@happyvertical/smrt-users 0.54.0 → 0.54.3

package/dist/sveltekit.js

@@ -1,16 +1,16 @@
-import { A as DeviceCredentialForbiddenError, C as encodeOidcTransaction, L as SessionService, M as DeviceCredentialService, S as decodeOidcTransaction, T as resolveOidcProviderConfig, _ as MobileAuthService, a as TerminalAuthError, b as OidcLoginError, c as OperationPermissionError, g as MobileAuthError, h as withSessionPermissionContext, j as DeviceCredentialPolicyError, k as DeviceCredentialError, o as TerminalAuthRateLimitError, q as LoginRateLimitError, s as TerminalAuthService, v as readMobileBearerToken, w as getUsersOidcConfig, x as OidcLoginService, y as validateMobileRedirectUri } from "./chunks/TerminalAuthService-BfxG493c.js";
+import { A as readMobileBearerToken, D as withSessionPermissionContext, F as encodeOidcTransaction, H as DeviceCredentialForbiddenError, I as getUsersOidcConfig, L as resolveOidcProviderConfig, M as OidcLoginError, N as OidcLoginService, O as MobileAuthError, P as decodeOidcTransaction, U as DeviceCredentialPolicyError, V as DeviceCredentialError, W as DeviceCredentialService, Y as SessionService, _ as PasswordCredentialService, a as TerminalAuthError, at as LoginRateLimitError, b as OperationPermissionError, g as PasswordCredentialForbiddenError, h as PasswordCredentialError, j as validateMobileRedirectUri, k as MobileAuthService, o as TerminalAuthRateLimitError, s as TerminalAuthService, v as PasswordPolicyError } from "./chunks/TerminalAuthService-Bc67JXJ5.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";
 import { classnameToTablename } from "@happyvertical/smrt-core/utils";
 import { methodNameToKebab, resolveApiActionSet } from "@happyvertical/smrt-core/vite-plugin";
 //#region src/sveltekit/device-credential-handlers.ts
-var logger$2 = createLogger({ level: "info" });
-var NO_STORE_HEADERS$2 = {
+var logger$3 = createLogger({ level: "info" });
+var NO_STORE_HEADERS$3 = {
 	"cache-control": "private, no-store",
 	pragma: "no-cache"
 };
-function json(body2, status = 200, headers) {
+function json$1(body2, status = 200, headers) {
 	return new Response(JSON.stringify(body2), {
 		status,
 		headers: {
@@ -22,40 +22,40 @@ function json(body2, status = 200, headers) {
 function bearer(event) {
 	return (event.request.headers.get("authorization")?.match(/^Bearer\s+(.+)$/iu))?.[1]?.trim() || null;
 }
-async function body(event) {
+async function body$1(event) {
 	const parsed = await event.request.json().catch(() => null);
 	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
 }
-function str(value) {
+function str$1(value) {
 	return typeof value === "string" ? value : "";
 }
-function errorResponse$1(error) {
-	if (error instanceof LoginRateLimitError) return json({
+function errorResponse$2(error) {
+	if (error instanceof LoginRateLimitError) return json$1({
 		error: "Too many attempts. Try again later.",
 		code: "rate_limited"
 	}, 429, {
-		...NO_STORE_HEADERS$2,
+		...NO_STORE_HEADERS$3,
 		"retry-after": String(error.retryAfterSeconds)
 	});
-	if (error instanceof DeviceCredentialError) return json({
+	if (error instanceof DeviceCredentialError) return json$1({
 		error: "Invalid credentials.",
 		code: "invalid_credentials"
-	}, 401, NO_STORE_HEADERS$2);
-	if (error instanceof DeviceCredentialForbiddenError) return json({
+	}, 401, NO_STORE_HEADERS$3);
+	if (error instanceof DeviceCredentialForbiddenError) return json$1({
 		error: error.message,
 		code: "forbidden"
-	}, 403, NO_STORE_HEADERS$2);
-	if (error instanceof DeviceCredentialPolicyError) return json({
+	}, 403, NO_STORE_HEADERS$3);
+	if (error instanceof DeviceCredentialPolicyError) return json$1({
 		error: error.message,
 		code: "pin_policy"
-	}, 400, NO_STORE_HEADERS$2);
-	logger$2.error("Device credential handler error", { error });
-	return json({
+	}, 400, NO_STORE_HEADERS$3);
+	logger$3.error("Device credential handler error", { error });
