@kywi-software/core 0.7.0 → 0.8.0

package/dist/auth/__tests__/access-control.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-control.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/access-control.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAGzD,MAAM,KAAK,GAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACvE,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,CAAA;AAE7E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,MAAM,GAAwB;YAClC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI;SAClC,CAAA;QACD,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5D,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAwB;YAClC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK;SAC/D,CAAA;QACD,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC9D,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAwB;YAClC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI;SAClC,CAAA;QACD,kFAAkF;QAClF,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAwB;YAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY;SACnD,CAAA;QACD,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAwB;YAClC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY;SAClD,CAAA;QACD,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/__tests__/authjs.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=authjs.test.d.ts.map

package/dist/auth/__tests__/authjs.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authjs.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/authjs.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/authjs.test.js

@@ -1,96 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-vi.mock('@auth/core/providers/credentials', () => ({
-    default: vi.fn((config) => ({
-        id: 'credentials',
-        name: config.name,
-        type: 'credentials',
-        authorize: config.authorize,
-    })),
-}));
-import { createKywiAuthConfig } from '../authjs.js';
-const mockConfig = {
-    mode: 'coupled',
-    db: { provider: 'postgresql', url: 'postgres://localhost/test' },
-    auth: {
-        secret: 'test-secret-at-least-32-chars-long!!',
-        providers: ['credentials'],
-    },
-    sites: [
-        {
-            id: 'default',
-            name: 'Test',
-            domain: 'localhost',
-            defaultLocale: 'en',
-            theme: 'default',
-        },
-    ],
-    contentTypes: [],
-    plugins: [],
-    modules: [],
-    themes: [],
-    media: { provider: 'local' },
-    cache: { provider: 'memory' },
-};
-describe('createKywiAuthConfig', () => {
-    it('returns Auth.js config with credentials provider', () => {
-        const authConfig = createKywiAuthConfig(mockConfig, {});
-        expect(authConfig).toBeDefined();
-        expect(authConfig.providers).toBeDefined();
-        expect(authConfig.providers.length).toBe(1);
-    });
-    it('includes secret from kywi config', () => {
-        const authConfig = createKywiAuthConfig(mockConfig, {});
-        expect(authConfig.secret).toBe(mockConfig.auth.secret);
-    });
-    it('configures session strategy as jwt', () => {
-        const authConfig = createKywiAuthConfig(mockConfig, {});
-        expect(authConfig.session?.strategy).toBe('jwt');
-    });
-    it('sets custom sign-in page to /admin/login', () => {
-        const authConfig = createKywiAuthConfig(mockConfig, {});
-        expect(authConfig.pages?.signIn).toBe('/admin/login');
-    });
-    it('enables trustHost', () => {
-        const authConfig = createKywiAuthConfig(mockConfig, {});
-        expect(authConfig.trustHost).toBe(true);
-    });
-    it('does not add providers not in config', () => {
-        const noProviders = {
-            ...mockConfig,
-            auth: { ...mockConfig.auth, providers: [] },
-        };
-        const authConfig = createKywiAuthConfig(noProviders, {});
-        expect(authConfig.providers.length).toBe(0);
-    });
-    it('has jwt and session callbacks', () => {
-        const authConfig = createKywiAuthConfig(mockConfig, {});
-        expect(authConfig.callbacks?.jwt).toBeDefined();
-        expect(authConfig.callbacks?.session).toBeDefined();
-    });
-    it('jwt callback copies user fields to token', async () => {
-        const authConfig = createKywiAuthConfig(mockConfig, {});
-        const token = await authConfig.callbacks.jwt({
-            token: { sub: 'u1' },
-            user: { id: 'u1', email: 'a@b.com', role: 'admin', groups: ['editors'] },
-            account: null,
-            trigger: 'signIn',
-        });
-        if (!token)
-            throw new Error('jwt callback returned null');
-        expect(token.id).toBe('u1');
-        expect(token.role).toBe('admin');
-        expect(token.groups).toEqual(['editors']);
-    });
-    it('session callback copies token fields to session.user', async () => {
-        const authConfig = createKywiAuthConfig(mockConfig, {});
-        const session = await authConfig.callbacks.session({
-            session: { user: { name: 'Test', email: 'a@b.com' }, expires: '' },
-            token: { id: 'u1', role: 'editor', groups: ['writers'], sub: 'u1' },
-            trigger: 'update',
-        });
-        expect(session.user.id).toBe('u1');
-        expect(session.user.role).toBe('editor');
-        expect(session.user.groups).toEqual(['writers']);
-    });
-});
-//# sourceMappingURL=authjs.test.js.map

