@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/identity/auth/guards/jwt-auth.guard.js

@@ -0,0 +1,250 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = exports.NODE_ROUTE_PREFIX = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const passport_1 = require("@nestjs/passport");
+const public_decorator_1 = require("../decorators/public.decorator");
+const pat_service_1 = require("../../pat/pat.service");
+const ports_1 = require("../../ports");
+const principal_factory_1 = require("../principal.factory");
+// =============================================================================
+// The `nod_` route allowlist (issue #267, epic #254)
+// =============================================================================
+//
+// A worker-node credential authenticates AS ITS OWNING USER — `validateToken`
+// returns the same `AuthenticatedUser` the JWT strategy would, carrying that
+// user's real roles and permissions, because `RolesGuard` and
+// `PermissionsGuard` downstream need something they can actually evaluate.
+// And the owner of a node credential is an admin: `nodes:write` is granted to
+// Admin only in `prisma/seed-data.ts`.
+//
+// So without this allowlist, a `nod_` token WOULD BE AN ADMIN TOKEN. That is
+// not a hypothetical — it is the direct consequence of resolving it to a real
+// user, and it is exactly the property that makes a leaked worker credential
+// catastrophic rather than merely bad. A node credential lives in a config
+// file on a machine nobody is watching; it must not be able to call
+// `PATCH /api/users/:id`.
+//
+// -----------------------------------------------------------------------------
+// WHY THE ALLOWLIST LIVES HERE AND NOT IN `NodeCredentialService`
+// -----------------------------------------------------------------------------
+// Because THIS is where route identity exists. `validateToken` answers "is
+// this string a live credential, and whose" and has more than one caller by
+// design; it has no request, no URL, and no business making an authorization
+// decision about a route it cannot see. Pushing the check into the service
+// would mean either passing a URL into a function whose job is credential
+// liveness, or duplicating the rule at each caller — and a security rule that
+// exists in two places is a security rule that will disagree with itself.
+// Recorded as a rejected alternative in docs/specs/worker-nodes.md.
+//
+// -----------------------------------------------------------------------------
+// WHY THE PREFIX MATCH IS EXACT AND NOT `startsWith('/api/nodes')`
+// -----------------------------------------------------------------------------
+// A bare `startsWith` would also admit `/api/nodesX`, `/api/nodes-other` and —
+// the one that actually matters — any future `/api/nodes…`-shaped route
+// somebody adds without thinking about this file. The rule is therefore
+// "exactly the collection, or something UNDER it": `/api/nodes` itself, or a
+// path beginning `/api/nodes/`. `/api/node-credentials` is not under it and
+// is not admitted, which is deliberate and is the subject of its own comment
+// in `nodes/node-credential.controller.ts`.
+// =============================================================================
+/**
+ * The one route prefix a `nod_` credential may reach. No trailing slash.
+ *
+ * @stability stable
+ */
+exports.NODE_ROUTE_PREFIX = '/api/nodes';
+/** The `Authorization` value prefixes each token family is recognized by. */
+const PAT_BEARER_PREFIX = 'Bearer pat_';
+const NODE_BEARER_PREFIX = 'Bearer nod_';
+/** Length of `'Bearer '`, i.e. where the raw token starts in the header. */
+const BEARER_OFFSET = 'Bearer '.length;
+/**
+ * JWT authentication guard.
+ *
+ * Validates JWT tokens on protected routes. Routes marked `@Public()` are
+ * skipped. Two opaque bearer families are recognized before Passport is ever
+ * reached:
+ *
+ *   * `Bearer pat_…` — a personal access token, accepted on EVERY
+ *     authenticated route with the owner's full authority. That universality
+ *     is a documented promise of this API (`openapi/description.ts`) and is
+ *     proven by `test/auth/pat-universality.integration.spec.ts`.
+ *
+ *   * `Bearer nod_…` — a worker-node credential, confined to
+ *     {@link NODE_ROUTE_PREFIX}. Everything else is a 403. See the block
+ *     comment above and docs/specs/worker-nodes.md.
+ *
+ * The two branches are intentionally asymmetric, and the asymmetry IS the
+ * security model: a PAT is a human deliberately delegating their own
+ * authority to a script they control, while a node credential is authority
+ * handed to an unattended process on a machine the deployment may not own.
+ *
+ * @stability stable
+ */
+let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)('jwt') {
+    reflector;
+    patService;
+    nodeCredentialService;
+    constructor(reflector, patService, nodeCredentialService) {
+        super();
+        this.reflector = reflector;
+        this.patService = patService;
+        this.nodeCredentialService = nodeCredentialService;
+    }
+    /**
+     * Determines if the route requires authentication.
+     *
+     * Order: `@Public()` first, then the two opaque bearer families, then
+     * Passport. Note that a `@Public()` route short-circuits BEFORE either
+     * opaque branch, so a public endpoint never pays for a credential lookup
+     * and a `nod_` token is never 403'd on a route that needs no
+     * authentication at all.
+     */
+    async canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const authHeader = request.headers?.authorization;
+        if (authHeader?.startsWith(PAT_BEARER_PREFIX)) {
+            const token = authHeader.slice(BEARER_OFFSET);
+            const resolved = await this.patService.resolveToken(token);
+            if (!resolved) {
+                throw new common_1.UnauthorizedException('Invalid or expired personal access token');
+            }
+            // Set the full AuthenticatedUser on request.user so RolesGuard/PermissionsGuard
+            // can call toRequestUser() on it (same format as JWT strategy validate() returns)
+            request.user = resolved.user;
+            // Which PAT it was (its id, never the token): `@AuthCredential()`.
