@molecule/api-resource-user 1.0.0

package/dist/handlers/create.js

@@ -0,0 +1,208 @@
+import { v4 as uuid } from 'uuid';
+import { get, getAnalytics, getLogger } from '@molecule/api-bond';
+import { create as storeCreate, findOne } from '@molecule/api-database';
+import { t } from '@molecule/api-i18n';
+import { hash } from '@molecule/api-password';
+import { create as resourceCreate } from '@molecule/api-resource';
+import * as authorization from '../authorization.js';
+import { normalizeEmail } from '../utilities/normalizeEmail.js';
+const analytics = getAnalytics();
+const logger = getLogger();
+/**
+ * Creates a user with username and password. Validates username uniqueness and email format,
+ * hashes the password into a separate secrets table, creates a session device via the bonded
+ * DeviceService, and sets JWT authorization on the response.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 201, body: { props } }` on success.
+ */
+export const create = ({ name, tableName, schema }) => {
+    const createResource = resourceCreate({
+        name,
+        tableName,
+        schema,
+    });
+    return async (req, res) => {
+        let body;
+        let props;
+        try {
+            const { password, deviceName } = req.body;
+            body = { password, deviceName };
+            // SECURITY (P2E-1): build an explicit allow-list of client-writable signup
+            // fields. NEVER spread `req.body` into props — that mass-assigns privileged
+            // columns. planKey/planExpiresAt/planAutoRenews/emailVerified/oauthServer/
+            // oauthId/oauthData/twoFactorEnabled MUST NOT be settable from a signup
+            // body (free paid-tier access + email-confirmation bypass + OAuth
+            // account-takeover). Those columns are writable only through their
+            // dedicated verified flows: updatePlan -> provider confirmation,
+            // verifyPayment, the email-confirmation flow, and logInOAuth (which
+            // hand-builds its props from the verified provider, not from req.body).
+            // Mirrors update.ts, which likewise constructs props field-by-field.
+            props = {};
+            if (req.body.username !== undefined) {
+                // Limit username to 255 alphanumeric characters.
+                props.username = String(req.body.username)
+                    .replace(/[^a-zA-Z0-9]/g, '')
+                    .substring(0, 255);
+            }
+            if (req.body.name !== undefined) {
+                props.name = String(req.body.name).substring(0, 255);
+            }
+            if (!body.password) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.passwordRequired'),
+                        errorKey: 'user.error.passwordRequired',
+                    },
+                };
+            }
+            if (body.password.length > 1024) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.passwordTooLong', undefined, {
+                            defaultValue: 'Password must be at most 1024 characters',
+                        }),
+                        errorKey: 'user.error.passwordTooLong',
+                    },
+                };
+            }
+            if (body.password.length < 8) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.passwordTooShort', undefined, {
+                            defaultValue: 'Password must be at least 8 characters',
+                        }),
+                        errorKey: 'user.error.passwordTooShort',
+                    },
+                };
+            }
+            if (req.body.email !== undefined) {
+                if (req.body.email === '' || req.body.email === null) {
+                    props.email = null;
+                }
+                else {
+                    // Normalize (trim + lowercase) BEFORE validation/storage so case and
+                    // whitespace variants of the same mailbox can't bypass the `email`
+                    // UNIQUE constraint or the OAuth collision lookup (which also
+                    // normalizes). Keep the existing length cap.
+                    const normalizedEmail = normalizeEmail(String(req.body.email))?.substring(0, 1023);
+                    props.email = normalizedEmail ?? null;
+                    // Basic email validation
+                    if (props.email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(props.email)) {
+                        return {
+                            statusCode: 400,
+                            body: { error: t('user.error.emailInvalid'), errorKey: 'user.error.emailInvalid' },
+                        };
+                    }
+                }
+            }
+        }
+        catch (err) {
+            logger.warn('Failed to parse user create request body', { error: err });
+            return {
+                statusCode: 400,
+                body: { error: t('user.error.badRequest'), errorKey: 'user.error.badRequest' },
+            };
+        }
+        try {
+            // Check if username is taken.
+            const usernameTaken = Boolean((await findOne(tableName, [
+                { field: 'username', operator: '=', value: props.username },
+            ]))?.id);
+            if (usernameTaken) {
+                return {
+                    statusCode: 403,
+                    body: {
+                        error: t('user.error.usernameUnavailable'),
+                        errorKey: 'user.error.usernameUnavailable',
+                    },
+                };
+            }
+            if (props.email) {
+                const emailTaken = Boolean((await findOne(tableName, [
+                    { field: 'email', operator: '=', value: props.email },
+                ]))?.id);
+                if (emailTaken) {
+                    return {
+                        statusCode: 403,
+                        body: {
+                            error: t('user.error.emailAlreadyRegistered'),
+                            errorKey: 'user.error.emailAlreadyRegistered',
+                        },
+                    };
+                }
+            }
+        }
+        catch (error) {
+            logger.error(error);
+        }
+        // Create the id in advance.
+        const id = uuid();
+        // Create the user first (usersSecrets has a FK to users.id).
+        const createdResponse = await createResource({ props, id: id });
+        if (!createdResponse || createdResponse.statusCode !== 201) {
+            return createdResponse;
+        }
+        // Hash and store the password.
+        try {
+            const passwordHash = await hash(body.password);
+            const result = await storeCreate(`${tableName}Secrets`, { id, passwordHash });
+            if (!result?.affected) {
+                throw new Error(`Failed to insert passwordHash into ${tableName}Secrets.`);
+            }
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: {
+                    error: t('user.error.failedToHashPassword'),
+                    errorKey: 'user.error.failedToHashPassword',
+                },
+            };
+        }
+        // User and secrets created — now set up the session.
+        try {
+            const deviceId = await get('device')?.createOrUpdate(id, body.deviceName || 'Unknown');
+            if (deviceId) {
+                const accessToken = authorization.set(req, res, { userId: id, deviceId });
+                analytics
+                    .track({ name: 'user.signup', userId: id, properties: { method: 'password' } })
+                    .catch(() => { });
+                analytics
+                    .identify({
+                    userId: id,
+                    email: props.email || undefined,
+                    name: props.name || undefined,
+                })
+                    .catch(() => { });
+                // Include accessToken and user in the response body so the frontend
+                // auth client can store them (it expects { accessToken, user }).
+                const user = createdResponse.body?.props ?? { id, ...props };
+                return {
+                    statusCode: 201,
+                    body: { props: user, accessToken, user },
+                };
+            }
+            else {
+                throw new Error('Failed to create session device.');
+            }
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: {
+                    error: t('user.error.failedToCreateSession'),
+                    errorKey: 'user.error.failedToCreateSession',
+                },
+            };
+        }
+    };
+};
+//# sourceMappingURL=create.js.map