package/dist/auth/__tests__/authjs.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authjs.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/authjs.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEjD,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;CACJ,CAAC,CAAC,CAAA;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAGnD,MAAM,UAAU,GAAe;IAC7B,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,2BAA2B,EAAE;IAChE,IAAI,EAAE;QACJ,MAAM,EAAE,sCAAsC;QAC9C,SAAS,EAAE,CAAC,aAAa,CAAC;KAC3B;IACD,KAAK,EAAE;QACL;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,WAAW;YACnB,aAAa,EAAE,IAAI;YACnB,KAAK,EAAE,SAAS;SACjB;KACF;IACD,YAAY,EAAE,EAAE;IAChB,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC5B,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;CAC9B,CAAA;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAS,CAAC,CAAA;QAC9D,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;QAChC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1C,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAS,CAAC,CAAA;QAC9D,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAS,CAAC,CAAA;QAC9D,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAS,CAAC,CAAA;QAC9D,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAS,CAAC,CAAA;QAC9D,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,WAAW,GAAG;YAClB,GAAG,UAAU;YACb,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,EAAW,EAAE;SACrD,CAAA;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,WAAW,EAAE,EAAS,CAAC,CAAA;QAC/D,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAS,CAAC,CAAA;QAC9D,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;QAC/C,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAS,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAU,CAAC,GAAI,CAAC;YAC7C,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;YACpB,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAS;YAC/E,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAA;QACF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QACzD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAS,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAU,CAAC,OAAQ,CAAC;YACnD,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,EAAS;YACzE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE;YACnE,OAAO,EAAE,QAAQ;SACX,CAAC,CAAA;QACT,MAAM,CAAE,OAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,CAAE,OAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjD,MAAM,CAAE,OAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/__tests__/brute-force.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=brute-force.test.d.ts.map

package/dist/auth/__tests__/brute-force.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"brute-force.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/brute-force.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/brute-force.test.js