+            request.authCredential = { kind: 'pat', tokenId: resolved.tokenId };
+            this.attachPrincipal(request, 'pat');
+            return true;
+        }
+        if (authHeader?.startsWith(NODE_BEARER_PREFIX)) {
+            // -----------------------------------------------------------------
+            // THE ROUTE ALLOWLIST RUNS FIRST. THIS ORDER IS NOT NEGOTIABLE.
+            // -----------------------------------------------------------------
+            // Validating first and checking the route second would produce the
+            // same status code and be wrong in two ways at once:
+            //
+            //   1. `validateToken` stamps `lastUsedAt` fire-and-forget on every
+            //      success. A stolen credential probed against `/api/users` would
+            //      therefore leave a fresh `lastUsedAt` in the operator's own
+            //      listing — a LIVENESS ORACLE handed to the attacker (the
+            //      request was refused, so they learn nothing from the response;
+            //      but a confederate who can read the list learns the token is
+            //      still good) and, worse, a corrupted signal for the operator,
+            //      whose "is this node still alive?" column now reflects an
+            //      attacker's probes rather than a working node.
+            //
+            //   2. It spends a database round trip — an indexed lookup plus the
+            //      `include` of roles and permissions, plus a write — on a request
+            //      that was never going to be allowed. That turns a refused
+            //      request into a cheap way to generate load, on the
+            //      authentication path, for an unauthenticated caller.
+            //
+            // Rejecting on route identity alone needs no I/O and leaks nothing:
+            // the answer is the same for a real credential, a revoked one and a
+            // string somebody made up.
+            // -----------------------------------------------------------------
+            if (!this.isNodeRoute(request)) {
+                throw new common_1.ForbiddenException('Worker node credentials may only be used on node endpoints');
+            }
+            const token = authHeader.slice(BEARER_OFFSET);
+            const user = await this.nodeCredentialService.validateToken(token);
+            if (!user) {
+                // Deliberately one message for unknown, revoked, expired and
+                // inactive-owner alike — see `NodeCredentialService.validateToken`.
+                throw new common_1.UnauthorizedException('Invalid or expired node credential');
+            }
+            request.user = user;
+            request.authCredential = { kind: 'node' };
+            this.attachPrincipal(request, 'node');
+            return true;
+        }
+        const admitted = await super.canActivate(context);
+        if (admitted) {
+            request.authCredential = { kind: 'jwt' };
+            // `session` or `device`: stamped by `AuthService.validateJwtPayload`.
+            this.attachPrincipal(request, request.user?.tokenKind ?? 'session');
+        }
+        return admitted;
+    }
+    /**
+     * Sets `request.principal` (ADR 0001, #724) beside `request.user`: the
+     * same graph, bound to the org the credential path validated, with the
+     * credential kind this branch admitted. A node principal has no
+     * `activeOrgId`. Skipped for a `request.user` that is not a loaded graph
+     * (a unit test's stub), which then has no principal.
+     */
+    attachPrincipal(request, kind) {
+        const user = request.user;
+        if (!user || !Array.isArray(user.userRoles))
+            return;
+        request.principal = (0, principal_factory_1.toPrincipal)(user, kind);
+    }
+    /**
+     * Whether this request targets a route a `nod_` credential may reach.
+     *
+     * READS THE RAW URL, NOT NEST'S ROUTE METADATA. `context.getHandler()` /
+     * `getClass()` would tell us which controller Nest matched, and gating on
+     * "is this the nodes controller" is the tempting version. It is the wrong
+     * version: the answer would then depend on decorators #268 has not written
+     * yet, and any new controller that forgot the marker would silently be
+     * either open or closed depending on which default we picked. A path is a
+     * fact about the request that exists before routing and cannot be
+     * accidentally omitted.
+     *
+     * `originalUrl ?? url` covers both adapters: Fastify (this application's)
+     * exposes the full path on `url`, Express rewrites `url` when a router is
+     * mounted and preserves the real path on `originalUrl`. Taking
+     * `originalUrl` first means a future adapter change cannot quietly narrow
+     * what this function is looking at.
+     *
+     * The query string is stripped because it is not part of route identity:
+     * `/api/nodes?x=1` is the nodes collection and must match, while nothing
+     * after `?` may be allowed to influence the decision — a caller who could
+     * append `?/api/nodes` to a forbidden path and pass would have found a
+     * complete bypass.
+     */
+    isNodeRoute(request) {
+        const raw = request.originalUrl ?? request.url;
+        if (typeof raw !== 'string') {
+            // No URL to reason about. Refuse rather than assume: this function's
+            // `false` is a 403, and failing closed on a request we cannot classify
+            // is the only safe default for an allowlist.
+            return false;
+        }
+        const path = raw.split('?')[0];
+        // Exactly the collection, or something beneath it. NOT `startsWith` on
+        // the bare prefix — see the block comment at the top of this file for the
+        // paths that would wrongly admit.
+        return path === exports.NODE_ROUTE_PREFIX || path.startsWith(`${exports.NODE_ROUTE_PREFIX}/`);
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(ports_1.IDENTITY_NODE_CREDENTIALS)),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        pat_service_1.PatService, Object])
+], JwtAuthGuard);
+//# sourceMappingURL=jwt-auth.guard.js.map

