@h-ai/serv 0.1.0-alpha.72 → 0.1.0-alpha.73

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/README.en.md +14 -0
  2. package/README.ja.md +14 -0
  3. package/README.md +14 -0
  4. package/dist/{chunk-WW25756Z.js → chunk-IRZVJW4V.js} +3 -3
  5. package/dist/{chunk-WW25756Z.js.map → chunk-IRZVJW4V.js.map} +1 -1
  6. package/dist/{chunk-KR4H56KP.js → chunk-N6IOKLQY.js} +26 -4
  7. package/dist/chunk-N6IOKLQY.js.map +1 -0
  8. package/dist/features/ai.js +1 -1
  9. package/dist/features/feedback.js +1 -1
  10. package/dist/features/iam.d.ts +321 -1
  11. package/dist/features/iam.js +28 -9
  12. package/dist/features/iam.js.map +1 -1
  13. package/dist/features/storage.js +2 -2
  14. package/dist/index.js +44 -14
  15. package/dist/index.js.map +1 -1
  16. package/package.json +17 -15
  17. package/dist/chunk-KR4H56KP.js.map +0 -1
package/dist/features/iam.d.ts CHANGED
@@ -1,7 +1,7 @@
1
+ import * as _orpc_contract from '@orpc/contract';
1
2
  import * as _orpc_server from '@orpc/server';
2
3
  import * as zod_v4_core from 'zod/v4/core';
3
4
  import * as zod from 'zod';
4
- import * as _orpc_contract from '@orpc/contract';
5
5
  import { IamFunctions } from '@h-ai/iam';
6
6
  export { TokenPair } from '@h-ai/iam';
7
7
  import { S as ServContext } from '../serv-context-B-AxU8hj.js';
@@ -40,9 +40,82 @@ interface IamProcedureDeps {
40
40
  */
41
41
  declare function createIamProcedures(deps: IamProcedureDeps): {
42
42
  auth: {
43
+ createCaptcha: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
44
+ operation: zod.ZodEnum<{
45
+ login: "login";
46
+ register: "register";
47
+ sendOtp: "sendOtp";
48
+ passwordReset: "passwordReset";
49
+ renewPassword: "renewPassword";
50
+ }>;
51
+ }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
52
+ success: zod.ZodLiteral<true>;
53
+ data: zod.ZodObject<{
54
+ id: zod.ZodString;
55
+ challenge: zod.ZodObject<{
56
+ signature: zod.ZodOptional<zod.ZodString>;
57
+ parameters: zod.ZodObject<{
58
+ algorithm: zod.ZodString & zod.ZodType<"PBKDF2/SHA-256", string, zod_v4_core.$ZodTypeInternals<"PBKDF2/SHA-256", string>>;
59
+ nonce: zod.ZodString;
60
+ salt: zod.ZodString;
61
+ cost: zod.ZodNumber;
62
+ keyLength: zod.ZodNumber;
63
+ keyPrefix: zod.ZodString;
64
+ keySignature: zod.ZodOptional<zod.ZodString>;
65
+ data: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber, zod.ZodBoolean, zod.ZodNull]>>>;
66
+ }, zod_v4_core.$strip>;
67
+ }, zod_v4_core.$strip>;
68
+ }, zod_v4_core.$strip>;
69
+ }, zod_v4_core.$strip>, zod.ZodObject<{
70
+ success: zod.ZodLiteral<false>;
71
+ error: zod.ZodObject<{
72
+ code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
73
+ message: zod.ZodString;
74
+ traceId: zod.ZodOptional<zod.ZodString>;
75
+ httpStatus: zod.ZodOptional<zod.ZodNumber>;
76
+ system: zod.ZodOptional<zod.ZodString>;
77
+ module: zod.ZodOptional<zod.ZodString>;
78
+ cause: zod.ZodOptional<zod.ZodUnknown>;
79
+ suggestion: zod.ZodOptional<zod.ZodString>;
80
+ ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
81
+ }, zod_v4_core.$strip>;
82
+ }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
83
+ reauthenticate: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
84
+ password: zod.ZodString;
85
+ operation: zod.ZodString;
86
+ }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
87
+ success: zod.ZodLiteral<true>;
88
+ data: zod.ZodObject<{
89
+ ticket: zod.ZodString;
90
+ expiresAt: zod.ZodNumber;
91
+ }, zod_v4_core.$strip>;
92
+ }, zod_v4_core.$strip>, zod.ZodObject<{
93
+ success: zod.ZodLiteral<false>;
94
+ error: zod.ZodObject<{
95
+ code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
96
+ message: zod.ZodString;
97
+ traceId: zod.ZodOptional<zod.ZodString>;
98
+ httpStatus: zod.ZodOptional<zod.ZodNumber>;
99
+ system: zod.ZodOptional<zod.ZodString>;
100
+ module: zod.ZodOptional<zod.ZodString>;
101
+ cause: zod.ZodOptional<zod.ZodUnknown>;
102
+ suggestion: zod.ZodOptional<zod.ZodString>;
103
+ ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
104