@@ -1,125 +0,0 @@
-import { describe, it, expect, beforeEach } from 'vitest';
-import { recordStrike, isLockedOut, clearStrikes, } from '../brute-force.js';
-const DEFAULT_CONFIG = {
-    maxStrikes: 5,
-    windowMinutes: 15,
-    lockoutMinutes: 30,
-};
-/**
- * In-memory implementation of BruteForceDb for testing.
- */
-function createInMemoryDb() {
-    const strikes = [];
-    let counter = 0;
-    return {
-        async insertStrike(userId, ip) {
-            counter += 1;
-            strikes.push({
-                id: `strike-${String(counter)}`,
-                userId,
-                ip,
-                attemptedAt: new Date(),
-            });
-        },
-        async getStrikes(userId, ip, since) {
-            return strikes.filter((s) => s.userId === userId &&
-                s.ip === ip &&
-                s.attemptedAt.getTime() >= since.getTime());
-        },
-        async deleteStrikes(userId, ip) {
-            // Remove matching entries in place
-            for (let i = strikes.length - 1; i >= 0; i--) {
-                if (strikes[i].userId === userId && strikes[i].ip === ip) {
-                    strikes.splice(i, 1);
-                }
-            }
-        },
-    };
-}
-describe('brute-force protection', () => {
-    let db;
-    beforeEach(() => {
-        db = createInMemoryDb();
-    });
-    it('allows access when strikes are below the threshold', async () => {
-        for (let i = 0; i < 4; i++) {
-            await recordStrike(db, 'user-1', '1.2.3.4');
-        }
-        const result = await isLockedOut(db, 'user-1', '1.2.3.4', DEFAULT_CONFIG);
-        expect(result.locked).toBe(false);
-    });
-    it('locks out after 5 failed attempts', async () => {
-        for (let i = 0; i < 5; i++) {
-            await recordStrike(db, 'user-1', '1.2.3.4');
-        }
-        const result = await isLockedOut(db, 'user-1', '1.2.3.4', DEFAULT_CONFIG);
-        expect(result.locked).toBe(true);
-        expect(result.retryAfter).toBeDefined();
-        expect(result.retryAfter).toBeGreaterThan(0);
-    });
-    it('unlocks after clearStrikes (successful login)', async () => {
-        for (let i = 0; i < 5; i++) {
-            await recordStrike(db, 'user-1', '1.2.3.4');
-        }
-        // Confirm locked
-        let result = await isLockedOut(db, 'user-1', '1.2.3.4', DEFAULT_CONFIG);
-        expect(result.locked).toBe(true);
-        // Simulate successful login — clear strikes
-        await clearStrikes(db, 'user-1', '1.2.3.4');
-        result = await isLockedOut(db, 'user-1', '1.2.3.4', DEFAULT_CONFIG);
-        expect(result.locked).toBe(false);
-    });
-    it('lockout expires after the configured duration', async () => {
-        // Use a very short lockout for this test
-        const shortConfig = {
-            maxStrikes: 5,
-            windowMinutes: 15,
-            lockoutMinutes: 0, // 0 minutes = expires immediately
-        };
-        for (let i = 0; i < 5; i++) {
-            await recordStrike(db, 'user-1', '1.2.3.4');
-        }
-        // With 0-minute lockout, the lockout has already expired
-        const result = await isLockedOut(db, 'user-1', '1.2.3.4', shortConfig);
-        expect(result.locked).toBe(false);
-    });
-    it('tracks different IPs separately', async () => {
-        // 5 strikes from IP A
-        for (let i = 0; i < 5; i++) {
-            await recordStrike(db, 'user-1', '1.2.3.4');
-        }
-        // IP A is locked
-        const lockedResult = await isLockedOut(db, 'user-1', '1.2.3.4', DEFAULT_CONFIG);
-        expect(lockedResult.locked).toBe(true);
-        // IP B has no strikes — not locked
-        const freeResult = await isLockedOut(db, 'user-1', '5.6.7.8', DEFAULT_CONFIG);
-        expect(freeResult.locked).toBe(false);
-    });
-    it('does not count strikes outside the time window', async () => {
-        // Use a config with a tiny window
-        const tinyWindowConfig = {
-            maxStrikes: 5,
-            windowMinutes: 0, // 0-minute window — nothing is "recent"
-            lockoutMinutes: 30,
-        };
-        for (let i = 0; i < 5; i++) {
-            await recordStrike(db, 'user-1', '1.2.3.4');
-        }
-        // Strikes happened "now", but window is 0 minutes, so the window
-        // start is Date.now() — strikes at exactly Date.now() are on the boundary.
-        // The getStrikes uses >=, so they are included. However with windowMinutes=0
-        // and Date.now() granularity, let's just verify the lockout expires.
-        // Instead, use a mock to simulate old strikes:
-        const mockDb = {
-            async insertStrike() { },
-            async getStrikes() {
-                // Return 5 strikes that are all in the past (before any window)
-                return [];
-            },
-            async deleteStrikes() { },
-        };
-        const result = await isLockedOut(mockDb, 'user-1', '1.2.3.4', DEFAULT_CONFIG);
-        expect(result.locked).toBe(false);
-    });
-});
-//# sourceMappingURL=brute-force.test.js.map