package/dist/identity/auth/guards/jwt-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../../src/identity/auth/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAMwB;AACxB,uCAAyC;AACzC,+CAA6C;AAC7C,qEAA+D;AAC/D,uDAAmD;AACnD,uCAAsF;AAGtF,4DAAmD;AAGnD,gFAAgF;AAChF,qDAAqD;AACrD,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,8DAA8D;AAC9D,2EAA2E;AAC3E,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,0BAA0B;AAC1B,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAChF,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,oEAAoE;AACpE,EAAE;AACF,gFAAgF;AAChF,mEAAmE;AACnE,gFAAgF;AAChF,+EAA+E;AAC/E,wEAAwE;AACxE,wEAAwE;AACxE,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,4CAA4C;AAC5C,gFAAgF;AAEhF;;;;GAIG;AACU,QAAA,iBAAiB,GAAG,YAAY,CAAC;AAE9C,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,aAAa,CAAC;AACxC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IAEtC;IACA;IACmC;IAH7C,YACU,SAAoB,EACpB,UAAsB,EACa,qBAA8C;QAEzF,KAAK,EAAE,CAAC;QAJA,cAAS,GAAT,SAAS,CAAW;QACpB,eAAU,GAAV,UAAU,CAAY;QACa,0BAAqB,GAArB,qBAAqB,CAAyB;IAG3F,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;QAElD,IAAI,UAAU,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,8BAAqB,CAAC,0CAA0C,CAAC,CAAC;YAC9E,CAAC;YACD,gFAAgF;YAChF,kFAAkF;YAClF,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC7B,mEAAmE;YACnE,OAAO,CAAC,cAAc,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAA+B,CAAC;YACjG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/C,oEAAoE;YACpE,gEAAgE;YAChE,oEAAoE;YACpE,mEAAmE;YACnE,qDAAqD;YACrD,EAAE;YACF,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,+DAA+D;YAC/D,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,gEAAgE;YAChE,qDAAqD;YACrD,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,yDAAyD;YACzD,2DAA2D;YAC3D,EAAE;YACF,oEAAoE;YACpE,oEAAoE;YACpE,2BAA2B;YAC3B,oEAAoE;YACpE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,2BAAkB,CAC1B,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,6DAA6D;gBAC7D,oEAAoE;gBACpE,MAAM,IAAI,8BAAqB,CAAC,oCAAoC,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,CAAC,cAAc,GAAG,EAAE,IAAI,EAAE,MAAM,EAA+B,CAAC;YACvE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,MAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAsB,CAAC;QACxE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,cAAc,GAAG,EAAE,IAAI,EAAE,KAAK,EAA+B,CAAC;YACtE,sEAAsE;YACtE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CACrB,OAA0D,EAC1D,IAAoB;QAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO;QACpD,OAAO,CAAC,SAAS,GAAG,IAAA,+BAAW,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,WAAW,CAAC,OAAiD;QACnE,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,qEAAqE;YACrE,uEAAuE;YACvE,6CAA6C;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/B,uEAAuE;QACvE,0EAA0E;QAC1E,kCAAkC;QAClC,OAAO,IAAI,KAAK,yBAAiB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,yBAAiB,GAAG,CAAC,CAAC;IAChF,CAAC;CACF,CAAA;AA7JY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,iCAAyB,CAAC,CAAA;qCAFf,gBAAS;QACR,wBAAU;GAHrB,YAAY,CA6JxB"}

