7 @@ function createPasswordStrategy(config) {
       const resetResult = await resetLoginFailures(config.userRepository, storedUser, failurePolicy);
       if (!resetResult.success)
         return resetResult;
-      logger6.debug("Password authentication succeeded", { userId: storedUser.id });
+      logger7.debug("Password authentication succeeded", { userId: storedUser.id });
       return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
@@ -2270,7 +2406,7 @@ function createPasswordStrategy(config) {
 }
 
 // src/authn/iam-authn-functions.ts
-var logger7 = core.logger.child({ module: "iam", scope: "authn" });
+var logger8 = core.logger.child({ module: "iam", scope: "authn" });
 async function createAuthnOperations(deps) {
   try {
     const { config, sessionFunctions, authzFunctions, ldapClientFactory, ldapSyncUser, onOtpSendEmail, onOtpSendSms } = deps;
@@ -2354,10 +2490,10 @@ async function createAuthnOperations(deps) {
       userRepository,
       config
     });
-    logger7.info("Authn sub-feature initialized");
+    logger8.info("Authn sub-feature initialized");
     return ok({ authn: operations.authn, loginRegisteredUser: operations.loginRegisteredUser, passwordStrategyResult: passwordResult, apiKeyFunctions });
   } catch (error) {
-    logger7.error("Authn sub-feature initialization failed", { error });
+    logger8.error("Authn sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -2452,7 +2588,7 @@ function buildAuthnOperations(deps) {
     if (!recorded.success) {
       const revoked = await sessionFunctions.delete(session.accessToken);
       if (!revoked.success)
-        logger7.error("Failed to revoke session after login timestamp write failure", { userId: user.id, error: revoked.error });
+        logger8.error("Failed to revoke session after login timestamp write failure", { userId: user.id, error: revoked.error });
       return recorded;
     }
     const { credentialVersion, ...publicUser } = user;
@@ -2481,14 +2617,14 @@ function buildAuthnOperations(deps) {
       ...credentials
     });
     if (!authResult.success) {
-      logger7.warn("Login failed", { type, reason: authResult.error.code });
+      logger8.warn("Login failed", { type, reason: authResult.error.code });
       return authResult;
     }
     if (credentials.expectedUserId && credentials.expectedUserId !== authResult.data.id)
       return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
     const result = await buildAuthResult(authResult.data, void 0, context);
     if (result.success) {
-      logger7.info("Login succeeded", { type, userId: authResult.data.id });
+      logger8.info("Login succeeded", { type, userId: authResult.data.id });
     }
     return result;
   }
@@ -2496,19 +2632,10 @@ function buildAuthnOperations(deps) {
     const session = await sessionFunctions.verifyToken(accessToken);
     if (!session.success)
       return session;
-    const [user, authorization] = await Promise.all([
-      userRepository.findById(session.data.userId),
-      authzFunctions.getUserAuthorization(session.data.userId)
-    ]);
-    if (!user.success)
-      return user;
-    if (!user.data?.enabled)
-      return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
-    if (session.data.credentialVersion !== (user.data.credentialVersion ?? ""))
-      return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
+    const authorization = await authzFunctions.getUserAuthorization(session.data.userId);
     if (!authorization.success)
       return authorization;
-    const current = { ...session.data, username: user.data.username, displayName: user.data.displayName, avatarUrl: user.data.avatarUrl, ...authorization.data };
+    const current = { ...session.data, ...authorization.data };
     return ok(current.apiKeyId ? applyApiKeyScopes(current, current.apiKeyScopes ?? []) : current);
   }
   const tickets = createTicketOperations();
@@ -2516,7 +2643,9 @@ function buildAuthnOperations(deps) {
   async function requiresProof(operation) {
     if (!sensitive?.enabled)
       return ok(false);
-    const configured = await authzFunctions.getSensitiveOperations();
+    if (sensitive.operations.includes(operation))
+      return ok(true);
+    const configured = await authzFunctions.getSensitiveOperations(operation);
     if (!configured.success)
       return configured;
     return ok(sensitive.operations.includes(operation) || configured.data.includes(operation));
@@ -2703,8 +2832,12 @@ async function createDbPermissionRepository() {
   return repo;
 }
 var DbPermissionRepository = class extends BaseReldbCrudRepository {
-  async getSensitiveOperations() {
-    const result = await reldb.sql.query("SELECT sensitive_operations FROM hai_iam_permissions WHERE sensitive_operations IS NOT NULL");
+  async getSensitiveOperations(operation) {
+    if (operation !== void 0 && (typeof operation !== "string" || !operation.trim() || operation.length > 128))
+      return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
+    const match = reldb.config?.type === "postgresql" ? "sensitive_operations::jsonb @> CAST(? AS jsonb)" : reldb.config?.type === "mysql" ? "JSON_CONTAINS(sensitive_operations, JSON_QUOTE(?))" : "EXISTS (SELECT 1 FROM json_each(sensitive_operations) WHERE type = 'text' AND value = ?)";
