@hilbras/keystone 1.6.0 → 2.5.0

package/dist/services/trustedProxies.d.ts

@@ -0,0 +1,90 @@
+import type { FastifyRequest } from "fastify";
+/**
+ * Trusted-proxy model.
+ *
+ * ```text
+ * Internet  →  trusted reverse proxy  →  Keystone
+ * ```
+ *
+ * Two rules follow from that diagram, and everything else in this module exists
+ * to enforce them:
+ *
+ *  1. Only a request whose **peer** address is a configured trusted proxy may
+ *     have its forwarded headers believed. `request.ip` cannot be used for this
+ *     decision, because Fastify derives it from `x-forwarded-for` when
+ *     `trustProxy` is on — which is exactly the attacker-controlled value.
+ *  2. The peer address is the only value that cannot be spoofed. Forwarded
+ *     headers are only consulted when (1) holds.
+ *
+ * With no trusted proxies configured, nothing is trusted: the peer address is
+ * used for rate limiting and client-certificate headers are ignored entirely.
+ * The default is therefore fail-closed.
+ */
+/** Headers that carry client identity and must never be believed from an untrusted peer. */
+export declare const IDENTITY_HEADERS: readonly ["x-forwarded-client-cert", "x-client-cert-fingerprint", "x-service-account-id", "x-forwarded-client-cert-chain"];
+/**
+ * Normalize an address so every spelling of the same host compares equal.
+ *
+ * IPv4-mapped IPv6 arrives in two forms — the dotted form `::ffff:127.0.0.1`
+ * and the hex form `::ffff:7f00:1`. Both must collapse to `127.0.0.1`,
+ * otherwise a mapped address slips past an IPv4 CIDR allowlist.
+ */
+export declare function normalizeAddress(address: string | undefined): string;
+/** Does `address` fall inside `cidr`? Supports IPv4 CIDR and exact IPv6. */
+export declare function addressInCidr(address: string, cidr: string): boolean;
+/** Reset the parse cache. Exists for tests that change configuration. */
+export declare function resetTrustedProxyCache(): void;
+/**
+ * Is at least one trusted proxy configured? False means client-identity headers
+ * are stripped from every request and rate limits key on the peer address.
+ */
+export declare function hasTrustedProxies(): boolean;
+export declare function isTrustedProxy(address: string | undefined): boolean;
+/**
+ * The socket's peer address. This is the only value a client cannot forge,
+ * because it is established by the TCP connection rather than by a header.
+ */
+export declare function peerAddress(request: FastifyRequest): string;
+/** True when the immediate peer is a configured trusted proxy. */
+export declare function isFromTrustedProxy(request: FastifyRequest): boolean;
+/**
+ * The client address to use for rate limiting and logging.
+ *
+ * Behind a trusted proxy this is the left-most forwarded address, because the
+ * proxy is the one that appended it. From any other peer the forwarded headers
+ * are ignored, so a client cannot rotate `x-forwarded-for` to obtain a fresh
+ * rate-limit budget.
+ */
+export declare function clientAddress(request: FastifyRequest): string;
+/**
+ * Remove identity and forwarded headers from a request that did not arrive via
+ * a trusted proxy. Stripping rather than merely ignoring means no downstream
+ * route, plugin, or future feature can accidentally read them.
+ *
+ * @returns whether the request was trusted (and therefore kept its headers)
+ */
+export declare function stripUntrustedHeaders(request: FastifyRequest): boolean;
+/** The value Fastify's `trustProxy` option should be given. */
+export declare function fastifyTrustProxySetting(): boolean | string[];
+/**
+ * Does this address look like infrastructure rather than a public client?
+ *
+ * Loopback, RFC 1918, link-local, and unique-local ranges are where reverse
+ * proxies, load balancers, and service meshes live. A request arriving from one
+ * of these while no trusted proxy is configured is the signature of a proxied
+ * deployment that forgot `KEYSTONE_TRUSTED_PROXIES` — which fails silently, as
+ * every client collapsing into a single rate-limit budget.
+ */
+export declare function isInfrastructureAddress(address: string): boolean;
+/**
+ * Why no forwarded headers were believed, or `null` when the peer was trusted.