package/dist/identity/auth/guards/permissions.guard.d.ts

@@ -0,0 +1,21 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+/**
+ * Admits a caller holding ALL the permissions `@Permissions(...)` names, in
+ * their effective set (system grants plus the current organization's).
+ * Applied by `@Auth()` after `JwtAuthGuard`.
+ *
+ * @stability stable
+ */
+export declare class PermissionsGuard implements CanActivate {
+    private reflector;
+    constructor(reflector: Reflector);
+    /**
+     * Whether the request's user holds every required permission.
+     *
+     * @param context - the execution context.
+     * @returns `true` to admit; throws `ForbiddenException` otherwise.
+     */
+    canActivate(context: ExecutionContext): boolean;
+}
+//# sourceMappingURL=permissions.guard.d.ts.map

package/dist/identity/auth/guards/permissions.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.guard.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/guards/permissions.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAEjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAKzC;;;;;;GAMG;AACH,qBACa,gBAAiB,YAAW,WAAW;IACtC,OAAO,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAExC;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA0DhD"}

package/dist/identity/auth/guards/permissions.guard.js

@@ -0,0 +1,79 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionsGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const permissions_decorator_1 = require("../decorators/permissions.decorator");
+const authenticated_user_interface_1 = require("../interfaces/authenticated-user.interface");
+/**
+ * Admits a caller holding ALL the permissions `@Permissions(...)` names, in
+ * their effective set (system grants plus the current organization's).
+ * Applied by `@Auth()` after `JwtAuthGuard`.
+ *
+ * @stability stable
+ */
+let PermissionsGuard = class PermissionsGuard {
+    reflector;
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    /**
+     * Whether the request's user holds every required permission.
+     *
+     * @param context - the execution context.
+     * @returns `true` to admit; throws `ForbiddenException` otherwise.
+     */
+    canActivate(context) {
+        const requiredPermissions = this.reflector.getAllAndOverride(permissions_decorator_1.PERMISSIONS_KEY, [context.getHandler(), context.getClass()]);
+        const anyOf = this.reflector.getAllAndOverride(permissions_decorator_1.ANY_PERMISSIONS_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        const required = requiredPermissions ?? [];
+        const alternatives = anyOf ?? [];
+        // No permissions required - allow access
+        if (required.length === 0 && alternatives.length === 0) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const user = request.user;
+        if (!user) {
+            throw new common_1.ForbiddenException('No user in request');
+        }
+        const requestUser = (0, authenticated_user_interface_1.toRequestUser)(user);
+        // The request's principal (#724) is authoritative when `JwtAuthGuard` set
+        // it: its permissions are the active org's. Both are derived from the same
+        // bound graph, so they agree; the fallback serves a request whose
+        // principal was never attached (a unit test's hand-built request).
+        const principal = request.principal;
+        const granted = principal?.permissions ?? requestUser.permissions;
+        // Check if user has ALL required permissions
+        const hasAllPermissions = required.every((permission) => granted.includes(permission));
+        if (!hasAllPermissions) {
+            const missing = required.filter((p) => !granted.includes(p));
+            throw new common_1.ForbiddenException(`Missing permissions: ${missing.join(', ')}`);
+        }
+        // Attach simplified user to request for convenience
+        // `@Auth({ anyPermissions })` (#738): at least one of them.
+        if (alternatives.length > 0 && !alternatives.some((permission) => granted.includes(permission))) {
+            throw new common_1.ForbiddenException(`Missing permissions: one of ${alternatives.join(', ')}`);
+        }
+        request.requestUser = requestUser;
+        return true;
+    }
+};
+exports.PermissionsGuard = PermissionsGuard;
+exports.PermissionsGuard = PermissionsGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], PermissionsGuard);
+//# sourceMappingURL=permissions.guard.js.map