package/dist/handlers/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/handlers/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,MAAM,CAAA;AAEjC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AACvE,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AAE7C,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAEjE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAA;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAU1B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAkB,EAAE,EAAE;IACpE,MAAM,cAAc,GAAG,cAAc,CAAC;QACpC,IAAI;QACJ,SAAS;QACT,MAAM;KACP,CAAC,CAAA;IAEF,OAAO,KAAK,EAAE,GAAkB,EAAE,GAAqB,EAAE,EAAE;QACzD,IAAI,IAAiD,CAAA;QACrD,IAAI,KAAyB,CAAA;QAE7B,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YACzC,IAAI,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;YAE/B,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,wEAAwE;YACxE,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,oEAAoE;YACpE,wEAAwE;YACxE,qEAAqE;YACrE,KAAK,GAAG,EAAE,CAAA;YAEV,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACpC,iDAAiD;gBACjD,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;qBACvC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;qBAC5B,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YACtB,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YACtD,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,6BAA6B,CAAC;wBACvC,QAAQ,EAAE,6BAA6B;qBACxC;iBACF,CAAA;YACH,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAChC,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,4BAA4B,EAAE,SAAS,EAAE;4BAChD,YAAY,EAAE,0CAA0C;yBACzD,CAAC;wBACF,QAAQ,EAAE,4BAA4B;qBACvC;iBACF,CAAA;YACH,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,6BAA6B,EAAE,SAAS,EAAE;4BACjD,YAAY,EAAE,wCAAwC;yBACvD,CAAC;wBACF,QAAQ,EAAE,6BAA6B;qBACxC;iBACF,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBACrD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAA;gBACpB,CAAC;qBAAM,CAAC;oBACN,qEAAqE;oBACrE,mEAAmE;oBACnE,8DAA8D;oBAC9D,6CAA6C;oBAC7C,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;oBAClF,KAAK,CAAC,KAAK,GAAG,eAAe,IAAI,IAAI,CAAA;oBACrC,yBAAyB;oBACzB,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;wBACnE,OAAO;4BACL,UAAU,EAAE,GAAG;4BACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,yBAAyB,EAAE;yBACnF,CAAA;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YACvE,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,uBAAuB,CAAC,EAAE,QAAQ,EAAE,uBAAuB,EAAE;aAC/E,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,8BAA8B;YAC9B,MAAM,aAAa,GAAG,OAAO,CAC3B,CACE,MAAM,OAAO,CAAiB,SAAS,EAAE;gBACvC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;aAC5D,CAAC,CACH,EAAE,EAAE,CACN,CAAA;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,gCAAgC,CAAC;wBAC1C,QAAQ,EAAE,gCAAgC;qBAC3C;iBACF,CAAA;YACH,CAAC;YAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAG,OAAO,CACxB,CACE,MAAM,OAAO,CAAiB,SAAS,EAAE;oBACvC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;iBACtD,CAAC,CACH,EAAE,EAAE,CACN,CAAA;gBAED,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,mCAAmC,CAAC;4BAC7C,QAAQ,EAAE,mCAAmC;yBAC9C;qBACF,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,4BAA4B;QAC5B,MAAM,EAAE,GAAG,IAAI,EAAE,CAAA;QAEjB,6DAA6D;QAC7D,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAY,EAAE,CAAC,CAAA;QAEzE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,CAAA;YAC/C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,SAAS,SAAS,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;YAE7E,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,UAAU,CAAC,CAAA;YAC5E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,iCAAiC,CAAC;oBAC3C,QAAQ,EAAE,iCAAiC;iBAC5C;aACF,CAAA;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAEvB,QAAQ,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAA;YAE9D,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACzE,SAAS;qBACN,KAAK,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;qBAC9E,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClB,SAAS;qBACN,QAAQ,CAAC;oBACR,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS;oBAC/B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS;iBAC9B,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAElB,oEAAoE;gBACpE,iEAAiE;gBACjE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAA;gBAC5D,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;iBACzC,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,kCAAkC,CAAC;oBAC5C,QAAQ,EAAE,kCAAkC;iBAC7C;aACF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/del.d.ts

