@hilbras/keystone 1.6.0 → 1.9.0

package/dist/services/totp.js

@@ -1,11 +1,26 @@
 import crypto from "node:crypto";
-import { eq, and, isNull } from "drizzle-orm";
+import { and, eq, gt, isNull, or, sql } from "drizzle-orm";
 import { Secret, TOTP } from "otpauth";
 import { config } from "../config.js";
 import { db } from "../db/index.js";
-import { totpBackupCodes } from "../db/schema.js";
-const ALGORITHM = "aes-256-cbc";
-const IV_LENGTH = 16;
+import { totpBackupCodes, users } from "../db/schema.js";
+/**
+ * TOTP / backup-code primitives.
+ *
+ * The secret-level helpers below operate on raw base32 secrets and are only
+ * used by enrollment flows. Interactive verification must always go through
+ * {@link verifyUserTotpCode} or {@link verifyUserBackupCode}, which load the
+ * user record, decrypt the stored secret, and apply replay protection. Never
+ * pass a user id (or any other identifier) to a secret-level function.
+ */
+const LEGACY_ALGORITHM = "aes-256-cbc";
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
+const SECRET_VERSION_PREFIX = "v2";
+export const TOTP_PERIOD_SECONDS = 30;
+export const TOTP_DIGITS = 6;
+export const BACKUP_CODE_COUNT = 10;
+const CODE_PATTERN = /^[0-9]{6}$/;
 function getEncryptionKey() {
     const raw = config.TOTP_ENCRYPTION_KEY || config.INTERNAL_API_KEY;
     if (raw && raw.length >= 32) {
@@ -13,6 +28,16 @@ function getEncryptionKey() {
     }
     return crypto.createHash("sha256").update(raw || "keystone-totp-default").digest();
 }
+/**
+ * Keyed hash used for backup codes so that a leaked database dump cannot be
+ * brute-forced offline without the server secret.
+ */
+function getPepperKey() {
+    return crypto
+        .createHmac("sha256", getEncryptionKey())
+        .update("keystone-totp-backup-code-pepper")
+        .digest();
+}
 export function generateSecret() {
     return new Secret({ size: 20 }).base32;
 }
@@ -22,75 +47,187 @@ export function buildProvisioningUri(input) {
         issuer,
         label: input.email,
         algorithm: "SHA1",
-        digits: 6,
-        period: 30,
+        digits: TOTP_DIGITS,
+        period: TOTP_PERIOD_SECONDS,
         secret: Secret.fromBase32(input.secret),
     });
     return totp.toString();
 }
-export function verifyTOTP(secret, code, window = 1) {
+function createTotp(secret) {
+    return new TOTP({
+        algorithm: "SHA1",
+        digits: TOTP_DIGITS,
+        period: TOTP_PERIOD_SECONDS,
+        secret: Secret.fromBase32(secret),
+    });
+}
+/**
+ * Validate a raw base32 secret against a code, returning the matching TOTP
+ * time-step counter (or null). The counter is required for replay protection.
+ */
+export function validateTotpCode(secret, code, window = 1, at = Date.now()) {
+    if (!CODE_PATTERN.test(code))
+        return null;
     try {
-        const totp = new TOTP({
-            algorithm: "SHA1",
-            digits: 6,
-            period: 30,
-            secret: Secret.fromBase32(secret),
-        });
-        const delta = totp.validate({ token: code, window });
-        return delta !== null;
+        const totp = createTotp(secret);
+        const delta = totp.validate({ token: code, window, timestamp: at });
+        if (delta === null)
+            return null;
+        return Math.floor(at / 1000 / TOTP_PERIOD_SECONDS) + delta;
     }
     catch {
-        return false;
+        return null;
     }
 }
+/**
+ * Secret-level verification for enrollment flows where the caller already holds
+ * the plaintext secret. Interactive logins must not use this directly.
+ */
+export function verifyTOTP(secret, code, window = 1) {
+    return validateTotpCode(secret, code, window) !== null;
+}
 export function encryptSecret(secret) {
     const key = getEncryptionKey();
     const iv = crypto.randomBytes(IV_LENGTH);
     const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
     const encrypted = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
-    return `${iv.toString("base64url")}:${encrypted.toString("base64url")}`;
+    const tag = cipher.getAuthTag();
+    return [
+        SECRET_VERSION_PREFIX,
+        iv.toString("base64url"),
+        tag.toString("base64url"),
+        encrypted.toString("base64url"),
+    ].join(".");
 }
+/**
+ * Decrypt a stored TOTP secret.
+ *
+ * Two formats exist in the wild:
+ *   - `v2.<iv>.<tag>.<ciphertext>` — AES-256-GCM, written by this version.
+ *   - `<iv>:<ciphertext>`          — legacy AES-256-CBC, still readable so
+ *     authenticators enrolled before the upgrade are not locked out.
+ */
 export function decryptSecret(encrypted) {
-    const [ivBase64, dataBase64] = encrypted.split(":");
-    if (!ivBase64 || !dataBase64)
-        throw new Error("Invalid encrypted secret format");
-    const key = getEncryptionKey();
-    const iv = Buffer.from(ivBase64, "base64url");
-    const encryptedData = Buffer.from(dataBase64, "base64url");
-    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
-    const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
-    return decrypted.toString("utf8");
+    if (encrypted.startsWith(`${SECRET_VERSION_PREFIX}.`)) {
+        const [, ivBase64, tagBase64, dataBase64] = encrypted.split(".");
+        if (!ivBase64 || !tagBase64 || !dataBase64)
+            throw new Error("Invalid encrypted secret format");
+        const decipher = crypto.createDecipheriv(ALGORITHM, getEncryptionKey(), Buffer.from(ivBase64, "base64url"));