+ }, zod_v4_core.$strip>;
105
+ }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
43
106
  publicConfig: _orpc_server.Procedure<ServContext & {}, any, _orpc_contract.Schema<unknown, unknown>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
44
107
  success: zod.ZodLiteral<true>;
45
108
  data: zod.ZodNullable<zod.ZodObject<{
109
+ captcha: zod.ZodDefault<zod.ZodObject<{
110
+ enabled: zod.ZodBoolean;
111
+ }, zod_v4_core.$strip>>;
112
+ reauthentication: zod.ZodOptional<zod.ZodObject<{
113
+ enabled: zod.ZodBoolean;
114
+ operations: zod.ZodArray<zod.ZodString>;
115
+ }, zod_v4_core.$strip>>;
116
+ initialCredentials: zod.ZodOptional<zod.ZodObject<{
117
+ enabled: zod.ZodBoolean;
118
+ }, zod_v4_core.$strip>>;
46
119
  password: zod.ZodObject<{
47
120
  minLength: zod.ZodNumber;
48
121
  maxLength: zod.ZodNumber;
@@ -51,6 +124,9 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
51
124
  requireNumber: zod.ZodBoolean;
52
125
  requireSpecialChar: zod.ZodBoolean;
53
126
  expirationDays: zod.ZodNumber;
127
+ minCharacterClasses: zod.ZodOptional<zod.ZodNumber>;
128
+ preventSamePassword: zod.ZodOptional<zod.ZodBoolean>;
129
+ requireInitialChange: zod.ZodOptional<zod.ZodBoolean>;
54
130
  }, zod_v4_core.$strip>;
55
131
  register: zod.ZodObject<{
56
132
  enabled: zod.ZodBoolean;
@@ -95,6 +171,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
95
171
  }, zod_v4_core.$strip>;
96
172
  session: zod.ZodObject<{
97
173
  maxAge: zod.ZodNumber;
174
+ endOnPageHide: zod.ZodDefault<zod.ZodBoolean>;
98
175
  }, zod_v4_core.$strip>;
99
176
  }, zod_v4_core.$strip>>;
100
177
  }, zod_v4_core.$strip>, zod.ZodObject<{
@@ -111,9 +188,32 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
111
188
  ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
112
189
  }, zod_v4_core.$strip>;
113
190
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
191
+ renewPassword: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
192
+ identifier: zod.ZodString;
193
+ password: zod.ZodString;
194
+ newPassword: zod.ZodString;
195
+ captcha: zod.ZodOptional<zod.ZodString>;
196
+ }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
197
+ success: zod.ZodLiteral<true>;
198
+ data: zod.ZodVoid;
199
+ }, zod_v4_core.$strip>, zod.ZodObject<{
200
+ success: zod.ZodLiteral<false>;
201
+ error: zod.ZodObject<{
202
+ code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
203
+ message: zod.ZodString;
204
+ traceId: zod.ZodOptional<zod.ZodString>;
205
+ httpStatus: zod.ZodOptional<zod.ZodNumber>;
206
+ system: zod.ZodOptional<zod.ZodString>;
207
+ module: zod.ZodOptional<zod.ZodString>;
208
+ cause: zod.ZodOptional<zod.ZodUnknown>;
209
+ suggestion: zod.ZodOptional<zod.ZodString>;
210
+ ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
211
+ }, zod_v4_core.$strip>;
212
+ }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
114
213
  loginWithLdap: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
115
214
  username: zod.ZodString;
116
215
  password: zod.ZodString;
216
+ captcha: zod.ZodOptional<zod.ZodString>;
117
217
  }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
118
218
  success: zod.ZodLiteral<true>;
119
219
  data: zod.ZodObject<{
@@ -125,6 +225,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
125
225
  displayName: zod.ZodOptional<zod.ZodString>;
126
226
  avatarUrl: zod.ZodOptional<zod.ZodString>;
127
227
  enabled: zod.ZodBoolean;
228
+ accountType: zod.ZodOptional<zod.ZodEnum<{
229
+ permanent: "permanent";
230
+ temporary: "temporary";
231
+ }>>;
232
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
233
+ active: "active";
234
+ dormant: "dormant";
235
+ closed: "closed";
236
+ }>>;
237
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
238
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
239
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
128
240
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
129
241
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
130
242
  createdAt: zod.ZodCoercedDate<unknown>;
