@molecule/api-resource-user 1.0.0

package/dist/handlers/payments/verifyPayment.js

@@ -0,0 +1,383 @@
+import { get, getAnalytics, getLogger, require as bondRequire } from '@molecule/api-bond';
+import { t } from '@molecule/api-i18n';
+import { isConfigNotConfiguredError, } from '@molecule/api-payments';
+import { update as resourceUpdate } from '@molecule/api-resource';
+import { updatePlanPropsSchema } from '../../schema.js';
+import { invalidateEntitlementsCacheSafe } from '../../utilities/invalidateEntitlements.js';
+const analytics = getAnalytics();
+const logger = getLogger();
+/**
+ * Generic payment verification handler that works with any bonded PaymentProvider. Reads the
+ * provider name from the `:provider` route parameter and dispatches based on `verifyFlow`:
+ * - `'subscription'` (Stripe-style): Calls `verifySubscription(subscriptionId)`.
+ * - Default (Apple/Google-style): Calls `verifyReceipt()` or `verifyPurchase()` with a receipt
+ *   string and the plan's platform product ID.
+ *
+ * On successful verification, updates the user's plan (planKey, planExpiresAt, planAutoRenews)
+ * and stores the payment record via the bonded PaymentRecordService.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler for payment verification.
+ */
+export const verifyPayment = ({ name, tableName, schema: _schema }) => {
+    return async (req) => {
+        const providerName = req.params.provider;
+        if (!providerName) {
+            return {
+                statusCode: 400,
+                body: {
+                    error: t('user.payment.providerRequired'),
+                    errorKey: 'user.payment.providerRequired',
+                },
+            };
+        }
+        try {
+            const provider = bondRequire('payments', providerName);
+            const plans = bondRequire('plans');
+            let verified = null;
+            let receipt;
+            // Dispatch based on verifyFlow (with method-existence fallback).
+            const isSubscriptionFlow = provider.verifyFlow === 'subscription' ||
+                (!provider.verifyFlow && !!provider.verifySubscription);
+            if (isSubscriptionFlow) {
+                // Stripe-style: subscriptionId in body or query. Providers that redirect
+                // back to this endpoint append their OWN parameter names — PayPal adds
+                // `subscription_id` (billing subscriptions) or `token` (v2 orders) to the
+                // return_url query — so accept those snake_case echoes as fallbacks. The
+                // value is still verified with the provider below before anything grants.
+                const subscriptionId = (req.body?.subscriptionId ??
+                    req.query?.subscriptionId ??
+                    req.query?.subscription_id ??
+                    req.query?.token);
+                if (!subscriptionId) {
+                    return {
+                        statusCode: 400,
+                        body: {
+                            error: t('user.payment.subscriptionIdRequired', { provider: providerName }),
+                            errorKey: 'user.payment.subscriptionIdRequired',
+                        },
+                    };
+                }
+                if (!provider.verifySubscription) {
+                    return {
+                        statusCode: 500,
+                        body: {
+                            error: t('user.payment.verificationNotConfigured', { provider: providerName }),
+                            errorKey: 'user.payment.verificationNotConfigured',
+                        },
+                    };
+                }
+                verified = await provider.verifySubscription(subscriptionId);
+            }
+            else {
+                // Apple/Google-style: receipt + planKey in body.