+        decipher.setAuthTag(Buffer.from(tagBase64, "base64url"));
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(dataBase64, "base64url")),
+            decipher.final(),
+        ]);
+        return decrypted.toString("utf8");
+    }
+    if (encrypted.includes(":")) {
+        const [ivBase64, dataBase64] = encrypted.split(":");
+        if (!ivBase64 || !dataBase64)
+            throw new Error("Invalid encrypted secret format");
+        const decipher = crypto.createDecipheriv(LEGACY_ALGORITHM, getEncryptionKey(), Buffer.from(ivBase64, "base64url"));
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(dataBase64, "base64url")),
+            decipher.final(),
+        ]);
+        return decrypted.toString("utf8");
+    }
+    throw new Error("Invalid encrypted secret format");
+}
+/**
+ * Verify a TOTP code for a user using the user's decrypted secret, and consume
+ * the time-step so a captured code cannot be replayed.
+ */
+export async function verifyUserTotpCode(user, code, options = {}) {
+    const requireEnabled = options.requireEnabled ?? true;
+    if (requireEnabled && !user.totpEnabled)
+        return { valid: false };
+    if (!user.totpSecret)
+        return { valid: false };
+    if (!CODE_PATTERN.test(code))
+        return { valid: false };
+    let secret;
+    try {
+        secret = decryptSecret(user.totpSecret);
+    }
+    catch {
+        return { valid: false };
+    }
+    const counter = validateTotpCode(secret, code, options.window ?? 1);
+    if (counter === null)
+        return { valid: false };
+    if (options.consume === false)
+        return { valid: true, counter };
+    const consumed = await consumeTotpStep(user.id, counter);
+    if (!consumed)
+        return { valid: false };
+    return { valid: true, counter };
+}
+/**
+ * Atomically advance the user's last accepted TOTP step. Returns false when the
+ * step was already consumed (replay) or is older than the recorded step.
+ */
+async function consumeTotpStep(userId, counter) {
+    const rows = await db
+        .update(users)
+        .set({ totpLastStep: counter })
+        .where(and(eq(users.id, userId), or(isNull(users.totpLastStep), sql `${users.totpLastStep} < ${counter}`)))
+        .returning({ id: users.id });
+    return rows.length === 1;
+}
+export function normalizeBackupCode(code) {
+    return code.replace(/[\s-]/g, "").trim().toUpperCase();
+}
+export function hashBackupCode(code) {
+    return crypto
+        .createHmac("sha256", getPepperKey())
+        .update(normalizeBackupCode(code))
+        .digest("hex");
 }
 export function generateBackupCodes() {
     const codes = [];
     const hashes = [];
-    for (let i = 0; i < 10; i++) {
-        const code = crypto.randomBytes(4).toString("hex").toLowerCase();
+    for (let i = 0; i < BACKUP_CODE_COUNT; i++) {
+        // 80 bits of entropy, formatted for legibility.
+        const raw = crypto.randomBytes(10).toString("hex").toUpperCase();
+        const code = `${raw.slice(0, 5)}-${raw.slice(5, 10)}-${raw.slice(10, 15)}-${raw.slice(15, 20)}`;
         codes.push(code);
-        hashes.push(crypto.createHash("sha256").update(code).digest("hex"));
+        hashes.push(hashBackupCode(code));
     }
     return { codes, hashes };
 }
+function backupCodeExpiry(from = new Date()) {
+    return new Date(from.getTime() + config.TOTP_BACKUP_CODE_TTL_SECONDS * 1000);
+}
+/**
+ * Replace a user's backup codes atomically so a regeneration failure can never
+ * leave the account without codes.
+ */
 export async function storeBackupCodes(userId, codeHashes) {
     if (codeHashes.length === 0)
         return;
+    const expiresAt = backupCodeExpiry();
+    await db.transaction(async (tx) => {
+        await tx.delete(totpBackupCodes).where(eq(totpBackupCodes.userId, userId));
+        await tx.insert(totpBackupCodes).values(codeHashes.map((codeHash) => ({ userId, codeHash, expiresAt })));
+    });
+}
+export async function deleteBackupCodes(userId) {
     await db.delete(totpBackupCodes).where(eq(totpBackupCodes.userId, userId));
-    await db.insert(totpBackupCodes).values(codeHashes.map((hash) => ({ userId, codeHash: hash })));
 }
+/**
+ * Consume a backup code with a single conditional update so concurrent attempts
+ * can never both succeed, and expired codes are rejected.
+ */
 export async function verifyBackupCode(userId, code) {
-    const codeHash = crypto.createHash("sha256").update(code).digest("hex");
-    const now = new Date();
-    const [record] = await db
-        .select()
-        .from(totpBackupCodes)
-        .where(and(eq(totpBackupCodes.userId, userId), eq(totpBackupCodes.codeHash, codeHash), isNull(totpBackupCodes.usedAt)))
-        .limit(1);
-    if (!record)
+    if (typeof code !== "string" || code.trim().length === 0)
         return false;
-    await db
+    const codeHash = hashBackupCode(code);
+    const now = new Date();
+    const consumed = await db
         .update(totpBackupCodes)
         .set({ usedAt: now })
-        .where(eq(totpBackupCodes.id, record.id));
-    return true;
+        .where(and(eq(totpBackupCodes.userId, userId), eq(totpBackupCodes.codeHash, codeHash), isNull(totpBackupCodes.usedAt), gt(totpBackupCodes.expiresAt, now)))
+        .returning({ id: totpBackupCodes.id });
+    return consumed.length === 1;
 }
 //# sourceMappingURL=totp.js.map

