@kyro-cms/core 0.1.3 → 0.1.5

package/dist/bootstrap-BDTTUGY2.js

@@ -0,0 +1,4 @@
+export { autoBootstrap, bootstrapAdmin, bootstrapWithRetry, checkBootstrapRequired, getBootstrapFromEnv } from './chunk-C74MQIRL.js';
+import './chunk-NSBPE2FW.js';
+//# sourceMappingURL=bootstrap-BDTTUGY2.js.map
+//# sourceMappingURL=bootstrap-BDTTUGY2.js.map

package/dist/{bootstrap-Q2TWUQF3.js.map → bootstrap-BDTTUGY2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"bootstrap-Q2TWUQF3.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"bootstrap-BDTTUGY2.js"}

package/dist/bootstrap-X6TP3NKX.cjs

@@ -0,0 +1,29 @@
+'use strict';
+
+var chunkMHS6CPO5_cjs = require('./chunk-MHS6CPO5.cjs');
+require('./chunk-5BLDMQED.cjs');
+
+
+
+Object.defineProperty(exports, "autoBootstrap", {
+  enumerable: true,
+  get: function () { return chunkMHS6CPO5_cjs.autoBootstrap; }
+});
+Object.defineProperty(exports, "bootstrapAdmin", {
+  enumerable: true,
+  get: function () { return chunkMHS6CPO5_cjs.bootstrapAdmin; }
+});
+Object.defineProperty(exports, "bootstrapWithRetry", {
+  enumerable: true,
+  get: function () { return chunkMHS6CPO5_cjs.bootstrapWithRetry; }
+});
+Object.defineProperty(exports, "checkBootstrapRequired", {
+  enumerable: true,
+  get: function () { return chunkMHS6CPO5_cjs.checkBootstrapRequired; }
+});
+Object.defineProperty(exports, "getBootstrapFromEnv", {
+  enumerable: true,
+  get: function () { return chunkMHS6CPO5_cjs.getBootstrapFromEnv; }
+});
+//# sourceMappingURL=bootstrap-X6TP3NKX.cjs.map
+//# sourceMappingURL=bootstrap-X6TP3NKX.cjs.map

package/dist/{bootstrap-2WJK6PG7.cjs.map → bootstrap-X6TP3NKX.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"bootstrap-2WJK6PG7.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"bootstrap-X6TP3NKX.cjs"}

package/dist/chunk-5BLDMQED.cjs

@@ -0,0 +1,18 @@
+'use strict';
+
+var __defProp = Object.defineProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+exports.__export = __export;
+exports.__require = __require;
+//# sourceMappingURL=chunk-5BLDMQED.cjs.map
+//# sourceMappingURL=chunk-5BLDMQED.cjs.map

package/dist/{chunk-Q7SFCCGT.cjs.map → chunk-5BLDMQED.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-Q7SFCCGT.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-5BLDMQED.cjs"}

package/dist/{chunk-U4CHJTWX.cjs → chunk-7G6EVYCU.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk5AOILNGY_cjs = require('./chunk-5AOILNGY.cjs');
+var chunkTZFJMPCH_cjs = require('./chunk-TZFJMPCH.cjs');
 var postgresJs = require('drizzle-orm/postgres-js');
 var postgres = require('postgres');
 var migrator = require('drizzle-orm/postgres-js/migrator');
@@ -28,7 +28,7 @@ async function createDatabase(config) {
     max: maxConnections,
     ssl: ssl ? "require" : false
   });
-  const db = postgresJs.drizzle(client, { schema: chunk5AOILNGY_cjs.auth_exports });
+  const db = postgresJs.drizzle(client, { schema: chunkTZFJMPCH_cjs.auth_exports });
   return { client, db };
 }
 async function runMigrations(db) {
@@ -37,7 +37,7 @@ async function runMigrations(db) {
   console.log("Migrations complete");
 }
 async function seedDefaultRoles(db) {
-  const { roles } = chunk5AOILNGY_cjs.auth_exports;
+  const { roles } = chunkTZFJMPCH_cjs.auth_exports;
   const defaultRoles = [
     {
       name: "super_admin",
@@ -90,5 +90,5 @@ async function seedDefaultRoles(db) {
 exports.createDatabase = createDatabase;
 exports.runMigrations = runMigrations;
 exports.seedDefaultRoles = seedDefaultRoles;
-//# sourceMappingURL=chunk-U4CHJTWX.cjs.map
-//# sourceMappingURL=chunk-U4CHJTWX.cjs.map
+//# sourceMappingURL=chunk-7G6EVYCU.cjs.map
+//# sourceMappingURL=chunk-7G6EVYCU.cjs.map

package/dist/{chunk-U4CHJTWX.cjs.map → chunk-7G6EVYCU.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/database/drizzle/database.ts"],"names":["postgres","drizzle","auth_exports","migrate"],"mappings":";;;;;;;;;;;AAKA,SAAS,MAAA,CAAO,GAAA,EAAa,QAAA,GAAmB,EAAA,EAAY;AAC1D,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,QAAA;AAC7B;AAEA,SAAS,SAAA,CAAU,GAAA,EAAa,QAAA,GAAmB,CAAA,EAAW;AAC5D,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,OAAO,QAAA;AACjB,EAAA,OAAO,QAAA,CAAS,KAAK,EAAE,CAAA;AACzB;AAQA,eAAsB,eAAe,MAAA,EAAkC;AACrE,EAAA,MAAM,WAAA,GACJ,QAAQ,GAAA,IACR,MAAA;AAAA,IACE,cAAA;AAAA,IACA;AAAA,GACF;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,EAAQ,cAAA,IAAkB,SAAA,CAAU,qBAAqB,EAAE,CAAA;AAC7D,EAAA,MAAM,MAAM,MAAA,EAAQ,GAAA,IAAO,MAAA,CAAO,cAAA,EAAgB,OAAO,CAAA,KAAM,MAAA;AAE/D,EAAA,MAAM,MAAA,GAASA,0BAAS,WAAA,EAAa;AAAA,IACnC,GAAA,EAAK,cAAA;AAAA,IACL,GAAA,EAAK,MAAM,SAAA,GAAY;AAAA,GACxB,CAAA;AAGD,EAAA,MAAM,KAAKC,kBAAA,CAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQC,gCAAe,CAAA;AAEpD,EAAA,OAAO,EAAE,QAAQ,EAAA,EAAG;AACtB;AAEA,eAAsB,cAAc,EAAA,EAAgC;AAClE,EAAA,OAAA,CAAQ,IAAI,uBAAuB,CAAA;AACnC,EAAA,MAAMC,gBAAA,CAAQ,EAAA,EAAI,EAAE,gBAAA,EAAkB,aAAa,CAAA;AACnD,EAAA,OAAA,CAAQ,IAAI,qBAAqB,CAAA;AACnC;AAEA,eAAsB,iBAAiB,EAAA,EAAgC;AACrE,EAAA,MAAM,EAAE,OAAM,GAAID,8BAAA;AAElB,EAAA,MAAM,YAAA,GAAe;AAAA,IACnB;AAAA,MACE,IAAA,EAAM,aAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,UAAU,EAAC;AAAA,MACX,WAAA,EAAa,uCAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,QAAA,EAAU,CAAC,QAAQ,CAAA;AAAA,MACnB,WAAA,EAAa,iDAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,QAAA,EAAU,CAAC,QAAQ,CAAA;AAAA,MACnB,WAAA,EAAa,8BAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,QAAA,EAAU,CAAC,UAAU,CAAA;AAAA,MACrB,WAAA,EAAa,6BAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,UAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,UAAU,EAAC;AAAA,MACX,WAAA,EAAa,oCAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,UAAU,EAAC;AAAA,MACX,WAAA,EAAa,yBAAA;AAAA,MACb,QAAA,EAAU;AAAA;AACZ,GACF;AAEA,EAAA,KAAA,MAAW,QAAQ,YAAA,EAAc;AAC/B,IAAA,MAAM,GAAG,MAAA,CAAO,KAAK,EAAE,MAAA,CAAO,IAAI,EAAE,mBAAA,EAAoB;AAAA,EAC1D;AACF","file":"chunk-U4CHJTWX.cjs","sourcesContent":["import { drizzle } from \"drizzle-orm/postgres-js\";\nimport postgres from \"postgres\";\nimport { migrate } from \"drizzle-orm/postgres-js/migrator\";\nimport * as schema from \"./schema/auth.js\";\n\nfunction getEnv(key: string, fallback: string = \"\"): string {\n  return process.env[key] || fallback;\n}\n\nfunction getEnvNum(key: string, fallback: number = 0): number {\n  const val = process.env[key];\n  if (!val) return fallback;\n  return parseInt(val, 10);\n}\n\nexport interface DatabaseConfig {\n  url: string;\n  maxConnections: number;\n  ssl: boolean;\n}\n\nexport async function createDatabase(config?: Partial<DatabaseConfig>) {\n  const databaseUrl =\n    config?.url ||\n    getEnv(\n      \"DATABASE_URL\",\n      \"postgresql://postgres:postgres@localhost:5432/kyro_cms\",\n    );\n  const maxConnections =\n    config?.maxConnections || getEnvNum(\"DATABASE_POOL_MAX\", 10);\n  const ssl = config?.ssl || getEnv(\"DATABASE_SSL\", \"false\") === \"true\";\n\n  const client = postgres(databaseUrl, {\n    max: maxConnections,\n    ssl: ssl ? \"require\" : false,\n  });\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const db = drizzle(client, { schema: schema as any });\n\n  return { client, db };\n}\n\nexport async function runMigrations(db: ReturnType<typeof drizzle>) {\n  console.log(\"Running migrations...\");\n  await migrate(db, { migrationsFolder: \"./drizzle\" });\n  console.log(\"Migrations complete\");\n}\n\nexport async function seedDefaultRoles(db: ReturnType<typeof drizzle>) {\n  const { roles } = schema;\n\n  const defaultRoles = [\n    {\n      name: \"super_admin\",\n      level: 100,\n      inherits: [],\n      description: \"Full system access across all tenants\",\n      isSystem: true,\n    },\n    {\n      name: \"admin\",\n      level: 90,\n      inherits: [\"editor\"],\n      description: \"Full tenant access with all content permissions\",\n      isSystem: true,\n    },\n    {\n      name: \"editor\",\n      level: 70,\n      inherits: [\"author\"],\n      description: \"Edit and publish all content\",\n      isSystem: true,\n    },\n    {\n      name: \"author\",\n      level: 50,\n      inherits: [\"customer\"],\n      description: \"Create and edit own content\",\n      isSystem: true,\n    },\n    {\n      name: \"customer\",\n      level: 30,\n      inherits: [],\n      description: \"Access own data and make purchases\",\n      isSystem: true,\n    },\n    {\n      name: \"guest\",\n      level: 10,\n      inherits: [],\n      description: \"Public read-only access\",\n      isSystem: true,\n    },\n  ];\n\n  for (const role of defaultRoles) {\n    await db.insert(roles).values(role).onConflictDoNothing();\n  }\n}\n"]}
+{"version":3,"sources":["../src/database/drizzle/database.ts"],"names":["postgres","drizzle","auth_exports","migrate"],"mappings":";;;;;;;;;;;AAKA,SAAS,MAAA,CAAO,GAAA,EAAa,QAAA,GAAmB,EAAA,EAAY;AAC1D,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,QAAA;AAC7B;AAEA,SAAS,SAAA,CAAU,GAAA,EAAa,QAAA,GAAmB,CAAA,EAAW;AAC5D,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,OAAO,QAAA;AACjB,EAAA,OAAO,QAAA,CAAS,KAAK,EAAE,CAAA;AACzB;AAQA,eAAsB,eAAe,MAAA,EAAkC;AACrE,EAAA,MAAM,WAAA,GACJ,QAAQ,GAAA,IACR,MAAA;AAAA,IACE,cAAA;AAAA,IACA;AAAA,GACF;AACF,EAAA,MAAM,cAAA,GACJ,MAAA,EAAQ,cAAA,IAAkB,SAAA,CAAU,qBAAqB,EAAE,CAAA;AAC7D,EAAA,MAAM,MAAM,MAAA,EAAQ,GAAA,IAAO,MAAA,CAAO,cAAA,EAAgB,OAAO,CAAA,KAAM,MAAA;AAE/D,EAAA,MAAM,MAAA,GAASA,0BAAS,WAAA,EAAa;AAAA,IACnC,GAAA,EAAK,cAAA;AAAA,IACL,GAAA,EAAK,MAAM,SAAA,GAAY;AAAA,GACxB,CAAA;AAGD,EAAA,MAAM,KAAKC,kBAAA,CAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQC,gCAAe,CAAA;AAEpD,EAAA,OAAO,EAAE,QAAQ,EAAA,EAAG;AACtB;AAEA,eAAsB,cAAc,EAAA,EAAgC;AAClE,EAAA,OAAA,CAAQ,IAAI,uBAAuB,CAAA;AACnC,EAAA,MAAMC,gBAAA,CAAQ,EAAA,EAAI,EAAE,gBAAA,EAAkB,aAAa,CAAA;AACnD,EAAA,OAAA,CAAQ,IAAI,qBAAqB,CAAA;AACnC;AAEA,eAAsB,iBAAiB,EAAA,EAAgC;AACrE,EAAA,MAAM,EAAE,OAAM,GAAID,8BAAA;AAElB,EAAA,MAAM,YAAA,GAAe;AAAA,IACnB;AAAA,MACE,IAAA,EAAM,aAAA;AAAA,MACN,KAAA,EAAO,GAAA;AAAA,MACP,UAAU,EAAC;AAAA,MACX,WAAA,EAAa,uCAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,QAAA,EAAU,CAAC,QAAQ,CAAA;AAAA,MACnB,WAAA,EAAa,iDAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,QAAA,EAAU,CAAC,QAAQ,CAAA;AAAA,MACnB,WAAA,EAAa,8BAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,QAAA,EAAU,CAAC,UAAU,CAAA;AAAA,MACrB,WAAA,EAAa,6BAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,UAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,UAAU,EAAC;AAAA,MACX,WAAA,EAAa,oCAAA;AAAA,MACb,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,KAAA,EAAO,EAAA;AAAA,MACP,UAAU,EAAC;AAAA,MACX,WAAA,EAAa,yBAAA;AAAA,MACb,QAAA,EAAU;AAAA;AACZ,GACF;AAEA,EAAA,KAAA,MAAW,QAAQ,YAAA,EAAc;AAC/B,IAAA,MAAM,GAAG,MAAA,CAAO,KAAK,EAAE,MAAA,CAAO,IAAI,EAAE,mBAAA,EAAoB;AAAA,EAC1D;AACF","file":"chunk-7G6EVYCU.cjs","sourcesContent":["import { drizzle } from \"drizzle-orm/postgres-js\";\nimport postgres from \"postgres\";\nimport { migrate } from \"drizzle-orm/postgres-js/migrator\";\nimport * as schema from \"./schema/auth.js\";\n\nfunction getEnv(key: string, fallback: string = \"\"): string {\n  return process.env[key] || fallback;\n}\n\nfunction getEnvNum(key: string, fallback: number = 0): number {\n  const val = process.env[key];\n  if (!val) return fallback;\n  return parseInt(val, 10);\n}\n\nexport interface DatabaseConfig {\n  url: string;\n  maxConnections: number;\n  ssl: boolean;\n}\n\nexport async function createDatabase(config?: Partial<DatabaseConfig>) {\n  const databaseUrl =\n    config?.url ||\n    getEnv(\n      \"DATABASE_URL\",\n      \"postgresql://postgres:postgres@localhost:5432/kyro_cms\",\n    );\n  const maxConnections =\n    config?.maxConnections || getEnvNum(\"DATABASE_POOL_MAX\", 10);\n  const ssl = config?.ssl || getEnv(\"DATABASE_SSL\", \"false\") === \"true\";\n\n  const client = postgres(databaseUrl, {\n    max: maxConnections,\n    ssl: ssl ? \"require\" : false,\n  });\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const db = drizzle(client, { schema: schema as any });\n\n  return { client, db };\n}\n\nexport async function runMigrations(db: ReturnType<typeof drizzle>) {\n  console.log(\"Running migrations...\");\n  await migrate(db, { migrationsFolder: \"./drizzle\" });\n  console.log(\"Migrations complete\");\n}\n\nexport async function seedDefaultRoles(db: ReturnType<typeof drizzle>) {\n  const { roles } = schema;\n\n  const defaultRoles = [\n    {\n      name: \"super_admin\",\n      level: 100,\n      inherits: [],\n      description: \"Full system access across all tenants\",\n      isSystem: true,\n    },\n    {\n      name: \"admin\",\n      level: 90,\n      inherits: [\"editor\"],\n      description: \"Full tenant access with all content permissions\",\n      isSystem: true,\n    },\n    {\n      name: \"editor\",\n      level: 70,\n      inherits: [\"author\"],\n      description: \"Edit and publish all content\",\n      isSystem: true,\n    },\n    {\n      name: \"author\",\n      level: 50,\n      inherits: [\"customer\"],\n      description: \"Create and edit own content\",\n      isSystem: true,\n    },\n    {\n      name: \"customer\",\n      level: 30,\n      inherits: [],\n      description: \"Access own data and make purchases\",\n      isSystem: true,\n    },\n    {\n      name: \"guest\",\n      level: 10,\n      inherits: [],\n      description: \"Public read-only access\",\n      isSystem: true,\n    },\n  ];\n\n  for (const role of defaultRoles) {\n    await db.insert(roles).values(role).onConflictDoNothing();\n  }\n}\n"]}

package/dist/chunk-A3RQWHKD.cjs

@@ -0,0 +1,263 @@
+'use strict';
+
+var Redis = require('ioredis');
+var bcrypt = require('bcryptjs');
+var crypto = require('crypto');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var Redis__default = /*#__PURE__*/_interopDefault(Redis);
+var bcrypt__default = /*#__PURE__*/_interopDefault(bcrypt);
+
+// src/auth/redis-adapter.ts
+var DEFAULT_PREFIX = "kyro:auth:";
+var DEFAULT_TOKEN_EXPIRATION = 86400;
+var DEFAULT_REFRESH_EXPIRATION = 604800;
+var RedisAuthAdapter = class {
+  redis;
+  prefix;
+  tokenExpiration;
+  refreshExpiration;
+  constructor(options = {}) {
+    const url = options.url || `redis://${options.host || "localhost"}:${options.port || 6379}`;
+    this.redis = new Redis__default.default(url, {
+      password: options.password,
+      db: options.db,
+      lazyConnect: true,
+      tls: options.tls ? {} : void 0
+    });
+    this.prefix = options.keyPrefix || DEFAULT_PREFIX;
+    this.tokenExpiration = options.tokenExpiration || DEFAULT_TOKEN_EXPIRATION;
+    this.refreshExpiration = options.refreshTokenExpiration || DEFAULT_REFRESH_EXPIRATION;
+  }
+  async connect() {
+    await this.redis.connect();
+  }
+  async disconnect() {
+    await this.redis.quit();
+  }
+  userKey(userId) {
+    return `${this.prefix}users:${userId}`;
+  }
+  sessionKey(sessionId) {
+    return `${this.prefix}sessions:${sessionId}`;
+  }
+  refreshKey(token) {
+    return `${this.prefix}refresh:${token}`;
+  }
+  userByEmailKey(email) {
+    return `${this.prefix}users:email:${email.toLowerCase()}`;
+  }
+  passwordHistoryKey(userId) {
+    return `${this.prefix}users:${userId}:password_history`;
+  }
+  async createUser(data) {
+    const userId = crypto.randomBytes(16).toString("hex");
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const user = {
+      id: userId,
+      email: data.email.toLowerCase(),
+      passwordHash: data.passwordHash,
+      role: data.role || "customer",
+      tenantId: data.tenantId,
+      createdAt: now,
+      updatedAt: now
+    };
+    const pipeline = this.redis.pipeline();
+    pipeline.hset(this.userKey(userId), this.userToHash(user));
+    pipeline.set(this.userByEmailKey(data.email), userId);
+    await pipeline.exec();
+    return user;
+  }
+  async findUserByEmail(email) {
+    const userId = await this.redis.get(
