@hilbras/keystone 1.6.0 → 2.5.0

package/dist/services/enterpriseSso.js

@@ -1,11 +1,42 @@
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import { db } from "../db/index.js";
-import { users, orgMemberships } from "../db/schema.js";
+import { users, orgMemberships, ssoIdentityLinks } from "../db/schema.js";
 import { slugifyUsername, ensureUniqueUsername } from "./users.js";
-export async function provisionEnterpriseUser(orgId, claims, defaultRole = "member") {
+import { emit } from "./events/bus.js";
+export async function provisionEnterpriseUser(orgId, claims, connection, defaultRole = "member") {
     const email = claims.email.toLowerCase().trim();
-    let [user] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+    const externalId = claims.externalId.trim();
+    if (!["owner", "admin", "member"].includes(defaultRole)) {
+        throw new Error("Invalid organization role");
+    }
+    if (!email || !externalId) {
+        throw new Error("Enterprise SSO requires a verified email and external subject");
+    }
+    const [link] = await db
+        .select()
+        .from(ssoIdentityLinks)
+        .where(and(eq(ssoIdentityLinks.connectionType, connection.type), eq(ssoIdentityLinks.connectionId, connection.id), eq(ssoIdentityLinks.orgId, orgId), eq(ssoIdentityLinks.externalSub, externalId)))
+        .limit(1);
+    const [byEmail] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+    if (byEmail && link && byEmail.id !== link.userId) {
+        throw new Error("Enterprise SSO subject is already linked to a different user");
+    }
+    if (byEmail?.role === "owner") {
+        throw new Error("Platform owners cannot authenticate through tenant SSO");
+    }
+    if (byEmail?.accountReviewRequired) {
+        throw new Error("User account requires platform review");
+    }
+    let user = byEmail;
+    if (link) {
+        if (!user) {
+            [user] = await db.select().from(users).where(eq(users.id, link.userId)).limit(1);
+        }
+    }
     if (!user) {
+        if (byEmail || link) {
+            throw new Error("Existing enterprise users require an explicit identity link");
+        }
         const baseUsername = claims.username || claims.email.split("@")[0];
         const username = await ensureUniqueUsername(slugifyUsername(baseUsername));
         [user] = await db
@@ -18,17 +49,55 @@ export async function provisionEnterpriseUser(orgId, claims, defaultRole = "memb
             emailVerified: true,
         })
             .returning();
+        await db.insert(ssoIdentityLinks).values({
+            connectionType: connection.type,
+            connectionId: connection.id,
+            orgId,
+            userId: user.id,
+            externalSub: externalId,
+        });
+    }
+    if (user?.role === "owner") {
+        throw new Error("Platform owners cannot authenticate through tenant SSO");
+    }
+    if (user?.accountReviewRequired) {
+        throw new Error("User account requires platform review");
+    }
+    if (byEmail && !link) {
+        throw new Error("Existing enterprise users require an explicit identity link");
+    }
+    if (!user.isActive) {
+        throw new Error("User account is deactivated");
     }
     const [existingMembership] = await db
         .select()
         .from(orgMemberships)
-        .where(eq(orgMemberships.userId, user.id))
+        .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, user.id)))
         .limit(1);
     if (!existingMembership) {
-        await db.insert(orgMemberships).values({
+        if (byEmail || link) {
+            throw new Error("Existing users must be explicitly invited before enterprise SSO login");
+        }
+        await db
+            .insert(orgMemberships)
+            .values({
             orgId,
             userId: user.id,
             role: defaultRole,
+        })
+            .onConflictDoNothing({ target: [orgMemberships.orgId, orgMemberships.userId] });
+        await emit({
+            type: "organization_member_invited",
+            payload: {
+                userId: user.id,
+                orgId,
+                metadata: {
+                    targetUserId: user.id,
+                    previousRole: null,
+                    newRole: defaultRole,
+                    action: "enterprise_sso_provisioned",
+                },
+            },
         });
     }
     return user;