package/dist/services/totp.js.map

@@ -1 +1 @@
-{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/services/totp.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAClE,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAyD;IAC5F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,MAAM,GAAG,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;YACpB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAoB;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CACrC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAC/B,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,EAAE;SACL,MAAM,CAAC,eAAe,CAAC;SACvB,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5C,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/services/totp.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAEpE;;;;;;;;GAQG;AAEH,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAClE,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY;IACnB,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;SACxC,MAAM,CAAC,kCAAkC,CAAC;SAC1C,MAAM,EAAE,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAyD;IAC5F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,IAAI,IAAI,CAAC;QACd,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY,EAAE,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;IACxF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,mBAAmB,CAAC,GAAG,KAAK,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,MAAM,GAAG,CAAC;IACjE,OAAO,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACL,qBAAqB;QACrB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QACxB,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzB,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;KAChC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,qBAAqB,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAE/F,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5G,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACrD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAEjF,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QACnH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACrD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAqD,EACrD,IAAY,EACZ,OAAO,GAAqE,EAAE;IAE9E,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;IACtD,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEtD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAE9C,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAE/D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,OAAe;IAC5D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;SAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EACpB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,CAAA,GAAG,KAAK,CAAC,YAAY,MAAM,OAAO,EAAE,CAAC,CACxE,CACF;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;SACpC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;SACjC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,gDAAgD;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAI,GAAG,IAAI,IAAI,EAAE;IACzC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,UAAoB;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAChC,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3E,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc;IACpD,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,IAAY;IACjE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,eAAe,CAAC;SACvB,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,EAC9B,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CACnC,CACF;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/dist/services/users.d.ts

