@hilbras/keystone 1.1.0

package/dist/services/federation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,iBAAiB,CAE9E;AAED,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOzH;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAMhF"}

package/dist/services/federation.js

@@ -0,0 +1,22 @@
+import { buildConnector } from "./connectors/registry.js";
+import { upsertOAuthUser } from "./users.js";
+import { createTokenSet } from "./tokens.js";
+export function getFederationConnector(providerType) {
+    return buildConnector(providerType);
+}
+export async function getFederationAuthorizeUrl(providerType, state, redirectUri) {
+    const connector = getFederationConnector(providerType);
+    return connector.getAuthorizeUrl({
+        state,
+        redirectUri,
+        scopes: ["openid", "profile", "email"],
+    });
+}
+export async function completeFederationLogin(providerType, code, redirectUri) {
+    const connector = getFederationConnector(providerType);
+    const identity = await connector.exchangeCode(code, redirectUri);
+    const user = await upsertOAuthUser(identity, providerType);
+    const tokens = await createTokenSet(user);
+    return { user, tokens: { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken } };
+}
+//# sourceMappingURL=federation.js.map

package/dist/services/federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7C,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,YAAoB,EAAE,KAAa,EAAE,WAAmB;IACtG,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,eAAe,CAAC;QAC/B,KAAK;QACL,WAAW;QACX,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,IAAY,EACZ,WAAmB;IAEnB,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;AAClG,CAAC"}

package/dist/services/hibp.d.ts

@@ -0,0 +1,2 @@
+export declare function isPasswordBreached(password: string): Promise<boolean>;
+//# sourceMappingURL=hibp.d.ts.map

package/dist/services/hibp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hibp.d.ts","sourceRoot":"","sources":["../../src/services/hibp.ts"],"names":[],"mappings":"AAEA,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyB3E"}

package/dist/services/hibp.js

@@ -0,0 +1,29 @@
+import crypto from "node:crypto";
+export async function isPasswordBreached(password) {
+    const hash = crypto.createHash("sha1").update(password).digest("hex").toUpperCase();
+    const prefix = hash.slice(0, 5);
+    const suffix = hash.slice(5);
+    try {
+        const response = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`, {
+            headers: { "Add-Padding": "true" },
+        });
+        if (!response.ok) {
+            return false;
+        }
+        const text = await response.text();
+        const lines = text.split("\r\n");
+        for (const line of lines) {
+            const [lineSuffix, countStr] = line.split(":");
+            if (!lineSuffix || !countStr)
+                continue;
+            if (lineSuffix === suffix && Number(countStr) > 0) {
+                return true;
+            }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=hibp.js.map

package/dist/services/hibp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hibp.js","sourceRoot":"","sources":["../../src/services/hibp.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,wCAAwC,MAAM,EAAE,EAAE;YAC7E,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACvC,IAAI,UAAU,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/services/ipControls.d.ts

@@ -0,0 +1,7 @@
+export declare function ipMatchesEntry(ip: string, entry: string): boolean;
+export interface IpCheckResult {
+    allowed: boolean;
+    reason?: string;
+}
+export declare function checkIpAllowed(clientId: string | undefined, ip: string | undefined): Promise<IpCheckResult>;
+//# sourceMappingURL=ipControls.d.ts.map

package/dist/services/ipControls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipControls.d.ts","sourceRoot":"","sources":["../../src/services/ipControls.ts"],"names":[],"mappings":"AAmDA,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAkBjE;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAsBjH"}

