@hilbras/keystone 1.6.0 → 1.9.0

package/dist/services/enterpriseSso.js.map

@@ -1 +1 @@
-{"version":3,"file":"enterpriseSso.js","sourceRoot":"","sources":["../../src/services/enterpriseSso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAqB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AASnE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,MAA4B,EAC5B,cAA4C,QAAQ;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAE3E,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACd,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC;YACN,KAAK;YACL,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;YAC7B,QAAQ,EAAE,gBAAgB;YAC1B,aAAa,EAAE,IAAI;SACpB,CAAC;aACD,SAAS,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAG,MAAM,EAAE;SAClC,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YACrC,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,0DAA0D;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"enterpriseSso.js","sourceRoot":"","sources":["../../src/services/enterpriseSso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAqB,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAcvC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,MAA4B,EAC5B,UAAuC,EACvC,WAAW,GAAiC,QAAQ;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,EACpD,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC,EAChD,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,EACjC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAC7C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,EAAE,qBAAqB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3E,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACd,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC;YACN,KAAK;YACL,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;YAC7B,QAAQ,EAAE,gBAAgB;YAC1B,aAAa,EAAE,IAAI;SACpB,CAAC;aACD,SAAS,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;YACvC,cAAc,EAAE,UAAU,CAAC,IAAI;YAC/B,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,WAAW,EAAE,UAAU;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,EAAE,qBAAqB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAG,MAAM,EAAE;SAClC,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;SAC/E,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,EAAE;aACL,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,WAAW;SAClB,CAAC;aACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK;gBACL,QAAQ,EAAE;oBACR,YAAY,EAAE,IAAI,CAAC,EAAE;oBACrB,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,WAAW;oBACpB,MAAM,EAAE,4BAA4B;iBACrC;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,0DAA0D;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/services/events/subscribers/auditLog.js

@@ -11,7 +11,7 @@ export async function auditLogSubscriber(event) {
             event: `${event.type}:v${event.version}`,
             ipAddress: ip ?? null,
             userAgent: userAgent ?? null,
-            metadata: { ...(metadata ?? {}), eventVersion: event.version },
+            metadata: { ...metadata, eventVersion: event.version },
         });
     }
     catch (err) {

package/dist/services/events/subscribers/auditLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACnF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;YACxC,SAAS,EAAE,EAAE,IAAI,IAAI;YACrB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}
+{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACnF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;YACxC,SAAS,EAAE,EAAE,IAAI,IAAI;YACrB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/services/events/types.d.ts