package/dist/identity/auth/guards/permissions.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.guard.js","sourceRoot":"","sources":["../../../../src/identity/auth/guards/permissions.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAAyC;AACzC,+EAA2F;AAE3F,6FAA8F;AAE9F;;;;;;GAMG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IACP;IAApB,YAAoB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAE5C;;;;;OAKG;IACH,WAAW,CAAC,OAAyB;QACnC,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1D,uCAAe,EACf,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,2CAAmB,EAAE;YAC5E,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,mBAAmB,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE,CAAC;QAEjC,yCAAyC;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAyB,CAAC;QAE/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,2BAAkB,CAAC,oBAAoB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,4CAAa,EAAC,IAAI,CAAC,CAAC;QAExC,0EAA0E;QAC1E,2EAA2E;QAC3E,kEAAkE;QAClE,mEAAmE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAkC,CAAC;QAC7D,MAAM,OAAO,GAAsB,SAAS,EAAE,WAAW,IAAI,WAAW,CAAC,WAAW,CAAC;QAErF,6CAA6C;QAC7C,MAAM,iBAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC7B,CAAC;QAEF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5B,CAAC;YACF,MAAM,IAAI,2BAAkB,CAC1B,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7C,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,4DAA4D;QAC5D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAChG,MAAM,IAAI,2BAAkB,CAAC,+BAA+B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QAElC,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAnEY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAEoB,gBAAS;GAD7B,gBAAgB,CAmE5B"}

package/dist/identity/auth/guards/roles.guard.d.ts

@@ -0,0 +1,20 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+/**
+ * Admits a caller holding ANY of the system roles `@Roles(...)` names (no
+ * roles named: everyone authenticated). Applied by `@Auth()` after `JwtAuthGuard`.
+ *
+ * @stability stable
+ */
+export declare class RolesGuard implements CanActivate {
+    private reflector;
+    constructor(reflector: Reflector);
+    /**
+     * Whether the request's user holds one of the required roles.
+     *
+     * @param context - the execution context.
+     * @returns `true` to admit; throws `ForbiddenException` otherwise.
+     */
+    canActivate(context: ExecutionContext): boolean;
+}
+//# sourceMappingURL=roles.guard.d.ts.map

package/dist/identity/auth/guards/roles.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.guard.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/guards/roles.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAEjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC;;;;;GAKG;AACH,qBACa,UAAW,YAAW,WAAW;IAChC,OAAO,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAExC;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAoChD"}