package/dist/services/ipControls.js

@@ -0,0 +1,92 @@
+import { db } from "../db/index.js";
+import { applications } from "../db/schema.js";
+import { eq } from "drizzle-orm";
+/**
+ * Per-application IP allow/block lists.
+ *
+ * Entries may be exact IPs ("203.0.113.10") or CIDR ranges
+ * ("203.0.113.0/24", "2001:db8::/32"). When `allowedIps` is non-empty only
+ * matching IPs may authenticate; `blockedIps` always wins.
+ */
+function ipToBigInt(ip) {
+    if (ip.includes(".")) {
+        const parts = ip.split(".");
+        if (parts.length !== 4)
+            return null;
+        let value = 0n;
+        for (const part of parts) {
+            const n = Number(part);
+            if (!Number.isInteger(n) || n < 0 || n > 255)
+                return null;
+            value = (value << 8n) | BigInt(n);
+        }
+        return { value, bits: 32 };
+    }
+    if (ip.includes(":")) {
+        // Expand :: shorthand and parse 8 hextets.
+        const [head, tail] = ip.split("::");
+        let hextets;
+        if (tail !== undefined) {
+            const headParts = head ? head.split(":") : [];
+            const tailParts = tail ? tail.split(":") : [];
+            const missing = 8 - headParts.length - tailParts.length;
+            if (missing < 0)
+                return null;
+            hextets = [...headParts, ...Array(missing).fill("0"), ...tailParts];
+        }
+        else {
+            hextets = ip.split(":");
+        }
+        if (hextets.length !== 8)
+            return null;
+        let value = 0n;
+        for (const hex of hextets) {
+            const n = parseInt(hex || "0", 16);
+            if (Number.isNaN(n) || n < 0 || n > 0xffff)
+                return null;
+            value = (value << 16n) | BigInt(n);
+        }
+        return { value, bits: 128 };
+    }
+    return null;
+}
+export function ipMatchesEntry(ip, entry) {
+    const target = ipToBigInt(ip);
+    if (!target)
+        return false;
+    const [networkIp, prefixStr] = entry.split("/");
+    const network = ipToBigInt(networkIp.trim());
+    if (!network || network.bits !== target.bits)
+        return false;
+    if (prefixStr === undefined) {
+        return target.value === network.value;
+    }
+    const prefix = Number(prefixStr);
+    if (!Number.isInteger(prefix) || prefix < 0 || prefix > network.bits)
+        return false;
+    if (prefix === 0)
+        return true;
+    const shift = BigInt(network.bits - prefix);
+    return target.value >> shift === network.value >> shift;
+}
+export async function checkIpAllowed(clientId, ip) {
+    if (!clientId || !ip)
+        return { allowed: true };
+    const [app] = await db
+        .select({ allowedIps: applications.allowedIps, blockedIps: applications.blockedIps })
+        .from(applications)
+        .where(eq(applications.clientId, clientId))
+        .limit(1);
+    if (!app)
+        return { allowed: true };
+    const blocked = app.blockedIps || [];
+    if (blocked.some((entry) => ipMatchesEntry(ip, entry))) {
+        return { allowed: false, reason: "Your IP address is blocked for this application." };
+    }
+    const allowed = app.allowedIps || [];
+    if (allowed.length > 0 && !allowed.some((entry) => ipMatchesEntry(ip, entry))) {
+        return { allowed: false, reason: "Your IP address is not allowed for this application." };
+    }
+    return { allowed: true };
+}
+//# sourceMappingURL=ipControls.js.map

package/dist/services/ipControls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipControls.js","sourceRoot":"","sources":["../../src/services/ipControls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC;;;;;;GAMG;AAEH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1D,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,2CAA2C;QAC3C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAiB,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YACxD,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAE3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;AAC1D,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAA4B,EAAE,EAAsB;IACvF,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC;SACpF,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEnC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/services/magicLinks.d.ts

@@ -0,0 +1,16 @@
+import { type User } from "../db/schema.js";
+export declare function generateMagicLink(): {
+    token: string;
+    tokenHash: string;
+};
+export declare function storeMagicLink(userId: string, tokenHash: string, expiresAt: Date): Promise<{
+    id: string;
+    createdAt: Date;
+    userId: string;
+    expiresAt: Date;
+    tokenHash: string;
+    usedAt: Date | null;
+}>;
+export declare function consumeMagicLink(token: string): Promise<User | undefined>;
+export declare function magicLinkExpiresAt(): Date;
+//# sourceMappingURL=magicLinks.d.ts.map

package/dist/services/magicLinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLinks.d.ts","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAG/D,wBAAgB,iBAAiB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIxE;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;;;;;;;GAUtF;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAsB/E;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/services/magicLinks.js