@@ -5,9 +5,29 @@ export interface OAuthClaims {
     username?: string;
     name?: string;
     picture?: string;
+    emailVerified?: boolean;
     email_verified?: boolean;
 }
 export declare function findUserByEmail(email: string): Promise<User | undefined>;
+export declare function findIdentityProviderByType(providerType: string): Promise<{
+    id: string;
+    orgId: string;
+    providerType: string;
+    name: string;
+    issuer: string | null;
+    authorizationEndpoint: string | null;
+    tokenEndpoint: string | null;
+    userinfoEndpoint: string | null;
+    jwksUri: string | null;
+    clientId: string | null;
+    clientSecretEncrypted: string | null;
+    scopes: string[];
+    attributeMapping: unknown;
+    isActive: boolean;
+    isFederation: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}>;
 export declare function findUserById(id: string): Promise<User | undefined>;
 export declare function findUserByZitadelId(zitadelUserId: string): Promise<User | undefined>;
 export declare function createPasswordUser(input: {
@@ -21,19 +41,7 @@ export declare function createPasswordUser(input: {
 export declare function upsertOAuthUser(claims: OAuthClaims, providerType: string, providerId?: string): Promise<User>;
 export declare function linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string, profile?: Record<string, unknown>): Promise<void>;
 export declare function updateUserLastSeen(id: string): Promise<void>;
-export declare function findOrCreateUserByEmail(input: {
-    email: string;
-    name?: string;
-    username?: string;
-}): Promise<User>;
 export declare function listUsersByOrg(orgId: string): Promise<User[]>;
-export declare function updateUser(userId: string, updates: Partial<{
-    name: string;
-    username: string;
-    role: string;
-    emailVerified: boolean;
-}>): Promise<User | undefined>;
-export declare function deactivateUser(userId: string): Promise<void>;
 export declare function slugifyUsername(input: string): string;
 export declare function ensureUniqueUsername(base: string, excludeId?: string): Promise<string>;
 //# sourceMappingURL=users.d.ts.map

package/dist/services/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4D,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEtG,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG9E;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAGxE;AAED,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG1F;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA2Ef;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhB;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAOnE;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC,GACD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAO3B;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5F"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4D,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEtG,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG9E;AAED,wBAAsB,0BAA0B,CAAC,YAAY,EAAE,MAAM;;;;;;;;;;;;;;;;;;GAOpE;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAGxE;AAED,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG1F;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAoEf;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAOnE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5F"}