package/dist/auth/__tests__/brute-force.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"brute-force.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/brute-force.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAM,MAAM,QAAQ,CAAA;AAC7D,OAAO,EACL,YAAY,EACZ,WAAW,EACX,YAAY,GAIb,MAAM,mBAAmB,CAAA;AAE1B,MAAM,cAAc,GAAqB;IACvC,UAAU,EAAE,CAAC;IACb,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,EAAE;CACnB,CAAA;AAED;;GAEG;AACH,SAAS,gBAAgB;IACvB,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,EAAU;YAC3C,OAAO,IAAI,CAAC,CAAA;YACZ,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,UAAU,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC/B,MAAM;gBACN,EAAE;gBACF,WAAW,EAAE,IAAI,IAAI,EAAE;aACxB,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,EAAU,EAAE,KAAW;YACtD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,MAAM;gBACnB,CAAC,CAAC,EAAE,KAAK,EAAE;gBACX,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAC7C,CAAA;QACH,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,EAAU;YAC5C,mCAAmC;YACnC,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7C,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC3D,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,EAAgB,CAAA;IAEpB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,GAAG,gBAAgB,EAAE,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;QACzE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;QACzE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,UAAW,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7C,CAAC;QAED,iBAAiB;QACjB,IAAI,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEhC,4CAA4C;QAC5C,MAAM,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAE3C,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;QACnE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,yCAAyC;QACzC,MAAM,WAAW,GAAqB;YACpC,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,EAAE;YACjB,cAAc,EAAE,CAAC,EAAE,kCAAkC;SACtD,CAAA;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7C,CAAC;QAED,yDAAyD;QACzD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACtE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,sBAAsB;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7C,CAAC;QAED,iBAAiB;QACjB,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;QAC/E,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEtC,mCAAmC;QACnC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;QAC7E,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,kCAAkC;QAClC,MAAM,gBAAgB,GAAqB;YACzC,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,CAAC,EAAE,wCAAwC;YAC1D,cAAc,EAAE,EAAE;SACnB,CAAA;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7C,CAAC;QAED,iEAAiE;QACjE,2EAA2E;QAC3E,6EAA6E;QAC7E,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,MAAM,GAAiB;YAC3B,KAAK,CAAC,YAAY,KAAI,CAAC;YACvB,KAAK,CAAC,UAAU;gBACd,gEAAgE;gBAChE,OAAO,EAAE,CAAA;YACX,CAAC;YACD,KAAK,CAAC,aAAa,KAAI,CAAC;SACzB,CAAA;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;QAC7E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/__tests__/document-access.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=document-access.test.d.ts.map

package/dist/auth/__tests__/document-access.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-access.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/document-access.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/document-access.test.js