+    const params = operation === void 0 ? [] : [reldb.config?.type === "postgresql" ? JSON.stringify([operation]) : operation];
+    const result = await reldb.sql.query(`SELECT sensitive_operations FROM hai_iam_permissions WHERE sensitive_operations IS NOT NULL${operation === void 0 ? "" : ` AND ${match} LIMIT 1`}`, params);
     if (!result.success)
       return result;
     const operations = /* @__PURE__ */ new Set();
@@ -2716,7 +2849,8 @@ var DbPermissionRepository = class extends BaseReldbCrudRepository {
         for (const value of values) {
           if (typeof value !== "string" || !value.trim() || value.length > 128)
             return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
-          operations.add(value.trim());
+          if (operation === void 0 || value.trim() === operation)
+            operations.add(value.trim());
         }
       }
       return ok([...operations].sort());
@@ -3292,7 +3426,7 @@ var DbRoleRepository = class extends BaseReldbCrudRepository {
 };
 
 // src/authz/iam-authz-functions.ts
-var logger8 = core.logger.child({ module: "iam", scope: "authz" });
+var logger9 = core.logger.child({ module: "iam", scope: "authz" });
 async function createAuthzOperations(deps) {
   try {
     const { config, session } = deps;
@@ -3314,10 +3448,23 @@ async function createAuthzOperations(deps) {
       userRoleRepository: userRoleResult.data,
       session
     });
-    logger8.info("Authz sub-feature initialized");
-    return ok(manager);
+    logger9.info("Authz sub-feature initialized");
+    return ok({
+      ...manager,
+      assignRole: guardIamMutation(manager.assignRole, 2),
+      removeRole: guardIamMutation(manager.removeRole, 2),
+      syncRoles: guardIamMutation(manager.syncRoles, 2),
+      createRole: guardIamMutation(manager.createRole, 1),
+      updateRole: guardIamMutation(manager.updateRole, 2),
+      deleteRole: guardIamMutation(manager.deleteRole, 1),
+      createPermission: guardIamMutation(manager.createPermission, 1),
+      deletePermission: guardIamMutation(manager.deletePermission, 1),
+      assignPermissionToRole: guardIamMutation(manager.assignPermissionToRole, 2),
+      removePermissionFromRole: guardIamMutation(manager.removePermissionFromRole, 2),
+      setPermissionSensitiveOperations: guardIamMutation(manager.setPermissionSensitiveOperations)
+    });
   } catch (error) {
-    logger8.error("Authz sub-feature initialization failed", { error });
+    logger9.error("Authz sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -3334,18 +3481,6 @@ function createRbacManager(config) {
     userRoleRepository,
     session
   } = config;
-  let superAdminRoleId;
-  async function resolveSuperAdminRoleId() {
-    if (superAdminRoleId !== void 0) {
-      return ok(superAdminRoleId);
-    }
-    const roleResult = await roleRepository.findByCode(rbacConfig.superAdminRole);
-    if (!roleResult.success) {
-      return mapRepositoryError2("iam_queryRoleFailed", roleResult.error.message);
-    }
-    superAdminRoleId = roleResult.data?.id ?? null;
-    return ok(superAdminRoleId);
-  }
   function mapRepositoryError2(messageKey, message) {
     return err(
       HaiIamError.REPOSITORY_ERROR,
@@ -3362,16 +3497,6 @@ function createRbacManager(config) {
     }
     return false;
   }
-  async function hasPermissionInRoles(roleIds, permission) {
-    const codesResult = await rolePermissionRepository.getPermissionCodesForRoles(roleIds);
-    if (!codesResult.success)
-      return codesResult;
-    for (const code of codesResult.data) {
-      if (matchesPermission(permission, code))
-        return ok(true);
-    }
-    return ok(false);
-  }
   async function getUserPermissionsInternal(userId) {
     const roleIdsResult = await userRoleRepository.getRoleIds(userId);
     if (!roleIdsResult.success)
@@ -3413,19 +3538,19 @@ function createRbacManager(config) {
   async function syncSessionPermissionsForRole(roleId) {
     const userIdsResult = await userRoleRepository.getUserIdsByRoleId(roleId);
     if (!userIdsResult.success) {
-      logger8.error("Failed to query users for permission sync", { roleId, error: userIdsResult.error.message });
+      logger9.error("Failed to query users for permission sync", { roleId, error: userIdsResult.error.message });
       return;
     }
     await Promise.allSettled(
       userIdsResult.data.map(async (userId) => {
         const permResult = await resolveUserPermissionCodes(userId);
         if (!permResult.success) {
-          logger8.error("Failed to resolve permissions for session sync", { userId, roleId, error: permResult.error.message });
+          logger9.error("Failed to resolve permissions for session sync", { userId, roleId, error: permResult.error.message });
           return;
         }
         const syncResult = await session.patchUserSessions(userId, { permissions: permResult.data });
         if (!syncResult.success) {
-          logger8.error("Failed to sync session permissions", { userId, roleId, error: syncResult.error.message });
+          logger9.error("Failed to sync session permissions", { userId, roleId, error: syncResult.error.message });
         }
       })
     );
@@ -3439,17 +3564,17 @@ function createRbacManager(config) {
     if (roleCodesResult.success) {
       updates.roles = roleCodesResult.data;
     } else {