@@ -0,0 +1,39 @@
+import crypto from "node:crypto";
+import { eq, and, gt, isNull } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { magicLinks, users } from "../db/schema.js";
+import { config } from "../config.js";
+export function generateMagicLink() {
+    const token = crypto.randomBytes(48).toString("base64url");
+    const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
+    return { token, tokenHash };
+}
+export async function storeMagicLink(userId, tokenHash, expiresAt) {
+    const [record] = await db
+        .insert(magicLinks)
+        .values({
+        userId,
+        tokenHash,
+        expiresAt,
+    })
+        .returning();
+    return record;
+}
+export async function consumeMagicLink(token) {
+    const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
+    const now = new Date();
+    const [record] = await db
+        .select()
+        .from(magicLinks)
+        .where(and(eq(magicLinks.tokenHash, tokenHash), gt(magicLinks.expiresAt, now), isNull(magicLinks.usedAt)))
+        .limit(1);
+    if (!record)
+        return undefined;
+    await db.update(magicLinks).set({ usedAt: now }).where(eq(magicLinks.id, record.id));
+    const [user] = await db.select().from(users).where(eq(users.id, record.userId)).limit(1);
+    return user;
+}
+export function magicLinkExpiresAt() {
+    return new Date(Date.now() + config.MAGIC_LINK_TTL_SECONDS * 1000);
+}
+//# sourceMappingURL=magicLinks.js.map

package/dist/services/magicLinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLinks.js","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,SAAe;IACrF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC;QACN,MAAM;QACN,SAAS;QACT,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EACnC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,EAC7B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAC1B,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAErF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;AACrE,CAAC"}

package/dist/services/oauth2.d.ts

@@ -0,0 +1,58 @@
+import { oauth2AuthorizationCodes, type User, type Application } from "../db/schema.js";
+export interface AuthorizationCodeInput {
+    appId: string;
+    userId: string;
+    challenge?: string;
+    challengeMethod?: string;
+    redirectUri?: string;
+    scopes?: string[];
+    nonce?: string;
+}
+export declare function generateAuthorizationCode(): {
+    code: string;
+    codeHash: string;
+};
+export declare function storeAuthorizationCode(input: AuthorizationCodeInput): Promise<{
+    code: string;
+    id: string;
+    createdAt: Date;
+    userId: string;
+    expiresAt: Date;
+    appId: string;
+    scopes: string[];
+    codeHash: string;
+    challenge: string | null;
+    challengeMethod: string | null;
+    redirectUri: string | null;
+    nonce: string | null;
+    usedAt: Date | null;
+}>;
+export declare function consumeAuthorizationCode(code: string, appId: string, redirectUri?: string): Promise<typeof oauth2AuthorizationCodes.$inferSelect | undefined>;
+export declare function verifyPKCE(challenge: string | null | undefined, method: string | null | undefined, verifier: string): boolean;
+export declare function hasConsent(userId: string, appId: string, requestedScopes: string[]): Promise<boolean>;
+export declare function grantConsent(userId: string, appId: string, scopes: string[]): Promise<{
+    id: string;
+    userId: string;
+    appId: string;
+    revokedAt: Date | null;
+    scopes: string[];
+    grantedAt: Date;
+}>;
+export declare function revokeConsent(userId: string, appId: string): Promise<void>;
+export declare function listConsentsByAppId(appId: string): Promise<{
+    id: string;
+    userId: string;
+    appId: string;
+    revokedAt: Date | null;
+    scopes: string[];
+    grantedAt: Date;
+}[]>;
+export declare function createTokenResponse(user: User, app: Application, scopes: string[], opts?: {
+    ip?: string;
+    userAgent?: string;
+    deviceFingerprint?: string;
+    nonce?: string;
+}): Promise<Record<string, unknown>>;
+export declare function findApplicationByClientId(clientId: string): Promise<Application | undefined>;
+export declare function verifyClientSecret(clientId: string, secret: string): Promise<Application | undefined>;
+//# sourceMappingURL=oauth2.d.ts.map

package/dist/services/oauth2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,EAIxB,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAIzB,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,yBAAyB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAI9E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB;;;;;;;;;;;;;;GAoBzE;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,wBAAwB,CAAC,YAAY,GAAG,SAAS,CAAC,CA4BnE;AAED,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GACf,OAAO,CAKT;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;;;;;;;GAoBjF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhF;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM;;;;;;;KAKtD;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,oCA6B3F;AAED,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlG;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAWlC"}