package/dist/identity/auth/guards/roles.guard.js

@@ -0,0 +1,61 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolesGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const roles_decorator_1 = require("../decorators/roles.decorator");
+const authenticated_user_interface_1 = require("../interfaces/authenticated-user.interface");
+/**
+ * Admits a caller holding ANY of the system roles `@Roles(...)` names (no
+ * roles named: everyone authenticated). Applied by `@Auth()` after `JwtAuthGuard`.
+ *
+ * @stability stable
+ */
+let RolesGuard = class RolesGuard {
+    reflector;
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    /**
+     * Whether the request's user holds one of the required roles.
+     *
+     * @param context - the execution context.
+     * @returns `true` to admit; throws `ForbiddenException` otherwise.
+     */
+    canActivate(context) {
+        const requiredRoles = this.reflector.getAllAndOverride(roles_decorator_1.ROLES_KEY, [context.getHandler(), context.getClass()]);
+        // No roles required - allow access
+        if (!requiredRoles || requiredRoles.length === 0) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const user = request.user;
+        if (!user) {
+            throw new common_1.ForbiddenException('No user in request');
+        }
+        const requestUser = (0, authenticated_user_interface_1.toRequestUser)(user);
+        // Check if user has at least one required role
+        const hasRole = requiredRoles.some((role) => requestUser.roles.includes(role));
+        if (!hasRole) {
+            throw new common_1.ForbiddenException(`Required roles: ${requiredRoles.join(', ')}`);
+        }
+        // Attach simplified user to request for convenience
+        request.requestUser = requestUser;
+        return true;
+    }
+};
+exports.RolesGuard = RolesGuard;
+exports.RolesGuard = RolesGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], RolesGuard);
+//# sourceMappingURL=roles.guard.js.map

package/dist/identity/auth/guards/roles.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.guard.js","sourceRoot":"","sources":["../../../../src/identity/auth/guards/roles.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAAyC;AACzC,mEAA0D;AAC1D,6FAA8F;AAE9F;;;;;GAKG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IACD;IAApB,YAAoB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAE5C;;;;;OAKG;IACH,WAAW,CAAC,OAAyB;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,2BAAS,EACT,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,mCAAmC;QACnC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAyB,CAAC;QAE/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,2BAAkB,CAAC,oBAAoB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,4CAAa,EAAC,IAAI,CAAC,CAAC;QAExC,+CAA+C;QAC/C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1C,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CACjC,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAC1B,mBAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,oDAAoD;QACpD,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QAElC,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7CY,gCAAU;qBAAV,UAAU;IADtB,IAAA,mBAAU,GAAE;qCAEoB,gBAAS;GAD7B,UAAU,CA6CtB"}

package/dist/identity/auth/handlers/token-cleanup.handler.d.ts

@@ -0,0 +1,44 @@
+import { OnModuleInit } from '@nestjs/common';
+import { type IdentityJobHandler, type IdentityJobRecord as Job, type IdentityJobsPort } from '../../ports';
+import { PatService } from '../../pat/pat.service';
+import { AuthService } from '../auth.service';
+/**
+ * The handler key, and therefore the `Job.type` every token-cleanup row
+ * carries.
+ *
+ * Dotted, lowercase, product-neutral and PERMANENT: rows outlive handlers, so
+ * renaming this orphans every historical row and every job already queued under
+ * the old name. Exported because `TokenCleanupTask` needs the same string to
+ * ask "is one already queued?", and two literals is one typo away from a cron
+ * that enqueues a duplicate every night forever.
+ *
+ * @stability stable
+ */
+export declare const AUTH_TOKEN_CLEANUP_TYPE = "auth.token.cleanup";
+export declare class TokenCleanupHandler implements IdentityJobHandler, OnModuleInit {
+    private readonly jobs;
+    private readonly auth;
+    private readonly pat;
+    private readonly logger;
+    readonly type = "auth.token.cleanup";
+    readonly label = "Token cleanup";
+    constructor(jobs: IdentityJobsPort, auth: AuthService, pat: PatService);
+    /** Self-registration — the only wiring a handler needs. */
+    onModuleInit(): void;
+    /**
+     * Deletes expired refresh tokens and expired personal access tokens.
+     *
+     * THROWS TO FAIL, like every handler: the two service calls are not caught,
+     * so a database error becomes `Job.lastError` plus a retry on the queue's own
+     * budget rather than a silently skipped night.
+     *
+     * ⚠ THE PAT DELETE IS NOT GUARDED BY THE REFRESH-TOKEN DELETE SUCCEEDING, and
+     * that ordering is deliberate rather than accidental: they are two
+     * independent housekeeping duties that happen to share a schedule, and a
+     * retry re-runs both. Running them in one `process` (rather than as two job
+     * types) keeps one row per night in the dashboard, which is what an operator
+     * asking "did session cleanup run?" is actually looking for.
+     */
+    process(job: Job): Promise<void>;
+}
+//# sourceMappingURL=token-cleanup.handler.d.ts.map

