@h-ai/iam 0.1.0-alpha8 → 0.1.0-alpha9

package/dist/index.d.ts

@@ -331,7 +331,6 @@ interface ApiKeyOperations {
 /**
  * @h-ai/iam — 授权子功能类型定义（RBAC）
  *
- * @h-ai/iam — 授权子功能类型定义（RBAC）
  * @module iam-authz-types
  */
 
@@ -1250,7 +1249,7 @@ declare const HaiIamError: {
     readonly PASSWORD_EXPIRED: _h_ai_core.HaiErrorDef;
     readonly PASSWORD_POLICY_VIOLATION: _h_ai_core.HaiErrorDef;
     readonly OTP_INVALID: _h_ai_core.HaiErrorDef;
-    readonly OTP_EXPIRED: _h_ai_core.HaiErrorDef;
+    readonly NOT_INITIALIZED: _h_ai_core.HaiErrorDef;
     readonly OTP_RESEND_TOO_FAST: _h_ai_core.HaiErrorDef;
     readonly LOGIN_DISABLED: _h_ai_core.HaiErrorDef;
     readonly REGISTER_DISABLED: _h_ai_core.HaiErrorDef;
@@ -1262,6 +1261,7 @@ declare const HaiIamError: {
     readonly RESET_TOKEN_INVALID: _h_ai_core.HaiErrorDef;
     readonly RESET_TOKEN_EXPIRED: _h_ai_core.HaiErrorDef;
     readonly RESET_TOKEN_MAX_ATTEMPTS: _h_ai_core.HaiErrorDef;
+    readonly OTP_EXPIRED: _h_ai_core.HaiErrorDef;
     readonly SESSION_NOT_FOUND: _h_ai_core.HaiErrorDef;
     readonly SESSION_EXPIRED: _h_ai_core.HaiErrorDef;
     readonly SESSION_INVALID: _h_ai_core.HaiErrorDef;
@@ -1283,7 +1283,6 @@ declare const HaiIamError: {
     readonly FORBIDDEN: _h_ai_core.HaiErrorDef;
     readonly INVALID_ARGUMENT: _h_ai_core.HaiErrorDef;
     readonly CONFIG_ERROR: _h_ai_core.HaiErrorDef;
-    readonly NOT_INITIALIZED: _h_ai_core.HaiErrorDef;
     readonly INTERNAL_ERROR: _h_ai_core.HaiErrorDef;
 };
 /**