@@ -164,6 +276,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
164
276
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
165
277
  requestPasswordReset: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
166
278
  identifier: zod.ZodString;
279
+ captcha: zod.ZodOptional<zod.ZodString>;
167
280
  }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
168
281
  success: zod.ZodLiteral<true>;
169
282
  data: zod.ZodVoid;
@@ -202,6 +315,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
202
315
  }, zod_v4_core.$strip>;
203
316
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
204
317
  login: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
318
+ captcha: zod.ZodOptional<zod.ZodString>;
205
319
  identifier: zod.ZodString;
206
320
  password: zod.ZodString;
207
321
  }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
@@ -215,6 +329,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
215
329
  displayName: zod.ZodOptional<zod.ZodString>;
216
330
  avatarUrl: zod.ZodOptional<zod.ZodString>;
217
331
  enabled: zod.ZodBoolean;
332
+ accountType: zod.ZodOptional<zod.ZodEnum<{
333
+ permanent: "permanent";
334
+ temporary: "temporary";
335
+ }>>;
336
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
337
+ active: "active";
338
+ dormant: "dormant";
339
+ closed: "closed";
340
+ }>>;
341
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
342
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
343
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
218
344
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
219
345
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
220
346
  createdAt: zod.ZodCoercedDate<unknown>;
@@ -253,6 +379,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
253
379
  }, zod_v4_core.$strip>;
254
380
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
255
381
  loginWithOtp: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
382
+ captcha: zod.ZodOptional<zod.ZodString>;
256
383
  identifier: zod.ZodString;
257
384
  code: zod.ZodString;
258
385
  }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
@@ -266,6 +393,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
266
393
  displayName: zod.ZodOptional<zod.ZodString>;
267
394
  avatarUrl: zod.ZodOptional<zod.ZodString>;
268
395
  enabled: zod.ZodBoolean;
396
+ accountType: zod.ZodOptional<zod.ZodEnum<{
397
+ permanent: "permanent";
398
+ temporary: "temporary";
399
+ }>>;
400
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
401
+ active: "active";
402
+ dormant: "dormant";
403
+ closed: "closed";
404
+ }>>;
405
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
406
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
407
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
269
408
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
270
409
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
271
410
  createdAt: zod.ZodCoercedDate<unknown>;
@@ -322,6 +461,25 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
322
461
  ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
323
462
  }, zod_v4_core.$strip>;
324
463
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
464
+ closeSession: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
465
+ accessToken: zod.ZodOptional<zod.ZodString>;
466
+ }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
467
+ success: zod.ZodLiteral<true>;
468
+ data: zod.ZodVoid;
469
+ }, zod_v4_core.$strip>, zod.ZodObject<{
470
+ success: zod.ZodLiteral<false>;
471
+ error: zod.ZodObject<{
472
+ code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
473
+ message: zod.ZodString;
474
+ traceId: zod.ZodOptional<zod.ZodString>;
475
+ httpStatus: zod.ZodOptional<zod.ZodNumber>;
476
+ system: zod.ZodOptional<zod.ZodString>;
477
+ module: zod.ZodOptional<zod.ZodString>;
478
+ cause: zod.ZodOptional<zod.ZodUnknown>;
479
+ suggestion: zod.ZodOptional<zod.ZodString>;
480
+ ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
481
+ }, zod_v4_core.$strip>;
482
+ }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