+ *
+ * Returned so the caller can log a warning only in the case that indicates a
+ * misconfiguration, rather than on every stripped request.
+ */
+export declare function describeUntrustedPeer(address: string): string | null;
+/** A SHA-256 fingerprint, in hex or the colon-separated form AWS ALB emits. */
+export declare function isValidFingerprint(value: string | undefined): value is string;
+/** Canonical fingerprint form used for storage and comparison. */
+export declare function canonicalFingerprint(value: string): string;
+//# sourceMappingURL=trustedProxies.d.ts.map

package/dist/services/trustedProxies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxies.d.ts","sourceRoot":"","sources":["../../src/services/trustedProxies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,YAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,+BAA+B,CACvB,CAAC;AAKX;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAwBpE;AAeD,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAwCpE;AAoBD,yEAAyE;AACzE,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMnE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE3D;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAEnE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAW7D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAMtE;AAED,+DAA+D;AAC/D,wBAAgB,wBAAwB,IAAI,OAAO,GAAG,MAAM,EAAE,CAG7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAmBhE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASpE;AAKD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAI7E;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/services/trustedProxies.js

@@ -0,0 +1,283 @@
+import { config } from "../config.js";
+/**
+ * Trusted-proxy model.
+ *
+ * ```text
+ * Internet  →  trusted reverse proxy  →  Keystone
+ * ```
+ *
+ * Two rules follow from that diagram, and everything else in this module exists
+ * to enforce them:
+ *
+ *  1. Only a request whose **peer** address is a configured trusted proxy may
+ *     have its forwarded headers believed. `request.ip` cannot be used for this
+ *     decision, because Fastify derives it from `x-forwarded-for` when
+ *     `trustProxy` is on — which is exactly the attacker-controlled value.
+ *  2. The peer address is the only value that cannot be spoofed. Forwarded
+ *     headers are only consulted when (1) holds.
+ *
+ * With no trusted proxies configured, nothing is trusted: the peer address is
+ * used for rate limiting and client-certificate headers are ignored entirely.
+ * The default is therefore fail-closed.
+ */
+/** Headers that carry client identity and must never be believed from an untrusted peer. */
+export const IDENTITY_HEADERS = [
+    "x-forwarded-client-cert",
+    "x-client-cert-fingerprint",
+    "x-service-account-id",
+    "x-forwarded-client-cert-chain",
+];
+/** Headers that influence the apparent client address. */
+const FORWARDED_HEADERS = ["x-forwarded-for", "x-real-ip", "forwarded"];
+/**
+ * Normalize an address so every spelling of the same host compares equal.
+ *
+ * IPv4-mapped IPv6 arrives in two forms — the dotted form `::ffff:127.0.0.1`
+ * and the hex form `::ffff:7f00:1`. Both must collapse to `127.0.0.1`,
+ * otherwise a mapped address slips past an IPv4 CIDR allowlist.
+ */
+export function normalizeAddress(address) {
+    if (!address)
+        return "";
+    let value = address.trim().toLowerCase();
+    if (value.startsWith("[") && value.endsWith("]"))
+        value = value.slice(1, -1);
+    // Strip a zone index and any port suffix on bare IPv6.
+    const zone = value.indexOf("%");
+    if (zone !== -1)
+        value = value.slice(0, zone);
+    if (value.startsWith("::ffff:")) {
+        const tail = value.slice(7);
+        if (tail.includes("."))
+            return tail;
+        // Hex form: the final two hextets are the IPv4 address.