@@ -1,3 +1,9 @@
+export interface EventContext {
+    requestId?: string;
+    ip?: string;
+    userAgent?: string;
+    appId?: string;
+}
 export interface EventPayload {
     userId?: string;
     orgId?: string;
@@ -17,5 +23,5 @@ export interface KeystoneEvent {
 export type EventHandler = (event: KeystoneEvent) => void | Promise<void>;
 export declare const EVENT_VERSIONS: Record<string, number>;
 export declare function eventVersion(type: string): number;
-export type AuditEventType = "user_registered" | "user_login" | "user_login_failed" | "user_logout" | "token_refresh" | "token_refresh_failed" | "oauth_callback" | "oauth2_authorize" | "oauth2_token" | "oauth2_client_credentials" | "oauth2_revoke" | "oauth2_consent" | "password_reset_requested" | "password_reset_completed" | "api_key_created" | "api_key_revoked" | "api_key_used" | "service_account_created" | "service_account_updated" | "unauthorized_access" | "organization_created" | "organization_updated" | "organization_plan_updated" | "billing_customer_provisioned" | "organization_member_invited" | "organization_member_removed" | "organization_member_role_updated" | "permission_created" | "permission_deleted" | "application_created" | "application_updated" | "magic_link_sent" | "magic_link_verified" | "totp_enrolled" | "totp_verify_failed" | "totp_enabled" | "totp_disable_failed" | "totp_disabled" | "webauthn_registered" | "webauthn_authenticated" | "new_device_detected" | "sms_otp_sent" | "sms_otp_verify_failed" | "sms_otp_verified" | "authz_check" | "saml_sso_login" | "oidc_enterprise_login" | "saml_connection_created" | "saml_connection_deleted" | "oidc_connection_created" | "oidc_connection_deleted" | "scim_user_created" | "scim_user_updated" | "scim_user_deleted" | "federation_login" | "workflow_triggered" | "workflow_step_executed" | "workflow_created" | "workflow_deleted" | "platform_user_updated" | "platform_user_deactivated" | "platform_signing_key_rotated" | "platform_plugin_unregistered" | "platform_feature_flag_updated" | "platform_feature_flag_deleted" | "profile_updated" | "email_verification_sent" | "email_verified" | "platform_webhook_created" | "platform_webhook_updated" | "platform_webhook_deleted" | "platform_webhook_secret_rotated" | "federation_identity_linked" | "user_token_login" | "session_revoked" | "sessions_revoked_all";
+export type AuditEventType = "user_registered" | "user_login" | "user_login_failed" | "user_logout" | "token_refresh" | "token_refresh_failed" | "oauth_callback" | "oauth2_authorize" | "oauth2_token" | "oauth2_refresh" | "oauth2_refresh_failed" | "oauth2_client_credentials" | "oauth2_revoke" | "oauth2_consent" | "password_reset_requested" | "password_reset_completed" | "api_key_created" | "api_key_revoked" | "api_key_used" | "service_account_created" | "service_account_updated" | "unauthorized_access" | "organization_created" | "organization_updated" | "organization_plan_updated" | "billing_customer_provisioned" | "organization_member_invited" | "organization_member_removed" | "organization_member_role_updated" | "permission_created" | "permission_deleted" | "permission_role_updated" | "application_created" | "application_updated" | "magic_link_sent" | "magic_link_verified" | "totp_enrolled" | "totp_verify_failed" | "totp_enabled" | "totp_disable_failed" | "totp_disabled" | "webauthn_registered" | "webauthn_authenticated" | "new_device_detected" | "sms_otp_sent" | "sms_otp_verify_failed" | "sms_otp_verified" | "authz_check" | "saml_sso_login" | "oidc_enterprise_login" | "saml_connection_created" | "saml_connection_deleted" | "oidc_connection_created" | "oidc_connection_deleted" | "scim_user_created" | "scim_user_updated" | "scim_user_deleted" | "federation_login" | "workflow_triggered" | "workflow_step_executed" | "workflow_created" | "workflow_deleted" | "workflow_blocked" | "platform_user_updated" | "platform_role_changed" | "platform_user_deactivated" | "platform_account_reviewed" | "platform_signing_key_rotated" | "platform_plugin_unregistered" | "platform_feature_flag_updated" | "platform_feature_flag_deleted" | "profile_updated" | "email_verification_sent" | "email_verified" | "platform_webhook_created" | "platform_webhook_updated" | "platform_webhook_deleted" | "platform_webhook_secret_rotated" | "federation_identity_linked" | "user_token_login" | "session_revoked" | "sessions_revoked_all" | "mfa_challenge_created" | "mfa_challenge_failed" | "mfa_challenge_expired" | "mfa_challenge_rejected" | "mfa_verified" | "mfa_bypass_blocked" | "mfa_backup_code_regenerated" | "scim_connection_created" | "scim_connection_rotated" | "scim_connection_revoked" | "scim_authentication_failed" | "scim_access_denied" | "scim_group_created" | "scim_group_updated" | "scim_group_deleted";
 //# sourceMappingURL=types.d.ts.map

package/dist/services/events/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,6BAA6B,GAC7B,kCAAkC,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,2BAA2B,GAC3B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,iCAAiC,GACjC,4BAA4B,GAC5B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,uBAAuB,GACvB,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,6BAA6B,GAC7B,kCAAkC,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,2BAA2B,GAC3B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,iCAAiC,GACjC,4BAA4B,GAC5B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,GACtB,uBAAuB,GACvB,sBAAsB,GACtB,uBAAuB,GACvB,wBAAwB,GACxB,cAAc,GACd,oBAAoB,GACpB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,4BAA4B,GAC5B,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,CAAC"}

package/dist/services/events/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,2CAA2C;IAC3C,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC;AACxD,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,2CAA2C;IAC3C,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC;AACxD,CAAC"}

package/dist/services/events/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA2ED,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAqB1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYnE"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAsGD,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAqB1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYnE"}