-      logger8.error("Failed to resolve roles for session sync", { userId, error: roleCodesResult.error.message });
+      logger9.error("Failed to resolve roles for session sync", { userId, error: roleCodesResult.error.message });
     }
     if (permCodesResult.success) {
       updates.permissions = permCodesResult.data;
     } else {
-      logger8.error("Failed to resolve permissions for session sync", { userId, error: permCodesResult.error.message });
+      logger9.error("Failed to resolve permissions for session sync", { userId, error: permCodesResult.error.message });
     }
     if (updates.roles !== void 0 || updates.permissions !== void 0) {
       const syncResult = await session.patchUserSessions(userId, updates);
       if (!syncResult.success) {
-        logger8.error("Failed to patch user sessions", { userId, error: syncResult.error.message });
+        logger9.error("Failed to patch user sessions", { userId, error: syncResult.error.message });
       }
     }
   }
@@ -3472,8 +3597,14 @@ function createRbacManager(config) {
     }
     return ok(void 0);
   }
+  async function getUserAuthorization(userId) {
+    return readIamCache(`authorization:${userId}`, async () => {
+      const rows = await reldb.sql.query("SELECT r.code AS role_code, p.code AS permission_code FROM hai_iam_user_roles ur JOIN hai_iam_roles r ON r.id = ur.role_id LEFT JOIN hai_iam_role_permissions rp ON rp.role_id = r.id LEFT JOIN hai_iam_permissions p ON p.id = rp.permission_id WHERE ur.user_id = ?", [userId]);
+      return rows.success ? ok({ roles: [...new Set(rows.data.map((row) => row.role_code))], permissions: [...new Set(rows.data.flatMap((row) => row.permission_code ? [row.permission_code] : []))] }) : rows;
+    });
+  }
   return {
-    getSensitiveOperations: () => rbacConfig.enabled ? permissionRepository.getSensitiveOperations() : Promise.resolve(ok([])),
+    getSensitiveOperations: (operation) => rbacConfig.enabled ? readIamCache(`sensitive:${operation ?? "*"}`, () => permissionRepository.getSensitiveOperations(operation)) : Promise.resolve(ok([])),
     async setPermissionSensitiveOperations(permissionId, operations) {
       if (!Array.isArray(operations) || operations.length > 1e3 || operations.some((value) => typeof value !== "string" || !value.trim() || value.length > 128))
         return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
@@ -3493,33 +3624,15 @@ function createRbacManager(config) {
       if (!rbacConfig.enabled) {
         return ok(true);
       }
-      const roleIdsResult = await userRoleRepository.getRoleIds(userId);
-      if (!roleIdsResult.success)
-        return roleIdsResult;
-      const roleIds = roleIdsResult.data;
-      if (roleIds.length === 0) {
-        return ok(false);
-      }
-      const superAdminResult = await resolveSuperAdminRoleId();
-      if (!superAdminResult.success)
-        return superAdminResult;
-      if (superAdminResult.data && roleIds.includes(superAdminResult.data)) {
-        return ok(true);
-      }
-      return hasPermissionInRoles(roleIds, permission);
+      const authorization = await getUserAuthorization(userId);
+      if (!authorization.success)
+        return authorization;
+      return ok(authorization.data.roles.includes(rbacConfig.superAdminRole) || authorization.data.permissions.some((code) => matchesPermission(permission, code)));
     },
     async getUserPermissions(userId) {
       return getUserPermissionsInternal(userId);
     },
-    async getUserAuthorization(userId) {
-      const roles = await userRoleRepository.getRoleSummaries(userId);
-      if (!roles.success)
-        return roles;
-      const permissions = roles.data.length ? await rolePermissionRepository.getPermissionCodesForRoles(roles.data.map((role) => role.id)) : ok([]);
-      if (!permissions.success)
-        return permissions;
-      return ok({ roles: roles.data.map((role) => role.code), permissions: permissions.data });
-    },
+    getUserAuthorization,
     async getUserRoles(userId) {
       return userRoleRepository.getRoles(userId);
     },
@@ -3533,7 +3646,7 @@ function createRbacManager(config) {
       }
       const result = await userRoleRepository.assign(userId, roleId, tx);
       if (result.success) {
-        logger8.info("Role assigned to user", { userId, roleId });
+        logger9.info("Role assigned to user", { userId, roleId });
         if (!tx) {
           await syncUserSessionAfterRoleChange(userId);
         }
@@ -3543,7 +3656,7 @@ function createRbacManager(config) {
     async removeRole(userId, roleId, tx) {
       const result = await userRoleRepository.remove(userId, roleId, tx);
       if (result.success) {
-        logger8.info("Role removed from user", { userId, roleId });
+        logger9.info("Role removed from user", { userId, roleId });
         if (!tx) {
           await syncUserSessionAfterRoleChange(userId);
         }
@@ -3611,7 +3724,7 @@ function createRbacManager(config) {
           error
         );
       }
-      logger8.info("Roles synced for user", { userId, added: toAdd.length, removed: toRemove.length });
+      logger9.info("Roles synced for user", { userId, added: toAdd.length, removed: toRemove.length });
       if (ownTx) {
         await syncUserSessionAfterRoleChange(userId);
       }
@@ -3663,10 +3776,7 @@ function createRbacManager(config) {