+	return json$1({
 		error: "Internal error.",
 		code: "internal"
-	}, 500, NO_STORE_HEADERS$2);
+	}, 500, NO_STORE_HEADERS$3);
 }
-async function resolveActor(event, service) {
+async function resolveActor$1(event, service) {
 	const token = bearer(event);
 	if (token) return service.resolveActor(token);
 	const locals = event.locals ?? {};
@@ -87,22 +87,22 @@ function createDeviceCredentialHandlers(options) {
 		service,
 		pinSignIn: async (event) => {
 			const deviceToken = bearer(event);
-			const input = await body(event);
-			const userId = str(input.userId).trim();
-			const pin = str(input.pin);
-			if (!deviceToken || !userId || !pin) return json({
+			const input = await body$1(event);
+			const userId = str$1(input.userId).trim();
+			const pin = str$1(input.pin);
+			if (!deviceToken || !userId || !pin) return json$1({
 				error: "Invalid credentials.",
 				code: "invalid_credentials"
-			}, 401, NO_STORE_HEADERS$2);
+			}, 401, NO_STORE_HEADERS$3);
 			try {
-				return json(await (await service()).signInWithPin({
+				return json$1(await (await service()).signInWithPin({
 					deviceToken,
 					userId,
 					pin,
 					...meta(event)
-				}), 201, NO_STORE_HEADERS$2);
+				}), 201, NO_STORE_HEADERS$3);
 			} catch (error) {
-				return errorResponse$1(error);
+				return errorResponse$2(error);
 			}
 		},
 		signOut: async (event) => {
@@ -110,74 +110,74 @@ function createDeviceCredentialHandlers(options) {
 			if (token) try {
 				await (await service()).signOut(token);
 			} catch (error) {
-				logger$2.error("Device credential sign-out error", { error });
+				logger$3.error("Device credential sign-out error", { error });
 			}
-			return json({ authenticated: false }, 200, NO_STORE_HEADERS$2);
+			return json$1({ authenticated: false }, 200, NO_STORE_HEADERS$3);
 		},
 		setPin: async (event) => {
-			const actor = await resolveActor(event, await service());
-			if (!actor) return json({
+			const actor = await resolveActor$1(event, await service());
+			if (!actor) return json$1({
 				error: "Unauthenticated.",
 				code: "unauthenticated"
-			}, 401, NO_STORE_HEADERS$2);
-			const input = await body(event);
+			}, 401, NO_STORE_HEADERS$3);
+			const input = await body$1(event);
 			try {
 				await (await service()).setPin({
 					actor,
-					userId: str(input.userId).trim() || (actor.user.id ?? ""),
-					pin: str(input.pin),
-					currentPin: str(input.currentPin) || void 0,
+					userId: str$1(input.userId).trim() || (actor.user.id ?? ""),
+					pin: str$1(input.pin),
+					currentPin: str$1(input.currentPin) || void 0,
 					ipAddress: event.getClientAddress?.()
 				});
 				return new Response(null, {
 					status: 204,
-					headers: NO_STORE_HEADERS$2
+					headers: NO_STORE_HEADERS$3
 				});
 			} catch (error) {
-				return errorResponse$1(error);
+				return errorResponse$2(error);
 			}
 		},
 		resetPin: async (event) => {
-			const actor = await resolveActor(event, await service());
-			if (!actor) return json({
+			const actor = await resolveActor$1(event, await service());
+			if (!actor) return json$1({
 				error: "Unauthenticated.",
 				code: "unauthenticated"
-			}, 401, NO_STORE_HEADERS$2);
-			const input = await body(event);
+			}, 401, NO_STORE_HEADERS$3);
+			const input = await body$1(event);
 			try {
-				return json(await (await service()).resetPin({
+				return json$1(await (await service()).resetPin({
 					actor,
-					userId: str(input.userId).trim(),
-					pin: str(input.pin),
+					userId: str$1(input.userId).trim(),
+					pin: str$1(input.pin),
 					ipAddress: event.getClientAddress?.()
-				}), 200, NO_STORE_HEADERS$2);
+				}), 200, NO_STORE_HEADERS$3);
 			} catch (error) {
-				return errorResponse$1(error);
+				return errorResponse$2(error);
 			}
 		},
 		clearPin: async (event) => {
-			const actor = await resolveActor(event, await service());
-			if (!actor) return json({