package/dist/index.js

@@ -540,7 +540,7 @@ var IamErrorInfo = {
   PASSWORD_EXPIRED: "007:401",
   PASSWORD_POLICY_VIOLATION: "008:400",
   OTP_INVALID: "009:400",
-  OTP_EXPIRED: "010:400",
+  NOT_INITIALIZED: "010:500",
   OTP_RESEND_TOO_FAST: "011:429",
   LOGIN_DISABLED: "012:400",
   REGISTER_DISABLED: "013:403",
@@ -552,6 +552,7 @@ var IamErrorInfo = {
   RESET_TOKEN_INVALID: "019:400",
   RESET_TOKEN_EXPIRED: "020:400",
   RESET_TOKEN_MAX_ATTEMPTS: "021:429",
+  OTP_EXPIRED: "022:400",
   SESSION_NOT_FOUND: "101:401",
   SESSION_EXPIRED: "102:401",
   SESSION_INVALID: "103:401",
@@ -573,7 +574,6 @@ var IamErrorInfo = {
   FORBIDDEN: "501:403",
   INVALID_ARGUMENT: "502:400",
   CONFIG_ERROR: "901:500",
-  NOT_INITIALIZED: "910:500",
   INTERNAL_ERROR: "999:500"
 };
 var HaiIamError = core.error.buildHaiErrorsDef("iam", IamErrorInfo);
@@ -3048,9 +3048,9 @@ function createRbacManager(config) {
         if (ownTx) {
           const affectedUsersResult = await userRoleRepository.getUserIdsByRoleId(roleId);
           if (affectedUsersResult.success) {
-            for (const userId of affectedUsersResult.data) {
-              await syncUserSessionAfterRoleChange(userId);
-            }
+            await Promise.allSettled(
+              affectedUsersResult.data.map((userId) => syncUserSessionAfterRoleChange(userId))
+            );
           } else {
             logger6.error("Failed to query affected users after updateRole", { roleId, error: affectedUsersResult.error.message });
           }
@@ -3123,9 +3123,9 @@ function createRbacManager(config) {
         );
       }
       if (ownTx) {
-        for (const userId of affectedUserIds) {
-          await syncUserSessionAfterRoleChange(userId);
-        }
+        await Promise.allSettled(
+          affectedUserIds.map((userId) => syncUserSessionAfterRoleChange(userId))
+        );
       }
       superAdminRoleId = void 0;
       logger6.info("Role deleted", { roleId });
@@ -3275,9 +3275,9 @@ function createRbacManager(config) {
         );
       }
       if (ownTx) {
-        for (const roleId of affectedRoleIds) {
-          await syncSessionPermissionsForRole(roleId);
-        }
+        await Promise.allSettled(
+          affectedRoleIds.map((roleId) => syncSessionPermissionsForRole(roleId))
+        );
       }
       logger6.info("Permission deleted", { permissionId });
       void audit.helper.crud({ action: "delete", resource: "iam_permission", resourceId: permissionId });
@@ -3668,28 +3668,38 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
           tokensResult.error
         );
       }
+      const tokens = tokensResult.data;
+      const readResults = await Promise.allSettled(
+        tokens.map(async (token) => {
+          const sessionKey = buildTokenKey(token);
+          const [sessionResult, ttlResult] = await Promise.all([
+            cache.kv.get(sessionKey),
+            cache.kv.ttl(sessionKey)
+          ]);
+          return { token, sessionKey, sessionResult, ttlResult };
+        })
+      );
       const staleTokens = [];
-      for (const token of tokensResult.data) {
-        const sessionKey = buildTokenKey(token);
-        const sessionResult = await cache.kv.get(sessionKey);
-        if (!sessionResult.success || !sessionResult.data) {
-          staleTokens.push(token);
+      const writeOps = [];
+      for (const entry of readResults) {
+        if (entry.status === "rejected")
           continue;
-        }
-        const ttlResult = await cache.kv.ttl(sessionKey);
-        if (!ttlResult.success || ttlResult.data <= 0) {
+        const { token, sessionKey, sessionResult, ttlResult } = entry.value;
+        if (!sessionResult.success || !sessionResult.data || !ttlResult.success || ttlResult.data <= 0) {
           staleTokens.push(token);
           continue;
         }
         const updated = { ...sessionResult.data, ...updates };
-        const setResult = await cache.kv.set(sessionKey, updated, { ex: ttlResult.data });
-        if (!setResult.success) {
-          return err(
-            HaiIamError.REPOSITORY_ERROR,
-            iamM("iam_saveUserSessionCacheFailed", { params: { message: setResult.error.message } }),
-            setResult.error
-          );
-        }
+        writeOps.push(cache.kv.set(sessionKey, updated, { ex: ttlResult.data }));
+      }
+      const writeResults = await Promise.allSettled(writeOps);
+      const failedWrite = writeResults.find((r) => r.status === "fulfilled" && !r.value.success);
+      if (failedWrite) {
+        const failedResult = failedWrite.value;
+        return err(
+          HaiIamError.REPOSITORY_ERROR,
+          iamM("iam_saveUserSessionCacheFailed", { params: { message: failedResult.error.message } })
+        );
       }
       if (staleTokens.length > 0) {
         await cache.set_.srem(buildUserTokensKey(userId), ...staleTokens);
@@ -4499,7 +4509,7 @@ function buildPasswordResetOps(ctx) {
         return ok(void 0);
       }
       const user = toUser(userResult.data);
-      const token = globalThis.crypto.randomUUID();
+      const token = generateToken();
       const expiresAt = new Date(Date.now() + resetConfig.tokenExpiresIn * 1e3);
       const saveResult = await resetTokenRepository.saveToken(token, user.id, expiresAt);
       if (!saveResult.success) {