325
483
  currentUser: _orpc_server.Procedure<ServContext & {}, any, _orpc_contract.Schema<unknown, unknown>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
326
484
  success: zod.ZodLiteral<true>;
327
485
  data: zod.ZodObject<{
@@ -332,6 +490,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
332
490
  displayName: zod.ZodOptional<zod.ZodString>;
333
491
  avatarUrl: zod.ZodOptional<zod.ZodString>;
334
492
  enabled: zod.ZodBoolean;
493
+ accountType: zod.ZodOptional<zod.ZodEnum<{
494
+ permanent: "permanent";
495
+ temporary: "temporary";
496
+ }>>;
497
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
498
+ active: "active";
499
+ dormant: "dormant";
500
+ closed: "closed";
501
+ }>>;
502
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
503
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
504
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
335
505
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
336
506
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
337
507
  createdAt: zod.ZodCoercedDate<unknown>;
@@ -381,6 +551,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
381
551
  }, zod_v4_core.$strip>;
382
552
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
383
553
  sendOtp: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
554
+ captcha: zod.ZodOptional<zod.ZodString>;
384
555
  identifier: zod.ZodString;
385
556
  }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
386
557
  success: zod.ZodLiteral<true>;
@@ -402,6 +573,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
402
573
  }, zod_v4_core.$strip>;
403
574
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
404
575
  register: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
576
+ captcha: zod.ZodOptional<zod.ZodString>;
405
577
  username: zod.ZodString;
406
578
  password: zod.ZodString;
407
579
  email: zod.ZodOptional<zod.ZodString>;
@@ -419,6 +591,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
419
591
  displayName: zod.ZodOptional<zod.ZodString>;
420
592
  avatarUrl: zod.ZodOptional<zod.ZodString>;
421
593
  enabled: zod.ZodBoolean;
594
+ accountType: zod.ZodOptional<zod.ZodEnum<{
595
+ permanent: "permanent";
596
+ temporary: "temporary";
597
+ }>>;
598
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
599
+ active: "active";
600
+ dormant: "dormant";
601
+ closed: "closed";
602
+ }>>;
603
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
604
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
605
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
422
606
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
423
607
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
424
608
  createdAt: zod.ZodCoercedDate<unknown>;
@@ -493,6 +677,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
493
677
  displayName: zod.ZodOptional<zod.ZodString>;
494
678
  avatarUrl: zod.ZodOptional<zod.ZodString>;
495
679
  enabled: zod.ZodBoolean;
680
+ accountType: zod.ZodOptional<zod.ZodEnum<{
681
+ permanent: "permanent";
682
+ temporary: "temporary";
683
+ }>>;
684
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
685
+ active: "active";
686
+ dormant: "dormant";
687
+ closed: "closed";
688
+ }>>;
689
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
690
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
691
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
496
692
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
497
693
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
498
694
  createdAt: zod.ZodCoercedDate<unknown>;
@@ -515,6 +711,62 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
515
711
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
516
712
  };
517
713
  users: {
714
+ invite: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
715
+ metadata: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
716
+ email: zod.ZodOptional<zod.ZodString>;
717
+ username: zod.ZodString;
718
+ phone: zod.ZodOptional<zod.ZodString>;
719
+ displayName: zod.ZodOptional<zod.ZodString>;