package/dist/services/oauth2.js

@@ -0,0 +1,144 @@
+import crypto from "node:crypto";
+import { eq, and, gt, isNull } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { oauth2AuthorizationCodes, oauth2Consents, applications, } from "../db/schema.js";
+import { config } from "../config.js";
+import { createTokenSet, createIdToken } from "./tokens.js";
+export function generateAuthorizationCode() {
+    const code = crypto.randomBytes(48).toString("base64url");
+    const codeHash = crypto.createHash("sha256").update(code).digest("hex");
+    return { code, codeHash };
+}
+export async function storeAuthorizationCode(input) {
+    const { code, codeHash } = generateAuthorizationCode();
+    const expiresAt = new Date(Date.now() + config.OAUTH_CODE_TTL_SECONDS * 1000);
+    const [record] = await db
+        .insert(oauth2AuthorizationCodes)
+        .values({
+        appId: input.appId,
+        userId: input.userId,
+        codeHash,
+        challenge: input.challenge ?? null,
+        challengeMethod: input.challengeMethod ?? null,
+        redirectUri: input.redirectUri ?? null,
+        scopes: input.scopes ?? [],
+        nonce: input.nonce ?? null,
+        expiresAt,
+    })
+        .returning();
+    return { ...record, code };
+}
+export async function consumeAuthorizationCode(code, appId, redirectUri) {
+    const codeHash = crypto.createHash("sha256").update(code).digest("hex");
+    const now = new Date();
+    const [record] = await db
+        .select()
+        .from(oauth2AuthorizationCodes)
+        .where(and(eq(oauth2AuthorizationCodes.codeHash, codeHash), eq(oauth2AuthorizationCodes.appId, appId), gt(oauth2AuthorizationCodes.expiresAt, now), isNull(oauth2AuthorizationCodes.usedAt)))
+        .limit(1);
+    if (!record)
+        return undefined;
+    if (redirectUri && record.redirectUri && record.redirectUri !== redirectUri) {
+        return undefined;
+    }
+    await db
+        .update(oauth2AuthorizationCodes)
+        .set({ usedAt: now })
+        .where(eq(oauth2AuthorizationCodes.id, record.id));
+    return record;
+}
+export function verifyPKCE(challenge, method, verifier) {
+    if (!challenge)
+        return true;
+    if (method?.toLowerCase() !== "s256")
+        return false;
+    const hash = crypto.createHash("sha256").update(verifier).digest("base64url");
+    return hash === challenge;
+}
+export async function hasConsent(userId, appId, requestedScopes) {
+    if (requestedScopes.length === 0)
+        return true;
+    const [consent] = await db
+        .select()
+        .from(oauth2Consents)
+        .where(and(eq(oauth2Consents.appId, appId), eq(oauth2Consents.userId, userId), isNull(oauth2Consents.revokedAt)))
+        .limit(1);
+    if (!consent)
+        return false;
+    const granted = new Set(consent.scopes);
+    return requestedScopes.every((scope) => granted.has(scope));
+}
+export async function grantConsent(userId, appId, scopes) {
+    const now = new Date();
+    const [record] = await db
+        .insert(oauth2Consents)
+        .values({
+        appId,
+        userId,
+        scopes,
+        grantedAt: now,
+    })
+        .onConflictDoUpdate({
+        target: [oauth2Consents.appId, oauth2Consents.userId],
+        set: {
+            scopes,
+            grantedAt: now,
+            revokedAt: null,
+        },
+    })
+        .returning();
+    return record;
+}
+export async function revokeConsent(userId, appId) {
+    await db
+        .update(oauth2Consents)
+        .set({ revokedAt: new Date() })
+        .where(and(eq(oauth2Consents.appId, appId), eq(oauth2Consents.userId, userId)));
+}
+export async function listConsentsByAppId(appId) {
+    return db
+        .select()
+        .from(oauth2Consents)
+        .where(and(eq(oauth2Consents.appId, appId), isNull(oauth2Consents.revokedAt)));
+}
+export async function createTokenResponse(user, app, scopes, opts = {}) {
+    const tokenOpts = {
+        appId: app.id,
+        orgId: app.orgId,
+        clientId: app.clientId,
+    };
+    const tokenSet = await createTokenSet(user, opts.ip, opts.userAgent, tokenOpts, opts.deviceFingerprint);
+    const response = {
+        access_token: tokenSet.accessToken,
+        refresh_token: tokenSet.refreshToken,
+        token_type: "Bearer",
+        expires_in: config.ACCESS_TOKEN_TTL_SECONDS,
+        scope: scopes.join(" "),
+    };
+    if (scopes.includes("openid")) {
+        response.id_token = await createIdToken(user, app, opts.nonce);
+    }
+    return response;
+}
+export async function findApplicationByClientId(clientId) {
+    const [app] = await db
+        .select()
+        .from(applications)
+        .where(and(eq(applications.clientId, clientId), eq(applications.isActive, true)))
+        .limit(1);
+    return app;
+}
+export async function verifyClientSecret(clientId, secret) {
+    const [app] = await db
+        .select()
+        .from(applications)
+        .where(and(eq(applications.clientId, clientId), eq(applications.isActive, true)))
+        .limit(1);
+    if (!app)
+        return undefined;
+    const hash = crypto.createHash("sha256").update(secret).digest("hex");
+    if (app.clientSecretHash !== hash)
+        return undefined;
+    return app;
+}
+//# sourceMappingURL=oauth2.js.map