package/dist/services/enterpriseSso.js.map

@@ -1 +1 @@
-{"version":3,"file":"enterpriseSso.js","sourceRoot":"","sources":["../../src/services/enterpriseSso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAqB,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AASnE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,MAA4B,EAC5B,cAA4C,QAAQ;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAE3E,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACd,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC;YACN,KAAK;YACL,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;YAC7B,QAAQ,EAAE,gBAAgB;YAC1B,aAAa,EAAE,IAAI;SACpB,CAAC;aACD,SAAS,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAG,MAAM,EAAE;SAClC,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YACrC,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,0DAA0D;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"enterpriseSso.js","sourceRoot":"","sources":["../../src/services/enterpriseSso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAqB,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAcvC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,MAA4B,EAC5B,UAAuC,EACvC,WAAW,GAAiC,QAAQ;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,EACpD,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC,EAChD,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,EACjC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAC7C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,EAAE,qBAAqB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3E,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACd,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC;YACN,KAAK;YACL,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;YAC7B,QAAQ,EAAE,gBAAgB;YAC1B,aAAa,EAAE,IAAI;SACpB,CAAC;aACD,SAAS,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;YACvC,cAAc,EAAE,UAAU,CAAC,IAAI;YAC/B,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,WAAW,EAAE,UAAU;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,EAAE,qBAAqB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,GAAG,MAAM,EAAE;SAClC,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;SAC/E,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,EAAE;aACL,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,WAAW;SAClB,CAAC;aACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK;gBACL,QAAQ,EAAE;oBACR,YAAY,EAAE,IAAI,CAAC,EAAE;oBACrB,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,WAAW;oBACpB,MAAM,EAAE,4BAA4B;iBACrC;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,0DAA0D;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/services/events/subscribers/auditLog.js

@@ -11,7 +11,7 @@ export async function auditLogSubscriber(event) {
             event: `${event.type}:v${event.version}`,
             ipAddress: ip ?? null,
             userAgent: userAgent ?? null,
-            metadata: { ...(metadata ?? {}), eventVersion: event.version },
+            metadata: { ...metadata, eventVersion: event.version },
         });
     }
     catch (err) {

package/dist/services/events/subscribers/auditLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACnF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;YACxC,SAAS,EAAE,EAAE,IAAI,IAAI;YACrB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}
+{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../../../src/services/events/subscribers/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACnF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,MAAM,IAAI,IAAI;YACtB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;YACxC,SAAS,EAAE,EAAE,IAAI,IAAI;YACrB,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/services/events/types.d.ts