package/dist/services/events/validate.js

@@ -9,6 +9,8 @@ const VALID_EVENT_TYPES = new Set([
     "oauth_callback",
     "oauth2_authorize",
     "oauth2_token",
+    "oauth2_refresh",
+    "oauth2_refresh_failed",
     "oauth2_client_credentials",
     "oauth2_revoke",
     "oauth2_consent",
@@ -29,6 +31,7 @@ const VALID_EVENT_TYPES = new Set([
     "organization_member_role_updated",
     "permission_created",
     "permission_deleted",
+    "permission_role_updated",
     "application_created",
     "application_updated",
     "magic_link_sent",
@@ -59,8 +62,11 @@ const VALID_EVENT_TYPES = new Set([
     "workflow_step_executed",
     "workflow_created",
     "workflow_deleted",
+    "workflow_blocked",
     "platform_user_updated",
+    "platform_role_changed",
     "platform_user_deactivated",
+    "platform_account_reviewed",
     "platform_signing_key_rotated",
     "platform_plugin_unregistered",
     "platform_feature_flag_updated",
@@ -69,7 +75,28 @@ const VALID_EVENT_TYPES = new Set([
     "email_verification_sent",
     "email_verified",
     "platform_webhook_created",
+    "platform_webhook_updated",
     "platform_webhook_deleted",
+    "platform_webhook_secret_rotated",
+    "federation_identity_linked",
+    "user_token_login",
+    "session_revoked",
+    "sessions_revoked_all",
+    "mfa_challenge_created",
+    "mfa_challenge_failed",
+    "mfa_challenge_expired",
+    "mfa_challenge_rejected",
+    "mfa_verified",
+    "mfa_bypass_blocked",
+    "mfa_backup_code_regenerated",
+    "scim_connection_created",
+    "scim_connection_rotated",
+    "scim_connection_revoked",
+    "scim_authentication_failed",
+    "scim_access_denied",
+    "scim_group_created",
+    "scim_group_updated",
+    "scim_group_deleted",
 ]);
 export function validateEvent(event) {
     const errors = [];

package/dist/services/events/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,yBAAyB;IACzB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,kCAAkC;IAClC,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,yBAAyB;IACzB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,kCAAkC;IAClC,oBAAoB;IACpB,oBAAoB;IACpB,yBAAyB;IACzB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,iCAAiC;IACjC,4BAA4B;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,sBAAsB;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,cAAc;IACd,oBAAoB;IACpB,6BAA6B;IAC7B,yBAAyB;IACzB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/dist/services/features.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,qBAAa,yBAA0B,YAAW,kBAAkB;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,oBAAoB;IAEzD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAOnC"}
+{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,qBAAa,yBAA0B,YAAW,kBAAkB;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,oBAAoB,EAAI;IAE7D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/B;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}

package/dist/services/features.js.map

@@ -1 +1 @@
-{"version":3,"file":"features.js","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,MAA4B;QAA5B,WAAM,GAAN,MAAM,CAAsB;IAAG,CAAC;IAE7D,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAmC,CAAC;YAC9F,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;YACvB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"features.js","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,yBAAyB;IACP,MAAM;IAAnC,YAA6B,MAA4B;sBAA5B,MAAM;IAAyB,CAAC;IAE7D,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAmC,CAAC;YAC9F,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;YACvB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/services/federation.d.ts

@@ -1,8 +1,13 @@
 import type { User } from "../db/schema.js";
 import type { IdentityConnector } from "./connectors/types.js";
+export interface FederationApplicationContext {
+    id: string;
+    orgId: string;
+    clientId: string;
+}
 export declare function getFederationConnector(providerType: string): IdentityConnector;
 export declare function getFederationAuthorizeUrl(providerType: string, state: string, redirectUri: string): Promise<string>;
-export declare function completeFederationLogin(providerType: string, code: string, redirectUri: string): Promise<{
+export declare function completeFederationLogin(providerType: string, code: string, redirectUri: string, application?: FederationApplicationContext): Promise<{
     user: User;
     tokens: {
         accessToken: string;

package/dist/services/federation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,iBAAiB,CAE9E;AAED,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOzH;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAMhF"}
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,iBAAiB,CAE9E;AAED,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOzH;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,4BAA4B,GACzC,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAmChF"}