+        const hextets = tail.split(":");
+        if (hextets.length === 2 && hextets.every((h) => /^[0-9a-f]{1,4}$/.test(h))) {
+            const high = parseInt(hextets[0], 16);
+            const low = parseInt(hextets[1], 16);
+            if (Number.isInteger(high) && Number.isInteger(low)) {
+                return [high >> 8, high & 0xff, low >> 8, low & 0xff].join(".");
+            }
+        }
+        return tail;
+    }
+    return value;
+}
+function toIPv4Octets(address) {
+    const parts = address.split(".");
+    if (parts.length !== 4)
+        return null;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const n = Number(part);
+        if (n < 0 || n > 255)
+            return null;
+        octets.push(n);
+    }
+    return octets;
+}
+/** Does `address` fall inside `cidr`? Supports IPv4 CIDR and exact IPv6. */
+export function addressInCidr(address, cidr) {
+    const target = normalizeAddress(address);
+    const range = cidr.trim().toLowerCase();
+    if (!target || !range)
+        return false;
+    if (!range.includes("/"))
+        return target === normalizeAddress(range);
+    const [network, bitsRaw] = range.split("/");
+    const bits = Number(bitsRaw);
+    if (!Number.isInteger(bits))
+        return false;
+    const targetOctets = toIPv4Octets(normalizeAddress(network));
+    const boundOctets = toIPv4Octets(normalizeAddress(network));
+    if (!targetOctets || !boundOctets) {
+        // IPv6: compare the leading `bits` of the hextets. Anything not an exact
+        // or prefix match is treated as outside the range.
+        if (bits < 0 || bits > 128)
+            return false;
+        const left = normalizeAddress(network).split(":");
+        const right = normalizeAddress(target).split(":");
+        if (left.length !== right.length)
+            return false;
+        const hextets = bits / 16;
+        for (let i = 0; i < Math.floor(hextets); i++) {
+            if (left[i] !== right[i])
+                return false;
+        }
+        return true;
+    }
+    if (bits < 0 || bits > 32)
+        return false;
+    const targetV4 = toIPv4Octets(normalizeAddress(target));
+    if (!targetV4)
+        return false;
+    let remaining = bits;
+    for (let i = 0; i < 4; i++) {
+        if (remaining <= 0)
+            break;
+        const take = Math.min(8, remaining);
+        const mask = take === 0 ? 0 : (0xff << (8 - take)) & 0xff;
+        if ((targetV4[i] & mask) !== (boundOctets[i] & mask))
+            return false;
+        remaining -= take;
+    }
+    return true;
+}
+let cachedConfig = null;
+/**
+ * Read the setting at call time rather than from the `config` snapshot, which
+ * is built once at import. Cached on the raw string, so this is cheap while
+ * still picking up a reload.
+ */
+function trustedEntries() {
+    const raw = (process.env.KEYSTONE_TRUSTED_PROXIES ?? config.TRUSTED_PROXIES ?? "").trim();
+    if (cachedConfig?.raw === raw)
+        return cachedConfig.entries;
+    const entries = raw
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    cachedConfig = { raw, entries };
+    return entries;
+}
+/** Reset the parse cache. Exists for tests that change configuration. */
+export function resetTrustedProxyCache() {
+    cachedConfig = null;
+}
+/**
+ * Is at least one trusted proxy configured? False means client-identity headers
+ * are stripped from every request and rate limits key on the peer address.
+ */
+export function hasTrustedProxies() {
+    return trustedEntries().length > 0;
+}
+export function isTrustedProxy(address) {
+    const entries = trustedEntries();
+    if (entries.length === 0)
+        return false;
+    const target = normalizeAddress(address);
+    if (!target)
+        return false;
+    return entries.some((entry) => addressInCidr(target, entry));
+}
+/**
+ * The socket's peer address. This is the only value a client cannot forge,
+ * because it is established by the TCP connection rather than by a header.
+ */
+export function peerAddress(request) {
+    return normalizeAddress(request.socket?.remoteAddress ?? request.ip);
+}
+/** True when the immediate peer is a configured trusted proxy. */
+export function isFromTrustedProxy(request) {
+    return isTrustedProxy(peerAddress(request));
+}
+/**
+ * The client address to use for rate limiting and logging.
+ *
+ * Behind a trusted proxy this is the left-most forwarded address, because the
+ * proxy is the one that appended it. From any other peer the forwarded headers
+ * are ignored, so a client cannot rotate `x-forwarded-for` to obtain a fresh
+ * rate-limit budget.
+ */
+export function clientAddress(request) {
+    if (!isFromTrustedProxy(request))
+        return peerAddress(request);
+    const xff = request.headers["x-forwarded-for"];
+    if (typeof xff === "string" && xff.trim()) {
+        const first = xff.split(",")[0]?.trim();
+        if (first)
+            return normalizeAddress(first);
+    }
+    const realIp = request.headers["x-real-ip"];
+    if (typeof realIp === "string" && realIp.trim())
+        return normalizeAddress(realIp);
+    return peerAddress(request);
+}
+/**
+ * Remove identity and forwarded headers from a request that did not arrive via
+ * a trusted proxy. Stripping rather than merely ignoring means no downstream
+ * route, plugin, or future feature can accidentally read them.