package/dist/services/users.js

@@ -1,10 +1,18 @@
-import { eq, sql } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { users, userIdentities, identityProviders, orgMemberships } from "../db/schema.js";
 export async function findUserByEmail(email) {
     const [user] = await db.select().from(users).where(eq(users.email, email.toLowerCase())).limit(1);
     return user;
 }
+export async function findIdentityProviderByType(providerType) {
+    const [provider] = await db
+        .select()
+        .from(identityProviders)
+        .where(and(eq(identityProviders.providerType, providerType), eq(identityProviders.isActive, true)))
+        .limit(1);
+    return provider;
+}
 export async function findUserById(id) {
     const [user] = await db.select().from(users).where(eq(users.id, id)).limit(1);
     return user;
@@ -29,18 +37,24 @@ export async function createPasswordUser(input) {
     return user;
 }
 export async function upsertOAuthUser(claims, providerType, providerId) {
+    const verified = claims.emailVerified === true || claims.email_verified === true;
+    if (!verified) {
+        throw new Error("Identity provider did not verify the email address");
+    }
     const username = slugifyUsername(claims.username || claims.name || claims.email.split("@")[0]);
     const email = claims.email.toLowerCase().trim();
-    // Prefer linking by external identity when a provider record is available.
+    // Only an explicit provider/subject link may identify an existing account.
     if (providerId) {
         const [existingLink] = await db
             .select({ user: users })
             .from(userIdentities)
-            .where(eq(userIdentities.externalSub, claims.sub))
+            .where(and(eq(userIdentities.providerId, providerId), eq(userIdentities.externalSub, claims.sub)))
             .innerJoin(users, eq(userIdentities.userId, users.id))
             .limit(1);
         if (existingLink) {
             const existing = existingLink.user;
+            if (!existing.isActive || existing.accountReviewRequired)
+                throw new Error("User account is unavailable");
             const [updated] = await db
                 .update(users)
                 .set({
@@ -48,7 +62,7 @@ export async function upsertOAuthUser(claims, providerType, providerId) {
                 username: await ensureUniqueUsername(username, existing.id),
                 name: claims.name || existing.name,
                 avatarUrl: claims.picture || existing.avatarUrl,
-                emailVerified: claims.email_verified ?? existing.emailVerified ?? true,
+                emailVerified: true,
                 provider: providerType,
                 updatedAt: sql `now()`,
             })
@@ -57,23 +71,11 @@ export async function upsertOAuthUser(claims, providerType, providerId) {
             return updated;
         }
     }
-    // Fall back to email-based matching.
-    const existing = await findUserByEmail(email);
-    if (existing) {
-        const [updated] = await db
-            .update(users)
-            .set({
-            email,
-            username: await ensureUniqueUsername(username, existing.id),
-            name: claims.name || existing.name,
-            avatarUrl: claims.picture || existing.avatarUrl,
-            emailVerified: claims.email_verified ?? existing.emailVerified ?? true,
-            provider: providerType,
-            updatedAt: sql `now()`,
-        })
-            .where(eq(users.id, existing.id))
-            .returning();
-        return updated;
+    // Email equality alone is never proof of identity. Existing users must be
+    // linked through an explicitly provisioned provider/subject identity.
+    const existingByEmail = await findUserByEmail(email);
+    if (existingByEmail) {
+        throw new Error("Existing account requires an explicit external identity link");
     }
     const [user] = await db
         .insert(users)
@@ -82,7 +84,7 @@ export async function upsertOAuthUser(claims, providerType, providerId) {
         username: await ensureUniqueUsername(username),
         name: claims.name || username,
         avatarUrl: claims.picture,
-        emailVerified: claims.email_verified ?? true,
+        emailVerified: true,
         provider: providerType,
     })
         .returning();
@@ -117,24 +119,6 @@ export async function linkUserIdentity(userId, providerId, providerType, externa
 export async function updateUserLastSeen(id) {
     await db.update(users).set({ updatedAt: sql `now()` }).where(eq(users.id, id));
 }
-export async function findOrCreateUserByEmail(input) {
-    const existing = await findUserByEmail(input.email);
-    if (existing)
-        return existing;
-    const baseUsername = input.username || input.email.split("@")[0];
-    const username = await ensureUniqueUsername(slugifyUsername(baseUsername));
-    const [user] = await db
-        .insert(users)
-        .values({
-        email: input.email.toLowerCase().trim(),
-        username,
-        name: input.name || username,
-        provider: "password",
-        emailVerified: false,
-    })
-        .returning();
-    return user;
-}
 export async function listUsersByOrg(orgId) {
     const rows = await db
         .select({ user: users })
@@ -143,17 +127,6 @@ export async function listUsersByOrg(orgId) {
         .where(eq(orgMemberships.orgId, orgId));
     return rows.map((r) => r.user);
 }
-export async function updateUser(userId, updates) {
-    const [updated] = await db
-        .update(users)
-        .set({ ...updates, updatedAt: sql `now()` })
-        .where(eq(users.id, userId))
-        .returning();
-    return updated;
-}
-export async function deactivateUser(userId) {
-    await db.update(users).set({ emailVerified: false, updatedAt: sql `now()` }).where(eq(users.id, userId));
-}
 export function slugifyUsername(input) {
     return input
         .toLowerCase()