@@ -1,3 +1,9 @@
+export interface EventContext {
+    requestId?: string;
+    ip?: string;
+    userAgent?: string;
+    appId?: string;
+}
 export interface EventPayload {
     userId?: string;
     orgId?: string;
@@ -17,5 +23,5 @@ export interface KeystoneEvent {
 export type EventHandler = (event: KeystoneEvent) => void | Promise<void>;
 export declare const EVENT_VERSIONS: Record<string, number>;
 export declare function eventVersion(type: string): number;
-export type AuditEventType = "user_registered" | "user_login" | "user_login_failed" | "user_logout" | "token_refresh" | "token_refresh_failed" | "oauth_callback" | "oauth2_authorize" | "oauth2_token" | "oauth2_client_credentials" | "oauth2_revoke" | "oauth2_consent" | "password_reset_requested" | "password_reset_completed" | "api_key_created" | "api_key_revoked" | "api_key_used" | "service_account_created" | "service_account_updated" | "unauthorized_access" | "organization_created" | "organization_updated" | "organization_plan_updated" | "billing_customer_provisioned" | "organization_member_invited" | "organization_member_removed" | "organization_member_role_updated" | "permission_created" | "permission_deleted" | "application_created" | "application_updated" | "magic_link_sent" | "magic_link_verified" | "totp_enrolled" | "totp_verify_failed" | "totp_enabled" | "totp_disable_failed" | "totp_disabled" | "webauthn_registered" | "webauthn_authenticated" | "new_device_detected" | "sms_otp_sent" | "sms_otp_verify_failed" | "sms_otp_verified" | "authz_check" | "saml_sso_login" | "oidc_enterprise_login" | "saml_connection_created" | "saml_connection_deleted" | "oidc_connection_created" | "oidc_connection_deleted" | "scim_user_created" | "scim_user_updated" | "scim_user_deleted" | "federation_login" | "workflow_triggered" | "workflow_step_executed" | "workflow_created" | "workflow_deleted" | "platform_user_updated" | "platform_user_deactivated" | "platform_signing_key_rotated" | "platform_plugin_unregistered" | "platform_feature_flag_updated" | "platform_feature_flag_deleted" | "profile_updated" | "email_verification_sent" | "email_verified" | "platform_webhook_created" | "platform_webhook_updated" | "platform_webhook_deleted" | "platform_webhook_secret_rotated" | "federation_identity_linked" | "user_token_login" | "session_revoked" | "sessions_revoked_all";
+export type AuditEventType = "user_registered" | "user_login" | "user_login_failed" | "user_logout" | "token_refresh" | "token_refresh_failed" | "oauth_callback" | "oauth2_authorize" | "oauth2_token" | "oauth2_refresh" | "oauth2_refresh_failed" | "oauth2_client_credentials" | "oauth2_revoke" | "oauth2_consent" | "password_reset_requested" | "password_reset_completed" | "api_key_created" | "api_key_revoked" | "api_key_used" | "service_account_created" | "service_account_updated" | "magic_link_replayed" | "sms_otp_replayed" | "password_reset_token_replayed" | "service_account_certificate_bound" | "service_account_certificate_unbound" | "service_account_revoked" | "unauthorized_access" | "organization_created" | "organization_updated" | "organization_plan_updated" | "billing_customer_provisioned" | "organization_member_invited" | "organization_member_removed" | "organization_member_role_updated" | "permission_created" | "permission_deleted" | "permission_role_updated" | "application_created" | "application_updated" | "magic_link_sent" | "magic_link_verified" | "totp_enrolled" | "totp_verify_failed" | "totp_enabled" | "totp_disable_failed" | "totp_disabled" | "webauthn_registered" | "webauthn_authenticated" | "new_device_detected" | "sms_otp_sent" | "sms_otp_verify_failed" | "sms_otp_verified" | "authz_check" | "saml_sso_login" | "oidc_enterprise_login" | "saml_connection_created" | "saml_connection_deleted" | "oidc_connection_created" | "oidc_connection_deleted" | "scim_user_created" | "scim_user_updated" | "scim_user_deleted" | "federation_login" | "workflow_triggered" | "workflow_step_executed" | "workflow_created" | "workflow_deleted" | "workflow_blocked" | "platform_user_updated" | "platform_role_changed" | "platform_user_deactivated" | "platform_account_reviewed" | "platform_signing_key_rotated" | "platform_plugin_unregistered" | "platform_feature_flag_updated" | "platform_feature_flag_deleted" | "profile_updated" | "email_verification_sent" | "email_verified" | "platform_webhook_created" | "platform_webhook_updated" | "platform_webhook_deleted" | "platform_webhook_secret_rotated" | "federation_identity_linked" | "user_token_login" | "session_revoked" | "sessions_revoked_all" | "mfa_challenge_created" | "mfa_challenge_failed" | "mfa_challenge_expired" | "mfa_challenge_rejected" | "mfa_verified" | "mfa_bypass_blocked" | "mfa_backup_code_regenerated" | "scim_connection_created" | "scim_connection_rotated" | "scim_connection_revoked" | "scim_authentication_failed" | "scim_access_denied" | "scim_group_created" | "scim_group_updated" | "scim_group_deleted";
 //# sourceMappingURL=types.d.ts.map

package/dist/services/events/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,6BAA6B,GAC7B,kCAAkC,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,2BAA2B,GAC3B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,iCAAiC,GACjC,4BAA4B,GAC5B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAEF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,uBAAuB,GACvB,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,qBAAqB,GACrB,kBAAkB,GAClB,+BAA+B,GAC/B,mCAAmC,GACnC,qCAAqC,GACrC,yBAAyB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,sBAAsB,GACtB,2BAA2B,GAC3B,8BAA8B,GAC9B,6BAA6B,GAC7B,6BAA6B,GAC7B,kCAAkC,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,uBAAuB,GACvB,kBAAkB,GAClB,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,2BAA2B,GAC3B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,iCAAiC,GACjC,4BAA4B,GAC5B,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,GACtB,uBAAuB,GACvB,sBAAsB,GACtB,uBAAuB,GACvB,wBAAwB,GACxB,cAAc,GACd,oBAAoB,GACpB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,yBAAyB,GACzB,4BAA4B,GAC5B,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,CAAC"}