+                const body = req.body || {};
+                receipt = body.receipt;
+                const planKey = body.planKey;
+                if (!receipt || !planKey) {
+                    return {
+                        statusCode: 400,
+                        body: {
+                            error: t('user.payment.receiptAndPlanRequired', { provider: providerName }),
+                            errorKey: 'user.payment.receiptAndPlanRequired',
+                        },
+                    };
+                }
+                const plan = plans.findPlan(planKey);
+                if (!plan || plan.platformKey !== providerName) {
+                    return {
+                        statusCode: 400,
+                        body: {
+                            error: t('user.payment.invalidPlan', { provider: providerName }),
+                            errorKey: 'user.payment.invalidPlan',
+                        },
+                    };
+                }
+                const verifyFn = provider.verifyReceipt ?? provider.verifyPurchase;
+                if (!verifyFn) {
+                    return {
+                        statusCode: 500,
+                        body: {
+                            error: t('user.payment.verificationNotConfigured', { provider: providerName }),
+                            errorKey: 'user.payment.verificationNotConfigured',
+                        },
+                    };
+                }
+                verified = await verifyFn.call(provider, receipt, plan.platformProductId);
+            }
+            if (!verified) {
+                const id = req.params.id;
+                analytics
+                    .track({
+                    name: 'payment.verification_failed',
+                    userId: id,
+                    properties: { provider: providerName },
+                })
+                    .catch(() => { });
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.payment.verificationFailed', { provider: providerName }),
+                        errorKey: 'user.payment.verificationFailed',
+                    },
+                };
+            }
+            // Subscription-flow ownership binding. The resolved subscription must
+            // belong to THIS user, so a caller cannot upgrade themselves by submitting
+            // a subscription id they merely learned (leaked log / shared success_url /
+            // support channel):
+            //   • If the user already has a stored customer id for this provider, the
+            //     verified subscription's customer MUST match it.
+            //   • Otherwise (no prior record) a grant is only allowed when the
+            //     verification came through the per-user, unguessable checkout-session
+            //     redirect (`viaCheckoutSession`) — never from a bare, caller-supplied
+            //     subscription id.
+            if (isSubscriptionFlow) {
+                const ownerId = req.params.id;
+                const data = (verified.data ?? {});
+                const verifiedCustomerId = data.customerId;
+                const records = get('paymentRecords');
+                const existing = records ? await records.findByUserId(ownerId, providerName) : null;
+                const storedCustomerId = existing?.data?.customerId;
+                const ownsByStoredCustomer = !!storedCustomerId && !!verifiedCustomerId && storedCustomerId === verifiedCustomerId;
+                const ownsByFreshCheckout = !storedCustomerId && data.viaCheckoutSession === true;
+                if (!ownsByStoredCustomer && !ownsByFreshCheckout) {
+                    analytics
+                        .track({
+                        name: 'payment.verification_ownership_rejected',
+                        userId: ownerId,
+                        properties: { provider: providerName },
+                    })
+                        .catch(() => { });
+                    return {
+                        statusCode: 403,
+                        body: {
+                            error: t('user.payment.subscriptionOwnershipMismatch', { provider: providerName }, { defaultValue: 'This subscription does not belong to your account.' }),
+                            errorKey: 'user.payment.subscriptionOwnershipMismatch',
+                        },
+                    };
+                }
+                // First-claim-wins replay defense (M3-1), mirroring the receipt branch.
+                // The ownership check above proves the caller MAY claim the subscription;
+                // this proves the subscription has not ALREADY been claimed by another
+                // account. A `cs_` checkout-session id is reusable by whoever obtained it
+                // (e.g. the attacker, from their own legitimate checkout redirect), so
+                // without this a single paid session could be replayed to grant premium
+                // to unlimited fresh accounts — each would pass `ownsByFreshCheckout`.
+                // The atomic, race-safe backstop is the insert-before-grant below; this
+                // is the fast, fail-closed pre-check.
+                //
+                // A subscription with no transaction id cannot be bound to a single
+                // account and therefore cannot be protected from replay — fail closed
+                // rather than grant an unbounded entitlement.