@@ -0,0 +1,30 @@
+import type { MoleculeRequest } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/**
+ * Deletes a user and their associated data. Removes secrets from the secrets table,
+ * devices via the bonded DeviceService, and payment records via the bonded PaymentRecordService
+ * before deleting the user row itself.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { props: { id } } }` on success.
+ */
+export declare const del: ({ name: _name, tableName, schema: _schema }: types.Resource) => (req: MoleculeRequest) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        props?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        props: {
+            id: string;
+        };
+        error?: undefined;
+        errorKey?: undefined;
+    };
+}>;
+//# sourceMappingURL=del.d.ts.map

package/dist/handlers/del.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"del.d.ts","sourceRoot":"","sources":["../../src/handlers/del.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAG7D,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAKzC;;;;;;;;;GASG;AACH,eAAO,MAAM,GAAG,GAAI,6CAA6C,KAAK,CAAC,QAAQ,MAC/D,KAAK,eAAe;;;;;;;;;;;;;;;;EA0CnC,CAAA"}

package/dist/handlers/del.js

@@ -0,0 +1,55 @@
+import { get, getAnalytics, getLogger } from '@molecule/api-bond';
+import { deleteById } from '@molecule/api-database';
+import { t } from '@molecule/api-i18n';
+import { invalidateAllDeviceExistsCache } from '../authorization.js';
+const analytics = getAnalytics();
+const logger = getLogger();
+/**
+ * Deletes a user and their associated data. Removes secrets from the secrets table,
+ * devices via the bonded DeviceService, and payment records via the bonded PaymentRecordService
+ * before deleting the user row itself.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { props: { id } } }` on success.
+ */
+export const del = ({ name: _name, tableName, schema: _schema }) => {
+    return async (req) => {
+        try {
+            const id = req.params.id;
+            // Delete secrets.
+            await deleteById(`${tableName}Secrets`, id).catch((err) => {
+                logger.warn('Failed to delete user secrets', { userId: id, error: err });
+            });
+            // Delete devices via bond, then evict this process's positive
+            // device-exists cache so any in-flight token for a just-deleted device is
+            // rejected on its very next request (immediate in-process revocation).
+            await get('device')?.deleteByUserId(id);
+            invalidateAllDeviceExistsCache();
+            // Delete payments via bond.
+            await get('paymentRecords')?.deleteByUserId(id);
+            // Delete user.
+            const result = await deleteById(tableName, id);
+            if (!result?.affected) {
+                return {
+                    statusCode: 404,
+                    body: { error: t('user.error.notFound'), errorKey: 'user.error.notFound' },
+                };
+            }
+            analytics.track({ name: 'user.deleted', userId: id }).catch(() => { });
+            return { statusCode: 200, body: { props: { id } } };
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: {
+                    error: t('user.error.failedToDeleteUser'),
+                    errorKey: 'user.error.failedToDeleteUser',
+                },
+            };
+        }
+    };
+};
+//# sourceMappingURL=del.js.map