             return mapRepositoryError2("iam_createRoleFailed", commitResult.error.message);
           }
         }
-        logger8.info("Role created", { roleId: createdResult.data.id, code: role.code });
-        if (role.code === rbacConfig.superAdminRole) {
-          superAdminRoleId = void 0;
-        }
+        logger9.info("Role created", { roleId: createdResult.data.id, code: role.code });
         return ok(createdResult.data);
       } catch (error) {
         if (ownTx)
@@ -3752,7 +3862,6 @@ function createRbacManager(config) {
             return mapRepositoryError2("iam_updateRoleFailed", commitResult.error.message);
           }
         }
-        superAdminRoleId = void 0;
         if (ownTx) {
           const affectedUsersResult = await userRoleRepository.getUserIdsByRoleId(roleId);
           if (affectedUsersResult.success) {
@@ -3760,7 +3869,7 @@ function createRbacManager(config) {
               affectedUsersResult.data.map((userId) => syncUserSessionAfterRoleChange(userId))
             );
           } else {
-            logger8.error("Failed to query affected users after updateRole", { roleId, error: affectedUsersResult.error.message });
+            logger9.error("Failed to query affected users after updateRole", { roleId, error: affectedUsersResult.error.message });
           }
         }
         return ok(updatedResult.data);
@@ -3834,8 +3943,7 @@ function createRbacManager(config) {
           affectedUserIds.map((userId) => syncUserSessionAfterRoleChange(userId))
         );
       }
-      superAdminRoleId = void 0;
-      logger8.info("Role deleted", { roleId });
+      logger9.info("Role deleted", { roleId });
       return ok(void 0);
     },
     // ─── 权限管理 ───
@@ -3879,7 +3987,7 @@ function createRbacManager(config) {
             return mapRepositoryError2("iam_createPermissionFailed", commitResult.error.message);
           }
         }
-        logger8.info("Permission created", { permissionId: createdResult.data.id, code: permission.code });
+        logger9.info("Permission created", { permissionId: createdResult.data.id, code: permission.code });
         return ok(createdResult.data);
       } catch (error) {
         if (ownTx)
@@ -3983,7 +4091,7 @@ function createRbacManager(config) {
           affectedRoleIds.map((roleId) => syncSessionPermissionsForRole(roleId))
         );
       }
-      logger8.info("Permission deleted", { permissionId });
+      logger9.info("Permission deleted", { permissionId });
       return ok(void 0);
     },
     async assignPermissionToRole(roleId, permissionId, tx) {
@@ -4005,7 +4113,7 @@ function createRbacManager(config) {
       }
       const assignResult = await rolePermissionRepository.assign(roleId, permissionId, tx);
       if (assignResult.success) {
-        logger8.info("Permission assigned to role", { roleId, permissionId });
+        logger9.info("Permission assigned to role", { roleId, permissionId });
         if (!tx) {
           await syncSessionPermissionsForRole(roleId);
         }
@@ -4034,7 +4142,7 @@ function createRbacManager(config) {
       }
       const removeResult = await rolePermissionRepository.remove(roleId, permissionId, tx);
       if (removeResult.success) {
-        logger8.info("Permission removed from role", { roleId, permissionId });
+        logger9.info("Permission removed from role", { roleId, permissionId });
         if (!tx) {
           await syncSessionPermissionsForRole(roleId);
         }
@@ -4052,14 +4160,16 @@ function createRbacManager(config) {
     }
   };
 }
-var logger9 = core.logger.child({ module: "iam", scope: "audit" });
+var logger10 = core.logger.child({ module: "iam", scope: "audit" });
 async function observe(operation, event, tx) {
   const result = await operation();
+  if (!audit.isInitialized)
+    return result;
   const fields = typeof event === "function" ? event(result) : event;
   if (!fields)
     return result;
   if (tx && !result.success) {
-    logger9.warn("IAM transactional operation failed", { action: fields.action, resource: fields.resource, reasonCode: result.error.code });
+    logger10.warn("IAM transactional operation failed", { action: fields.action, resource: fields.resource, reasonCode: result.error.code });
     return result;
   }
   const recorded = await audit.capture({
@@ -4069,7 +4179,7 @@ async function observe(operation, event, tx) {
     details: { ...fields.details, ...!result.success ? { reasonCode: result.error.code } : {} }
   }, { tx });
   if (!recorded.success) {
-    logger9.error("IAM event audit failed", { action: fields.action, resource: fields.resource, error: recorded.error });
+    logger10.error("IAM event audit failed", { action: fields.action, resource: fields.resource, error: recorded.error });
     if (tx)
       return recorded;
   }
@@ -4292,7 +4402,29 @@ function buildIamPublicConfig(config, runtime) {
     initialCredentials: { enabled: Boolean(config.initialCredentials?.enabled && config.passwordReset?.enabled !== false && runtime.onPasswordResetRequest) }
   };
 }
-var logger10 = core.logger.child({ module: "iam", scope: "seed" });
+async function readIamUserSecurity(repository, userId) {
+  const found = await readIamCache(`user:${userId}`, async () => {
+    const row = await repository.findById(userId);