720
+ accountType: zod.ZodOptional<zod.ZodEnum<{
721
+ permanent: "permanent";
722
+ temporary: "temporary";
723
+ }>>;
724
+ accountExpiresAt: zod.ZodOptional<zod.ZodCoercedDate<unknown>>;
725
+ roleIds: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
726
+ enabled: zod.ZodOptional<zod.ZodLiteral<true>>;
727
+ accountStatus: zod.ZodOptional<zod.ZodLiteral<"active">>;
728
+ }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
729
+ success: zod.ZodLiteral<true>;
730
+ data: zod.ZodObject<{
731
+ id: zod.ZodString;
732
+ username: zod.ZodString;
733
+ email: zod.ZodOptional<zod.ZodString>;
734
+ phone: zod.ZodOptional<zod.ZodString>;
735
+ displayName: zod.ZodOptional<zod.ZodString>;
736
+ avatarUrl: zod.ZodOptional<zod.ZodString>;
737
+ enabled: zod.ZodBoolean;
738
+ accountType: zod.ZodOptional<zod.ZodEnum<{
739
+ permanent: "permanent";
740
+ temporary: "temporary";
741
+ }>>;
742
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
743
+ active: "active";
744
+ dormant: "dormant";
745
+ closed: "closed";
746
+ }>>;
747
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
748
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
749
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
750
+ emailVerified: zod.ZodOptional<zod.ZodBoolean>;
751
+ phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
752
+ createdAt: zod.ZodCoercedDate<unknown>;
753
+ updatedAt: zod.ZodCoercedDate<unknown>;
754
+ metadata: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
755
+ }, zod_v4_core.$strip>;
756
+ }, zod_v4_core.$strip>, zod.ZodObject<{
757
+ success: zod.ZodLiteral<false>;
758
+ error: zod.ZodObject<{
759
+ code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
760
+ message: zod.ZodString;
761
+ traceId: zod.ZodOptional<zod.ZodString>;
762
+ httpStatus: zod.ZodOptional<zod.ZodNumber>;
763
+ system: zod.ZodOptional<zod.ZodString>;
764
+ module: zod.ZodOptional<zod.ZodString>;
765
+ cause: zod.ZodOptional<zod.ZodUnknown>;
766
+ suggestion: zod.ZodOptional<zod.ZodString>;
767
+ ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
768
+ }, zod_v4_core.$strip>;
769
+ }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
518
770
  list: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
519
771
  page: zod.ZodOptional<zod.ZodCoercedNumber<unknown>>;
520
772
  pageSize: zod.ZodOptional<zod.ZodCoercedNumber<unknown>>;
@@ -535,6 +787,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
535
787
  displayName: zod.ZodOptional<zod.ZodString>;
536
788
  avatarUrl: zod.ZodOptional<zod.ZodString>;
537
789
  enabled: zod.ZodBoolean;
790
+ accountType: zod.ZodOptional<zod.ZodEnum<{
791
+ permanent: "permanent";
792
+ temporary: "temporary";
793
+ }>>;
794
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
795
+ active: "active";
796
+ dormant: "dormant";
797
+ closed: "closed";
798
+ }>>;
799
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
800
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
801
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
538
802
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
539
803
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
540
804
  createdAt: zod.ZodCoercedDate<unknown>;
@@ -571,6 +835,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
571
835
  displayName: zod.ZodOptional<zod.ZodString>;
572
836
  avatarUrl: zod.ZodOptional<zod.ZodString>;
573
837
  enabled: zod.ZodBoolean;
838
+ accountType: zod.ZodOptional<zod.ZodEnum<{
839
+ permanent: "permanent";
840
+ temporary: "temporary";
841
+ }>>;
842
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
843
+ active: "active";
844
+ dormant: "dormant";
845
+ closed: "closed";
846
+ }>>;
847
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
848
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
849
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
574
850
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
575
851
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
576
852
  createdAt: zod.ZodCoercedDate<unknown>;