package/dist/services/events/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,2CAA2C;IAC3C,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC;AACxD,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/events/types.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,2CAA2C;IAC3C,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC;AACxD,CAAC"}

package/dist/services/events/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA2ED,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAqB1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYnE"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA4GD,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,qBAAqB,CAqB1E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAYnE"}

package/dist/services/events/validate.js

@@ -9,6 +9,8 @@ const VALID_EVENT_TYPES = new Set([
     "oauth_callback",
     "oauth2_authorize",
     "oauth2_token",
+    "oauth2_refresh",
+    "oauth2_refresh_failed",
     "oauth2_client_credentials",
     "oauth2_revoke",
     "oauth2_consent",
@@ -19,6 +21,12 @@ const VALID_EVENT_TYPES = new Set([
     "api_key_used",
     "service_account_created",
     "service_account_updated",
+    "magic_link_replayed",
+    "sms_otp_replayed",
+    "password_reset_token_replayed",
+    "service_account_certificate_bound",
+    "service_account_certificate_unbound",
+    "service_account_revoked",
     "unauthorized_access",
     "organization_created",
     "organization_updated",
@@ -29,6 +37,7 @@ const VALID_EVENT_TYPES = new Set([
     "organization_member_role_updated",
     "permission_created",
     "permission_deleted",
+    "permission_role_updated",
     "application_created",
     "application_updated",
     "magic_link_sent",
@@ -59,8 +68,11 @@ const VALID_EVENT_TYPES = new Set([
     "workflow_step_executed",
     "workflow_created",
     "workflow_deleted",
+    "workflow_blocked",
     "platform_user_updated",
+    "platform_role_changed",
     "platform_user_deactivated",
+    "platform_account_reviewed",
     "platform_signing_key_rotated",
     "platform_plugin_unregistered",
     "platform_feature_flag_updated",
@@ -69,7 +81,28 @@ const VALID_EVENT_TYPES = new Set([
     "email_verification_sent",
     "email_verified",
     "platform_webhook_created",
+    "platform_webhook_updated",
     "platform_webhook_deleted",
+    "platform_webhook_secret_rotated",
+    "federation_identity_linked",
+    "user_token_login",
+    "session_revoked",
+    "sessions_revoked_all",
+    "mfa_challenge_created",
+    "mfa_challenge_failed",
+    "mfa_challenge_expired",
+    "mfa_challenge_rejected",
+    "mfa_verified",
+    "mfa_bypass_blocked",
+    "mfa_backup_code_regenerated",
+    "scim_connection_created",
+    "scim_connection_rotated",
+    "scim_connection_revoked",
+    "scim_authentication_failed",
+    "scim_access_denied",
+    "scim_group_created",
+    "scim_group_updated",
+    "scim_group_deleted",
 ]);
 export function validateEvent(event) {
     const errors = [];

package/dist/services/events/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,yBAAyB;IACzB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,kCAAkC;IAClC,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/services/events/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,aAAa;IACb,eAAe;IACf,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,uBAAuB;IACvB,2BAA2B;IAC3B,eAAe;IACf,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,yBAAyB;IACzB,yBAAyB;IACzB,qBAAqB;IACrB,kBAAkB;IAClB,+BAA+B;IAC/B,mCAAmC;IACnC,qCAAqC;IACrC,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,2BAA2B;IAC3B,8BAA8B;IAC9B,6BAA6B;IAC7B,6BAA6B;IAC7B,kCAAkC;IAClC,oBAAoB;IACpB,oBAAoB;IACpB,yBAAyB;IACzB,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IACrB,cAAc;IACd,uBAAuB;IACvB,kBAAkB;IAClB,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,iCAAiC;IACjC,4BAA4B;IAC5B,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,sBAAsB;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,cAAc;IACd,oBAAoB;IACpB,6BAA6B;IAC7B,yBAAyB;IACzB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/dist/services/features.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,qBAAa,yBAA0B,YAAW,kBAAkB;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,oBAAoB;IAEzD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAOnC"}
+{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,qBAAa,yBAA0B,YAAW,kBAAkB;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,oBAAoB,EAAI;IAE7D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/B;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}