@@ -1,173 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-import { checkDocumentAccess, checkDocumentMutationAccess } from '../access-control.js';
-// ─── Mock DB helpers ──────────────────────────────────────────────────────────
-function makeSelectChain(rows) {
-    return {
-        from: vi.fn().mockReturnThis(),
-        where: vi.fn().mockResolvedValue(rows),
-    };
-}
-function makeSelectChainWithLimit(rows) {
-    return {
-        from: vi.fn().mockReturnThis(),
-        where: vi.fn().mockReturnThis(),
-        limit: vi.fn().mockResolvedValue(rows),
-    };
-}
-function makeMockDb(permRows, hasPermission) {
-    let selectCallCount = 0;
-    return {
-        select: vi.fn(() => {
-            selectCallCount += 1;
-            // First call = listContentPermissions (no limit), second = checkUserContentPermission (with limit)
-            if (selectCallCount === 1)
-                return makeSelectChain(permRows);
-            return makeSelectChainWithLimit(hasPermission ? [{ id: 'perm-1' }] : []);
-        }),
-    };
-}
-// ─── Test users ───────────────────────────────────────────────────────────────
-const superAdmin = { id: 'sa-1', role: 'superAdmin', groups: [] };
-const siteAdmin = { id: 'siteadmin-1', role: 'siteAdmin', groups: [] };
-const editor = { id: 'editor-1', role: 'editor', groups: ['writers'] };
-const reader = { id: 'reader-1', role: 'reader', groups: [] };
-const CONTENT_ID = 'content-uuid-1';
-const PERM_ROW = { id: 'perm-1', contentId: CONTENT_ID, userId: 'reader-1', groupId: null, action: 'read' };
-// ─── Tests ────────────────────────────────────────────────────────────────────
-describe('checkDocumentAccess', () => {
-    describe('admin bypass', () => {
-        it('grants superAdmin access without checking permissions', async () => {
-            const db = makeMockDb([], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, superAdmin, 'read');
-            expect(result).toBe(true);
-            expect(db.select).not.toHaveBeenCalled();
-        });
-        it('grants siteAdmin access without checking permissions', async () => {
-            const db = makeMockDb([], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, siteAdmin, 'read');
-            expect(result).toBe(true);
-            expect(db.select).not.toHaveBeenCalled();
-        });
-        it('grants superAdmin access even for delete action', async () => {
-            const db = makeMockDb([], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, superAdmin, 'delete');
-            expect(result).toBe(true);
-        });
-    });
-    describe('no permissions defined (open access)', () => {
-        it('allows anonymous user when no permissions exist', async () => {
-            const db = makeMockDb([], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, null, 'read');
-            expect(result).toBe(true);
-        });
-        it('allows authenticated user when no permissions exist', async () => {
-            const db = makeMockDb([], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, reader, 'read');
-            expect(result).toBe(true);
-        });
-        it('allows editor when no permissions exist', async () => {
-            const db = makeMockDb([], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, editor, 'write');
-            expect(result).toBe(true);
-        });
-    });
-    describe('permissions exist + anonymous user', () => {
-        it('denies anonymous user when permissions are defined', async () => {
-            const db = makeMockDb([PERM_ROW], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, null, 'read');
-            expect(result).toBe(false);
-        });
-        it('denies null user regardless of action when permissions exist', async () => {
-            const db = makeMockDb([PERM_ROW], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, null, 'write');
-            expect(result).toBe(false);
-        });
-    });
-    describe('permissions exist + authenticated user', () => {
-        it('allows user with a matching direct permission', async () => {
-            const db = makeMockDb([PERM_ROW], true);
-            const result = await checkDocumentAccess(db, CONTENT_ID, reader, 'read');
-            expect(result).toBe(true);
-        });
-        it('denies user with no matching permission', async () => {
-            const db = makeMockDb([PERM_ROW], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, reader, 'read');
-            expect(result).toBe(false);
-        });
-        it('allows user with a matching group permission', async () => {
-            const groupPermRow = { id: 'perm-2', contentId: CONTENT_ID, userId: null, groupId: 'writers', action: 'write' };
-            const db = makeMockDb([groupPermRow], true);
-            const result = await checkDocumentAccess(db, CONTENT_ID, editor, 'write');
-            expect(result).toBe(true);
-        });
-        it('denies user with wrong action in permissions', async () => {
-            // Permissions exist but user has no write perm, only read perm exists
-            const db = makeMockDb([PERM_ROW], false);
-            const result = await checkDocumentAccess(db, CONTENT_ID, reader, 'write');
-            expect(result).toBe(false);
-        });
-    });
-});
-// ─── checkDocumentMutationAccess (G-J04b-01) ───────────────────────────────────
-const PERMS = [PERM_ROW]; // any non-empty ACL → node is locked down
-/**
- * Sequential mock DB: each `db.select()` call dequeues the next result set. The
- * two shapes checkDocumentAccess uses (listContentPermissions resolves at
- * `.where()`, checkUserContentPermission resolves at `.limit()`) both read the
- * same dequeued rows, so the queue is one entry per select() call.
- */
-function makeSeqDb(results) {
-    let i = 0;
-    return {
-        select: vi.fn(() => {
-            const rows = results[i++] ?? [];
-            const where = {
-                then: (resolve) => resolve(rows),
-                limit: () => Promise.resolve(rows),
-            };
-            return { from: () => ({ where: () => where }) };
-        }),
-    };
-}
-const author = { id: 'author-1', role: 'author', groups: [] };
-describe('checkDocumentMutationAccess', () => {
-    it('bypasses all checks for siteAdmin (no DB access)', async () => {
-        const db = makeSeqDb([]);
-        expect(await checkDocumentMutationAccess(db, CONTENT_ID, siteAdmin, 'write')).toBe(true);
-        expect(db.select).not.toHaveBeenCalled();
-    });
-    it('allows any authenticated writer when the node has no ACL rows', async () => {
-        // read gate: empty perms → open; write gate: empty perms → open
-        const db = makeSeqDb([[], []]);
-        expect(await checkDocumentMutationAccess(db, CONTENT_ID, author, 'write')).toBe(true);
-    });
-    it('denies an author with NO grant on a locked node (F1c scenario)', async () => {
-        // read gate: perms exist, no read grant → read denied, short-circuits
-        const db = makeSeqDb([PERMS, []]);
-        expect(await checkDocumentMutationAccess(db, CONTENT_ID, author, 'write')).toBe(false);
-    });
-    it('denies write when the author can read but has no write grant', async () => {
-        // read gate passes (grant present), write gate fails (no write grant)
-        const db = makeSeqDb([PERMS, [{ id: 'p' }], PERMS, []]);
-        expect(await checkDocumentMutationAccess(db, CONTENT_ID, author, 'write')).toBe(false);
-    });
-    it('allows write when the author holds both read and write grants', async () => {
-        const db = makeSeqDb([PERMS, [{ id: 'p' }], PERMS, [{ id: 'p' }]]);
-        expect(await checkDocumentMutationAccess(db, CONTENT_ID, author, 'write')).toBe(true);
-    });
-    it('denies a write-only grant with no read grant (cannot act on invisible node)', async () => {
-        // read gate: perms exist, no read grant → denied even though a write grant exists
-        const db = makeSeqDb([PERMS, []]);
-        expect(await checkDocumentMutationAccess(db, CONTENT_ID, author, 'write')).toBe(false);
-    });
-    it('denies anonymous users on a locked node', async () => {
-        const db = makeSeqDb([PERMS]);
-        expect(await checkDocumentMutationAccess(db, CONTENT_ID, null, 'delete')).toBe(false);
-    });
-    it('evaluates the action-specific grant for publish/delete', async () => {
-        // read grant present, publish grant absent → publish denied
-        const db = makeSeqDb([PERMS, [{ id: 'p' }], PERMS, []]);
-        expect(await checkDocumentMutationAccess(db, CONTENT_ID, author, 'publish')).toBe(false);
-    });
-});
-//# sourceMappingURL=document-access.test.js.map