package/dist/services/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAa,MAAM,iBAAiB,CAAC;AAWtG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAOxC;IACC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ;QACzC,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;KAC3C,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAmB,EACnB,YAAoB,EACpB,UAAmB;IAEnB,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,2EAA2E;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,EAAE;aAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;aACjD,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACrD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC;gBACH,KAAK;gBACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC3D,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;gBAClC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;gBAC/C,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI;gBACtE,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,GAAG,CAAA,OAAO;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAChC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC;YACH,KAAK;YACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;YAClC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;YAC/C,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI;YACtE,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,GAAG,CAAA,OAAO;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;aAChC,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK;QACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC;QAC9C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;QAC7B,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;QAC5C,QAAQ,EAAE,YAAY;KACvB,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU;YACV,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,GAAG;YACvB,KAAK;YACL,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,UAAkB,EAClB,YAAoB,EACpB,WAAmB,EACnB,KAAc,EACd,OAAiC;IAEjC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,MAAM;QACN,UAAU;QACV,YAAY;QACZ,WAAW;QACX,KAAK;QACL,OAAO,EAAE,OAAO,IAAI,EAAE;KACvB,CAAC;SACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3E,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;QACvC,QAAQ;QACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ;QAC5B,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,KAAK;KACrB,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACvB,IAAI,CAAC,KAAK,CAAC;SACX,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;SAC9D,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,OAKE;IAEF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;SAC1C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC3B,SAAS,EAAE,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IACzE,IAAI,QAAQ,GAAG,IAAI,IAAI,MAAM,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAa,MAAM,iBAAiB,CAAC;AAYtG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,YAAoB;IACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAClG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAOxC;IACC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ;QACzC,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;KAC3C,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAmB,EACnB,YAAoB,EACpB,UAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC;IACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,2EAA2E;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,EAAE;aAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;aACjG,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACrD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,qBAAqB;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACzG,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC;gBACH,KAAK;gBACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC3D,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;gBAClC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;gBAC/C,aAAa,EAAE,IAAI;gBACnB,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,GAAG,CAAA,OAAO;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAChC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK;QACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC;QAC9C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;QAC7B,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,YAAY;KACvB,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU;YACV,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,GAAG;YACvB,KAAK;YACL,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,UAAkB,EAClB,YAAoB,EACpB,WAAmB,EACnB,KAAc,EACd,OAAiC;IAEjC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,MAAM;QACN,UAAU;QACV,YAAY;QACZ,WAAW;QACX,KAAK;QACL,OAAO,EAAE,OAAO,IAAI,EAAE;KACvB,CAAC;SACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACvB,IAAI,CAAC,KAAK,CAAC;SACX,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;SAC9D,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IACzE,IAAI,QAAQ,GAAG,IAAI,IAAI,MAAM,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/services/webauthn.d.ts

@@ -18,18 +18,18 @@ export declare function verifyAuthentication(response: AuthenticationResponseJSO
     verified: boolean;
     user: {
         id: string;
-        name: string | null;
-        plan: string;
-        createdAt: Date;
-        updatedAt: Date;
         zitadelUserId: string | null;
         email: string;
         username: string;
+        name: string | null;
         avatarUrl: string | null;
         emailVerified: boolean;
         emailVerifiedToken: string | null;
         provider: string;
+        plan: string;
         role: string;
+        isActive: boolean;
+        accountReviewRequired: boolean;
         defaultOrgId: string | null;
         phoneNumber: string | null;
         phoneVerified: boolean;
@@ -38,8 +38,12 @@ export declare function verifyAuthentication(response: AuthenticationResponseJSO
         totpSecret: string | null;
         totpEnabled: boolean;
         totpVerifiedAt: Date | null;
+        totpLastStep: number | null;
         failedLoginAttempts: number;
         lockedUntil: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
     };
+    credentialRegisteredAt: Date;
 }>;
 //# sourceMappingURL=webauthn.d.ts.map

package/dist/services/webauthn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/services/webauthn.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAEhC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAGL,KAAK,IAAI,EACT,KAAK,kBAAkB,IAAI,oBAAoB,EAChD,MAAM,iBAAiB,CAAC;AAczB,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAWD,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAMjF;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAE3F;AAED,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAOxG;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,IAAI,oFAexD;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,wBAAwB,EAClC,iBAAiB,EAAE,MAAM,EACzB,UAAU,CAAC,EAAE,MAAM;;GA2BpB;AAED,wBAAsB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,mFA2B9D;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCzG"}
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/services/webauthn.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAEhC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAGL,KAAK,IAAI,EACT,KAAK,kBAAkB,IAAI,oBAAoB,EAChD,MAAM,iBAAiB,CAAC;AAczB,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAWD,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAMjF;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAE3F;AAED,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAOxG;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,IAAI,oFAexD;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,wBAAwB,EAClC,iBAAiB,EAAE,MAAM,EACzB,UAAU,CAAC,EAAE,MAAM;;GA2BpB;AAED,wBAAsB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,mFA2B9D;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCzG"}