package/dist/handlers/del.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"del.js","sourceRoot":"","sources":["../../src/handlers/del.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AAItC,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAA;AAGpE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAkB,EAAE,EAAE;IACjF,OAAO,KAAK,EAAE,GAAoB,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAA;YAElC,kBAAkB;YAClB,MAAM,UAAU,CAAC,GAAG,SAAS,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxD,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1E,CAAC,CAAC,CAAA;YAEF,8DAA8D;YAC9D,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,GAAG,CAAoD,QAAQ,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,CAAA;YAC1F,8BAA8B,EAAE,CAAA;YAEhC,4BAA4B;YAC5B,MAAM,GAAG,CAAuB,gBAAgB,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,CAAA;YAErE,eAAe;YACf,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;YAE9C,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACtB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE;iBAC3E,CAAA;YACH,CAAC;YAED,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAErE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC;oBACzC,QAAQ,EAAE,+BAA+B;iBAC1C;aACF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/forgotPassword.d.ts

@@ -0,0 +1,34 @@
+import type { MoleculeRequest } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/** Request body for password reset initiation. */
+export interface ForgotPasswordRequest extends MoleculeRequest {
+    body: {
+        email?: string;
+    };
+}
+/**
+ * Generates a UUID password reset token, stores it in the secrets table, and sends a reset
+ * email via the bonded email provider (if available). Always returns 200 regardless of whether
+ * the email exists, to prevent user enumeration.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { success: true } }`.
+ */
+export declare const forgotPassword: ({ name: _name, tableName, schema: _schema }: types.Resource) => (req: ForgotPasswordRequest) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        success?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        success: boolean;
+        error?: undefined;
+        errorKey?: undefined;
+    };
+}>;
+//# sourceMappingURL=forgotPassword.d.ts.map

package/dist/handlers/forgotPassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgotPassword.d.ts","sourceRoot":"","sources":["../../src/handlers/forgotPassword.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE7D,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAOzC,kDAAkD;AAClD,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,EAAE;QACJ,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAAI,6CAA6C,KAAK,CAAC,QAAQ,MAC1E,KAAK,qBAAqB;;;;;;;;;;;;;;EAmIzC,CAAA"}

