@h-ai/iam 1.0.0-beta.21 → 1.0.0-beta.23

package/README.en.md

@@ -1090,7 +1090,7 @@ When these deadlines are disabled, access and refresh retain their independent l
 
 ### Schema and credential notifications
 
-After RelDB initialization, `migrateIam({ dryRun: true })` previews persistence preparation without writes. iam.init prepares persistence and credential/reset fields while retaining users, passwords and permissions. Back up and stop conflicting writes before structural changes. Sessions must match the current credential generation; mismatches require login, never lowering the stored generation. Default Reach notifications use sensitive/expiresAt/idempotencyKey without plaintext persistence or delayed replay. Custom callbacks must enforce the same expiry and credential protection.
+Initialize RelDB before `iam.init()`. IAM creates and validates the required tables and fails initialization if their structure is incompatible. Sessions must match the current credential generation. A mismatch requires signing in again. Default Reach notifications use `sensitive`, `expiresAt` and `idempotencyKey`, without persisting credentials or scheduling delayed delivery. Custom callbacks must enforce the same expiry and credential protection.
 
 When audit is initialized and capture.enabled is on, IAM records important account, authentication, password, authorization, API Key and session events, including failed/denied outcomes and safe reason codes. Initialize audit before IAM and close in reverse order. Passwords, one-time proofs and tokens are never copied into events. Only successful login establishes an actor; trusted service/CLI callers supply actor/correlation through audit.withContext. Events inside an external authorization transaction commit or roll back with that transaction; record failed attempts after rollback at the caller boundary. Audit failures emit diagnostics without converting an applied business result into an unsafe retry.
 

package/README.ja.md

@@ -1082,7 +1082,7 @@ RBAC 権限は `sensitiveOperations: string[]` を持ち、可空 JSON 列 `sens
 
 ### スキーマと認証情報の通知
 
-RelDB 初期化後の `migrateIam({ dryRun: true })` は読み取り専用です。iam.init は永続構造と認証・リセット項目を準備し、利用者・パスワード・権限を保持します。構造変更前に競合書込を停止しバックアップしてください。セッションは現在の資格世代と一致する必要があり、不一致なら再ログインします。認可復元のため世代を戻してはいけません。既定 Reach 通知は sensitive/expiresAt/idempotencyKey で平文保存や遅延再送を防ぎます。独自コールバックも同じ期限と保護を守ってください。
+RelDB の初期化後に `iam.init()` を呼び出します。IAM は必要なテーブルを作成・検証し、構造が一致しない場合は初期化に失敗します。セッションの資格世代が現在の世代と一致しない場合は再ログインが必要です。既定の Reach 通知は `sensitive`、`expiresAt`、`idempotencyKey` を使用し、資格情報本文を保存したり遅延配信したりしません。独自コールバックも同じ期限と資格情報保護を守ってください。
 
 audit が初期化済みで capture.enabled が有効なら、IAM はアカウント・認証・パスワード・権限・API Key・セッションの重要イベントと失敗/拒否の安全な理由コードを記録します。audit を IAM より先に初期化し、逆順に終了してください。パスワード・単回証明・トークンは記録しません。ログイン成功後に主体を確定し、信頼できるサービス/CLI は audit.withContext で操作者と関連文脈を設定します。外部権限トランザクション内のイベントは一緒にコミット/ロールバックされ、失敗試行はロールバック後に呼出境界で記録します。監査失敗は診断を出し、反映済み業務を危険な再試行に変えません。
 

package/README.md

@@ -1095,7 +1095,7 @@ RBAC 权限支持 `sensitiveOperations: string[]`（持久字段 `sensitive_oper
 
 ### 持久结构与凭据通知
 
-`migrateIam({ dryRun: true })` 在 RelDB 初始化后只读预检；iam.init 准备模块持久结构和凭据/重置字段，保留用户、密码与业务权限。结构变更前备份并停止冲突写入；会话必须匹配当前安全代际，不匹配时重新登录，不能降低数据库安全代际来恢复授权。默认 Reach 通知使用 sensitive/expiresAt/idempotencyKey，不落明文、不延迟重投；自定义回调同样须遵守有效期与凭据保护。
+先初始化 RelDB，再调用 `iam.init()`。IAM 会创建并校验所需表，结构不符时返回初始化失败。会话必须匹配当前凭据代次，不匹配时需重新登录。默认 Reach 通知使用 `sensitive`、`expiresAt` 和 `idempotencyKey`，不保存凭据正文或延迟重投。自定义回调也须遵守有效期与凭据保护要求。
 