package/dist/services/federation.js

@@ -1,6 +1,9 @@
+import { and, eq } from "drizzle-orm";
 import { buildConnector } from "./connectors/registry.js";
-import { upsertOAuthUser } from "./users.js";
+import { findIdentityProviderByType, upsertOAuthUser } from "./users.js";
 import { createTokenSet } from "./tokens.js";
+import { db } from "../db/index.js";
+import { users, orgMemberships } from "../db/schema.js";
 export function getFederationConnector(providerType) {
     return buildConnector(providerType);
 }
@@ -12,11 +15,35 @@ export async function getFederationAuthorizeUrl(providerType, state, redirectUri
         scopes: ["openid", "profile", "email"],
     });
 }
-export async function completeFederationLogin(providerType, code, redirectUri) {
+export async function completeFederationLogin(providerType, code, redirectUri, application) {
     const connector = getFederationConnector(providerType);
     const identity = await connector.exchangeCode(code, redirectUri);
-    const user = await upsertOAuthUser(identity, providerType);
-    const tokens = await createTokenSet(user);
+    const email = identity.email.toLowerCase().trim();
+    let existingUser;
+    if (application) {
+        const [existing] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+        if (!existing)
+            throw new Error("Federation users must be explicitly invited to the application organization");
+        if (!existing.isActive || existing.accountReviewRequired || existing.role === "owner") {
+            throw new Error("User account is unavailable for tenant federation");
+        }
+        const [membership] = await db
+            .select({ id: orgMemberships.id })
+            .from(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, application.orgId), eq(orgMemberships.userId, existing.id)))
+            .limit(1);
+        if (!membership)
+            throw new Error("Federation user must be explicitly invited to the application organization");
+        existingUser = existing;
+    }
+    const provider = await findIdentityProviderByType(providerType);
+    const user = await upsertOAuthUser(identity, providerType, provider?.id);
+    if (application && (!existingUser || existingUser.id !== user.id)) {
+        throw new Error("Federation identity is not linked to the invited user");
+    }
+    const tokens = await createTokenSet(user, undefined, undefined, application
+        ? { appId: application.id, orgId: application.orgId, clientId: application.clientId }
+        : {});
     return { user, tokens: { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken } };
 }
 //# sourceMappingURL=federation.js.map

package/dist/services/federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7C,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,YAAoB,EAAE,KAAa,EAAE,WAAmB;IACtG,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,eAAe,CAAC;QAC/B,KAAK;QACL,WAAW;QACX,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,IAAY,EACZ,WAAmB;IAEnB,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;AAClG,CAAC"}
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAUxD,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,YAAoB,EAAE,KAAa,EAAE,WAAmB;IACtG,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,eAAe,CAAC;QAC/B,KAAK;QACL,WAAW;QACX,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,IAAY,EACZ,WAAmB,EACnB,WAA0C;IAE1C,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAElD,IAAI,YAA8B,CAAC;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC9G,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,qBAAqB,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;aACjC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;aAC/F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC/G,YAAY,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,WAAW,IAAI,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,SAAS,EACT,SAAS,EACT,WAAW;QACT,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;QACrF,CAAC,CAAC,EAAE,CACP,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;AAClG,CAAC"}

package/dist/services/ipControls.js

@@ -1,6 +1,6 @@
 import { db } from "../db/index.js";
 import { applications } from "../db/schema.js";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 /**
  * Per-application IP allow/block lists.
  *
@@ -75,7 +75,7 @@ export async function checkIpAllowed(clientId, ip) {
     const [app] = await db
         .select({ allowedIps: applications.allowedIps, blockedIps: applications.blockedIps })
         .from(applications)
-        .where(eq(applications.clientId, clientId))
+        .where(and(eq(applications.clientId, clientId), eq(applications.isActive, true)))
         .limit(1);
     if (!app)
         return { allowed: true };

package/dist/services/ipControls.js.map

@@ -1 +1 @@
-{"version":3,"file":"ipControls.js","sourceRoot":"","sources":["../../src/services/ipControls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC;;;;;;GAMG;AAEH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1D,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,2CAA2C;QAC3C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAiB,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YACxD,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAE3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;AAC1D,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAA4B,EAAE,EAAsB;IACvF,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC;SACpF,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEnC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"ipControls.js","sourceRoot":"","sources":["../../src/services/ipControls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC;;;;;;GAMG;AAEH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1D,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,2CAA2C;QAC3C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAiB,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YACxD,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAE3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;AAC1D,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAA4B,EAAE,EAAsB;IACvF,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC;SACpF,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEnC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/services/magicLinks.d.ts