+                if (!verified.transactionId) {
+                    analytics
+                        .track({
+                        name: 'payment.verification_failed',
+                        userId: ownerId,
+                        properties: { provider: providerName, reason: 'missing_transaction_id' },
+                    })
+                        .catch(() => { });
+                    return {
+                        statusCode: 400,
+                        body: {
+                            error: t('user.payment.verificationFailed', { provider: providerName }),
+                            errorKey: 'user.payment.verificationFailed',
+                        },
+                    };
+                }
+                const existingTransaction = records
+                    ? await records.findByTransaction(providerName, verified.transactionId)
+                    : null;
+                if (existingTransaction && existingTransaction.userId !== ownerId) {
+                    analytics
+                        .track({
+                        name: 'payment.verification_ownership_rejected',
+                        userId: ownerId,
+                        properties: { provider: providerName },
+                    })
+                        .catch(() => { });
+                    return {
+                        statusCode: 403,
+                        body: {
+                            error: t('user.payment.transactionAlreadyClaimed', { provider: providerName }, { defaultValue: 'This purchase is already associated with another account.' }),
+                            errorKey: 'user.payment.transactionAlreadyClaimed',
+                        },
+                    };
+                }
+            }
+            else {
+                // Receipt-flow (Apple/Google) ownership/replay binding (R2-1), mirroring
+                // the subscription block above. A single purchased receipt must bind to
+                // exactly ONE account (first-claim-wins) so it cannot be replayed to
+                // upgrade many accounts. The atomic, race-safe backstop is the
+                // insert-before-grant below; this is the fast, fail-closed pre-check.
+                const ownerId = req.params.id;
+                // A receipt with no transaction id cannot be bound to a single account
+                // and therefore cannot be protected from replay — fail closed rather
+                // than grant an unbounded entitlement. (Google `latestOrderId` can be
+                // missing.)
+                if (!verified.transactionId) {
+                    analytics
+                        .track({
+                        name: 'payment.verification_failed',
+                        userId: ownerId,
+                        properties: { provider: providerName, reason: 'missing_transaction_id' },
+                    })
+                        .catch(() => { });
+                    return {
+                        statusCode: 400,
+                        body: {
+                            error: t('user.payment.verificationFailed', { provider: providerName }),
+                            errorKey: 'user.payment.verificationFailed',
+                        },
+                    };
+                }
+                const records = get('paymentRecords');
+                const existing = records
+                    ? await records.findByTransaction(providerName, verified.transactionId)
+                    : null;
+                if (existing && existing.userId !== ownerId) {
+                    analytics
+                        .track({
+                        name: 'payment.verification_ownership_rejected',
+                        userId: ownerId,
+                        properties: { provider: providerName },
+                    })
+                        .catch(() => { });
+                    return {
+                        statusCode: 403,
+                        body: {
+                            error: t('user.payment.transactionAlreadyClaimed', { provider: providerName }, { defaultValue: 'This purchase is already associated with another account.' }),
+                            errorKey: 'user.payment.transactionAlreadyClaimed',
+                        },
+                    };
+                }
+            }
+            // Find matching plan from the verified platform identifiers. Providers
+            // report the parent PRODUCT id on subscriptions, but apps register
+            // their catalogue with the PRICE ids checkout was started with — try
+            // both before rejecting.
+            const plan = plans.findPlanByProductId(verified.productId) ??
+                (verified.priceId ? plans.findPlanByProductId(verified.priceId) : null);
+            if (!plan) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.payment.unknownPlan', { provider: providerName }),
+                        errorKey: 'user.payment.unknownPlan',
+                    },
+                };
+            }
+            const id = req.params.id;
+            const records = get('paymentRecords');
+            // Bind the transaction to THIS user BEFORE granting the plan —
+            // fail-closed, first-claim-wins — for BOTH the receipt (Apple/Google, R2-1)
+            // and subscription (Stripe, M3-1) flows. The UNIQUE(platformKey,
+            // transactionId) index makes a second account's insert fail; `store()`
+            // surfaces that conflict (rather than swallowing it) so a replayed receipt
+            // OR a replayed checkout-session id is rejected here instead of being
+            // granted. Never grant the plan before the transaction is bound, and never
+            // swallow the store conflict in a path that has already granted.
+            if (records && verified.transactionId) {
+                try {
+                    await records.store({
+                        userId: id,
+                        platformKey: providerName,
+                        transactionId: verified.transactionId,
+                        productId: verified.productId,
+                        data: verified.data || {},
+                        ...(receipt ? { receipt } : {}),
+                    });
+                }
+                catch (error) {
+                    // Conflict: the transaction is already bound. Determine the owner —
+                    // if it belongs to another account, reject WITHOUT granting; if it is
+                    // this user re-verifying their own receipt, fall through to an
+                    // idempotent re-grant.