+			const actor = await resolveActor$1(event, await service());
+			if (!actor) return json$1({
 				error: "Unauthenticated.",
 				code: "unauthenticated"
-			}, 401, NO_STORE_HEADERS$2);
-			const input = await body(event);
+			}, 401, NO_STORE_HEADERS$3);
+			const input = await body$1(event);
 			try {
-				return json(await (await service()).clearPin({
+				return json$1(await (await service()).clearPin({
 					actor,
-					userId: str(input.userId).trim() || (actor.user.id ?? ""),
+					userId: str$1(input.userId).trim() || (actor.user.id ?? ""),
 					ipAddress: event.getClientAddress?.()
-				}), 200, NO_STORE_HEADERS$2);
+				}), 200, NO_STORE_HEADERS$3);
 			} catch (error) {
-				return errorResponse$1(error);
+				return errorResponse$2(error);
 			}
 		}
 	};
 }
 //#endregion
 //#region src/sveltekit/mobile-handlers.ts
-var logger$1 = createLogger({ level: "info" });
-var NO_STORE_HEADERS$1 = {
+var logger$2 = createLogger({ level: "info" });
+var NO_STORE_HEADERS$2 = {
 	"cache-control": "private, no-store",
 	pragma: "no-cache"
 };
@@ -186,23 +186,23 @@ function jsonResponse$2(body, status = 200) {
 		status,
 		headers: {
 			"content-type": "application/json",
-			...NO_STORE_HEADERS$1
+			...NO_STORE_HEADERS$2
 		}
 	});
 }
 function withNoStoreDefault(response) {
 	if (response.headers.has("cache-control")) return response;
 	const headers = new Headers(response.headers);
-	for (const [name, value] of Object.entries(NO_STORE_HEADERS$1)) headers.set(name, value);
+	for (const [name, value] of Object.entries(NO_STORE_HEADERS$2)) headers.set(name, value);
 	return new Response(response.body, {
 		status: response.status,
 		statusText: response.statusText,
 		headers
 	});
 }
-function errorResponse(error) {
+function errorResponse$1(error) {
 	if (error instanceof MobileAuthError) {
-		if (error.status >= 500) logger$1.error("Mobile handler server error", {
+		if (error.status >= 500) logger$2.error("Mobile handler server error", {
 			code: error.code,
 			message: error.message
 		});
@@ -217,7 +217,7 @@ function errorResponse(error) {
 		reason: error.decision.reason,
 		permission: error.permission
 	}, error.status);
-	logger$1.error("Unexpected mobile handler error", { error });
+	logger$2.error("Unexpected mobile handler error", { error });
 	return jsonResponse$2({
 		error: "Internal server error",
 		code: "internal_error"
@@ -283,7 +283,7 @@ function createMobileAuthHandlers(options) {
 			const body = await readJsonBody(event);
 			return jsonResponse$2(await service.start(parseStartRequest(body)));
 		} catch (error) {
-			return errorResponse(error);
+			return errorResponse$1(error);
 		}
 	};
 	const authComplete = async (event) => {
@@ -295,21 +295,21 @@ function createMobileAuthHandlers(options) {
 				ipAddress: clientAddress(event)
 			}));
 		} catch (error) {
-			return errorResponse(error);
+			return errorResponse$1(error);
 		}
 	};
 	const sessionGet = async (event) => {
 		try {
 			return jsonResponse$2(await (await getService()).bootstrap(event.request.headers.get("authorization")));
 		} catch (error) {
-			return errorResponse(error);
+			return errorResponse$1(error);
 		}
 	};
 	const sessionDelete = async (event) => {
 		try {
 			return jsonResponse$2(await (await getService()).logout(event.request.headers.get("authorization")));
 		} catch (error) {
-			return errorResponse(error);
+			return errorResponse$1(error);
 		}
 	};
 	const withSession = async (event, fn) => {
@@ -329,7 +329,7 @@ function createMobileAuthHandlers(options) {
 				return withNoStoreDefault(await fn(event, context));
 			});
 		} catch (error) {
-			return errorResponse(error);
+			return errorResponse$1(error);
 		}
 	};
 	return {
@@ -351,6 +351,175 @@ function resolveMobileUploadDedupKey(formData, headers, fieldName = "clientCaptu
 	return header && header.length > 0 ? header : null;
 }
 //#endregion