 审计模块已初始化且 capture.enabled 开启时，IAM 自动记录关键账号、鉴别、密码、授权、API Key 和会话事件，包含失败/拒绝与安全原因码。先初始化 audit 再初始化 IAM，关闭时反序。不会记录密码、一次性票据或令牌；成功登录才确认主体，可信服务/CLI 调用应以 audit.withContext 提供操作者和关联信息。外部授权事务的事件随该事务提交或回滚，回滚失败尝试由调用入口在事务结束后记录。审计写失败输出诊断，不把已生效业务改成可盲目重试的失败。
 

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 import { IamFunctions } from './browser.js';
 export { AccountConfigSchema, AgreementConfig, AgreementConfigSchema, AgreementDisplay, ApiKey, ApiKeyConfig, ApiKeyConfigSchema, ApiKeyCredentials, ApiKeyOperations, ApiKeySortDirection, ApiKeySortField, AuthRequestContext, AuthResult, AuthStrategy, AuthStrategyType, AuthStrategyTypeSchema, AuthUiConfig, AuthUiConfigSchema, AuthnOperations, AuthzOperations, CaptchaConfigSchema, CaptchaOperation, ConsumeTicketOptions, ConsumedTicket, CreateApiKeyOptions, CreateApiKeyResult, CreateSessionOptions, Credentials, HaiIamError, IamCaptchaChallenge, IamConfig, IamConfigInput, IamConfigSchema, IamConfigSettingsInput, IamNotificationContext, IamPublicConfig, IssueTicketOptions, IssuedTicket, LdapClientFactory, LdapConfig, LdapConfigSchema, LdapCredentials, ListApiKeysOptions, ListUsersOptions, LoginAccessConfigSchema, LoginConfig, LoginConfigSchema, OtpConfig, OtpConfigSchema, OtpCredentials, PasswordConfig, PasswordConfigSchema, PasswordCredentials, PasswordResetConfig, PasswordResetConfigSchema, Permission, PermissionQueryOptions, PermissionType, RbacConfig, RbacConfigSchema, RegisterConfig, RegisterConfigSchema, RegisterOptions, RegisterResult, Role, SecurityConfig, SecurityConfigSchema, Session, SessionConfig, SessionConfigSchema, SessionData, SessionFieldUpdates, SessionOperations, StoredUser, TicketGrant, TicketOperations, TokenPair, UpdateCurrentUserInput, User, UserOperations, UserSortDirection, UserSortField } from './browser.js';
-import * as _h_ai_core from '@h-ai/core';
-import * as _h_ai_reldb from '@h-ai/reldb';
 import 'zod';
+import '@h-ai/core';
 import '@h-ai/reach';
 import 'altcha/lib';
+import '@h-ai/reldb';
 
 /**
  * @h-ai/iam — IAM 服务主入口
@@ -30,16 +30,4 @@ import 'altcha/lib';
  */
 declare const iam: IamFunctions;
 
-/**
- * 预检或迁移 IAM 表。保留用户与密码；旧停用账号转休眠，删除 enabled，旧版 SDK 不可与新表混用。
- * @example
- * ```ts
- * import { migrateIam } from '@h-ai/iam'
- * const plan = await migrateIam({ dryRun: true }) // RelDB 已初始化；只读。
- * ```
- */
-declare function migrateIam(options?: {
-    dryRun?: boolean;
-}): Promise<_h_ai_core.HaiResult<_h_ai_reldb.SchemaMigrationPlan>>;
-
-export { IamFunctions, iam, migrateIam };
+export { IamFunctions, iam };