+    if (!row.success)
+      return row;
+    const user = row.data;
+    return ok(user ? {
+      username: user.username,
+      displayName: user.displayName,
+      avatarUrl: user.avatarUrl,
+      enabled: user.enabled,
+      accountType: user.accountType,
+      accountStatus: user.accountStatus,
+      accountExpiresAt: user.accountExpiresAt ? new Date(user.accountExpiresAt).getTime() : null,
+      credentialVersion: user.credentialVersion ?? "",
+      mustChangePassword: user.mustChangePassword,
+      hasPassword: !!user.passwordHash,
+      passwordUpdatedAt: user.passwordUpdatedAt?.getTime() ?? null
+    } : null);
+  });
+  return found.success ? ok(found.data ? { ...found.data, accountExpiresAt: found.data.accountExpiresAt === null ? null : new Date(found.data.accountExpiresAt), passwordUpdatedAt: found.data.passwordUpdatedAt === null ? void 0 : new Date(found.data.passwordUpdatedAt), passwordHash: found.data.hasPassword ? "present" : void 0 } : null) : found;
+}
+var logger11 = core.logger.child({ module: "iam", scope: "seed" });
 var DEFAULT_ROLES = [
   { code: "admin", name: () => iamM("iam_seedRoleAdminName"), description: () => iamM("iam_seedRoleAdminDesc"), isSystem: true },
   { code: "user", name: () => iamM("iam_seedRoleUserName"), description: () => iamM("iam_seedRoleUserDesc"), isSystem: true },
@@ -4336,12 +4468,11 @@ var USER_ROLE_PERMISSIONS = ["dashboard:view", "profile:read"];
 async function seedIamData(authz) {
   try {
     const existingRoles = await authz.getAllRoles({ page: 1, pageSize: 1e3 });
+    if (!existingRoles.success)
+      return existingRoles;
     const existingRoleMap = /* @__PURE__ */ new Map();
-    if (existingRoles.success) {
-      for (const role of existingRoles.data.items) {
-        existingRoleMap.set(role.code, role.id);
-      }
-    }
+    for (const role of existingRoles.data.items)
+      existingRoleMap.set(role.code, role.id);
     const roleMap = /* @__PURE__ */ new Map();
     for (const role of DEFAULT_ROLES) {
       const existingId = existingRoleMap.get(role.code);
@@ -4352,17 +4483,23 @@ async function seedIamData(authz) {
       const result = await authz.createRole({ code: role.code, name: role.name(), description: role.description(), isSystem: role.isSystem });
       if (result.success) {
         roleMap.set(role.code, result.data.id);
+      } else if (result.error.code === HaiIamError.ROLE_ALREADY_EXISTS.code) {
+        const concurrent = await authz.getRoleByCode(role.code);
+        if (!concurrent.success)
+          return concurrent;
+        if (!concurrent.data)
+          return result;
+        roleMap.set(role.code, concurrent.data.id);
       } else {
         return result;
       }
     }
     const existingPerms = await authz.getAllPermissions({ page: 1, pageSize: 1e3 });
+    if (!existingPerms.success)
+      return existingPerms;
     const existingPermMap = /* @__PURE__ */ new Map();
-    if (existingPerms.success) {
-      for (const perm of existingPerms.data.items) {
-        existingPermMap.set(perm.code, perm.id);
-      }
-    }
+    for (const perm of existingPerms.data.items)
+      existingPermMap.set(perm.code, perm.id);
     const permMap = /* @__PURE__ */ new Map();
     for (const perm of DEFAULT_PERMISSIONS) {
       const existingId = existingPermMap.get(perm.code);
@@ -4373,6 +4510,13 @@ async function seedIamData(authz) {
       const result = await authz.createPermission({ code: perm.code, name: perm.name(), type: perm.type, resource: perm.resource, action: perm.action });
       if (result.success) {
         permMap.set(perm.code, result.data.id);
+      } else if (result.error.code === HaiIamError.PERMISSION_ALREADY_EXISTS.code) {
+        const concurrent = await authz.getPermissionByCode(perm.code);
+        if (!concurrent.success)
+          return concurrent;
+        if (!concurrent.data)
+          return result;
+        permMap.set(perm.code, concurrent.data.id);
       } else {
         return result;
       }
@@ -4380,7 +4524,9 @@ async function seedIamData(authz) {
     const adminRoleId = roleMap.get("admin");
     if (adminRoleId) {
       for (const [, permId] of permMap) {
-        await authz.assignPermissionToRole(adminRoleId, permId);
+        const assigned = await authz.assignPermissionToRole(adminRoleId, permId);
+        if (!assigned.success)
+          return assigned;
       }
     }
     const userRoleId = roleMap.get("user");
@@ -4388,14 +4534,16 @@ async function seedIamData(authz) {
       for (const permCode of USER_ROLE_PERMISSIONS) {
         const permId = permMap.get(permCode);
         if (permId) {
-          await authz.assignPermissionToRole(userRoleId, permId);
+          const assigned = await authz.assignPermissionToRole(userRoleId, permId);
+          if (!assigned.success)
+            return assigned;
         }
       }
     }
-    logger10.info("IAM seed data initialized");
+    logger11.info("IAM seed data initialized");
     return ok(void 0);
   } catch (error) {
-    logger10.error("Failed to seed IAM data", { error });
+    logger11.error("Failed to seed IAM data", { error });
     return err(
       HaiIamError.REPOSITORY_ERROR,
       iamM("iam_initSeedDataFailed"),
@@ -4641,7 +4789,7 @@ function stripInternalSessionFields(session) {
   const hasExtraKeys = Object.keys(rest).length > 0;