package/dist/handlers/forgotPassword.js

@@ -0,0 +1,119 @@
+import crypto from 'crypto';
+import { get, getAnalytics, getLogger } from '@molecule/api-bond';
+import { get as getConfig } from '@molecule/api-config';
+import { findOne, updateById } from '@molecule/api-database';
+import { t } from '@molecule/api-i18n';
+import { hashResetToken } from '../utilities/hashResetToken.js';
+import { normalizeEmail } from '../utilities/normalizeEmail.js';
+const analytics = getAnalytics();
+const logger = getLogger();
+/**
+ * Generates a UUID password reset token, stores it in the secrets table, and sends a reset
+ * email via the bonded email provider (if available). Always returns 200 regardless of whether
+ * the email exists, to prevent user enumeration.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { success: true } }`.
+ */
+export const forgotPassword = ({ name: _name, tableName, schema: _schema }) => {
+    return async (req) => {
+        try {
+            const { email } = req.body;
+            if (!email) {
+                return {
+                    statusCode: 400,
+                    body: { error: t('user.error.emailRequired'), errorKey: 'user.error.emailRequired' },
+                };
+            }
+            // Find user by email — normalized to match how signup stores it. A raw
+            // mixed-case lookup silently finds nothing, and the 200-no-reveal response
+            // (anti-enumeration) then hides the failure: the user never gets a reset.
+            const normalizedEmail = normalizeEmail(email);
+            const user = normalizedEmail
+                ? await findOne(tableName, [
+                    { field: 'email', operator: '=', value: normalizedEmail },
+                ])
+                : null;
+            if (!user) {
+                // Don't reveal whether the email exists.
+                return { statusCode: 200, body: { success: true } };
+            }
+            // Generate a reset token. The RAW token is emailed to the user; only its
+            // sha256 hash is persisted, so a DB read never yields a usable token.
+            const passwordResetToken = crypto.randomBytes(32).toString('hex');
+            const passwordResetTokenAt = new Date().toISOString();
+            await updateById(`${tableName}Secrets`, user.id, {
+                passwordResetToken: hashResetToken(passwordResetToken),
+                passwordResetTokenAt,
+            });
+            // Try to send email if email service is bonded.
+            try {
+                const emailProvider = get('email');
+                if (!emailProvider) {
+                    // The token was persisted but no reset email can go out: with no
+                    // email bond the flow silently degrades to "token in the DB nobody
+                    // ever receives", and the 200-no-reveal response hides it from the
+                    // caller too. Surface it in the logs so an operator sees the reset
+                    // path is dead instead of discovering it from user complaints.
+                    logger.warn('Password reset token created but NO email provider is bonded — the reset email was not sent. Bond an email transport (e.g. @molecule/api-emails-sendgrid) for the reset flow to deliver.', { userId: user.id });
+                }
+                if (emailProvider) {
+                    const appName = getConfig('APP_NAME', 'App') ?? 'App';
+                    const siteOrigin = getConfig('SITE_ORIGIN', '');
+                    const resetUrl = siteOrigin
+                        ? `${siteOrigin}/reset-password?token=${passwordResetToken}`
+                        : '';
+                    // Default the sender to the app's OWN domain (derived from SITE_ORIGIN),
+                    // never a placeholder like `noreply@example.com`: a provider (e.g. Mailgun)
+                    // rejects a `from` whose domain isn't its verified sending domain, so a
+                    // placeholder silently BOUNCES this reset email — a critical flow. An
+                    // explicit EMAIL_FROM still wins; the localhost fallback is dev-only (prod
+                    // sets SITE_ORIGIN).
+                    let defaultFrom = 'no-reply@localhost';
+                    try {
+                        if (siteOrigin)
+                            defaultFrom = `no-reply@${new URL(siteOrigin).hostname}`;
+                    }
+                    catch (_error) {
+                        // Malformed SITE_ORIGIN — keep the localhost fallback.
+                    }
+                    await emailProvider.sendMail({
+                        from: getConfig('EMAIL_FROM', defaultFrom),
+                        to: email,
+                        subject: t('user.email.passwordResetSubject', { appName }, { locale: user?.locale || 'en' }),
+                        subjectKey: 'user.email.passwordResetSubject',
+                        text: t('user.email.passwordResetText', { token: passwordResetToken }, { locale: user?.locale || 'en' }) +
+                            '\n\n' +
+                            (resetUrl
+                                ? t('user.email.passwordResetLink', { url: resetUrl }, { locale: user?.locale || 'en' })
+                                : ''),
+                        textKey: 'user.email.passwordResetText',
+                        html: t('user.email.passwordResetHtml', { token: passwordResetToken }, { locale: user?.locale || 'en' }) +
+                            (resetUrl
+                                ? t('user.email.passwordResetHtmlLink', { url: resetUrl }, { locale: user?.locale || 'en' })
+                                : ''),
+                        htmlKey: 'user.email.passwordResetHtml',
+                    });
+                }
+            }
+            catch (error) {
+                logger.error('Failed to send password reset email:', error);
+            }
+            analytics.track({ name: 'user.password_reset_requested', userId: user.id }).catch(() => { });
+            return { statusCode: 200, body: { success: true } };
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: {
+                    error: t('user.error.failedToProcessPasswordReset'),
+                    errorKey: 'user.error.failedToProcessPasswordReset',
+                },
+            };
+        }
+    };
+};
+//# sourceMappingURL=forgotPassword.js.map