package/dist/services/features.js.map

@@ -1 +1 @@
-{"version":3,"file":"features.js","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,MAA4B;QAA5B,WAAM,GAAN,MAAM,CAAsB;IAAG,CAAC;IAE7D,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAmC,CAAC;YAC9F,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;YACvB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"features.js","sourceRoot":"","sources":["../../src/services/features.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,yBAAyB;IACP,MAAM;IAAnC,YAA6B,MAA4B;sBAA5B,MAAM;IAAyB,CAAC;IAE7D,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAmC,CAAC;YAC9F,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;YACvB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/services/federation.d.ts

@@ -1,8 +1,13 @@
 import type { User } from "../db/schema.js";
 import type { IdentityConnector } from "./connectors/types.js";
+export interface FederationApplicationContext {
+    id: string;
+    orgId: string;
+    clientId: string;
+}
 export declare function getFederationConnector(providerType: string): IdentityConnector;
 export declare function getFederationAuthorizeUrl(providerType: string, state: string, redirectUri: string): Promise<string>;
-export declare function completeFederationLogin(providerType: string, code: string, redirectUri: string): Promise<{
+export declare function completeFederationLogin(providerType: string, code: string, redirectUri: string, application?: FederationApplicationContext): Promise<{
     user: User;
     tokens: {
         accessToken: string;

package/dist/services/federation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,iBAAiB,CAE9E;AAED,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOzH;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAMhF"}
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,iBAAiB,CAE9E;AAED,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOzH;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,4BAA4B,GACzC,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAmChF"}

package/dist/services/federation.js

@@ -1,6 +1,9 @@
+import { and, eq } from "drizzle-orm";
 import { buildConnector } from "./connectors/registry.js";
-import { upsertOAuthUser } from "./users.js";
+import { findIdentityProviderByType, upsertOAuthUser } from "./users.js";
 import { createTokenSet } from "./tokens.js";
+import { db } from "../db/index.js";
+import { users, orgMemberships } from "../db/schema.js";
 export function getFederationConnector(providerType) {
     return buildConnector(providerType);
 }
@@ -12,11 +15,35 @@ export async function getFederationAuthorizeUrl(providerType, state, redirectUri
         scopes: ["openid", "profile", "email"],
     });
 }
-export async function completeFederationLogin(providerType, code, redirectUri) {
+export async function completeFederationLogin(providerType, code, redirectUri, application) {
     const connector = getFederationConnector(providerType);
     const identity = await connector.exchangeCode(code, redirectUri);
-    const user = await upsertOAuthUser(identity, providerType);
-    const tokens = await createTokenSet(user);
+    const email = identity.email.toLowerCase().trim();
+    let existingUser;
+    if (application) {
+        const [existing] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+        if (!existing)
+            throw new Error("Federation users must be explicitly invited to the application organization");
+        if (!existing.isActive || existing.accountReviewRequired || existing.role === "owner") {
+            throw new Error("User account is unavailable for tenant federation");
+        }
+        const [membership] = await db
+            .select({ id: orgMemberships.id })
+            .from(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, application.orgId), eq(orgMemberships.userId, existing.id)))
+            .limit(1);
+        if (!membership)
+            throw new Error("Federation user must be explicitly invited to the application organization");
+        existingUser = existing;
+    }
+    const provider = await findIdentityProviderByType(providerType);
+    const user = await upsertOAuthUser(identity, providerType, provider?.id);
+    if (application && (!existingUser || existingUser.id !== user.id)) {
+        throw new Error("Federation identity is not linked to the invited user");
+    }
+    const tokens = await createTokenSet(user, undefined, undefined, application
+        ? { appId: application.id, orgId: application.orgId, clientId: application.clientId }
+        : {});
     return { user, tokens: { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken } };
 }
 //# sourceMappingURL=federation.js.map