   return { ...session, data: hasExtraKeys ? rest : void 0 };
 }
-var logger11 = core.logger.child({ module: "iam", scope: "session" });
+var logger12 = core.logger.child({ module: "iam", scope: "session" });
 async function createSessionOperations(deps) {
   try {
     const { config } = deps;
@@ -4659,10 +4807,10 @@ async function createSessionOperations(deps) {
       sessionRepository,
       apiKeyRepository: config.login.apikey ? await createDbApiKeyRepository() : void 0
     });
-    logger11.info("Session sub-feature initialized");
+    logger12.info("Session sub-feature initialized");
     return ok(functions);
   } catch (error) {
-    logger11.error("Session sub-feature initialization failed", { error });
+    logger12.error("Session sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -4697,7 +4845,7 @@ function buildSessionFunctions(config) {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       if (typeof current.data.version !== "string" || expected !== void 0 && current.data.version !== expected)
         return err(HaiIamError.SESSION_INVALID, iamM("iam_sessionExpired"));
-      return ok(current.data.version);
+      return ok(current.data);
     } catch {
       return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_sessionExpired"));
     }
@@ -4707,7 +4855,10 @@ function buildSessionFunctions(config) {
       return ok(session);
     if (!config.apiKeyRepository)
       return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
-    const found = await config.apiKeyRepository.findOneById(session.apiKeyId);
+    const found = await readIamCache(`apikey:${session.apiKeyId}`, async () => {
+      const row = await config.apiKeyRepository.findOneById(session.apiKeyId);
+      return row.success ? ok(row.data ? { userId: row.data.userId, enabled: row.data.enabled, expiresAt: row.data.expiresAt?.getTime() ?? null, scopes: row.data.scopes } : null) : row;
+    });
     if (!found.success)
       return found;
     const key = found.data;
@@ -4715,7 +4866,7 @@ function buildSessionFunctions(config) {
       return err(HaiIamError.APIKEY_INVALID, iamM("iam_apikeyInvalid"));
     if (!key.enabled)
       return err(HaiIamError.APIKEY_DISABLED, iamM("iam_apikeyDisabled"));
-    if (key.expiresAt && /* @__PURE__ */ new Date() >= key.expiresAt)
+    if (key.expiresAt && Date.now() >= key.expiresAt)
       return err(HaiIamError.APIKEY_EXPIRED, iamM("iam_apikeyExpired"));
     return ok(applyApiKeyScopes({ ...session, apiKeyScopes: key.scopes }, key.scopes));
   }
@@ -4725,7 +4876,7 @@ function buildSessionFunctions(config) {
         const bound = await credential(options.userId, options.expectedCredentialVersion);
         if (!bound.success)
           return bound;
-        const built = candidate(options, bound.data);
+        const built = candidate(options, bound.data.version);
         if (!built.success)
           return built;
         const { session, tokens } = built.data;
@@ -4733,7 +4884,7 @@ function buildSessionFunctions(config) {
         if (!saveResult.success) {
           return saveResult;
         }
-        logger11.debug("Session created", { userId: options.userId });
+        logger12.debug("Session created", { userId: options.userId });
         return ok(session);
       } catch (error) {
         return err(
@@ -4764,7 +4915,7 @@ function buildSessionFunctions(config) {
       const bound = await credential(session.userId, session.credentialVersion);
       if (!bound.success)
         return bound;
-      const validated = await validateApiKey(session);
+      const validated = await validateApiKey({ ...session, ...bound.data.profile });
       if (!validated.success)
         return validated;
       let output = validated.data;
@@ -4794,7 +4945,7 @@ function buildSessionFunctions(config) {
       return repo.updateByAccessToken(accessToken, data, expectedVersion);
     },
     async delete(accessToken) {
-      logger11.debug("Session delete requested");
+      logger12.debug("Session delete requested");
       return repo.removeByAccessToken(accessToken);
     },
     async deleteByUserId(userId) {
@@ -4848,7 +4999,7 @@ function buildSessionFunctions(config) {
         const current = await credential(oldSession.userId, oldSession.credentialVersion);
         if (!current.success)
           return current;
-        logger11.debug("Token refreshed", { userId: oldSession.userId });
+        logger12.debug("Token refreshed", { userId: oldSession.userId });
         return ok(next.data.tokens);
       } catch (error) {
         return err(
@@ -4866,7 +5017,7 @@ function buildSessionFunctions(config) {
     }
   };
 }
-var logger12 = core.logger.child({ module: "iam", scope: "user" });
+var logger13 = core.logger.child({ module: "iam", scope: "user" });
 var USER_SORT_COLUMNS = {
   /** 用户名列。 */
   username: "username",
@@ -4891,10 +5042,10 @@ async function createUserOperations(deps) {
       config,
       onPasswordResetRequest
     });
-    logger12.info("User sub-feature initialized");
+    logger13.info("User sub-feature initialized");
     return ok(functions);
   } catch (error) {
-    logger12.error("User sub-feature initialization failed", { error });
+    logger13.error("User sub-feature initialization failed", { error });
     return err(