+      this.userByEmailKey(email.toLowerCase())
+    );
+    if (!userId) return null;
+    return this.findUserById(userId);
+  }
+  async findUserById(userId) {
+    const data = await this.redis.hgetall(this.userKey(userId));
+    if (!data || Object.keys(data).length === 0) return null;
+    return this.hashToUser(data);
+  }
+  async updateUser(userId, data) {
+    const existing = await this.findUserById(userId);
+    if (!existing) return null;
+    const updated = {
+      ...existing,
+      ...data,
+      id: userId,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if (data.email && data.email !== existing.email) {
+      const pipeline = this.redis.pipeline();
+      pipeline.del(this.userByEmailKey(existing.email));
+      pipeline.set(this.userByEmailKey(data.email), userId);
+      await pipeline.exec();
+    }
+    await this.redis.hset(this.userKey(userId), this.userToHash(updated));
+    return updated;
+  }
+  async deleteUser(userId) {
+    const user = await this.findUserById(userId);
+    if (!user) return false;
+    const pipeline = this.redis.pipeline();
+    pipeline.del(this.userKey(userId));
+    pipeline.del(this.userByEmailKey(user.email));
+    pipeline.del(this.passwordHistoryKey(userId));
+    await pipeline.exec();
+    return true;
+  }
+  async hashPassword(password) {
+    return bcrypt__default.default.hash(password, 12);
+  }
+  async verifyPassword(password, hash) {
+    return bcrypt__default.default.compare(password, hash);
+  }
+  async createSession(userId, data = {}) {
+    const sessionId = crypto.randomBytes(32).toString("hex");
+    const token = crypto.randomBytes(32).toString("base64url");
+    const refreshToken = crypto.randomBytes(32).toString("base64url");
+    const now = /* @__PURE__ */ new Date();
+    const session = {
+      id: sessionId,
+      userId,
+      token,
+      refreshToken,
+      expiresAt: new Date(
+        now.getTime() + this.tokenExpiration * 1e3
+      ).toISOString(),
+      createdAt: now.toISOString(),
+      ipAddress: data.ipAddress,
+      userAgent: data.userAgent
+    };
+    const pipeline = this.redis.pipeline();
+    pipeline.hset(this.sessionKey(sessionId), this.sessionToHash(session));
+    pipeline.setex(
+      this.refreshKey(refreshToken),
+      this.refreshExpiration,
+      sessionId
+    );
+    await pipeline.exec();
+    return session;
+  }
+  async findSessionByToken(token) {
+    const data = await this.redis.hgetall(this.sessionKey(token));
+    if (!data || Object.keys(data).length === 0) return null;
+    return this.hashToSession(data);
+  }
+  async deleteSession(sessionId) {
+    const session = await this.redis.hgetall(this.sessionKey(sessionId));
+    if (!session || Object.keys(session).length === 0) return false;
+    const pipeline = this.redis.pipeline();
+    pipeline.del(this.sessionKey(sessionId));
+    if (session.refreshToken) {
+      pipeline.del(this.refreshKey(session.refreshToken));
+    }
+    await pipeline.exec();
+    return true;
+  }
+  async deleteUserSessions(userId) {
+    const pattern = `${this.prefix}sessions:*`;
+    let cursor = "0";
+    let deleted = 0;
+    do {
+      const [nextCursor, keys] = await this.redis.scan(
+        cursor,
+        "MATCH",
+        pattern,
+        "COUNT",
+        100
+      );
+      cursor = nextCursor;
+      for (const key of keys) {
+        const sessionData = await this.redis.hgetall(key);
+        if (sessionData.userId === userId) {
+          const sessionId = key.replace(`${this.prefix}sessions:`, "");
+          await this.deleteSession(sessionId);
+          deleted++;
+        }
+      }
+    } while (cursor !== "0");
+    return deleted;
+  }
+  async addPasswordToHistory(userId, passwordHash) {
+    await this.redis.lpush(this.passwordHistoryKey(userId), passwordHash);
+    await this.redis.ltrim(this.passwordHistoryKey(userId), 0, 4);
+  }
+  async getPasswordHistory(userId, count = 5) {
+    return this.redis.lrange(this.passwordHistoryKey(userId), 0, count - 1);
+  }
+  async isPasswordInHistory(password, userId, historyCount = 5) {
+    const history = await this.getPasswordHistory(userId, historyCount);
+    for (const hash of history) {
+      if (await this.verifyPassword(password, hash)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  userToHash(user) {
+    const hash = {
+      id: user.id,
+      email: user.email,
+      passwordHash: user.passwordHash || "",
+      role: user.role,
+      createdAt: user.createdAt,
+      updatedAt: user.updatedAt
+    };
+    if (user.tenantId) hash.tenantId = user.tenantId;
+    if (user.emailVerified !== void 0)
+      hash.emailVerified = String(user.emailVerified);
+    if (user.locked !== void 0) hash.locked = String(user.locked);
+    if (user.lastLogin) hash.lastLogin = user.lastLogin;
+    if (user.failedLoginAttempts !== void 0)
+      hash.failedLoginAttempts = String(user.failedLoginAttempts);
+    return hash;
+  }
+  hashToUser(hash) {
+    return {
+      id: hash.id,
+      email: hash.email,
+      passwordHash: hash.passwordHash,
+      role: hash.role,
+      tenantId: hash.tenantId,
+      createdAt: hash.createdAt,
+      updatedAt: hash.updatedAt,