package/dist/services/federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7C,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,YAAoB,EAAE,KAAa,EAAE,WAAmB;IACtG,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,eAAe,CAAC;QAC/B,KAAK;QACL,WAAW;QACX,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,IAAY,EACZ,WAAmB;IAEnB,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;AAClG,CAAC"}
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/services/federation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAUxD,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,YAAoB,EAAE,KAAa,EAAE,WAAmB;IACtG,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,eAAe,CAAC;QAC/B,KAAK;QACL,WAAW;QACX,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,IAAY,EACZ,WAAmB,EACnB,WAA0C;IAE1C,MAAM,SAAS,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAElD,IAAI,YAA8B,CAAC;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC9G,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,qBAAqB,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;aACjC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;aAC/F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC/G,YAAY,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,WAAW,IAAI,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,SAAS,EACT,SAAS,EACT,WAAW;QACT,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;QACrF,CAAC,CAAC,EAAE,CACP,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;AAClG,CAAC"}

package/dist/services/ipControls.js

@@ -1,6 +1,6 @@
 import { db } from "../db/index.js";
 import { applications } from "../db/schema.js";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 /**
  * Per-application IP allow/block lists.
  *
@@ -75,7 +75,7 @@ export async function checkIpAllowed(clientId, ip) {
     const [app] = await db
         .select({ allowedIps: applications.allowedIps, blockedIps: applications.blockedIps })
         .from(applications)
-        .where(eq(applications.clientId, clientId))
+        .where(and(eq(applications.clientId, clientId), eq(applications.isActive, true)))
         .limit(1);
     if (!app)
         return { allowed: true };

package/dist/services/ipControls.js.map

@@ -1 +1 @@
-{"version":3,"file":"ipControls.js","sourceRoot":"","sources":["../../src/services/ipControls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC;;;;;;GAMG;AAEH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1D,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,2CAA2C;QAC3C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAiB,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YACxD,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAE3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;AAC1D,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAA4B,EAAE,EAAsB;IACvF,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC;SACpF,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SAC1C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEnC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"ipControls.js","sourceRoot":"","sources":["../../src/services/ipControls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC;;;;;;GAMG;AAEH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1D,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,2CAA2C;QAC3C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAiB,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YACxD,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,KAAa;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAE3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;AAC1D,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAA4B,EAAE,EAAsB;IACvF,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC;SACpF,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEnC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IAC5F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/services/magicLinks.d.ts

@@ -4,12 +4,12 @@ export declare function generateMagicLink(): {
     tokenHash: string;
 };
 export declare function storeMagicLink(userId: string, tokenHash: string, expiresAt: Date): Promise<{
-    id: string;
     createdAt: Date;
-    userId: string;
     expiresAt: Date;
+    id: string;
     tokenHash: string;
     usedAt: Date | null;
+    userId: string;
 }>;
 export declare function consumeMagicLink(token: string): Promise<User | undefined>;
 export declare function magicLinkExpiresAt(): Date;

package/dist/services/magicLinks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"magicLinks.d.ts","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAG/D,wBAAgB,iBAAiB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIxE;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;;;;;;;GAUtF;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAsB/E;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}
+{"version":3,"file":"magicLinks.d.ts","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAK/D,wBAAgB,iBAAiB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIxE;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;;;;;;;GAUtF;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAiB/E;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/services/magicLinks.js

@@ -1,8 +1,10 @@
 import crypto from "node:crypto";
-import { eq, and, gt, isNull } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { magicLinks, users } from "../db/schema.js";
 import { config } from "../config.js";
+import { consumeMagicLinkRow } from "./singleUse.js";
+import { emit } from "./events/bus.js";
 export function generateMagicLink() {
     const token = crypto.randomBytes(48).toString("base64url");
     const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
@@ -22,15 +24,17 @@ export async function storeMagicLink(userId, tokenHash, expiresAt) {
 export async function consumeMagicLink(token) {
     const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
     const now = new Date();
-    const [record] = await db
-        .select()
-        .from(magicLinks)
-        .where(and(eq(magicLinks.tokenHash, tokenHash), gt(magicLinks.expiresAt, now), isNull(magicLinks.usedAt)))
-        .limit(1);
-    if (!record)
+    // Claim atomically. A conditional SELECT followed by an unconditional UPDATE
+    // would let any number of parallel redemptions all pass the check and all log
+    // in, so the write is the gate.
+    const result = await consumeMagicLinkRow(tokenHash, now);
+    if (result.outcome !== "consumed" || !result.record) {
+        if (result.reason === "replayed") {
+            emit({ type: "magic_link_replayed", payload: {} });
+        }
         return undefined;
-    await db.update(magicLinks).set({ usedAt: now }).where(eq(magicLinks.id, record.id));
-    const [user] = await db.select().from(users).where(eq(users.id, record.userId)).limit(1);
+    }
+    const [user] = await db.select().from(users).where(eq(users.id, result.record.userId)).limit(1);
     return user;
 }
 export function magicLinkExpiresAt() {