+ *
+ * @returns whether the request was trusted (and therefore kept its headers)
+ */
+export function stripUntrustedHeaders(request) {
+    if (isFromTrustedProxy(request))
+        return true;
+    for (const header of [...IDENTITY_HEADERS, ...FORWARDED_HEADERS]) {
+        delete request.headers[header];
+    }
+    return false;
+}
+/** The value Fastify's `trustProxy` option should be given. */
+export function fastifyTrustProxySetting() {
+    const entries = trustedEntries();
+    return entries.length > 0 ? entries : false;
+}
+/**
+ * Does this address look like infrastructure rather than a public client?
+ *
+ * Loopback, RFC 1918, link-local, and unique-local ranges are where reverse
+ * proxies, load balancers, and service meshes live. A request arriving from one
+ * of these while no trusted proxy is configured is the signature of a proxied
+ * deployment that forgot `KEYSTONE_TRUSTED_PROXIES` — which fails silently, as
+ * every client collapsing into a single rate-limit budget.
+ */
+export function isInfrastructureAddress(address) {
+    const target = normalizeAddress(address);
+    if (!target)
+        return false;
+    if (target === "127.0.0.1" || target === "::1" || target === "0.0.0.0" || target === "::") {
+        return true;
+    }
+    if (target.startsWith("10."))
+        return true;
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(target))
+        return true;
+    if (target.startsWith("192.168."))
+        return true;
+    if (target.startsWith("169.254."))
+        return true;
+    // IPv6: fe80::/10 link-local, fc00::/7 unique-local. Compare the first
+    // hextet regardless of how many there are, so a fully expanded address
+    // (`fe80:0000:...:0001`) is classified the same as the compressed form.
+    const first = parseInt(target.split(":")[0] ?? "", 16);
+    if (Number.isInteger(first)) {
+        if ((first & 0xffc0) === 0xfe80)
+            return true;
+        if ((first & 0xfe00) === 0xfc00)
+            return true;
+    }
+    return false;
+}
+/**
+ * Why no forwarded headers were believed, or `null` when the peer was trusted.
+ *
+ * Returned so the caller can log a warning only in the case that indicates a
+ * misconfiguration, rather than on every stripped request.
+ */
+export function describeUntrustedPeer(address) {
+    if (hasTrustedProxies())
+        return null;
+    if (!isInfrastructureAddress(address))
+        return null;
+    return ("client-identity headers were stripped from an infrastructure address while " +
+        "KEYSTONE_TRUSTED_PROXIES is unset. If Keystone is behind a reverse proxy, " +
+        "set it to the proxy's address: until then every client shares one rate-limit " +
+        "budget and forwarded client addresses are ignored. See docs/security/proxy-security.md");
+}
+const FINGERPRINT_HEX = /^[0-9a-f]{64}$/i;
+const FINGERPRINT_COLON = /^(?:[0-9a-f]{2}:){31}[0-9a-f]{2}$/i;
+/** A SHA-256 fingerprint, in hex or the colon-separated form AWS ALB emits. */
+export function isValidFingerprint(value) {
+    if (!value)
+        return false;
+    const normalized = value.trim();
+    return FINGERPRINT_HEX.test(normalized) || FINGERPRINT_COLON.test(normalized);
+}
+/** Canonical fingerprint form used for storage and comparison. */
+export function canonicalFingerprint(value) {
+    return value.trim().replace(/:/g, "").toLowerCase();
+}
+//# sourceMappingURL=trustedProxies.js.map

package/dist/services/trustedProxies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxies.js","sourceRoot":"","sources":["../../src/services/trustedProxies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGtC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,yBAAyB;IACzB,2BAA2B;IAC3B,sBAAsB;IACtB,+BAA+B;CACvB,CAAC;AAEX,0DAA0D;AAC1D,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA2B;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,uDAAuD;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAE9C,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,wDAAwD;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAY;IACzD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEpC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEpE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,MAAM,YAAY,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,yEAAyE;QACzE,mDAAmD;QACnD,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,SAAS,IAAI,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,YAAY,GAA8C,IAAI,CAAC;AAEnE;;;;GAIG;AACH,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,YAAY,EAAE,GAAG,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,YAAY,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB;IACpC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA2B;IACxD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAuB;IACjD,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,OAAO,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAE9D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACjF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAuB;IAC3D,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,gBAAgB,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,CACL,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wFAAwF,CACzF,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAChF,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC"}