+      emailVerified: hash.emailVerified === "true",
+      locked: hash.locked === "true",
+      lastLogin: hash.lastLogin,
+      failedLoginAttempts: hash.failedLoginAttempts ? parseInt(hash.failedLoginAttempts, 10) : 0
+    };
+  }
+  sessionToHash(session) {
+    const hash = {
+      id: session.id,
+      userId: session.userId,
+      token: session.token,
+      expiresAt: session.expiresAt,
+      createdAt: session.createdAt
+    };
+    if (session.refreshToken) hash.refreshToken = session.refreshToken;
+    if (session.ipAddress) hash.ipAddress = session.ipAddress;
+    if (session.userAgent) hash.userAgent = session.userAgent;
+    return hash;
+  }
+  hashToSession(hash) {
+    return {
+      id: hash.id,
+      userId: hash.userId,
+      token: hash.token,
+      refreshToken: hash.refreshToken,
+      expiresAt: hash.expiresAt,
+      createdAt: hash.createdAt,
+      ipAddress: hash.ipAddress,
+      userAgent: hash.userAgent
+    };
+  }
+};
+
+exports.RedisAuthAdapter = RedisAuthAdapter;
+//# sourceMappingURL=chunk-A3RQWHKD.cjs.map
+//# sourceMappingURL=chunk-A3RQWHKD.cjs.map

package/dist/chunk-A3RQWHKD.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/redis-adapter.ts"],"names":["Redis","randomBytes","bcrypt"],"mappings":";;;;;;;;;;;;AAiBA,IAAM,cAAA,GAAiB,YAAA;AACvB,IAAM,wBAAA,GAA2B,KAAA;AACjC,IAAM,0BAAA,GAA6B,MAAA;AAE5B,IAAM,mBAAN,MAA8C;AAAA,EAC3C,KAAA;AAAA,EACA,MAAA;AAAA,EACA,eAAA;AAAA,EACA,iBAAA;AAAA,EAER,WAAA,CAAY,OAAA,GAAmC,EAAC,EAAG;AACjD,IAAA,MAAM,GAAA,GACJ,OAAA,CAAQ,GAAA,IACR,CAAA,QAAA,EAAW,OAAA,CAAQ,QAAQ,WAAW,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,IAAQ,IAAI,CAAA,CAAA;AAEhE,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAIA,sBAAA,CAAM,GAAA,EAAK;AAAA,MAC1B,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,WAAA,EAAa,IAAA;AAAA,MACb,GAAA,EAAK,OAAA,CAAQ,GAAA,GAAM,EAAC,GAAI;AAAA,KACzB,CAAA;AAED,IAAA,IAAA,CAAK,MAAA,GAAS,QAAQ,SAAA,IAAa,cAAA;AACnC,IAAA,IAAA,CAAK,eAAA,GAAkB,QAAQ,eAAA,IAAmB,wBAAA;AAClD,IAAA,IAAA,CAAK,iBAAA,GACH,QAAQ,sBAAA,IAA0B,0BAAA;AAAA,EACtC;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,IAAA,CAAK,MAAM,OAAA,EAAQ;AAAA,EAC3B;AAAA,EAEA,MAAM,UAAA,GAA4B;AAChC,IAAA,MAAM,IAAA,CAAK,MAAM,IAAA,EAAK;AAAA,EACxB;AAAA,EAEQ,QAAQ,MAAA,EAAwB;AACtC,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA;AAAA,EACtC;AAAA,EAEQ,WAAW,SAAA,EAA2B;AAC5C,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,SAAA,EAAY,SAAS,CAAA,CAAA;AAAA,EAC5C;AAAA,EAEQ,WAAW,KAAA,EAAuB;AACxC,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,QAAA,EAAW,KAAK,CAAA,CAAA;AAAA,EACvC;AAAA,EAEQ,eAAe,KAAA,EAAuB;AAC5C,IAAA,OAAO,GAAG,IAAA,CAAK,MAAM,CAAA,YAAA,EAAe,KAAA,CAAM,aAAa,CAAA,CAAA;AAAA,EACzD;AAAA,EAEQ,mBAAmB,MAAA,EAAwB;AACjD,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,MAAA,EAAS,MAAM,CAAA,iBAAA,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,WAAW,IAAA,EAKK;AACpB,IAAA,MAAM,MAAA,GAASC,kBAAA,CAAY,EAAE,CAAA,CAAE,SAAS,KAAK,CAAA;AAC7C,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAEnC,IAAA,MAAM,IAAA,GAAiB;AAAA,MACrB,EAAA,EAAI,MAAA;AAAA,MACJ,KAAA,EAAO,IAAA,CAAK,KAAA,CAAM,WAAA,EAAY;AAAA,MAC9B,cAAc,IAAA,CAAK,YAAA;AAAA,MACnB,IAAA,EAAO,KAAK,IAAA,IAAQ,UAAA;AAAA,MACpB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,SAAA,EAAW,GAAA;AAAA,MACX,SAAA,EAAW;AAAA,KACb;AAEA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS;AAErC,IAAA,QAAA,CAAS,IAAA,CAAK,KAAK,OAAA,CAAQ,MAAM,GAAG,IAAA,CAAK,UAAA,CAAW,IAAI,CAAC,CAAA;AACzD,IAAA,QAAA,CAAS,IAAI,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,KAAK,GAAG,MAAM,CAAA;AAEpD,IAAA,MAAM,SAAS,IAAA,EAAK;AAEpB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,KAAA,EAAyC;AAC7D,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA;AAAA,MAC9B,IAAA,CAAK,cAAA,CAAe,KAAA,CAAM,WAAA,EAAa;AAAA,KACzC;AACA,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,IAAA,OAAO,IAAA,CAAK,aAAa,MAAM,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,aAAa,MAAA,EAA0C;AAC3D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,KAAA,CAAM,QAAQ,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAC,CAAA;AAC1D,IAAA,IAAI,CAAC,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,GAAG,OAAO,IAAA;AACpD,IAAA,OAAO,IAAA,CAAK,WAAW,IAAI,CAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAA,CACJ,MAAA,EACA,IAAA,EAC0B;AAC1B,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,MAAM,CAAA;AAC/C,IAAA,IAAI,CAAC,UAAU,OAAO,IAAA;AAEtB,IAAA,MAAM,OAAA,GAAoB;AAAA,MACxB,GAAG,QAAA;AAAA,MACH,GAAG,IAAA;AAAA,MACH,EAAA,EAAI,MAAA;AAAA,MACJ,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,KACpC;AAEA,IAAA,IAAI,IAAA,CAAK,KAAA,IAAS,IAAA,CAAK,KAAA,KAAU,SAAS,KAAA,EAAO;AAC/C,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS;AACrC,MAAA,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,cAAA,CAAe,QAAA,CAAS,KAAK,CAAC,CAAA;AAChD,MAAA,QAAA,CAAS,IAAI,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,KAAK,GAAG,MAAM,CAAA;AACpD,MAAA,MAAM,SAAS,IAAA,EAAK;AAAA,IACtB;AAEA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA,EAAG,IAAA,CAAK,UAAA,CAAW,OAAO,CAAC,CAAA;AACpE,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,WAAW,MAAA,EAAkC;AACjD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,YAAA,CAAa,MAAM,CAAA;AAC3C,IAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS;AACrC,IAAA,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAC,CAAA;AACjC,IAAA,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,KAAK,CAAC,CAAA;AAC5C,IAAA,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,kBAAA,CAAmB,MAAM,CAAC,CAAA;AAC5C,IAAA,MAAM,SAAS,IAAA,EAAK;AAEpB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,QAAA,EAAmC;AACpD,IAAA,OAAOC,uBAAA,CAAO,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,cAAA,CAAe,QAAA,EAAkB,IAAA,EAAgC;AACrE,IAAA,OAAOA,uBAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,IAAI,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,aAAA,CACJ,MAAA,EACA,IAAA,GAGI,EAAC,EACa;AAClB,IAAA,MAAM,SAAA,GAAYD,kBAAA,CAAY,EAAE,CAAA,CAAE,SAAS,KAAK,CAAA;AAChD,IAAA,MAAM,KAAA,GAAQA,kBAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AAClD,IAAA,MAAM,YAAA,GAAeA,kBAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACzD,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AAErB,IAAA,MAAM,OAAA,GAAmB;AAAA,MACvB,EAAA,EAAI,SAAA;AAAA,MACJ,MAAA;AAAA,MACA,KAAA;AAAA,MACA,YAAA;AAAA,MACA,WAAW,IAAI,IAAA;AAAA,QACb,GAAA,CAAI,OAAA,EAAQ,GAAI,IAAA,CAAK,eAAA,GAAkB;AAAA,QACvC,WAAA,EAAY;AAAA,MACd,SAAA,EAAW,IAAI,WAAA,EAAY;AAAA,MAC3B,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA,KAClB;AAEA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS;AAErC,IAAA,QAAA,CAAS,IAAA,CAAK,KAAK,UAAA,CAAW,SAAS,GAAG,IAAA,CAAK,aAAA,CAAc,OAAO,CAAC,CAAA;AACrE,IAAA,QAAA,CAAS,KAAA;AAAA,MACP,IAAA,CAAK,WAAW,YAAY,CAAA;AAAA,MAC5B,IAAA,CAAK,iBAAA;AAAA,MACL;AAAA,KACF;AAEA,IAAA,MAAM,SAAS,IAAA,EAAK;AAEpB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,mBAAmB,KAAA,EAAwC;AAC/D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,KAAA,CAAM,QAAQ,IAAA,CAAK,UAAA,CAAW,KAAK,CAAC,CAAA;AAC5D,IAAA,IAAI,CAAC,QAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,MAAA,KAAW,GAAG,OAAO,IAAA;AACpD,IAAA,OAAO,IAAA,CAAK,cAAc,IAAI,CAAA;AAAA,EAChC;AAAA,EAEA,MAAM,cAAc,SAAA,EAAqC;AACvD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,QAAQ,IAAA,CAAK,UAAA,CAAW,SAAS,CAAC,CAAA;AACnE,IAAA,IAAI,CAAC,WAAW,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,KAAW,GAAG,OAAO,KAAA;AAE1D,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAA,EAAS;AACrC,IAAA,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAC,CAAA;AACvC,IAAA,IAAI,QAAQ,YAAA,EAAc;AACxB,MAAA,QAAA,CAAS,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,OAAA,CAAQ,YAAY,CAAC,CAAA;AAAA,IACpD;AACA,IAAA,MAAM,SAAS,IAAA,EAAK;AAEpB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,mBAAmB,MAAA,EAAiC;AACxD,IAAA,MAAM,OAAA,GAAU,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,UAAA,CAAA;AAC9B,IAAA,IAAI,MAAA,GAAS,GAAA;AACb,IAAA,IAAI,OAAA,GAAU,CAAA;AAEd,IAAA,GAAG;AACD,MAAA,MAAM,CAAC,UAAA,EAAY,IAAI,CAAA,GAAI,MAAM,KAAK,KAAA,CAAM,IAAA;AAAA,QAC1C,MAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,MAAA,GAAS,UAAA;AAET,MAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,QAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,KAAA,CAAM,QAAQ,GAAG,CAAA;AAChD,QAAA,IAAI,WAAA,CAAY,WAAW,MAAA,EAAQ;AACjC,UAAA,MAAM,YAAY,GAAA,CAAI,OAAA,CAAQ,GAAG,IAAA,CAAK,MAAM,aAAa,EAAE,CAAA;AAC3D,UAAA,MAAM,IAAA,CAAK,cAAc,SAAS,CAAA;AAClC,UAAA,OAAA,EAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,MAAA,KAAW,GAAA;AAEpB,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,oBAAA,CACJ,MAAA,EACA,YAAA,EACe;AACf,IAAA,MAAM,KAAK,KAAA,CAAM,KAAA,CAAM,KAAK,kBAAA,CAAmB,MAAM,GAAG,YAAY,CAAA;AACpE,IAAA,MAAM,IAAA,CAAK,MAAM,KAAA,CAAM,IAAA,CAAK,mBAAmB,MAAM,CAAA,EAAG,GAAG,CAAC,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAA,CACJ,MAAA,EACA,KAAA,GAAgB,CAAA,EACG;AACnB,IAAA,OAAO,IAAA,CAAK,MAAM,MAAA,CAAO,IAAA,CAAK,mBAAmB,MAAM,CAAA,EAAG,CAAA,EAAG,KAAA,GAAQ,CAAC,CAAA;AAAA,EACxE;AAAA,EAEA,MAAM,mBAAA,CACJ,QAAA,EACA,MAAA,EACA,eAAuB,CAAA,EACL;AAClB,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,kBAAA,CAAmB,QAAQ,YAAY,CAAA;AAElE,IAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,MAAA,IAAI,MAAM,IAAA,CAAK,cAAA,CAAe,QAAA,EAAU,IAAI,CAAA,EAAG;AAC7C,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEQ,WAAW,IAAA,EAAwC;AACzD,IAAA,MAAM,IAAA,GAA+B;AAAA,MACnC,IAAI,IAAA,CAAK,EAAA;AAAA,MACT,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,YAAA,EAAc,KAAK,YAAA,IAAgB,EAAA;AAAA,MACnC,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA,KAClB;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA;AACxC,IAAA,IAAI,KAAK,aAAA,KAAkB,MAAA;AACzB,MAAA,IAAA,CAAK,aAAA,GAAgB,MAAA,CAAO,IAAA,CAAK,aAAa,CAAA;AAChD,IAAA,IAAI,KAAK,MAAA,KAAW,MAAA,OAAgB,MAAA,GAAS,MAAA,CAAO,KAAK,MAAM,CAAA;AAC/D,IAAA,IAAI,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,SAAA;AAC1C,IAAA,IAAI,KAAK,mBAAA,KAAwB,MAAA;AAC/B,MAAA,IAAA,CAAK,mBAAA,GAAsB,MAAA,CAAO,IAAA,CAAK,mBAAmB,CAAA;AAE5D,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,WAAW,IAAA,EAAwC;AACzD,IAAA,OAAO;AAAA,MACL,IAAI,IAAA,CAAK,EAAA;AAAA,MACT,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,cAAc,IAAA,CAAK,YAAA;AAAA,MACnB,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,aAAA,EAAe,KAAK,aAAA,KAAkB,MAAA;AAAA,MACtC,MAAA,EAAQ,KAAK,MAAA,KAAW,MAAA;AAAA,MACxB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,qBAAqB,IAAA,CAAK,mBAAA,GACtB,SAAS,IAAA,CAAK,mBAAA,EAAqB,EAAE,CAAA,GACrC;AAAA,KACN;AAAA,EACF;AAAA,EAEQ,cAAc,OAAA,EAA0C;AAC9D,IAAA,MAAM,IAAA,GAA+B;AAAA,MACnC,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,WAAW,OAAA,CAAQ;AAAA,KACrB;AAEA,IAAA,IAAI,OAAA,CAAQ,YAAA,EAAc,IAAA,CAAK,YAAA,GAAe,OAAA,CAAQ,YAAA;AACtD,IAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,IAAA,CAAK,SAAA,GAAY,OAAA,CAAQ,SAAA;AAChD,IAAA,IAAI,OAAA,CAAQ,SAAA,EAAW,IAAA,CAAK,SAAA,GAAY,OAAA,CAAQ,SAAA;AAEhD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,cAAc,IAAA,EAAuC;AAC3D,IAAA,OAAO;AAAA,MACL,IAAI,IAAA,CAAK,EAAA;AAAA,MACT,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,cAAc,IAAA,CAAK,YAAA;AAAA,MACnB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA,KAClB;AAAA,EACF;AACF","file":"chunk-A3RQWHKD.cjs","sourcesContent":["import