@@ -592,6 +868,16 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
592
868
  }, zod_v4_core.$strip>;
593
869
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
594
870
  create: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
871
+ accountType: zod.ZodOptional<zod.ZodEnum<{
872
+ permanent: "permanent";
873
+ temporary: "temporary";
874
+ }>>;
875
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
876
+ active: "active";
877
+ dormant: "dormant";
878
+ closed: "closed";
879
+ }>>;
880
+ accountExpiresAt: zod.ZodOptional<zod.ZodCoercedDate<unknown>>;
595
881
  username: zod.ZodString;
596
882
  email: zod.ZodOptional<zod.ZodString>;
597
883
  phone: zod.ZodOptional<zod.ZodString>;
@@ -610,6 +896,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
610
896
  displayName: zod.ZodOptional<zod.ZodString>;
611
897
  avatarUrl: zod.ZodOptional<zod.ZodString>;
612
898
  enabled: zod.ZodBoolean;
899
+ accountType: zod.ZodOptional<zod.ZodEnum<{
900
+ permanent: "permanent";
901
+ temporary: "temporary";
902
+ }>>;
903
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
904
+ active: "active";
905
+ dormant: "dormant";
906
+ closed: "closed";
907
+ }>>;
908
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
909
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
910
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
613
911
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
614
912
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
615
913
  createdAt: zod.ZodCoercedDate<unknown>;
@@ -631,6 +929,16 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
631
929
  }, zod_v4_core.$strip>;
632
930
  }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
633
931
  update: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
932
+ accountType: zod.ZodOptional<zod.ZodEnum<{
933
+ permanent: "permanent";
934
+ temporary: "temporary";
935
+ }>>;
936
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
937
+ active: "active";
938
+ dormant: "dormant";
939
+ closed: "closed";
940
+ }>>;
941
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
634
942
  id: zod.ZodString;
635
943
  username: zod.ZodOptional<zod.ZodString>;
636
944
  email: zod.ZodOptional<zod.ZodString>;
@@ -650,6 +958,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
650
958
  displayName: zod.ZodOptional<zod.ZodString>;
651
959
  avatarUrl: zod.ZodOptional<zod.ZodString>;
652
960
  enabled: zod.ZodBoolean;
961
+ accountType: zod.ZodOptional<zod.ZodEnum<{
962
+ permanent: "permanent";
963
+ temporary: "temporary";
964
+ }>>;
965
+ accountStatus: zod.ZodOptional<zod.ZodEnum<{
966
+ active: "active";
967
+ dormant: "dormant";
968
+ closed: "closed";
969
+ }>>;
970
+ accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
971
+ lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
972
+ mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
653
973
  emailVerified: zod.ZodOptional<zod.ZodBoolean>;
654
974
  phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
655
975
  createdAt: zod.ZodCoercedDate<unknown>;
package/dist/features/iam.js CHANGED
@@ -1,5 +1,5 @@
1
1
  import { mapHaiResult } from '../chunk-XKCLD42I.js';
2
- import { implement, servM } from '../chunk-KR4H56KP.js';
2
+ import { implement, servM } from '../chunk-N6IOKLQY.js';
3
3
  import { apiContract } from '@h-ai/api-contract';
4
4
  import { core, ok, err, HaiCommonError } from '@h-ai/core';
5
5
 
@@ -7,7 +7,21 @@ var iamContract = apiContract.iam;
7
7
  var iamFeatureLogger = core.logger.child({ module: "serv", scope: "feature-iam" });
8
8
  function createIamProcedures(deps) {
9
9
  const { iam } = deps;
10
- return implement(iamContract).context().route("auth.login", ({ input }) => iam.auth.login(input)).route("auth.loginWithOtp", ({ input }) => iam.auth.loginWithOtp(input)).route("auth.loginWithLdap", ({ input }) => iam.auth.loginWithLdap(input)).route("auth.publicConfig", () => ok(iam.publicConfig)).route("auth.requestPasswordReset", ({ input }) => iam.user.requestPasswordReset(input.identifier)).route("auth.confirmPasswordReset", ({ input }) => iam.user.confirmPasswordReset(input.token, input.newPassword)).route("auth.logout", ({ input, context }) => {