package/dist/services/webauthn.js

@@ -91,7 +91,7 @@ export async function buildAuthenticationOptions(email) {
     let userId;
     if (email) {
         const [user] = await db.select().from(users).where(eq(users.email, email.toLowerCase())).limit(1);
-        if (user) {
+        if (user && user.isActive) {
             userId = user.id;
             const credentials = await listCredentialsByUser(user.id);
             allowCredentials = credentials.map((c) => ({
@@ -139,9 +139,9 @@ export async function verifyAuthentication(response, expectedChallenge) {
     })
         .where(eq(webauthnCredentials.id, credential.id));
     const [user] = await db.select().from(users).where(eq(users.id, credential.userId)).limit(1);
-    if (!user) {
-        throw new Error("User not found");
+    if (!user?.isActive) {
+        throw new Error("User account is deactivated");
     }
-    return { verified: true, user };
+    return { verified: true, user, credentialRegisteredAt: credential.createdAt };
 }
 //# sourceMappingURL=webauthn.js.map

package/dist/services/webauthn.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/services/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAI7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,KAAK,GAGN,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC,SAAS,IAAI;IACX,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5E,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AAC/B,CAAC;AAED,SAAS,MAAM;IACb,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAQD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;AAExD,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;YAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,iBAAiB,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACxF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,YAAoB;IAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;SACzD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAU;IACvD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,EAAE;QACZ,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;QAC3C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC;QACpC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,eAAe,EAAE,MAAM;QACvB,sBAAsB,EAAE;YACtB,WAAW,EAAE,WAAW;YACxB,gBAAgB,EAAE,WAAW;SAC9B;KACF,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAU,EACV,QAAkC,EAClC,iBAAyB,EACzB,UAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;QACpD,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,MAAM,EAAE;QACxB,YAAY,EAAE,IAAI,EAAE;QACpB,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;QAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClE,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAmC;QAC3E,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,UAAU,EAAE,UAAU,IAAI,IAAI;KAC/B,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAc;IAC7D,IAAI,gBAES,CAAC;IACd,IAAI,MAA0B,CAAC;IAE/B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzD,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzC,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,IAAI,EAAE,YAAqB;gBAC3B,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAmC;aACnE,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,IAAI,EAAE,IAAI,EAAE;QACZ,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC;QAClC,gBAAgB;QAChB,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAoC,EAAE,iBAAyB;IACxG,MAAM,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;QACtD,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,MAAM,EAAE;QACxB,YAAY,EAAE,IAAI,EAAE;QACpB,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;YACzD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAmC;SAC5E;QACD,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,mBAAmB,CAAC;SAC3B,GAAG,CAAC;QACH,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,UAAU;QACnD,UAAU,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEpD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/services/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAI7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,KAAK,GAGN,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC,SAAS,IAAI;IACX,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5E,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AAC/B,CAAC;AAED,SAAS,MAAM;IACb,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAQD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;AAExD,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;YAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,iBAAiB,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACxF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,YAAoB;IAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;SACzD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAU;IACvD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,EAAE;QACZ,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;QAC3C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC;QACpC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,eAAe,EAAE,MAAM;QACvB,sBAAsB,EAAE;YACtB,WAAW,EAAE,WAAW;YACxB,gBAAgB,EAAE,WAAW;SAC9B;KACF,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAU,EACV,QAAkC,EAClC,iBAAyB,EACzB,UAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;QACpD,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,MAAM,EAAE;QACxB,YAAY,EAAE,IAAI,EAAE;QACpB,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;QAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClE,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAA6B;QACrE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,UAAU,EAAE,UAAU,IAAI,IAAI;KAC/B,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAc;IAC7D,IAAI,gBAES,CAAC;IACd,IAAI,MAA0B,CAAC;IAE/B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzD,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzC,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,IAAI,EAAE,YAAqB;gBAC3B,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAA6B;aAC7D,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,IAAI,EAAE,IAAI,EAAE;QACZ,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC;QAClC,gBAAgB;QAChB,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAoC,EAAE,iBAAyB;IACxG,MAAM,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;QACtD,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,MAAM,EAAE;QACxB,YAAY,EAAE,IAAI,EAAE;QACpB,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;YACzD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAA6B;SACtE;QACD,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,mBAAmB,CAAC;SAC3B,GAAG,CAAC;QACH,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,UAAU;QACnD,UAAU,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEpD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;AAChF,CAAC"}