package/dist/index.js

@@ -1390,7 +1390,9 @@ async function createDbUserRepository() {
   if (userRepoInstance && userRepoSqlOps === reldb.sql)
     return userRepoInstance;
   const repo = new DbUserRepository();
-  await repo.count();
+  const ready = await repo.ready();
+  if (!ready.success)
+    throw ready.error;
   repo.create = guardIamMutation(repo.create.bind(repo), 1);
   repo.updateById = guardIamMutation(repo.updateById.bind(repo), 2);
   repo.deleteById = guardIamMutation(repo.deleteById.bind(repo), 1);
@@ -1408,6 +1410,9 @@ var DbUserRepository = class extends BaseReldbCrudRepository {
       fields: USER_FIELDS
     });
   }
+  ready() {
+    return this.ensureSchema();
+  }
   /** 数据库时钟在执行最终 SQL 时核验有效期，暂停进程不能复用旧的 Date.now()。 */
   databaseNow() {
     if (reldb.config?.type === "postgresql")
@@ -3073,7 +3078,9 @@ async function createDbPermissionRepository() {
   if (permRepoInstance && permRepoSqlOps === reldb.sql)
     return permRepoInstance;
   const repo = new DbPermissionRepository();
-  await repo.count();
+  const ready = await repo.ready();
+  if (!ready.success)
+    throw ready.error;
   permRepoInstance = repo;
   permRepoSqlOps = reldb.sql;
   return repo;
@@ -3113,6 +3120,9 @@ var DbPermissionRepository = class extends BaseReldbCrudRepository {
       fields: PERMISSION_FIELDS
     });
   }
+  ready() {
+    return this.ensureSchema();
+  }
   /** 根据权限代码查找权限 */
   async findByCode(code, tx) {
     return this.findOneBy("code = ?", [code], tx);
@@ -4738,123 +4748,6 @@ function observeApiKeys(operations) {
     revokeApiKey: (id) => observe(() => operations.revokeApiKey(id), { action: "apikey.revoke", resource: "iam.apikeys", resourceId: id })
   };
 }
-var columns = {
-  credential_version: "VARCHAR(255) NOT NULL DEFAULT ''",
-  reset_version: "VARCHAR(255) NOT NULL DEFAULT ''",
-  reset_hash: "TEXT",
-  reset_expires_at: "BIGINT",
-  reset_attempts: "INTEGER NOT NULL DEFAULT 0"
-};
-var accountColumns = {
-  account_type: "VARCHAR(16) NOT NULL DEFAULT 'permanent'",
-  account_status: "VARCHAR(16) NOT NULL DEFAULT 'active'",
-  account_expires_at: "TIMESTAMP",
-  last_login_at: "TIMESTAMP"
-};
-var steps = [
-  {
-    version: 1,
-    name: "credential-and-reset-versions",
-    async needed(sql) {
-      const found = await reldb.schemaColumns("hai_iam_users", sql);
-      return found.success ? ok(found.data.length > 0 && Object.keys(columns).some((name) => !found.data.includes(name))) : found;
-    },
-    async apply(sql) {
-      const found = await reldb.schemaColumns("hai_iam_users", sql);
-      if (!found.success)
-        return found;
-      for (const [name, definition] of Object.entries(columns)) {
-        if (found.data.includes(name))
-          continue;
-        const added = await sql.execute(`ALTER TABLE hai_iam_users ADD COLUMN ${name} ${definition}`);
-        if (!added.success)
-          return added;
-      }
-      return ok(void 0);
-    }
-  },
-  {
-    version: 2,
-    name: "account-lifecycle",
-    async needed(sql) {
-      const found = await reldb.schemaColumns("hai_iam_users", sql);
-      return found.success ? ok(found.data.length > 0 && Object.keys(accountColumns).some((name) => !found.data.includes(name))) : found;
-    },
-    async apply(sql) {
-      const found = await reldb.schemaColumns("hai_iam_users", sql);
-      if (!found.success)
-        return found;
-      for (const [name, definition] of Object.entries(accountColumns)) {
-        if (found.data.includes(name))
-          continue;
-        const added = await sql.execute(`ALTER TABLE hai_iam_users ADD COLUMN ${name} ${definition}`);
-        if (!added.success)
-          return added;
-      }
-      return ok(void 0);
-    }
-  },
-  {
-    version: 3,
-    name: "initial-password-state",
-    async needed(sql) {
-      const found = await reldb.schemaColumns("hai_iam_users", sql);
-      return found.success ? ok(found.data.length > 0 && !found.data.includes("must_change_password")) : found;
-    },
-    async apply(sql) {
-      const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN must_change_password BOOLEAN NOT NULL DEFAULT FALSE");
-      return added.success ? ok(void 0) : added;
-    }
-  },
-  {
-    version: 4,
-    name: "login-failure-window",
-    async needed(sql) {
-      const found = await reldb.schemaColumns("hai_iam_users", sql);
-      return found.success ? ok(found.data.length > 0 && !found.data.includes("first_login_failed_at")) : found;
-    },
-    async apply(sql) {
-      const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN first_login_failed_at TIMESTAMP");
-      return added.success ? ok(void 0) : added;
-    }
-  },
-  {
-    version: 5,
-    name: "permission-sensitive-operations",
-    async needed(sql) {
-      const found = await reldb.schemaColumns("hai_iam_permissions", sql);
-      return found.success ? ok(found.data.length > 0 && !found.data.includes("sensitive_operations")) : found;
-    },
-    async apply(sql) {
-      const added = await sql.execute("ALTER TABLE hai_iam_permissions ADD COLUMN sensitive_operations JSON");
-      return added.success ? ok(void 0) : added;
-    }
-  },
-  {
-    version: 6,
-    name: "account-lifecycle-only",
-    async needed(sql) {
-      const found = await reldb.schemaColumns("hai_iam_users", sql);
-      return found.success ? ok(found.data.includes("enabled")) : found;
-    },
-    async apply(sql) {
-      const converted = await sql.execute("UPDATE hai_iam_users SET account_status = ?, credential_version = ?, reset_version = ?, reset_hash = NULL, reset_expires_at = NULL WHERE (enabled = ? OR enabled IS NULL) AND account_status = ?", [
-        "dormant",
-        globalThis.crypto.randomUUID(),
-        globalThis.crypto.randomUUID(),
-        reldb.config?.type === "postgresql" ? false : 0,
-        "active"
-      ]);
-      if (!converted.success)
-        return converted;
-      const removed = await sql.execute("ALTER TABLE hai_iam_users DROP COLUMN enabled");
-      return removed.success ? ok(void 0) : removed;
-    }
-  }
-];
-function migrateIam(options = {}) {
-  return reldb.migrateSchema("iam", steps, options);
-}
 