10
+ async function sensitive(context, operation, run) {
11
+ const policy = iam.publicConfig?.reauthentication;
12
+ if (policy?.enabled && policy.operations.includes(operation)) {
13
+ const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? "", operation, context.request.headers.get("x-hai-reauthentication") ?? void 0);
14
+ if (!checked.success)
15
+ return checked;
16
+ }
17
+ return run();
18
+ }
19
+ return implement(iamContract).context().route("auth.reauthenticate").auth().handle(({ input, context }) => iam.auth.reauthenticate(context.accessToken ?? "", input.password, input.operation)).route("auth.login", ({ input, context }) => iam.auth.login(input, context)).route("auth.createCaptcha", ({ input }) => iam.auth.createCaptcha(input)).route("auth.loginWithOtp", ({ input, context }) => iam.auth.loginWithOtp(input, context)).route("auth.loginWithLdap", ({ input, context }) => iam.auth.loginWithLdap(input, context)).route("auth.publicConfig", () => ok(iam.publicConfig)).route("auth.renewPassword", ({ input }) => iam.user.renewPassword(input)).route("auth.requestPasswordReset", ({ input }) => iam.user.requestPasswordReset(input.identifier, input)).route("auth.confirmPasswordReset", ({ input }) => iam.user.confirmPasswordReset(input.token, input.newPassword)).route("auth.logout", ({ input, context }) => {
20
+ const token = input.accessToken ?? context.accessToken;
21
+ if (!token)
22
+ return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
23
+ return iam.auth.logout(token);
24
+ }).route("auth.closeSession", ({ input, context }) => {
11
25
  const token = input.accessToken ?? context.accessToken;
12
26
  if (!token)
13
27
  return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
@@ -26,7 +40,7 @@ function createIamProcedures(deps) {
26
40
  );
27
41
  }).route("auth.refresh", async ({ input }) => {
28
42
  return mapHaiResult(await iam.session.refresh(input.refreshToken), (tokens) => ({ tokens }));
29
- }).route("auth.sendOtp", ({ input }) => iam.auth.sendOtp(input.identifier)).route("auth.register", ({ input }) => iam.auth.registerAndLogin(input)).route("auth.changePassword").auth().handle(({ input, context }) => {
43
+ }).route("auth.sendOtp", ({ input }) => iam.auth.sendOtp(input.identifier, input)).route("auth.register", ({ input, context }) => iam.auth.registerAndLogin(input, context)).route("auth.changePassword").auth().handle(({ input, context }) => {
30
44
  const token = context.accessToken;
31
45
  if (!token)
32
46
  return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
@@ -36,21 +50,26 @@ function createIamProcedures(deps) {
36
50
  if (!token)
37
51
  return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
38
52
  return iam.user.updateCurrentUser(token, input);
39
- }).route("users.list").permission("iam.users.read").handle(({ input }) => iam.user.listUsers(input)).route("users.get").permission("iam.users.read").handle(({ input }) => iam.user.getUser(input.id, { include: ["roles"] })).route("users.create").permission("iam.users.write").handle(({ input }) => createUser(iam, input)).route("users.update").permission("iam.users.write").handle(({ input }) => updateUser(iam, input)).route("users.delete").permission("iam.users.write").handle(({ input, context }) => {
53
+ }).route("users.list").permission("iam.users.read").handle(({ input }) => iam.user.listUsers(input)).route("users.get").permission("iam.users.read").handle(({ input }) => iam.user.getUser(input.id, { include: ["roles"] })).route("users.create").permission("iam.users.write").handle(({ input, context }) => sensitive(context, "iam.users.create", () => createUser(iam, input))).route("users.invite").permission("iam.users.write").handle(({ input, context }) => sensitive(context, "iam.users.invite", () => createUser(iam, input))).route("users.update").permission("iam.users.write").handle(({ input, context }) => sensitive(context, "iam.users.update", () => updateUser(iam, input))).route("users.delete").permission("iam.users.write").handle(({ input, context }) => {