@@ -4,12 +4,12 @@ export declare function generateMagicLink(): {
     tokenHash: string;
 };
 export declare function storeMagicLink(userId: string, tokenHash: string, expiresAt: Date): Promise<{
-    id: string;
     createdAt: Date;
-    userId: string;
     expiresAt: Date;
+    id: string;
     tokenHash: string;
     usedAt: Date | null;
+    userId: string;
 }>;
 export declare function consumeMagicLink(token: string): Promise<User | undefined>;
 export declare function magicLinkExpiresAt(): Date;

package/dist/services/mfa.d.ts

@@ -0,0 +1,53 @@
+import type { User } from "../db/schema.js";
+import type { MfaChallengeRepository, MfaFlow, UserRepository } from "../repositories/types.js";
+import { type Result } from "../lib/result.js";
+/**
+ * MFA challenge lifecycle.
+ *
+ * ```text
+ * password_step   -> password valid, MFA enabled  -> requires_mfa
+ * requires_mfa    -> no access or refresh token has been issued
+ * mfa_step        -> factor verified                -> mfa_verified -> authenticated
+ * ```
+ *
+ * The opaque challenge value is only ever returned to the client; the database
+ * stores a SHA-256 hash of it. Every state transition is a single conditional
+ * database update so a challenge can be consumed exactly once.
+ */
+export type MfaFactor = "totp" | "backup_code";
+export interface IssuedMfaChallenge {
+    challenge: string;
+    expiresAt: Date;
+    flow: MfaFlow;
+    clientId?: string;
+}
+export interface MfaChallengeMeta {
+    ipAddress?: string;
+    userAgent?: string;
+}
+export declare function hashMfaChallenge(challenge: string): string;
+export declare function isMfaChallengeUsable(challenge: {
+    status: string;
+    attempts: number;
+    maxAttempts: number;
+    consumedAt: Date | null;
+    expiresAt: Date;
+}, now?: Date): boolean;
+export declare class MfaService {
+    private readonly challenges;
+    private readonly users;
+    constructor(challenges: MfaChallengeRepository, users: UserRepository);
+    createChallenge(user: User, flow: MfaFlow, clientId: string | undefined, meta?: MfaChallengeMeta): Promise<IssuedMfaChallenge>;
+    /**
+     * Verify a second factor for an outstanding challenge and consume it.
+     * No token is issued here: the caller decides what to issue after the state
+     * transition to `mfa_verified` has succeeded.
+     */
+    verifyChallenge(challengeToken: string, code: string, factor: MfaFactor, loadUser: (userId: string) => Promise<User | undefined>): Promise<Result<{
+        challengeId: string;
+        user: User;
+        flow: MfaFlow;
+        clientId?: string;
+    }>>;
+}
+//# sourceMappingURL=mfa.d.ts.map

package/dist/services/mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../../src/services/mfa.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EACV,sBAAsB,EACtB,OAAO,EACP,cAAc,EACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,aAAa,CAAC;AAK/C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,EAC9G,GAAG,OAAa,GACf,OAAO,CAIT;AAED,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFxB,YACmB,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,cAAc,EACpC;IAEE,eAAe,CACnB,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAmC7B;IAED;;;;OAIG;IACG,eAAe,CACnB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,GACtD,OAAO,CAAC,MAAM,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CA+GxF;CACF"}