package/dist/handlers/forgotPassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgotPassword.js","sourceRoot":"","sources":["../../src/handlers/forgotPassword.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AAItC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAS1B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAkB,EAAE,EAAE;IAC5F,OAAO,KAAK,EAAE,GAA0B,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,0BAA0B,CAAC,EAAE,QAAQ,EAAE,0BAA0B,EAAE;iBACrF,CAAA;YACH,CAAC;YAED,uEAAuE;YACvE,2EAA2E;YAC3E,0EAA0E;YAC1E,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,IAAI,GAAG,eAAe;gBAC1B,CAAC,CAAC,MAAM,OAAO,CAAc,SAAS,EAAE;oBACpC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE;iBAC1D,CAAC;gBACJ,CAAC,CAAC,IAAI,CAAA;YAER,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,yCAAyC;gBACzC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;YACrD,CAAC;YAED,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACjE,MAAM,oBAAoB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAErD,MAAM,UAAU,CAAC,GAAG,SAAS,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE;gBAC/C,kBAAkB,EAAE,cAAc,CAAC,kBAAkB,CAAC;gBACtD,oBAAoB;aACrB,CAAC,CAAA;YAEF,gDAAgD;YAChD,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,GAAG,CACvB,OAAO,CACR,CAAA;gBACD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,iEAAiE;oBACjE,mEAAmE;oBACnE,mEAAmE;oBACnE,mEAAmE;oBACnE,+DAA+D;oBAC/D,MAAM,CAAC,IAAI,CACT,0LAA0L,EAC1L,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CACpB,CAAA;gBACH,CAAC;gBACD,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,CAAA;oBACrD,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;oBAE/C,MAAM,QAAQ,GAAG,UAAU;wBACzB,CAAC,CAAC,GAAG,UAAU,yBAAyB,kBAAkB,EAAE;wBAC5D,CAAC,CAAC,EAAE,CAAA;oBAEN,yEAAyE;oBACzE,4EAA4E;oBAC5E,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,qBAAqB;oBACrB,IAAI,WAAW,GAAG,oBAAoB,CAAA;oBACtC,IAAI,CAAC;wBACH,IAAI,UAAU;4BAAE,WAAW,GAAG,YAAY,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;oBAC1E,CAAC;oBAAC,OAAO,MAAM,EAAE,CAAC;wBAChB,uDAAuD;oBACzD,CAAC;oBAED,MAAM,aAAa,CAAC,QAAQ,CAAC;wBAC3B,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC;wBAC1C,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE,CAAC,CACR,iCAAiC,EACjC,EAAE,OAAO,EAAE,EACX,EAAE,MAAM,EAAI,IAAgC,EAAE,MAAiB,IAAI,IAAI,EAAE,CAC1E;wBACD,UAAU,EAAE,iCAAiC;wBAC7C,IAAI,EACF,CAAC,CACC,8BAA8B,EAC9B,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAC7B,EAAE,MAAM,EAAI,IAAgC,EAAE,MAAiB,IAAI,IAAI,EAAE,CAC1E;4BACD,MAAM;4BACN,CAAC,QAAQ;gCACP,CAAC,CAAC,CAAC,CACC,8BAA8B,EAC9B,EAAE,GAAG,EAAE,QAAQ,EAAE,EACjB,EAAE,MAAM,EAAI,IAAgC,EAAE,MAAiB,IAAI,IAAI,EAAE,CAC1E;gCACH,CAAC,CAAC,EAAE,CAAC;wBACT,OAAO,EAAE,8BAA8B;wBACvC,IAAI,EACF,CAAC,CACC,8BAA8B,EAC9B,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAC7B,EAAE,MAAM,EAAI,IAAgC,EAAE,MAAiB,IAAI,IAAI,EAAE,CAC1E;4BACD,CAAC,QAAQ;gCACP,CAAC,CAAC,CAAC,CACC,kCAAkC,EAClC,EAAE,GAAG,EAAE,QAAQ,EAAE,EACjB,EAAE,MAAM,EAAI,IAAgC,EAAE,MAAiB,IAAI,IAAI,EAAE,CAC1E;gCACH,CAAC,CAAC,EAAE,CAAC;wBACT,OAAO,EAAE,8BAA8B;qBACxC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;YAC7D,CAAC;YAED,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAE3F,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,yCAAyC,CAAC;oBACnD,QAAQ,EAAE,yCAAyC;iBACpD;aACF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/index.d.ts