+//#region src/sveltekit/password-handlers.ts
+var logger$1 = createLogger({ level: "info" });
+var NO_STORE_HEADERS$1 = {
+	"cache-control": "private, no-store",
+	pragma: "no-cache"
+};
+function json(body2, status = 200, headers) {
+	return new Response(JSON.stringify(body2), {
+		status,
+		headers: {
+			"content-type": "application/json",
+			...headers
+		}
+	});
+}
+var invalidCredentials = () => json({
+	error: "Invalid credentials.",
+	code: "invalid_credentials"
+}, 401, NO_STORE_HEADERS$1);
+var unauthenticated = () => json({
+	error: "Unauthenticated.",
+	code: "unauthenticated"
+}, 401, NO_STORE_HEADERS$1);
+async function body(event) {
+	const type = event.request.headers.get("content-type") ?? "";
+	if (type.includes("application/x-www-form-urlencoded") || type.includes("multipart/form-data")) {
+		const form = await event.request.formData().catch(() => null);
+		if (!form) return {};
+		const fields = {};
+		for (const [key, value] of form.entries()) if (typeof value === "string") fields[key] = value;
+		return fields;
+	}
+	const parsed = await event.request.json().catch(() => null);
+	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+}
+function str(value) {
+	return typeof value === "string" ? value : "";
+}
+function errorResponse(error) {
+	if (error instanceof LoginRateLimitError) return json({
+		error: "Too many attempts. Try again later.",
+		code: "rate_limited"
+	}, 429, {
+		...NO_STORE_HEADERS$1,
+		"retry-after": String(error.retryAfterSeconds)
+	});
+	if (error instanceof PasswordCredentialError) return invalidCredentials();
+	if (error instanceof PasswordCredentialForbiddenError) return json({
+		error: "Not permitted.",
+		code: "forbidden"
+	}, 403, NO_STORE_HEADERS$1);
+	if (error instanceof PasswordPolicyError) return json({
+		error: error.message,
+		code: "password_policy"
+	}, 400, NO_STORE_HEADERS$1);
+	logger$1.error("Password credential handler error", { error: error instanceof Error ? error.name : "unknown" });
+	return json({
+		error: "Internal error.",
+		code: "internal"
+	}, 500, NO_STORE_HEADERS$1);
+}
+function resolveActor(event) {
+	const locals = event.locals ?? {};
+	const user = locals.user;
+	const sessionId = locals.sessionId;
+	if (!user || !sessionId) return null;
+	if (!("authMethod" in locals)) return null;
+	return {
+		user,
+		membership: locals.membership ?? null,
+		permissions: Array.isArray(locals.permissions) ? locals.permissions : [],
+		tenantId: locals.tenantId ?? null,
+		sessionId,
+		authMethod: locals.authMethod ?? null,
+		parent: locals.sessionParent ?? null
+	};
+}
+function createPasswordCredentialHandlers(options) {
+	const { tenantId: tenantOption, cookieName = "sid", cookiePath = "/", cookieDomain, cookieSecure, cookieSameSite = "lax", ...serviceOptions } = options;
+	let servicePromise = null;
+	const service = () => {
+		servicePromise ??= PasswordCredentialService.create(serviceOptions);
+		return servicePromise;
+	};
+	const resolveTenant = async (event) => (typeof tenantOption === "function" ? await tenantOption(event) : tenantOption) ?? null;
+	const clearCookie = (event) => event.cookies.delete(cookieName, {
+		path: cookiePath,
+		domain: cookieDomain
+	});
+	const management = (run) => async (event) => {
+		const actor = resolveActor(event);
+		if (!actor) return unauthenticated();
+		try {
+			const input = await body(event);
+			return json(await run(await service(), actor, input, event), 200, NO_STORE_HEADERS$1);
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	return {
+		service,
+		signIn: async (event) => {
+			try {
+				const input = await body(event);
+				const result = await (await service()).signIn({
+					identifier: str(input.email) || str(input.identifier),
+					password: str(input.password),
+					tenantId: await resolveTenant(event),
+					ipAddress: event.getClientAddress?.(),
+					userAgent: event.request.headers.get("user-agent") ?? void 0,