package/dist/services/magicLinks.js.map

@@ -1 +1 @@
-{"version":3,"file":"magicLinks.js","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,SAAe;IACrF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC;QACN,MAAM;QACN,SAAS;QACT,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EACnC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,EAC7B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAC1B,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAErF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"magicLinks.js","sourceRoot":"","sources":["../../src/services/magicLinks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAa,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,SAAe;IACrF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC;QACN,MAAM;QACN,SAAS;QACT,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,6EAA6E;IAC7E,8EAA8E;IAC9E,gCAAgC;IAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;AACrE,CAAC"}

package/dist/services/mfa.d.ts

@@ -0,0 +1,53 @@
+import type { User } from "../db/schema.js";
+import type { MfaChallengeRepository, MfaFlow, UserRepository } from "../repositories/types.js";
+import { type Result } from "../lib/result.js";
+/**
+ * MFA challenge lifecycle.
+ *
+ * ```text
+ * password_step   -> password valid, MFA enabled  -> requires_mfa
+ * requires_mfa    -> no access or refresh token has been issued
+ * mfa_step        -> factor verified                -> mfa_verified -> authenticated
+ * ```
+ *
+ * The opaque challenge value is only ever returned to the client; the database
+ * stores a SHA-256 hash of it. Every state transition is a single conditional
+ * database update so a challenge can be consumed exactly once.
+ */
+export type MfaFactor = "totp" | "backup_code";
+export interface IssuedMfaChallenge {
+    challenge: string;
+    expiresAt: Date;
+    flow: MfaFlow;
+    clientId?: string;
+}
+export interface MfaChallengeMeta {
+    ipAddress?: string;
+    userAgent?: string;
+}
+export declare function hashMfaChallenge(challenge: string): string;
+export declare function isMfaChallengeUsable(challenge: {
+    status: string;
+    attempts: number;
+    maxAttempts: number;
+    consumedAt: Date | null;
+    expiresAt: Date;
+}, now?: Date): boolean;
+export declare class MfaService {
+    private readonly challenges;
+    private readonly users;
+    constructor(challenges: MfaChallengeRepository, users: UserRepository);
+    createChallenge(user: User, flow: MfaFlow, clientId: string | undefined, meta?: MfaChallengeMeta): Promise<IssuedMfaChallenge>;
+    /**
+     * Verify a second factor for an outstanding challenge and consume it.
+     * No token is issued here: the caller decides what to issue after the state
+     * transition to `mfa_verified` has succeeded.
+     */
+    verifyChallenge(challengeToken: string, code: string, factor: MfaFactor, loadUser: (userId: string) => Promise<User | undefined>): Promise<Result<{
+        challengeId: string;
+        user: User;
+        flow: MfaFlow;
+        clientId?: string;
+    }>>;
+}
+//# sourceMappingURL=mfa.d.ts.map

package/dist/services/mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../../src/services/mfa.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EACV,sBAAsB,EACtB,OAAO,EACP,cAAc,EACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,aAAa,CAAC;AAK/C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,EAC9G,GAAG,OAAa,GACf,OAAO,CAIT;AAED,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFxB,YACmB,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,cAAc,EACpC;IAEE,eAAe,CACnB,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAmC7B;IAED;;;;OAIG;IACG,eAAe,CACnB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,GACtD,OAAO,CAAC,MAAM,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CA+GxF;CACF"}