package/dist/services/oauth2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAW,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,YAAY,GAIb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,aAAa,EAA2B,MAAM,aAAa,CAAC;AAYrF,MAAM,UAAU,yBAAyB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA6B;IACxE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,yBAAyB,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE9E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ;QACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,KAAa,EACb,WAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC/C,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,EACzC,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,EAC3C,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC,CACxC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,wBAAwB,CAAC;SAChC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAErD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,MAAiC,EACjC,QAAgB;IAEhB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9E,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,KAAa,EACb,eAAyB;IAEzB,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,MAAgB;IAChF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,KAAK;QACL,MAAM;QACN,MAAM;QACN,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC;QACrD,GAAG,EAAE;YACH,MAAM;YACN,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;SAChB;KACF,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,KAAa;IAC/D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,GAAgB,EAChB,MAAgB,EAChB,OAAwF,EAAE;IAE1F,MAAM,SAAS,GAAuB;QACpC,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,IAAI,EACJ,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,SAAS,EACT,IAAI,CAAC,iBAAiB,CACvB,CAAC;IAEF,MAAM,QAAQ,GAA4B;QACxC,YAAY,EAAE,QAAQ,CAAC,WAAW;QAClC,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;QAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,QAAgB;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,MAAc;IAEd,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/services/organizations.d.ts

@@ -0,0 +1,39 @@
+import { type Organization, type OrgMembership } from "../db/schema.js";
+export type OrgRole = "owner" | "admin" | "member";
+export declare function slugify(name: string): string;
+export declare function createOrganization(input: {
+    name: string;
+    slug?: string;
+    plan?: string;
+}): Promise<Organization>;
+export declare function findOrganizationById(id: string): Promise<Organization | undefined>;
+export declare function findOrganizationBySlug(slug: string): Promise<Organization | undefined>;
+export declare function findOrganizationsByUserId(userId: string): Promise<Organization[]>;
+export declare function addOrgMembership(input: {
+    orgId: string;
+    userId: string;
+    role: OrgRole;
+}): Promise<OrgMembership>;
+export declare function findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined>;
+export declare function updateMembershipRole(orgId: string, userId: string, role: OrgRole): Promise<OrgMembership | undefined>;
+export declare function removeMembership(orgId: string, userId: string): Promise<boolean>;
+export declare function countOwners(orgId: string): Promise<number>;
+export declare function requireOrgRole(userId: string, orgId: string, allowedRoles: OrgRole[]): Promise<OrgMembership>;
+export declare function listOrgMembers(orgId: string): Promise<{
+    membership: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        userId: string;
+        orgId: string;
+    };
+    user: {
+        id: string;
+        name: string | null;
+        email: string;
+        username: string;
+        avatarUrl: string | null;
+    };
+}[]>;
+//# sourceMappingURL=organizations.d.ts.map

package/dist/services/organizations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/services/organizations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwC,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE9G,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO5C;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,YAAY,CAAC,CAaxB;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAGxF;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAG5F;AAED,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAOvF;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBzB;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAOpC;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAOpC;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtF;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhE;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,EAAE,GACtB,OAAO,CAAC,aAAa,CAAC,CAexB;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;KAejD"}