package/dist/services/users.d.ts

@@ -5,9 +5,29 @@ export interface OAuthClaims {
     username?: string;
     name?: string;
     picture?: string;
+    emailVerified?: boolean;
     email_verified?: boolean;
 }
 export declare function findUserByEmail(email: string): Promise<User | undefined>;
+export declare function findIdentityProviderByType(providerType: string): Promise<{
+    id: string;
+    orgId: string;
+    providerType: string;
+    name: string;
+    issuer: string | null;
+    authorizationEndpoint: string | null;
+    tokenEndpoint: string | null;
+    userinfoEndpoint: string | null;
+    jwksUri: string | null;
+    clientId: string | null;
+    clientSecretEncrypted: string | null;
+    scopes: string[];
+    attributeMapping: unknown;
+    isActive: boolean;
+    isFederation: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}>;
 export declare function findUserById(id: string): Promise<User | undefined>;
 export declare function findUserByZitadelId(zitadelUserId: string): Promise<User | undefined>;
 export declare function createPasswordUser(input: {
@@ -21,19 +41,7 @@ export declare function createPasswordUser(input: {
 export declare function upsertOAuthUser(claims: OAuthClaims, providerType: string, providerId?: string): Promise<User>;
 export declare function linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string, profile?: Record<string, unknown>): Promise<void>;
 export declare function updateUserLastSeen(id: string): Promise<void>;
-export declare function findOrCreateUserByEmail(input: {
-    email: string;
-    name?: string;
-    username?: string;
-}): Promise<User>;
 export declare function listUsersByOrg(orgId: string): Promise<User[]>;
-export declare function updateUser(userId: string, updates: Partial<{
-    name: string;
-    username: string;
-    role: string;
-    emailVerified: boolean;
-}>): Promise<User | undefined>;
-export declare function deactivateUser(userId: string): Promise<void>;
 export declare function slugifyUsername(input: string): string;
 export declare function ensureUniqueUsername(base: string, excludeId?: string): Promise<string>;
 //# sourceMappingURL=users.d.ts.map

package/dist/services/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4D,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEtG,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG9E;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAGxE;AAED,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG1F;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA2Ef;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhB;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAOnE;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC,GACD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAO3B;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5F"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4D,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEtG,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG9E;AAED,wBAAsB,0BAA0B,CAAC,YAAY,EAAE,MAAM;;;;;;;;;;;;;;;;;;GAOpE;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAGxE;AAED,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG1F;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAoEf;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAOnE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5F"}

package/dist/services/users.js

@@ -1,10 +1,18 @@
-import { eq, sql } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { db } from "../db/index.js";
 import { users, userIdentities, identityProviders, orgMemberships } from "../db/schema.js";
 export async function findUserByEmail(email) {
     const [user] = await db.select().from(users).where(eq(users.email, email.toLowerCase())).limit(1);
     return user;
 }
+export async function findIdentityProviderByType(providerType) {
+    const [provider] = await db
+        .select()
+        .from(identityProviders)
+        .where(and(eq(identityProviders.providerType, providerType), eq(identityProviders.isActive, true)))
+        .limit(1);
+    return provider;
+}
 export async function findUserById(id) {
     const [user] = await db.select().from(users).where(eq(users.id, id)).limit(1);
     return user;
@@ -29,18 +37,24 @@ export async function createPasswordUser(input) {
     return user;
 }
 export async function upsertOAuthUser(claims, providerType, providerId) {
+    const verified = claims.emailVerified === true || claims.email_verified === true;
+    if (!verified) {
+        throw new Error("Identity provider did not verify the email address");
+    }
     const username = slugifyUsername(claims.username || claims.name || claims.email.split("@")[0]);
     const email = claims.email.toLowerCase().trim();
-    // Prefer linking by external identity when a provider record is available.