package/dist/services/mfa.js

@@ -0,0 +1,157 @@
+import crypto from "node:crypto";
+import { config } from "../config.js";
+import { emit } from "./events/bus.js";
+import { verifyBackupCode, verifyUserTotpCode } from "./totp.js";
+import { err, ok } from "../lib/result.js";
+/** Challenges newer than this are not superseded by a repeat password step. */
+const SUPERSEDE_GRACE_MS = 10_000;
+export function hashMfaChallenge(challenge) {
+    return crypto.createHash("sha256").update(challenge).digest("hex");
+}
+export function isMfaChallengeUsable(challenge, now = new Date()) {
+    if (challenge.status !== "requires_mfa" || challenge.consumedAt)
+        return false;
+    if (challenge.attempts >= challenge.maxAttempts)
+        return false;
+    return challenge.expiresAt > now;
+}
+export class MfaService {
+    challenges;
+    users;
+    constructor(challenges, users) {
+        this.challenges = challenges;
+        this.users = users;
+    }
+    async createChallenge(user, flow, clientId, meta = {}) {
+        // Supersede older challenges so a leaked one cannot outlive a fresh
+        // password step. A short grace period is kept so a client that retries
+        // login moments apart does not cancel the attempt it just started.
+        await this.challenges.invalidateUserChallenges(user.id, new Date(Date.now() - SUPERSEDE_GRACE_MS));
+        const challenge = crypto.randomBytes(32).toString("base64url");
+        const expiresAt = new Date(Date.now() + config.MFA_CHALLENGE_TTL_SECONDS * 1000);
+        await this.challenges.create({
+            challengeHash: hashMfaChallenge(challenge),
+            userId: user.id,
+            flow: normalizeFlow(flow),
+            clientId,
+            ipAddress: meta.ipAddress,
+            userAgent: meta.userAgent,
+            expiresAt,
+            maxAttempts: config.MFA_MAX_ATTEMPTS,
+        });
+        await emit({
+            type: "mfa_challenge_created",
+            payload: {
+                userId: user.id,
+                flow,
+                client_id: clientId,
+                ip: meta.ipAddress,
+                expiresAt: expiresAt.toISOString(),
+            },
+        });
+        return { challenge, expiresAt, flow, clientId };
+    }
+    /**
+     * Verify a second factor for an outstanding challenge and consume it.
+     * No token is issued here: the caller decides what to issue after the state
+     * transition to `mfa_verified` has succeeded.
+     */
+    async verifyChallenge(challengeToken, code, factor, loadUser) {
+        const now = new Date();
+        const challenge = await this.challenges.findByHash(hashMfaChallenge(challengeToken));
+        if (!challenge) {
+            await emit({ type: "mfa_challenge_rejected", payload: { reason: "unknown_challenge" } });
+            return err({ code: "MFA_CHALLENGE_INVALID", message: "The MFA challenge is invalid or has expired.", statusCode: 401 });
+        }
+        if (challenge.expiresAt <= now) {
+            await emit({ type: "mfa_challenge_expired", payload: { userId: challenge.userId, reason: "expired" } });
+            return err({ code: "MFA_CHALLENGE_EXPIRED", message: "The MFA challenge is invalid or has expired.", statusCode: 401 });
+        }
+        if (!isMfaChallengeUsable(challenge, now)) {
+            const reason = challenge.status !== "requires_mfa" ? challenge.status : "attempts_exhausted";
+            await emit({
+                type: challenge.status === "requires_mfa" ? "mfa_challenge_failed" : "mfa_challenge_rejected",
+                payload: { userId: challenge.userId, reason },
+            });
+            return err({
+                code: challenge.status === "consumed" ? "MFA_CHALLENGE_REPLAYED" : "MFA_CHALLENGE_LOCKED",
+                message: "The MFA challenge is invalid or has expired.",
+                statusCode: 401,
+            });
+        }
+        const user = await loadUser(challenge.userId);
+        if (!user || !user.isActive) {
+            await this.challenges.invalidateUserChallenges(challenge.userId, now);
+            await emit({ type: "mfa_challenge_failed", payload: { userId: challenge.userId, reason: "account_unusable" } });
+            return err({ code: "ACCOUNT_UNAVAILABLE", message: "This account cannot sign in.", statusCode: 403 });
+        }
+        // The password step refuses these states; the MFA step must not be the
+        // weaker door, or a challenge opened moments earlier would still work.
+        if (user.accountReviewRequired) {
+            await this.challenges.invalidateUserChallenges(user.id, now);
+            await emit({ type: "mfa_challenge_failed", payload: { userId: user.id, reason: "account_review_required" } });
+            return err({ code: "ACCOUNT_REVIEW_REQUIRED", message: "This account is pending review.", statusCode: 403 });
+        }
+        if (user.lockedUntil && user.lockedUntil > new Date()) {
+            await this.challenges.invalidateUserChallenges(user.id, now);
+            await emit({ type: "mfa_challenge_failed", payload: { userId: user.id, reason: "account_locked" } });
+            return err({ code: "ACCOUNT_LOCKED", message: "Account is temporarily locked due to too many failed attempts. Try again later.", statusCode: 403 });
+        }
+        if (!user.totpEnabled) {
+            // The factor was disabled while the challenge was outstanding.
+            await this.challenges.invalidateUserChallenges(user.id, now);
+            await emit({ type: "mfa_challenge_failed", payload: { userId: user.id, reason: "mfa_disabled" } });
+            return err({ code: "MFA_NOT_REQUIRED", message: "Multi-factor authentication is no longer required.", statusCode: 409 });
+        }
+        const verified = factor === "totp"
+            ? (await verifyUserTotpCode(user, code)).valid
+            : await verifyBackupCode(user.id, code);
+        if (!verified) {
+            const updated = await this.challenges.recordFailedAttempt(challenge.id, now);
+            // Count factor failures toward the account lockout so a stolen password
+            // cannot be brute-forced through the MFA step at its own slower pace.
+            const afterFailure = await this.users.recordFailedLogin(user.id);
+            const failedAttempts = afterFailure?.failedLoginAttempts ?? 0;
+            if (failedAttempts >= config.ACCOUNT_LOCKOUT_THRESHOLD) {
+                await this.users.lockAccount(user.id, new Date(Date.now() + config.ACCOUNT_LOCKOUT_DURATION_SECONDS * 1000));
+                await this.challenges.invalidateUserChallenges(user.id, new Date());
+                await emit({
+                    type: "mfa_challenge_failed",
+                    payload: { userId: user.id, factor, reason: "account_locked", attempts: failedAttempts },
+                });
+                return err({ code: "ACCOUNT_LOCKED", message: "Account locked due to too many failed attempts. Try again later.", statusCode: 403 });
+            }
+            await emit({
+                type: "mfa_challenge_failed",
+                payload: {
+                    userId: user.id,
+                    factor,
+                    attempts: updated?.attempts ?? challenge.attempts + 1,
+                    attemptsRemaining: updated ? Math.max(0, updated.maxAttempts - updated.attempts) : 0,
+                },
+            });
+            return err({ code: "MFA_INVALID_CODE", message: "The verification code is invalid.", statusCode: 401 });
+        }
+        const consumed = await this.challenges.consume(challenge.id, new Date());
+        if (!consumed) {
+            // Lost the race against a concurrent verification of the same challenge.
+            await emit({ type: "mfa_challenge_rejected", payload: { userId: user.id, reason: "already_consumed" } });
+            return err({ code: "MFA_CHALLENGE_REPLAYED", message: "The MFA challenge is invalid or has expired.", statusCode: 401 });
+        }
+        await this.users.resetFailedLogins(user.id);
+        await emit({
+            type: "mfa_verified",
+            payload: { userId: user.id, factor, flow: challenge.flow },
+        });
+        return ok({
+            challengeId: challenge.id,
+            user,
+            flow: normalizeFlow(challenge.flow),
+            clientId: challenge.clientId ?? undefined,
+        });
+    }
+}
+function normalizeFlow(flow) {
+    return flow === "token_login" ? "token_login" : "login";
+}
+//# sourceMappingURL=mfa.js.map