package/dist/services/organizations.js

@@ -0,0 +1,135 @@
+import { eq, and, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { organizations, orgMemberships, users } from "../db/schema.js";
+export function slugify(name) {
+    return name
+        .toLowerCase()
+        .trim()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 64);
+}
+export async function createOrganization(input) {
+    const baseSlug = input.slug || slugify(input.name);
+    const slug = await ensureUniqueSlug(baseSlug);
+    const [org] = await db
+        .insert(organizations)
+        .values({
+        name: input.name,
+        slug,
+        plan: input.plan || "free",
+    })
+        .returning();
+    return org;
+}
+export async function findOrganizationById(id) {
+    const [org] = await db.select().from(organizations).where(eq(organizations.id, id)).limit(1);
+    return org;
+}
+export async function findOrganizationBySlug(slug) {
+    const [org] = await db.select().from(organizations).where(eq(organizations.slug, slug)).limit(1);
+    return org;
+}
+export async function findOrganizationsByUserId(userId) {
+    const rows = await db
+        .select({ org: organizations })
+        .from(orgMemberships)
+        .where(eq(orgMemberships.userId, userId))
+        .innerJoin(organizations, eq(orgMemberships.orgId, organizations.id));
+    return rows.map((r) => r.org);
+}
+export async function addOrgMembership(input) {
+    const [membership] = await db
+        .insert(orgMemberships)
+        .values({
+        orgId: input.orgId,
+        userId: input.userId,
+        role: input.role,
+    })
+        .onConflictDoNothing({ target: [orgMemberships.orgId, orgMemberships.userId] })
+        .returning();
+    if (membership)
+        return membership;
+    const [existing] = await db
+        .select()
+        .from(orgMemberships)
+        .where(and(eq(orgMemberships.orgId, input.orgId), eq(orgMemberships.userId, input.userId)))
+        .limit(1);
+    return existing;
+}
+export async function findMembership(orgId, userId) {
+    const [membership] = await db
+        .select()
+        .from(orgMemberships)
+        .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+        .limit(1);
+    return membership;
+}
+export async function updateMembershipRole(orgId, userId, role) {
+    const [updated] = await db
+        .update(orgMemberships)
+        .set({ role, updatedAt: sql `now()` })
+        .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+        .returning();
+    return updated;
+}
+export async function removeMembership(orgId, userId) {
+    const deleted = await db
+        .delete(orgMemberships)
+        .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+        .returning();
+    return deleted.length > 0;
+}
+export async function countOwners(orgId) {
+    const rows = await db
+        .select({ count: sql `count(*)`.mapWith(Number) })
+        .from(orgMemberships)
+        .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.role, "owner")));
+    return rows[0]?.count ?? 0;
+}
+export async function requireOrgRole(userId, orgId, allowedRoles) {
+    const membership = await findMembership(orgId, userId);
+    if (!membership) {
+        const error = new Error("Not a member of this organization");
+        error.statusCode = 403;
+        throw error;
+    }
+    if (!allowedRoles.includes(membership.role)) {
+        const error = new Error("Insufficient organization permissions");
+        error.statusCode = 403;
+        throw error;
+    }
+    return membership;
+}
+export async function listOrgMembers(orgId) {
+    return db
+        .select({
+        membership: orgMemberships,
+        user: {
+            id: users.id,
+            email: users.email,
+            username: users.username,
+            name: users.name,
+            avatarUrl: users.avatarUrl,
+        },
+    })
+        .from(orgMemberships)
+        .where(eq(orgMemberships.orgId, orgId))
+        .innerJoin(users, eq(orgMemberships.userId, users.id));
+}
+async function ensureUniqueSlug(base) {
+    let slug = base || "org";
+    let counter = 2;
+    while (true) {
+        const existing = await db
+            .select({ id: organizations.id })
+            .from(organizations)
+            .where(eq(organizations.slug, slug))
+            .limit(1);
+        if (existing.length === 0)
+            return slug;
+        slug = `${base}-${counter}`;
+        counter++;
+    }
+}
+//# sourceMappingURL=organizations.js.map