       HaiIamError.CONFIG_ERROR,
       iamM("iam_initComponentFailed"),
@@ -5063,7 +5214,7 @@ function buildRegistrationOps(ctx) {
       await userRepository.deleteById(createdUser.id);
       return assigned;
     }
-    logger12.info("User registered", { userId: createdUser.id, username: options.username });
+    logger13.info("User registered", { userId: createdUser.id, username: options.username });
     return ok({
       user: toUser(createdUser),
       agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnRegister)
@@ -5312,7 +5463,7 @@ function buildUserMutationOps(ctx) {
       if (tx) {
         const revoked = await sessionFunctions.deleteByUserId(userId);
         if (!revoked.success)
-          logger12.warn("Account credentials revoked; session cache cleanup failed", { userId, error: revoked.error });
+          logger13.warn("Account credentials revoked; session cache cleanup failed", { userId, error: revoked.error });
       }
       const updatedResult = await userRepository.findById(userId);
       if (!updatedResult.success) {
@@ -5327,7 +5478,7 @@ function buildUserMutationOps(ctx) {
       return ok(toUser(updatedResult.data));
     },
     async deleteUser(userId) {
-      logger12.debug("Deleting user", { userId });
+      logger13.debug("Deleting user", { userId });
       const userResult = await userRepository.findById(userId);
       if (!userResult.success) {
         return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
@@ -5367,7 +5518,7 @@ function buildUserMutationOps(ctx) {
         );
       }
       await sessionFunctions.deleteByUserId(userId);
-      logger12.info("User deleted", { userId });
+      logger13.info("User deleted", { userId });
       return ok(void 0);
     }
   };
@@ -5377,7 +5528,7 @@ function buildPasswordChangeOps(ctx) {
   const { hashPassword } = ctx;
   return {
     async adminResetPassword(userId, newPassword) {
-      logger12.debug("Admin resetting user password", { userId });
+      logger13.debug("Admin resetting user password", { userId });
       const userResult = await userRepository.findById(userId);
       if (!userResult.success) {
         return mapRepositoryError("iam_queryUserFailed", userResult.error.message);
@@ -5402,7 +5553,7 @@ function buildPasswordChangeOps(ctx) {
       const revoked = await sessionFunctions.deleteByUserId(userId);
       if (!revoked.success)
         return revoked;
-      logger12.info("Admin reset password", { userId });
+      logger13.info("Admin reset password", { userId });
       return ok(void 0);
     },
     async changePassword(userId, oldPassword, newPassword) {
@@ -5456,7 +5607,7 @@ function buildPasswordChangeOps(ctx) {
       const revoked = await sessionFunctions.deleteByUserId(userId);
       if (!revoked.success)
         return revoked;
-      logger12.info("Password changed", { userId });
+      logger13.info("Password changed", { userId });
       return ok(void 0);
     },
     /**
@@ -5494,10 +5645,10 @@ async function issuePasswordReset(ctx, stored) {
   try {
     await onPasswordResetRequest(user, token, { expiresAt, idempotencyKey: `iam-reset:${tokenHash.data}` });
   } catch {
-    logger12.error("Password reset callback failed", { userId: user.id });
+    logger13.error("Password reset callback failed", { userId: user.id });
     return err(HaiIamError.INTERNAL_ERROR, iamM("iam_notificationDeliveryUnknown"));
   }
-  logger12.info("Password reset token generated", { userId: user.id });
+  logger13.info("Password reset token generated", { userId: user.id });
   return ok(void 0);
 }
 function buildPasswordResetOps(ctx) {
@@ -5508,17 +5659,17 @@ function buildPasswordResetOps(ctx) {
       const captcha = await verifyIamCaptcha(ctx.config.captcha, "passwordReset", options?.captcha);
       if (!captcha.success)
         return captcha;
-      logger12.debug("Password reset requested", { identifier });
+      logger13.debug("Password reset requested", { identifier });
       const resetConfig = ctx.resetConfig;
       if (!resetConfig.enabled || !onPasswordResetRequest)
         return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
       const userResult = await userRepository.findByIdentifier(identifier);
       if (!userResult.success) {
-        logger12.warn("Failed to look up user for password reset", { identifier });
+        logger13.warn("Failed to look up user for password reset", { identifier });
         return ok(void 0);
       }
       if (!userResult.data) {
-        logger12.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
+        logger13.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
         return ok(void 0);
       }
       const user = toUser(userResult.data);
@@ -5527,7 +5678,7 @@ function buildPasswordResetOps(ctx) {
       return issuePasswordReset(ctx, userResult.data);
     },
     async confirmPasswordReset(token, newPassword) {
-      logger12.debug("Confirming password reset");
+      logger13.debug("Confirming password reset");
       const resetConfig = ctx.resetConfig;
       if (!resetConfig.enabled)
         return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
@@ -5551,7 +5702,7 @@ function buildPasswordResetOps(ctx) {
       const revoked = await sessionFunctions.deleteByUserId(claimed.data.id);
       if (!revoked.success)
         return revoked;