package/dist/services/mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../../src/services/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAOjE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,kBAAkB,CAAC;AAkBxD,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAclC,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,SAA8G,EAC9G,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,IAAI,SAAS,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,SAAS,CAAC,SAAS,GAAG,GAAG,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,UAAU;IAEF,UAAU;IACV,KAAK;IAFxB,YACmB,UAAkC,EAClC,KAAqB;0BADrB,UAAU;qBACV,KAAK;IACrB,CAAC;IAEJ,KAAK,CAAC,eAAe,CACnB,IAAU,EACV,IAAa,EACb,QAA4B,EAC5B,IAAI,GAAqB,EAAE;QAE3B,oEAAoE;QACpE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAC5C,IAAI,CAAC,EAAE,EACP,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAC1C,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;QAEjF,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,aAAa,EAAE,gBAAgB,CAAC,SAAS,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;YACzB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;YACT,WAAW,EAAE,MAAM,CAAC,gBAAgB;SACrC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,IAAI;gBACJ,SAAS,EAAE,QAAQ;gBACnB,EAAE,EAAE,IAAI,CAAC,SAAS;gBAClB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;aACnC;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,cAAsB,EACtB,IAAY,EACZ,MAAiB,EACjB,QAAuD;QAEvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;YACzF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1H,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACxG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1H,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAC7F,MAAM,IAAI,CAAC;gBACT,IAAI,EAAE,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,wBAAwB;gBAC7F,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE;aAC9C,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;gBACT,IAAI,EAAE,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB;gBACzF,OAAO,EAAE,8CAA8C;gBACvD,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAChH,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;YAC9G,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YACrG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iFAAiF,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,+DAA+D;YAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YACnG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oDAAoD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3H,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK;YAC9C,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAE7E,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjE,MAAM,cAAc,GAAG,YAAY,EAAE,mBAAmB,IAAI,CAAC,CAAC;YAC9D,IAAI,cAAc,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACvD,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAC1B,IAAI,CAAC,EAAE,EACP,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC,CACtE,CAAC;gBACF,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACpE,MAAM,IAAI,CAAC;oBACT,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE;iBACzF,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kEAAkE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,MAAM,IAAI,CAAC;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM;oBACN,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,SAAS,CAAC,QAAQ,GAAG,CAAC;oBACrD,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;iBACrF;aACF,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,mCAAmC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,yEAAyE;YACzE,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YACzG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3H,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;SAC3D,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC;YACR,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,IAAI;YACJ,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC;YACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,SAAS;SAC1C,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1D,CAAC"}