package/dist/auth/__tests__/document-access.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-access.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/document-access.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAc,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAGvF,iFAAiF;AAEjF,SAAS,eAAe,CAAC,IAAe;IACtC,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;QAC9B,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;KACvC,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAe;IAC/C,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;QAC9B,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;QAC/B,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;KACvC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAmB,EAAE,aAAsB;IAC7D,IAAI,eAAe,GAAG,CAAC,CAAA;IACvB,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE;YACjB,eAAe,IAAI,CAAC,CAAA;YACpB,mGAAmG;YACnG,IAAI,eAAe,KAAK,CAAC;gBAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC3D,OAAO,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC1E,CAAC,CAAC;KACH,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,GAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AAC9E,MAAM,SAAS,GAAgB,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AACnF,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,CAAA;AACnF,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AAE1E,MAAM,UAAU,GAAG,gBAAgB,CAAA;AACnC,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAE3G,iFAAiF;AAEjF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;YACnF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACzB,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAClF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACzB,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;YACrF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;QACpD,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YAC7E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;YAC/E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;YAChF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAClD,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;YACxC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YAC7E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;YACxC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;YAC9E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACtD,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;YACvC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;YAC/E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;YACxC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;YAC/E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,YAAY,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;YAC/G,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAA;YAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;YAChF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,sEAAsE;YACtE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;YACxC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;YAChF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,kFAAkF;AAElF,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAA,CAAC,0CAA0C;AAEnE;;;;;GAKG;AACH,SAAS,SAAS,CAAC,OAAoB;IACrC,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;YAC/B,MAAM,KAAK,GAAQ;gBACjB,IAAI,EAAE,CAAC,OAA6B,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;gBACtD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;aACnC,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,CAAA;QACjD,CAAC,CAAC;KACH,CAAA;AACH,CAAC;AAED,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AAE1E,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;QACxB,MAAM,CAAC,MAAM,2BAA2B,CAAC,EAAS,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/F,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,gEAAgE;QAChE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAC9B,MAAM,CAAC,MAAM,2BAA2B,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,sEAAsE;QACtE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,2BAA2B,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,sEAAsE;QACtE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,MAAM,2BAA2B,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;QAClE,MAAM,CAAC,MAAM,2BAA2B,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,kFAAkF;QAClF,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,2BAA2B,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,2BAA2B,CAAC,EAAS,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,4DAA4D;QAC5D,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,MAAM,2BAA2B,CAAC,EAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/__tests__/field-filter.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=field-filter.test.d.ts.map

package/dist/auth/__tests__/field-filter.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"field-filter.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/field-filter.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/field-filter.test.js