+    // Only an explicit provider/subject link may identify an existing account.
     if (providerId) {
         const [existingLink] = await db
             .select({ user: users })
             .from(userIdentities)
-            .where(eq(userIdentities.externalSub, claims.sub))
+            .where(and(eq(userIdentities.providerId, providerId), eq(userIdentities.externalSub, claims.sub)))
             .innerJoin(users, eq(userIdentities.userId, users.id))
             .limit(1);
         if (existingLink) {
             const existing = existingLink.user;
+            if (!existing.isActive || existing.accountReviewRequired)
+                throw new Error("User account is unavailable");
             const [updated] = await db
                 .update(users)
                 .set({
@@ -48,7 +62,7 @@ export async function upsertOAuthUser(claims, providerType, providerId) {
                 username: await ensureUniqueUsername(username, existing.id),
                 name: claims.name || existing.name,
                 avatarUrl: claims.picture || existing.avatarUrl,
-                emailVerified: claims.email_verified ?? existing.emailVerified ?? true,
+                emailVerified: true,
                 provider: providerType,
                 updatedAt: sql `now()`,
             })
@@ -57,23 +71,11 @@ export async function upsertOAuthUser(claims, providerType, providerId) {
             return updated;
         }
     }
-    // Fall back to email-based matching.
-    const existing = await findUserByEmail(email);
-    if (existing) {
-        const [updated] = await db
-            .update(users)
-            .set({
-            email,
-            username: await ensureUniqueUsername(username, existing.id),
-            name: claims.name || existing.name,
-            avatarUrl: claims.picture || existing.avatarUrl,
-            emailVerified: claims.email_verified ?? existing.emailVerified ?? true,
-            provider: providerType,
-            updatedAt: sql `now()`,
-        })
-            .where(eq(users.id, existing.id))
-            .returning();
-        return updated;
+    // Email equality alone is never proof of identity. Existing users must be
+    // linked through an explicitly provisioned provider/subject identity.
+    const existingByEmail = await findUserByEmail(email);
+    if (existingByEmail) {
+        throw new Error("Existing account requires an explicit external identity link");
     }
     const [user] = await db
         .insert(users)
@@ -82,7 +84,7 @@ export async function upsertOAuthUser(claims, providerType, providerId) {
         username: await ensureUniqueUsername(username),
         name: claims.name || username,
         avatarUrl: claims.picture,
-        emailVerified: claims.email_verified ?? true,
+        emailVerified: true,
         provider: providerType,
     })
         .returning();
@@ -117,24 +119,6 @@ export async function linkUserIdentity(userId, providerId, providerType, externa
 export async function updateUserLastSeen(id) {
     await db.update(users).set({ updatedAt: sql `now()` }).where(eq(users.id, id));
 }
-export async function findOrCreateUserByEmail(input) {
-    const existing = await findUserByEmail(input.email);
-    if (existing)
-        return existing;
-    const baseUsername = input.username || input.email.split("@")[0];
-    const username = await ensureUniqueUsername(slugifyUsername(baseUsername));
-    const [user] = await db
-        .insert(users)
-        .values({
-        email: input.email.toLowerCase().trim(),
-        username,
-        name: input.name || username,
-        provider: "password",
-        emailVerified: false,
-    })
-        .returning();
-    return user;
-}
 export async function listUsersByOrg(orgId) {
     const rows = await db
         .select({ user: users })
@@ -143,17 +127,6 @@ export async function listUsersByOrg(orgId) {
         .where(eq(orgMemberships.orgId, orgId));
     return rows.map((r) => r.user);
 }
-export async function updateUser(userId, updates) {
-    const [updated] = await db
-        .update(users)
-        .set({ ...updates, updatedAt: sql `now()` })
-        .where(eq(users.id, userId))
-        .returning();
-    return updated;
-}
-export async function deactivateUser(userId) {
-    await db.update(users).set({ emailVerified: false, updatedAt: sql `now()` }).where(eq(users.id, userId));
-}
 export function slugifyUsername(input) {
     return input
         .toLowerCase()

package/dist/services/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAa,MAAM,iBAAiB,CAAC;AAWtG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAOxC;IACC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ;QACzC,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;KAC3C,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAmB,EACnB,YAAoB,EACpB,UAAmB;IAEnB,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,2EAA2E;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,EAAE;aAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;aACjD,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACrD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC;gBACH,KAAK;gBACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC3D,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;gBAClC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;gBAC/C,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI;gBACtE,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,GAAG,CAAA,OAAO;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAChC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC;YACH,KAAK;YACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;YAClC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;YAC/C,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI;YACtE,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,GAAG,CAAA,OAAO;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;aAChC,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK;QACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC;QAC9C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;QAC7B,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;QAC5C,QAAQ,EAAE,YAAY;KACvB,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU;YACV,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,GAAG;YACvB,KAAK;YACL,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,UAAkB,EAClB,YAAoB,EACpB,WAAmB,EACnB,KAAc,EACd,OAAiC;IAEjC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,MAAM;QACN,UAAU;QACV,YAAY;QACZ,WAAW;QACX,KAAK;QACL,OAAO,EAAE,OAAO,IAAI,EAAE;KACvB,CAAC;SACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3E,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;QACvC,QAAQ;QACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ;QAC5B,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,KAAK;KACrB,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACvB,IAAI,CAAC,KAAK,CAAC;SACX,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;SAC9D,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,OAKE;IAEF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;SAC1C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC3B,SAAS,EAAE,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IACzE,IAAI,QAAQ,GAAG,IAAI,IAAI,MAAM,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/services/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAa,MAAM,iBAAiB,CAAC;AAYtG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,YAAoB;IACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAClG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAOxC;IACC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QAC1C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;QACvC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ;QACzC,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;KAC3C,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAmB,EACnB,YAAoB,EACpB,UAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC;IACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEhD,2EAA2E;IAC3E,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,EAAE;aAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;aACjG,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACrD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,qBAAqB;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACzG,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC;gBACH,KAAK;gBACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC3D,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;gBAClC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;gBAC/C,aAAa,EAAE,IAAI;gBACnB,QAAQ,EAAE,YAAY;gBACtB,SAAS,EAAE,GAAG,CAAA,OAAO;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;iBAChC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK;QACL,QAAQ,EAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC;QAC9C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;QAC7B,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,YAAY;KACvB,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU;YACV,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,GAAG;YACvB,KAAK;YACL,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,UAAkB,EAClB,YAAoB,EACpB,WAAmB,EACnB,KAAc,EACd,OAAiC;IAEjC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,MAAM;QACN,UAAU;QACV,YAAY;QACZ,WAAW;QACX,KAAK;QACL,OAAO,EAAE,OAAO,IAAI,EAAE;KACvB,CAAC;SACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACvB,IAAI,CAAC,KAAK,CAAC;SACX,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;SAC9D,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IACzE,IAAI,QAAQ,GAAG,IAAI,IAAI,MAAM,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/services/webauthn.d.ts

@@ -18,18 +18,18 @@ export declare function verifyAuthentication(response: AuthenticationResponseJSO
     verified: boolean;
     user: {
         id: string;
-        name: string | null;
-        plan: string;
-        createdAt: Date;
-        updatedAt: Date;
         zitadelUserId: string | null;
         email: string;
         username: string;
+        name: string | null;
         avatarUrl: string | null;
         emailVerified: boolean;
         emailVerifiedToken: string | null;
         provider: string;
+        plan: string;
         role: string;
+        isActive: boolean;
+        accountReviewRequired: boolean;
         defaultOrgId: string | null;
         phoneNumber: string | null;
         phoneVerified: boolean;
@@ -38,8 +38,12 @@ export declare function verifyAuthentication(response: AuthenticationResponseJSO
         totpSecret: string | null;
         totpEnabled: boolean;
         totpVerifiedAt: Date | null;
+        totpLastStep: number | null;
         failedLoginAttempts: number;
         lockedUntil: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
     };
+    credentialRegisteredAt: Date;
 }>;
 //# sourceMappingURL=webauthn.d.ts.map