Redis from \"ioredis\";\nimport type { AuthAdapter, AuthUser, Session, UserRole } from \"./types.js\";\nimport bcrypt from \"bcryptjs\";\nimport { randomBytes } from \"crypto\";\n\nexport interface RedisAuthAdapterOptions {\n  url?: string;\n  host?: string;\n  port?: number;\n  password?: string;\n  db?: number;\n  keyPrefix?: string;\n  tokenExpiration?: number;\n  refreshTokenExpiration?: number;\n  tls?: boolean;\n}\n\nconst DEFAULT_PREFIX = \"kyro:auth:\";\nconst DEFAULT_TOKEN_EXPIRATION = 86400;\nconst DEFAULT_REFRESH_EXPIRATION = 604800;\n\nexport class RedisAuthAdapter implements AuthAdapter {\n  private redis: Redis;\n  private prefix: string;\n  private tokenExpiration: number;\n  private refreshExpiration: number;\n\n  constructor(options: RedisAuthAdapterOptions = {}) {\n    const url =\n      options.url ||\n      `redis://${options.host || \"localhost\"}:${options.port || 6379}`;\n\n    this.redis = new Redis(url, {\n      password: options.password,\n      db: options.db,\n      lazyConnect: true,\n      tls: options.tls ? {} : undefined,\n    });\n\n    this.prefix = options.keyPrefix || DEFAULT_PREFIX;\n    this.tokenExpiration = options.tokenExpiration || DEFAULT_TOKEN_EXPIRATION;\n    this.refreshExpiration =\n      options.refreshTokenExpiration || DEFAULT_REFRESH_EXPIRATION;\n  }\n\n  async connect(): Promise<void> {\n    await this.redis.connect();\n  }\n\n  async disconnect(): Promise<void> {\n    await this.redis.quit();\n  }\n\n  private userKey(userId: string): string {\n    return `${this.prefix}users:${userId}`;\n  }\n\n  private sessionKey(sessionId: string): string {\n    return `${this.prefix}sessions:${sessionId}`;\n  }\n\n  private refreshKey(token: string): string {\n    return `${this.prefix}refresh:${token}`;\n  }\n\n  private userByEmailKey(email: string): string {\n    return `${this.prefix}users:email:${email.toLowerCase()}`;\n  }\n\n  private passwordHistoryKey(userId: string): string {\n    return `${this.prefix}users:${userId}:password_history`;\n  }\n\n  async createUser(data: {\n    email: string;\n    passwordHash: string;\n    role?: UserRole;\n    tenantId?: string;\n  }): Promise<AuthUser> {\n    const userId = randomBytes(16).toString(\"hex\");\n    const now = new Date().toISOString();\n\n    const user: AuthUser = {\n      id: userId,\n      email: data.email.toLowerCase(),\n      passwordHash: data.passwordHash,\n      role: (data.role || \"customer\") as UserRole,\n      tenantId: data.tenantId,\n      createdAt: now,\n      updatedAt: now,\n    };\n\n    const pipeline = this.redis.pipeline();\n\n    pipeline.hset(this.userKey(userId), this.userToHash(user));\n    pipeline.set(this.userByEmailKey(data.email), userId);\n\n    await pipeline.exec();\n\n    return user;\n  }\n\n  async findUserByEmail(email: string): Promise<AuthUser | null> {\n    const userId = await this.redis.get(\n      this.userByEmailKey(email.toLowerCase()),\n    );\n    if (!userId) return null;\n    return this.findUserById(userId);\n  }\n\n  async findUserById(userId: string): Promise<AuthUser | null> {\n    const data = await this.redis.hgetall(this.userKey(userId));\n    if (!data || Object.keys(data).length === 0) return null;\n    return this.hashToUser(data);\n  }\n\n  async updateUser(\n    userId: string,\n    data: Partial<AuthUser>,\n  ): Promise<AuthUser | null> {\n    const existing = await this.findUserById(userId);\n    if (!existing) return null;\n\n    const updated: AuthUser = {\n      ...existing,\n      ...data,\n      id: userId,\n      updatedAt: new Date().toISOString(),\n    };\n\n    if (data.email && data.email !== existing.email) {\n      const pipeline = this.redis.pipeline();\n      pipeline.del(this.userByEmailKey(existing.email));\n      pipeline.set(this.userByEmailKey(data.email), userId);\n      await pipeline.exec();\n    }\n\n    await this.redis.hset(this.userKey(userId), this.userToHash(updated));\n    return updated;\n  }\n\n  async deleteUser(userId: string): Promise<boolean> {\n    const user = await this.findUserById(userId);\n    if (!user) return false;\n\n    const pipeline = this.redis.pipeline();\n    pipeline.del(this.userKey(userId));\n    pipeline.del(this.userByEmailKey(user.email));\n    pipeline.del(this.passwordHistoryKey(userId));\n    await pipeline.exec();\n\n    return true;\n  }\n\n  async hashPassword(password: string): Promise<string> {\n    return bcrypt.hash(password, 12);\n  }\n\n  async verifyPassword(password: string, hash: string): Promise<boolean> {\n    return bcrypt.compare(password, hash);\n  }\n\n  async createSession(\n    userId: string,\n    data: {\n      ipAddress?: string;\n      userAgent?: string;\n    } = {},\n  ): Promise<Session> {\n    const sessionId = randomBytes(32).toString(\"hex\");\n    const token = randomBytes(32).toString(\"base64url\");\n    const refreshToken = randomBytes(32).toString(\"base64url\");\n    const now = new Date();\n\n    const session: Session = {\n      id: sessionId,\n      userId,\n      token,\n      refreshToken,\n      expiresAt: new Date(\n        now.getTime() + this.tokenExpiration * 1000,\n      ).toISOString(),\n      createdAt: now.toISOString(),\n      ipAddress: data.ipAddress,\n      userAgent: data.userAgent,\n    };\n\n    const pipeline = this.redis.pipeline();\n\n    pipeline.hset(this.sessionKey(sessionId), this.sessionToHash(session));\n    pipeline.setex(\n      this.refreshKey(refreshToken),\n      this.refreshExpiration,\n      sessionId,\n    );\n\n    await pipeline.exec();\n\n    return session;\n  }\n\n  async findSessionByToken(token: string): Promise<Session | null> {\n    const data = await this.redis.hgetall(this.sessionKey(token));\n    if (!data || Object.keys(data).length === 0) return null;\n    return this.hashToSession(data);\n  }\n\n  async deleteSession(sessionId: string): Promise<boolean> {\n    const session = await this.redis.hgetall(this.sessionKey(sessionId));\n    if (!session || Object.keys(session).length === 0) return false;\n\n    const pipeline = this.redis.pipeline();\n    pipeline.del(this.sessionKey(sessionId));\n    if (session.refreshToken) {\n      pipeline.del(this.refreshKey(session.refreshToken));\n    }\n    await pipeline.exec();\n\n    return true;\n  }\n\n  async deleteUserSessions(userId: string): Promise<number> {\n    const pattern = `${this.prefix}sessions:*`;\n    let cursor = \"0\";\n    let deleted = 0;\n\n    do {\n      const [nextCursor, keys] = await this.redis.scan(\n        cursor,\n        \"MATCH\",\n        pattern,\n        \"COUNT\",\n        100,\n      );\n      cursor = nextCursor;\n\n      for (const key of keys) {\n        const sessionData = await this.redis.hgetall(key);\n        if (sessionData.userId === userId) {\n          const sessionId = key.replace(`${this.prefix}sessions:`, \"\");\n          await this.deleteSession(sessionId);\n          deleted++;\n        }\n      }\n    } while (cursor !== \"0\");\n\n    return deleted;\n  }\n\n  async addPasswordToHistory(\n    userId: string,\n    passwordHash: string,\n  ): Promise<void> {\n    await this.redis.lpush(this.passwordHistoryKey(userId), passwordHash);\n    await this.redis.ltrim(this.passwordHistoryKey(userId), 0, 4);\n  }\n\n  async getPasswordHistory(\n    userId: string,\n    count: number = 5,\n  ): Promise<string[]> {\n    return this.redis.lrange(this.passwordHistoryKey(userId), 0, count - 1);\n  }\n\n  async isPasswordInHistory(\n    password: string,\n    userId: string,\n    historyCount: number = 5,\n  ): Promise<boolean> {\n    const history = await this.getPasswordHistory(userId, historyCount);\n\n    for (const hash of history) {\n      if (await this.verifyPassword(password, hash)) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  private userToHash(user: AuthUser): Record<string, string> {\n    const hash: Record<string, string> = {\n      id: user.id,\n      email: user.email,\n      passwordHash: user.passwordHash || \"\",\n      role: user.role,\n      createdAt: user.createdAt,\n      updatedAt: user.updatedAt,\n    };\n\n    if (user.tenantId) hash.tenantId = user.tenantId;\n    if (user.emailVerified !== undefined)\n      hash.emailVerified = String(user.emailVerified);\n    if (user.locked !== undefined) hash.locked = String(user.locked);\n    if (user.lastLogin) hash.lastLogin = user.lastLogin;\n    if (user.failedLoginAttempts !== undefined)\n      hash.failedLoginAttempts = String(user.failedLoginAttempts);\n\n    return hash;\n  }\n\n  private hashToUser(hash: Record<string, string>): AuthUser {\n    return {\n      id: hash.id,\n      email: hash.email,\n      passwordHash: hash.passwordHash,\n      role: hash.role as UserRole,\n      tenantId: hash.tenantId,\n      createdAt: hash.createdAt,\n      updatedAt: hash.updatedAt,\n      emailVerified: hash.emailVerified === \"true\",\n      locked: hash.locked === \"true\",\n      lastLogin: hash.lastLogin,\n      failedLoginAttempts: hash.failedLoginAttempts\n        ? parseInt(hash.failedLoginAttempts, 10)\n        : 0,\n    };\n  }\n\n  private sessionToHash(session: Session): Record<string, string> {\n    const hash: Record<string, string> = {\n      id: session.id,\n      userId: session.userId,\n      token: session.token,\n      expiresAt: session.expiresAt,\n      createdAt: session.createdAt,\n    };\n\n    if (session.refreshToken) hash.refreshToken = session.refreshToken;\n    if (session.ipAddress) hash.ipAddress = session.ipAddress;\n    if (session.userAgent) hash.userAgent = session.userAgent;\n\n    return hash;\n  }\n\n  private hashToSession(hash: Record<string, string>): Session {\n    return {\n      id: hash.id,\n      userId: hash.userId,\n      token: hash.token,\n      refreshToken: hash.refreshToken,\n      expiresAt: hash.expiresAt,\n      createdAt: hash.createdAt,\n      ipAddress: hash.ipAddress,\n      userAgent: hash.userAgent,\n    };\n  }\n}\n"]}