@@ -1,61 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { filterFieldsForUser } from '../access-control.js';
-describe('filterFieldsForUser', () => {
-    const fields = [
-        { name: 'title', type: 'text', label: 'Title' },
-        { name: 'body', type: 'richText', label: 'Body' },
-        {
-            name: 'internalNotes',
-            type: 'textarea',
-            label: 'Internal Notes',
-            access: {
-                read: ({ user }) => user !== null && (user.role === 'siteAdmin' || user.role === 'superAdmin'),
-            },
-        },
-        {
-            name: 'salary',
-            type: 'number',
-            label: 'Salary',
-            access: {
-                read: ({ user }) => user?.role === 'superAdmin',
-                write: ({ user }) => user?.role === 'superAdmin',
-            },
-        },
-    ];
-    const siteAdmin = { id: 'u1', role: 'siteAdmin', groups: [] };
-    const editor = { id: 'u2', role: 'editor', groups: [] };
-    const superAdmin = { id: 'u3', role: 'superAdmin', groups: [] };
-    it('strips fields the user cannot read', () => {
-        const data = { title: 'Hello', body: '<p>World</p>', internalNotes: 'Private', salary: 100000 };
-        const filtered = filterFieldsForUser(data, fields, editor, 'read');
-        expect(filtered).toEqual({ title: 'Hello', body: '<p>World</p>' });
-        expect(filtered).not.toHaveProperty('internalNotes');
-        expect(filtered).not.toHaveProperty('salary');
-    });
-    it('keeps fields for siteAdmin', () => {
-        const data = { title: 'Hello', body: '<p>World</p>', internalNotes: 'Private', salary: 100000 };
-        const filtered = filterFieldsForUser(data, fields, siteAdmin, 'read');
-        expect(filtered).toHaveProperty('internalNotes', 'Private');
-        expect(filtered).not.toHaveProperty('salary');
-    });
-    it('keeps all fields for superAdmin', () => {
-        const data = { title: 'Hello', body: '<p>World</p>', internalNotes: 'Private', salary: 100000 };
-        const filtered = filterFieldsForUser(data, fields, superAdmin, 'read');
-        expect(filtered).toEqual(data);
-    });
-    it('returns all fields when no access restrictions defined', () => {
-        const unrestricted = [
-            { name: 'title', type: 'text', label: 'Title' },
-            { name: 'body', type: 'richText', label: 'Body' },
-        ];
-        const data = { title: 'Hello', body: '<p>World</p>' };
-        const filtered = filterFieldsForUser(data, unrestricted, editor, 'read');
-        expect(filtered).toEqual(data);
-    });
-    it('strips fields for null (anonymous) user', () => {
-        const data = { title: 'Hello', internalNotes: 'Private' };
-        const filtered = filterFieldsForUser(data, fields, null, 'read');
-        expect(filtered).toEqual({ title: 'Hello' });
-    });
-});
-//# sourceMappingURL=field-filter.test.js.map

package/dist/auth/__tests__/field-filter.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"field-filter.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/field-filter.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAG1D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,MAAM,MAAM,GAAsB;QAChC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;QAC/C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;QACjD;YACE,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE;gBACN,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;aAC/F;SACF;QACD;YACE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE;gBACN,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY;gBAC/C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY;aACjD;SACF;KACF,CAAA;IAED,MAAM,SAAS,GAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC1E,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACpE,MAAM,UAAU,GAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAE5E,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC/F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;QAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,eAAe,CAAC,CAAA;QACpD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC/F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACrE,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;QAC3D,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC/F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACtE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,YAAY,GAAsB;YACtC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;YAC/C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;SAClD,CAAA;QACD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;QACrD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACxE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAA;QACzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAChE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/__tests__/mfa.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=mfa.test.d.ts.map

package/dist/auth/__tests__/mfa.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mfa.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/mfa.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/mfa.test.js