package/dist/identity/auth/handlers/token-cleanup.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cleanup.handler.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/handlers/token-cleanup.handler.ts"],"names":[],"mappings":"AA+CA,OAAO,EAA8B,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1E,OAAO,EAAiB,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,IAAI,GAAG,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D,qBACa,mBAAoB,YAAW,kBAAkB,EAAE,YAAY;IAQjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAC5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,QAAQ,CAAC,IAAI,wBAA2B;IAExC,QAAQ,CAAC,KAAK,mBAAmB;gBAGS,IAAI,EAAE,gBAAgB,EAC7C,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,UAAU;IAGlC,2DAA2D;IAC3D,YAAY,IAAI,IAAI;IAIpB;;;;;;;;;;;;;OAaG;IACG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CASvC"}

package/dist/identity/auth/handlers/token-cleanup.handler.js

@@ -0,0 +1,124 @@
+"use strict";
+// =============================================================================
+// `auth.token.cleanup` — expired refresh tokens and PATs, as a queue job
+// (issue #353, epic #345)
+// =============================================================================
+//
+// The work is unchanged: `AuthService.cleanupExpiredTokens` deletes expired and
+// revoked `refresh_tokens`, `PatService.cleanupExpiredTokens` deletes expired
+// PATs and revoked ones past their thirty-day grace. WHAT CHANGED IS THE
+// EXECUTOR. Until #353 both calls happened inline in a `@Cron` at 3am, which
+// meant:
+//
+//   - the only record that they ran was a log line on whichever process held
+//     the timer, so "were expired sessions cleaned up last night?" was a grep
+//     rather than a row in the admin job list;
+//   - a failure got no retry at all — the next answer was "wait 24 hours" —
+//     and, because `TokenCleanupTask` did not even catch, a database blip
+//     during the delete became an unhandled rejection inside a cron;
+//   - the deletes competed with request traffic on the scheduler's thread
+//     rather than against a worker slot with a timeout.
+//
+// As a job it gets the queue's retry budget, its timeout, and a `jobs` row with
+// a duration and a `lastError` — the same accounting every other background
+// activity in this application now has.
+//
+// -----------------------------------------------------------------------------
+// SERVER-ONLY, BY DERIVATION AND BY NATURE
+// -----------------------------------------------------------------------------
+//
+// It carries NEITHER `nodeResultSchema` NOR `persistNodeResult`, so
+// `JobHandlerRegistry.serverOnlyTypes()` derives server-only and nothing has to
+// enforce it. That is also the only correct answer: this job IS two `deleteMany`
+// statements, so there is nothing for a machine with no database access to
+// compute. A `JOBS_WORKER_MODE=system` API server keeps running it while the
+// fleet takes node-eligible work, which is exactly right for housekeeping.
+//
+// -----------------------------------------------------------------------------
+// NO PROFILE, DELIBERATELY
+// -----------------------------------------------------------------------------
+//
+// Two indexed deletes are ordinary queue work: the deployment-wide
+// `JOBS_JOB_TIMEOUT_MS` and `JOBS_MAX_ATTEMPTS` are right for it, and declaring
+// a profile that merely restates them is a second place for those numbers to be
+// wrong. Retries are safe because both deletes are idempotent — a row deleted
+// twice is a row deleted once — which is the property `JobHandler.process`
+// asks for and the reason no profile is needed here.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var TokenCleanupHandler_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenCleanupHandler = exports.AUTH_TOKEN_CLEANUP_TYPE = void 0;
+const common_1 = require("@nestjs/common");
+const ports_1 = require("../../ports");
+const pat_service_1 = require("../../pat/pat.service");
+const auth_service_1 = require("../auth.service");
+/**
+ * The handler key, and therefore the `Job.type` every token-cleanup row
+ * carries.
+ *
+ * Dotted, lowercase, product-neutral and PERMANENT: rows outlive handlers, so
+ * renaming this orphans every historical row and every job already queued under
+ * the old name. Exported because `TokenCleanupTask` needs the same string to
+ * ask "is one already queued?", and two literals is one typo away from a cron
+ * that enqueues a duplicate every night forever.
+ *
+ * @stability stable
+ */
+exports.AUTH_TOKEN_CLEANUP_TYPE = 'auth.token.cleanup';
+let TokenCleanupHandler = TokenCleanupHandler_1 = class TokenCleanupHandler {
+    jobs;
+    auth;
+    pat;
+    logger = new common_1.Logger(TokenCleanupHandler_1.name);
+    type = exports.AUTH_TOKEN_CLEANUP_TYPE;
+    label = 'Token cleanup';
+    constructor(jobs, auth, pat) {
+        this.jobs = jobs;
+        this.auth = auth;
+        this.pat = pat;
+    }
+    /** Self-registration — the only wiring a handler needs. */
+    onModuleInit() {
+        this.jobs.registerHandler(this);
+    }
+    /**
+     * Deletes expired refresh tokens and expired personal access tokens.
+     *
+     * THROWS TO FAIL, like every handler: the two service calls are not caught,
+     * so a database error becomes `Job.lastError` plus a retry on the queue's own
+     * budget rather than a silently skipped night.
+     *
+     * ⚠ THE PAT DELETE IS NOT GUARDED BY THE REFRESH-TOKEN DELETE SUCCEEDING, and
+     * that ordering is deliberate rather than accidental: they are two
+     * independent housekeeping duties that happen to share a schedule, and a
+     * retry re-runs both. Running them in one `process` (rather than as two job
+     * types) keeps one row per night in the dashboard, which is what an operator
+     * asking "did session cleanup run?" is actually looking for.
+     */
+    async process(job) {
+        const refreshCount = await this.auth.cleanupExpiredTokens();
+        const patCount = await this.pat.cleanupExpiredTokens();
+        this.logger.log(`Token cleanup job ${job.id} removed ${refreshCount} refresh token(s) and ` +
+            `${patCount} personal access token(s)`);
+    }
+};
+exports.TokenCleanupHandler = TokenCleanupHandler;
+exports.TokenCleanupHandler = TokenCleanupHandler = TokenCleanupHandler_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(ports_1.IDENTITY_JOBS)),
+    __metadata("design:paramtypes", [Object, auth_service_1.AuthService,
+        pat_service_1.PatService])
+], TokenCleanupHandler);
+//# sourceMappingURL=token-cleanup.handler.js.map