-      logger12.info("Password reset confirmed", { userId: claimed.data.id });
+      logger13.info("Password reset confirmed", { userId: claimed.data.id });
       return ok(void 0);
     }
   };
@@ -5616,7 +5767,7 @@ function buildUserFunctions(deps) {
 }
 
 // src/iam-main.ts
-var logger13 = core.logger.child({ module: "iam", scope: "main" });
+var logger14 = core.logger.child({ module: "iam", scope: "main" });
 var initInProgress = false;
 var currentConfig = null;
 var currentPublicConfig = null;
@@ -5647,7 +5798,7 @@ var notInitializedUser = new Proxy({}, {
 var iam = {
   async init(config) {
     if (initInProgress) {
-      logger13.warn("IAM init already in progress, skipping concurrent call");
+      logger14.warn("IAM init already in progress, skipping concurrent call");
       return err(
         HaiIamError.CONFIG_ERROR,
         iamM("iam_initInProgress")
@@ -5656,11 +5807,11 @@ var iam = {
     initInProgress = true;
     try {
       if (currentConfig !== null) {
-        logger13.warn("IAM module is already initialized, reinitializing");
+        logger14.warn("IAM module is already initialized, reinitializing");
         await iam.close();
       }
       const { ldapClientFactory, ldapSyncUser } = config;
-      logger13.info("Initializing IAM module");
+      logger14.info("Initializing IAM module");
       if (!reldb.isInitialized) {
         return err(
           HaiIamError.CONFIG_ERROR,
@@ -5685,7 +5836,7 @@ var iam = {
       }
       const parseResult = IamConfigSchema.safeParse(config);
       if (!parseResult.success) {
-        logger13.error("IAM config validation failed", { error: parseResult.error.message });
+        logger14.error("IAM config validation failed", { error: parseResult.error.message });
         return err(
           HaiIamError.CONFIG_ERROR,
           iamM("iam_configError", { params: { error: parseResult.error.message } }),
@@ -5694,7 +5845,7 @@ var iam = {
       }
       const parsed = parseResult.data;
       const { onPasswordResetRequest, onOtpSendEmail, onOtpSendSms } = await resolveIamNotifications(config);
-      logger13.info("IAM notification channels resolved", { email: Boolean(onOtpSendEmail), sms: Boolean(onOtpSendSms), passwordReset: Boolean(onPasswordResetRequest) });
+      logger14.info("IAM notification channels resolved", { email: Boolean(onOtpSendEmail), sms: Boolean(onOtpSendSms), passwordReset: Boolean(onPasswordResetRequest) });
       const migration = await migrateIam();
       if (!migration.success)
         return migration;
@@ -5702,7 +5853,7 @@ var iam = {
       const sessionResult = await createSessionOperations({
         config: parsed,
         readCredential: async (userId) => {
-          const found = await credentialUsers.findById(userId);
+          const found = await readIamUserSecurity(credentialUsers, userId);
           if (!found.success)
             return found;
           if (found.data) {
@@ -5710,7 +5861,7 @@ var iam = {
             if (!passwordState.success)
               return passwordState;
           }
-          return ok(found.data ? { version: found.data.credentialVersion ?? "", enabled: isUserActive(found.data) } : null);
+          return ok(found.data ? { version: found.data.credentialVersion ?? "", enabled: isUserActive(found.data), profile: { username: found.data.username, displayName: found.data.displayName, avatarUrl: found.data.avatarUrl } } : null);
         }
       });
       if (!sessionResult.success) {
@@ -5775,19 +5926,19 @@ var iam = {
             return;
           accountScanRunning = users.scanInactiveAccounts().then((result) => {
             if (!result.success)
-              logger13.error("Inactive account scan failed", { error: result.error });
+              logger14.error("Inactive account scan failed", { error: result.error });
           }).catch((error) => {
-            logger13.error("Inactive account scan failed", { error });
+            logger14.error("Inactive account scan failed", { error });
           }).finally(() => {
             accountScanRunning = void 0;
           });
         }, (parsed.accounts?.scanIntervalSeconds ?? 3600) * 1e3);
         accountScanTimer.unref();
       }
-      logger13.info("IAM module initialized");
+      logger14.info("IAM module initialized");
       return ok(void 0);
     } catch (error) {
-      logger13.error("IAM module initialization failed", { error });
+      logger14.error("IAM module initialization failed", { error });
       return err(
         HaiIamError.CONFIG_ERROR,
         iamM("iam_initFailed"),
@@ -5841,10 +5992,10 @@ var iam = {
   },
   async close() {
     if (currentConfig === null && currentAuth === null && currentUser === null && currentAuthz === null && currentSession === null) {
-      logger13.info("IAM module already closed, skipping");
+      logger14.info("IAM module already closed, skipping");
       return;
     }
-    logger13.info("Closing IAM module");
+    logger14.info("Closing IAM module");
     clearInterval(accountScanTimer);
     accountScanTimer = void 0;
     await accountScanRunning;
@@ -5861,7 +6012,7 @@ var iam = {
     resetUserRepoSingleton();
     resetRoleRepoSingleton();
     resetPermissionRepoSingleton();
-    logger13.info("IAM module closed");
+    logger14.info("IAM module closed");
   }
 };