@@ -1,89 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import * as OTPAuth from 'otpauth';
-import { generateTotpSecret, verifyTotpCode, generateRecoveryCodes, hashRecoveryCode, verifyRecoveryCode, } from '../mfa.js';
-describe('generateTotpSecret', () => {
-    it('returns a base32 secret and an otpauth URI', () => {
-        const result = generateTotpSecret('Kywi', 'user@example.com');
-        expect(result.secret).toBeTruthy();
-        // Base32 characters: A-Z, 2-7, =
-        expect(result.secret).toMatch(/^[A-Z2-7]+=*$/);
-        expect(result.uri).toMatch(/^otpauth:\/\/totp\//);
-        expect(result.uri).toContain('issuer=Kywi');
-    });
-});
-describe('verifyTotpCode', () => {
-    it('returns true for a correct current TOTP code', () => {
-        const { secret } = generateTotpSecret('Kywi', 'user@example.com');
-        // Generate a valid token from the same secret
-        const totp = new OTPAuth.TOTP({
-            algorithm: 'SHA1',
-            digits: 6,
-            period: 30,
-            secret: OTPAuth.Secret.fromBase32(secret),
-        });
-        const validCode = totp.generate();
-        expect(verifyTotpCode(secret, validCode)).toBe(true);
-    });
-    it('returns false for an incorrect code', () => {
-        const { secret } = generateTotpSecret('Kywi', 'user@example.com');
-        expect(verifyTotpCode(secret, '000000')).toBe(false);
-    });
-});
-describe('generateRecoveryCodes', () => {
-    it('generates the requested number of codes', () => {
-        const codes = generateRecoveryCodes(8);
-        expect(codes).toHaveLength(8);
-    });
-    it('defaults to 10 codes', () => {
-        const codes = generateRecoveryCodes();
-        expect(codes).toHaveLength(10);
-    });
-    it('produces codes in XXXX-XXXX-XXXX format', () => {
-        const codes = generateRecoveryCodes(5);
-        for (const code of codes) {
-            expect(code).toMatch(/^[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}$/);
-        }
-    });
-});
-describe('hashRecoveryCode', () => {
-    it('returns a 64-char hex SHA-256 hash', () => {
-        const hash = hashRecoveryCode('abcd-1234-ef56');
-        expect(hash).toMatch(/^[0-9a-f]{64}$/);
-    });
-    it('normalizes dashes and case', () => {
-        const h1 = hashRecoveryCode('ABCD-1234-EF56');
-        const h2 = hashRecoveryCode('abcd1234ef56');
-        expect(h1).toBe(h2);
-    });
-});
-describe('verifyRecoveryCode', () => {
-    it('validates a correct recovery code and consumes it', () => {
-        const codes = generateRecoveryCodes(3);
-        const hashedCodes = codes.map(hashRecoveryCode);
-        const target = codes[1];
-        const result = verifyRecoveryCode(hashedCodes, target);
-        expect(result.valid).toBe(true);
-        expect(result.remainingCodes).toHaveLength(2);
-        // The consumed code's hash should no longer be in the list
-        expect(result.remainingCodes).not.toContain(hashRecoveryCode(target));
-    });
-    it('rejects an invalid recovery code', () => {
-        const codes = generateRecoveryCodes(3);
-        const hashedCodes = codes.map(hashRecoveryCode);
-        const result = verifyRecoveryCode(hashedCodes, 'xxxx-xxxx-xxxx');
-        expect(result.valid).toBe(false);
-        expect(result.remainingCodes).toHaveLength(3);
-    });
-    it('a consumed code cannot be reused', () => {
-        const codes = generateRecoveryCodes(3);
-        const hashedCodes = codes.map(hashRecoveryCode);
-        const target = codes[0];
-        // First use — valid
-        const first = verifyRecoveryCode(hashedCodes, target);
-        expect(first.valid).toBe(true);
-        // Second use with updated list — invalid
-        const second = verifyRecoveryCode(first.remainingCodes, target);
-        expect(second.valid).toBe(false);
-    });
-});
-//# sourceMappingURL=mfa.test.js.map