+					replaceSessionId: event.cookies.get(cookieName) ?? null
+				});
+				event.cookies.set(cookieName, result.sessionId, {
+					path: cookiePath,
+					domain: cookieDomain,
+					httpOnly: true,
+					secure: cookieSecure ?? event.url.protocol === "https:",
+					sameSite: cookieSameSite,
+					maxAge: Math.max(1, Math.floor((Date.parse(result.expiresAt) - Date.now()) / 1e3))
+				});
+				return json({
+					authenticated: true,
+					userId: result.userId,
+					tenantId: result.tenantId,
+					expiresAt: result.expiresAt,
+					mustChange: result.mustChange
+				}, 200, NO_STORE_HEADERS$1);
+			} catch (error) {
+				return errorResponse(error);
+			}
+		},
+		setPassword: management((svc, actor, input, event) => svc.setPassword({
+			actor,
+			userId: str(input.userId).trim() || (actor.user.id ?? ""),
+			password: str(input.password),
+			ipAddress: event.getClientAddress?.()
+		})),
+		changePassword: management(async (svc, actor, input, event) => {
+			const result = await svc.changePassword({
+				actor,
+				currentPassword: str(input.currentPassword),
+				newPassword: str(input.newPassword),
+				ipAddress: event.getClientAddress?.()
+			});
+			if (result.endedCurrentSession) {
+				clearCookie(event);
+				return {
+					revokedSessions: result.revokedSessions,
+					signedOut: true
+				};
+			}
+			return { revokedSessions: result.revokedSessions };
+		}),
+		resetPassword: management((svc, actor, input, event) => svc.resetPassword({
+			actor,
+			userId: str(input.userId).trim(),
+			password: str(input.password),
+			mustChange: typeof input.mustChange === "boolean" ? input.mustChange : input.mustChange === "false" ? false : void 0,
+			ipAddress: event.getClientAddress?.()
+		})),
+		clearPassword: management((svc, actor, input, event) => svc.clearPassword({
+			actor,
+			userId: str(input.userId).trim() || (actor.user.id ?? ""),
+			currentPassword: str(input.currentPassword) || void 0,
+			ipAddress: event.getClientAddress?.()
+		}))
+	};
+}
+//#endregion
 //#region src/sveltekit/resource-list-handler.ts
 var STANDARD_API_ACTIONS = [
 	"list",
@@ -1195,6 +1364,6 @@ var NO_STORE_HEADERS = {
 	pragma: "no-cache"
 };
 //#endregion
-export { DiscoveryArtifactValidationError, InvalidBearerError, MobileAuthError, MobileAuthService, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, beginOidcLogin, canonicalizeDiscoveryArtifact, completeOidcLogin, createBearerSessionDeleteHandler, createDeviceCredentialHandlers, createDiscoveryConformanceArtifact, createMobileAuthHandlers, createOidcCallbackHandler, createOidcLoginHandler, createResourceListHandler, createSessionCookie, createSessionHandler, createTerminalAuthStartHandler, createTerminalAuthTokenHandler, defaultSessionLocals, deriveCommandRequirements, destroySessionCookie, loadBearerSessionContext, mountTerminalLoginPage, parseBearerToken, readMobileBearerToken, resolveMobileUploadDedupKey, switchSessionTenant, validateDiscoveryConformanceArtifact, validateMobileRedirectUri };
+export { DiscoveryArtifactValidationError, InvalidBearerError, MobileAuthError, MobileAuthService, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, beginOidcLogin, canonicalizeDiscoveryArtifact, completeOidcLogin, createBearerSessionDeleteHandler, createDeviceCredentialHandlers, createDiscoveryConformanceArtifact, createMobileAuthHandlers, createOidcCallbackHandler, createOidcLoginHandler, createPasswordCredentialHandlers, createResourceListHandler, createSessionCookie, createSessionHandler, createTerminalAuthStartHandler, createTerminalAuthTokenHandler, defaultSessionLocals, deriveCommandRequirements, destroySessionCookie, loadBearerSessionContext, mountTerminalLoginPage, parseBearerToken, readMobileBearerToken, resolveMobileUploadDedupKey, switchSessionTenant, validateDiscoveryConformanceArtifact, validateMobileRedirectUri };
 
 //# sourceMappingURL=sveltekit.js.map