package/dist/services/oauth2.d.ts

@@ -1,4 +1,5 @@
 import { oauth2AuthorizationCodes, type User, type Application } from "../db/schema.js";
+import { type MfaAssertion } from "./tokens.js";
 export interface AuthorizationCodeInput {
     appId: string;
     userId: string;
@@ -7,6 +8,7 @@ export interface AuthorizationCodeInput {
     redirectUri?: string;
     scopes?: string[];
     nonce?: string;
+    mfaFactor?: MfaAssertion;
 }
 export declare function generateAuthorizationCode(): {
     code: string;
@@ -14,44 +16,46 @@ export declare function generateAuthorizationCode(): {
 };
 export declare function storeAuthorizationCode(input: AuthorizationCodeInput): Promise<{
     code: string;
-    id: string;
-    createdAt: Date;
-    userId: string;
-    expiresAt: Date;
     appId: string;
-    scopes: string[];
-    codeHash: string;
     challenge: string | null;
     challengeMethod: string | null;
-    redirectUri: string | null;
+    codeHash: string;
+    createdAt: Date;
+    expiresAt: Date;
+    id: string;
+    mfaFactor: string | null;
     nonce: string | null;
+    redirectUri: string | null;
+    scopes: string[];
     usedAt: Date | null;
+    userId: string;
 }>;
 export declare function consumeAuthorizationCode(code: string, appId: string, redirectUri?: string): Promise<typeof oauth2AuthorizationCodes.$inferSelect | undefined>;
 export declare function verifyPKCE(challenge: string | null | undefined, method: string | null | undefined, verifier: string): boolean;
 export declare function hasConsent(userId: string, appId: string, requestedScopes: string[]): Promise<boolean>;
 export declare function grantConsent(userId: string, appId: string, scopes: string[]): Promise<{
-    id: string;
-    userId: string;
     appId: string;
+    grantedAt: Date;
+    id: string;
     revokedAt: Date | null;
     scopes: string[];
-    grantedAt: Date;
+    userId: string;
 }>;
 export declare function revokeConsent(userId: string, appId: string): Promise<void>;
 export declare function listConsentsByAppId(appId: string): Promise<{
     id: string;
-    userId: string;
     appId: string;
-    revokedAt: Date | null;
+    userId: string;
     scopes: string[];
     grantedAt: Date;
+    revokedAt: Date | null;
 }[]>;
 export declare function createTokenResponse(user: User, app: Application, scopes: string[], opts?: {
     ip?: string;
     userAgent?: string;
     deviceFingerprint?: string;
     nonce?: string;
+    mfaFactor?: MfaAssertion;
 }): Promise<Record<string, unknown>>;
 export declare function findApplicationByClientId(clientId: string): Promise<Application | undefined>;
 export declare function verifyClientSecret(clientId: string, secret: string): Promise<Application | undefined>;