40
54
  if (context.session.userId === input.id)
41
55
  return err(HaiCommonError.FORBIDDEN, servM("serv_iamCannotDeleteCurrentUser", { locale: context.locale }));
42
- return iam.user.deleteUser(input.id);
43
- }).route("users.resetPassword").permission("iam.users.write").handle(({ input }) => iam.user.adminResetPassword(input.id, input.newPassword)).route("roles.list").permission("iam.roles.read").handle(() => iam.authz.getAllRoles()).route("roles.get").permission("iam.roles.read").handle(({ input }) => iam.authz.getRole(input.id)).route("roles.create").permission("iam.roles.write").handle(({ input }) => iam.authz.createRole(input)).route("roles.update").permission("iam.roles.write").handle(({ input }) => {
56
+ return sensitive(context, "iam.users.delete", () => iam.user.deleteUser(input.id));
57
+ }).route("users.resetPassword").permission("iam.users.write").handle(({ input, context }) => sensitive(context, "iam.users.resetPassword", () => iam.user.adminResetPassword(input.id, input.newPassword))).route("roles.list").permission("iam.roles.read").handle(() => iam.authz.getAllRoles()).route("roles.get").permission("iam.roles.read").handle(({ input }) => iam.authz.getRole(input.id)).route("roles.create").permission("iam.roles.write").handle(({ input, context }) => sensitive(context, "iam.roles.create", () => iam.authz.createRole(input))).route("roles.update").permission("iam.roles.write").handle(({ input, context }) => {
44
58
  const { id, ...data } = input;
45
- return iam.authz.updateRole(id, data);
46
- }).route("roles.delete").permission("iam.roles.write").handle(({ input }) => iam.authz.deleteRole(input.id)).route("permissions.list").permission("iam.permissions.read").handle(({ input }) => iam.authz.getAllPermissions(input)).route("permissions.get").permission("iam.permissions.read").handle(({ input }) => iam.authz.getPermission(input.id)).route("permissions.create").permission("iam.permissions.write").handle(({ input }) => iam.authz.createPermission(input)).route("permissions.delete").permission("iam.permissions.write").handle(({ input }) => iam.authz.deletePermission(input.id)).build();
59
+ return sensitive(context, "iam.roles.update", () => iam.authz.updateRole(id, data));
60
+ }).route("roles.delete").permission("iam.roles.write").handle(({ input, context }) => sensitive(context, "iam.roles.delete", () => iam.authz.deleteRole(input.id))).route("permissions.list").permission("iam.permissions.read").handle(({ input }) => iam.authz.getAllPermissions(input)).route("permissions.get").permission("iam.permissions.read").handle(({ input }) => iam.authz.getPermission(input.id)).route("permissions.create").permission("iam.permissions.write").handle(({ input, context }) => sensitive(context, "iam.permissions.create", () => iam.authz.createPermission(input))).route("permissions.delete").permission("iam.permissions.write").handle(({ input, context }) => sensitive(context, "iam.permissions.delete", () => iam.authz.deletePermission(input.id))).build();
47
61
  }
48
62
  async function createUser(iam, input) {
49
- const registerResult = await iam.user.createUser(input);
63
+ const invited = !("password" in input);
64
+ const registerResult = "password" in input ? await iam.user.createUser(input) : await iam.user.inviteUser(input);
50
65
  if (!registerResult.success)
51
66
  return registerResult;
52
67
  const userId = registerResult.data.user.id;
53
68
  async function rollback(reason) {
69
+ if (invited) {
70
+ iamFeatureLogger.error("Invited account requires configuration repair", { userId, reason });
71
+ return;
72
+ }
54
73
  const deleteResult = await iam.user.deleteUser(userId);
55
74
  if (!deleteResult.success)
56
75
  iamFeatureLogger.error("createUser rollback failed, orphan user may exist", { userId, reason, error: deleteResult.error });