@@ -0,0 +1,16 @@
+export * from './create.js';
+export * from './del.js';
+export * from './forgotPassword.js';
+export * from './logIn.js';
+export * from './logInOAuth.js';
+export * from './logout.js';
+export * from './oauthAuthorize.js';
+export { handlePaymentNotification, verifyPayment } from './payments/registry.js';
+export * from './read.js';
+export * from './readSelf.js';
+export * from './resetPassword.js';
+export * from './update.js';
+export * from './updatePassword.js';
+export * from './updatePlan.js';
+export * from './verifyTwoFactor.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,qBAAqB,CAAA;AACnC,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACjF,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}

package/dist/handlers/index.js

@@ -0,0 +1,16 @@
+export * from './create.js';
+export * from './del.js';
+export * from './forgotPassword.js';
+export * from './logIn.js';
+export * from './logInOAuth.js';
+export * from './logout.js';
+export * from './oauthAuthorize.js';
+export { handlePaymentNotification, verifyPayment } from './payments/registry.js';
+export * from './read.js';
+export * from './readSelf.js';
+export * from './resetPassword.js';
+export * from './update.js';
+export * from './updatePassword.js';
+export * from './updatePlan.js';
+export * from './verifyTwoFactor.js';
+//# sourceMappingURL=index.js.map

package/dist/handlers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,qBAAqB,CAAA;AACnC,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACjF,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA"}

package/dist/handlers/logIn.d.ts

@@ -0,0 +1,91 @@
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/** Request body for user login, supporting password, reset token, and 2FA flows. */
+export interface LogInRequest extends MoleculeRequest {
+    body: {
+        username?: string;
+        email?: string;
+        password?: string;
+        passwordResetToken?: string;
+        twoFactorToken?: string;
+        deviceName?: string;
+    };
+}
+/**
+ * Logs in a user by username or email. Supports password authentication, password reset token
+ * authentication (1-hour expiry), and optional two-factor verification via `@molecule/api-two-factor`.
+ * On success, creates/updates a device via the bonded DeviceService, sets JWT authorization,
+ * and notifies other devices about the new login.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { props } }` on success,
+ *   or `{ statusCode: 206, body: { twoFactorRequired: true } }` when 2FA is needed.
+ */
+export declare const logIn: ({ name: _name, tableName, schema: _schema }: types.Resource) => (req: LogInRequest, res: MoleculeResponse) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        twoFactorRequired?: undefined;
+        props?: undefined;
+        accessToken?: undefined;
+        user?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        twoFactorRequired: boolean;
+        error?: undefined;
+        errorKey?: undefined;
+        props?: undefined;
+        accessToken?: undefined;
+        user?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        props: {
+            id: string;
+            createdAt: string;
+            updatedAt: string;
+            username?: string | undefined;
+            name?: string | undefined;
+            email?: string | null | undefined;
+            emailVerified?: boolean | undefined;
+            avatar?: string | null | undefined;
+            bio?: string | null | undefined;
+            twoFactorEnabled?: boolean | undefined;
+            oauthServer?: string | undefined;
+            oauthId?: string | undefined;
+            oauthData?: Record<string, unknown> | undefined;
+            planKey?: string | undefined;
+            planExpiresAt?: string | undefined;
+            planAutoRenews?: boolean | undefined;
+        };
+        accessToken: string | null;
+        user: {
+            id: string;
+            createdAt: string;
+            updatedAt: string;
+            username?: string | undefined;
+            name?: string | undefined;
+            email?: string | null | undefined;
+            emailVerified?: boolean | undefined;
+            avatar?: string | null | undefined;
+            bio?: string | null | undefined;
+            twoFactorEnabled?: boolean | undefined;
+            oauthServer?: string | undefined;
+            oauthId?: string | undefined;
+            oauthData?: Record<string, unknown> | undefined;
+            planKey?: string | undefined;
+            planExpiresAt?: string | undefined;
+            planAutoRenews?: boolean | undefined;
+        };
+        error?: undefined;
+        errorKey?: undefined;
+        twoFactorRequired?: undefined;
+    };
+}>;
+//# sourceMappingURL=logIn.d.ts.map

package/dist/handlers/logIn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logIn.d.ts","sourceRoot":"","sources":["../../src/handlers/logIn.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAG/E,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAsBzC,oFAAoF;AACpF,MAAM,WAAW,YAAa,SAAQ,eAAe;IACnD,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,GAAI,6CAA6C,KAAK,CAAC,QAAQ,MACjE,KAAK,YAAY,EAAE,KAAK,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6MvD,CAAA"}