 // src/iam-notifications.ts
 async function resolveIamNotifications(input) {
@@ -5990,7 +5883,7 @@ function buildRegistrationOps(ctx) {
       await userRepository.deleteById(createdUser.id);
       return assigned;
     }
-    logger13.info("User registered", { userId: createdUser.id, username: options.username });
+    logger13.info("User registered", { userId: createdUser.id });
     return ok({
       user: toUser(createdUser),
       agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnRegister)
@@ -6454,17 +6347,17 @@ function buildPasswordResetOps(ctx) {
       const captcha = await verifyIamCaptcha(ctx.config.captcha, "passwordReset", options?.captcha);
       if (!captcha.success)
         return captcha;
-      logger13.debug("Password reset requested", { identifier });
+      logger13.debug("Password reset requested");
       const resetConfig = ctx.resetConfig;
       if (!resetConfig.enabled || !onPasswordResetRequest)
         return err(HaiIamError.PASSWORD_RESET_DISABLED, iamM("iam_passwordResetDisabled"));
       const userResult = await userRepository.findByIdentifier(identifier);
       if (!userResult.success) {
-        logger13.warn("Failed to look up user for password reset", { identifier });
+        logger13.warn("Failed to look up user for password reset", { reasonCode: userResult.error.code });
         return ok(void 0);
       }
       if (!userResult.data) {
-        logger13.debug("User not found for password reset, returning ok to prevent enumeration", { identifier });
+        logger13.debug("User not found for password reset");
         return ok(void 0);
       }
       const user = toUser(userResult.data);
@@ -6658,9 +6551,6 @@ var iam = {
         sms: Boolean(onOtpSendSms),
         passwordReset: Boolean(onPasswordResetRequest)
       });
-      const migration = await migrateIam();
-      if (!migration.success)
-        return migration;
       const credentialUsers = await createDbUserRepository();
       const sessionResult = await createSessionOperations({
         config: parsed,
@@ -6848,6 +6738,6 @@ var iam = {
   }
 };
 
-export { iam, migrateIam };
+export { iam };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map