package/dist/identity/auth/handlers/token-cleanup.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cleanup.handler.js","sourceRoot":"","sources":["../../../../src/identity/auth/handlers/token-cleanup.handler.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yEAAyE;AACzE,0BAA0B;AAC1B,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,SAAS;AACT,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,+CAA+C;AAC/C,4EAA4E;AAC5E,0EAA0E;AAC1E,qEAAqE;AACrE,0EAA0E;AAC1E,wDAAwD;AACxD,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,wCAAwC;AACxC,EAAE;AACF,gFAAgF;AAChF,2CAA2C;AAC3C,gFAAgF;AAChF,EAAE;AACF,oEAAoE;AACpE,gFAAgF;AAChF,iFAAiF;AACjF,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,EAAE;AACF,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAChF,EAAE;AACF,mEAAmE;AACnE,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,qDAAqD;AACrD,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAA0E;AAE1E,uCAA2H;AAC3H,uDAAmD;AACnD,kDAA8C;AAE9C;;;;;;;;;;;GAWG;AACU,QAAA,uBAAuB,GAAG,oBAAoB,CAAC;AAGrD,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAQY;IACvB;IACA;IATF,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IAEtD,IAAI,GAAG,+BAAuB,CAAC;IAE/B,KAAK,GAAG,eAAe,CAAC;IAEjC,YAC0C,IAAsB,EAC7C,IAAiB,EACjB,GAAe;QAFQ,SAAI,GAAJ,IAAI,CAAkB;QAC7C,SAAI,GAAJ,IAAI,CAAa;QACjB,QAAG,GAAH,GAAG,CAAY;IAC/B,CAAC;IAEJ,2DAA2D;IAC3D,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,OAAO,CAAC,GAAQ;QACpB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAEvD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qBAAqB,GAAG,CAAC,EAAE,YAAY,YAAY,wBAAwB;YACzE,GAAG,QAAQ,2BAA2B,CACzC,CAAC;IACJ,CAAC;CACF,CAAA;AAzCY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,eAAM,EAAC,qBAAa,CAAC,CAAA;6CACC,0BAAW;QACZ,wBAAU;GAVvB,mBAAmB,CAyC/B"}