+                    const owner = await records.findByTransaction(providerName, verified.transactionId);
+                    if (!owner || owner.userId !== id) {
+                        analytics
+                            .track({
+                            name: 'payment.verification_ownership_rejected',
+                            userId: id,
+                            properties: { provider: providerName },
+                        })
+                            .catch(() => { });
+                        return {
+                            statusCode: 403,
+                            body: {
+                                error: t('user.payment.transactionAlreadyClaimed', { provider: providerName }, { defaultValue: 'This purchase is already associated with another account.' }),
+                                errorKey: 'user.payment.transactionAlreadyClaimed',
+                            },
+                        };
+                    }
+                    // Same user re-verifying their own receipt → idempotent re-grant.
+                    logger.warn('Receipt already recorded for this user; re-granting idempotently', { error });
+                }
+            }
+            // Update user's plan. Use the partial plan-props schema, NOT the full
+            // user `schema` — the resource's full schema makes `id`/`createdAt`/
+            // `updatedAt` required and rejects the partial
+            // `{ planKey, planExpiresAt, planAutoRenews }` payload applied here
+            // (same fix as handlePaymentNotification).
+            const updateUser = resourceUpdate({
+                name,
+                tableName,
+                schema: updatePlanPropsSchema,
+            });
+            const result = await updateUser({
+                id,
+                props: {
+                    planKey: plan.planKey,
+                    planExpiresAt: verified.expiresAt,
+                    planAutoRenews: verified.autoRenews,
+                },
+            });
+            // The entitlements hot-path caches the plan key (default 5-min TTL) —
+            // drop it so the user who just paid sees their new tier immediately.
+            invalidateEntitlementsCacheSafe(id);
+            analytics
+                .track({
+                name: 'payment.verified',
+                userId: id,
+                properties: {
+                    provider: providerName,
+                    productId: verified.productId,
+                    planKey: plan.planKey,
+                },
+            })
+                .catch(() => { });
+            // Both flows now bind their payment record BEFORE granting (above), so
+            // there is no post-grant store here — a swallowed conflict after a grant
+            // is exactly the replay hole this closes (M3-1 / R2-1).
+            return result;
+        }
+        catch (error) {
+            // A bonded payment provider rethrows a tagged config-not-configured error
+            // (e.g. STRIPE_SECRET_KEY/APPLE_SHARED_SECRET/GOOGLE_API_SERVICE_KEY_OBJECT
+            // unset) instead of swallowing it into the same `null` a genuine failed
+            // verification returns — pass its REAL statusCode/errorKey through so the
+            // actionable "which key, where to get it" message reaches the caller
+            // instead of a generic 500 that reads identically to "bad receipt."
+            if (isConfigNotConfiguredError(error)) {
+                logger.warn(error.message, { errorKey: error.errorKey, provider: providerName });
+                return {
+                    statusCode: error.statusCode,
+                    body: { error: error.message, errorKey: error.errorKey },
+                };
+            }
+            logger.error(`${providerName} verifyPayment error:`, error);
+            return {
+                statusCode: 500,
+                body: {
+                    error: t('user.payment.verificationFailed', { provider: providerName }),
+                    errorKey: 'user.payment.verificationFailed',
+                },
+            };
+        }
+    };
+};
+//# sourceMappingURL=verifyPayment.js.map

package/dist/handlers/payments/verifyPayment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyPayment.js","sourceRoot":"","sources":["../../../src/handlers/payments/verifyPayment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AACtC,OAAO,EACL,0BAA0B,GAI3B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAEjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAEvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAA;AAE3F,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAkB,EAAE,EAAE;IACpF,OAAO,KAAK,EAAE,GAAoB,EAAE,EAAE;QACpC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,QAAkB,CAAA;QAElD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC;oBACzC,QAAQ,EAAE,+BAA+B;iBAC1C;aACF,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,WAAW,CAAkB,UAAU,EAAE,YAAY,CAAC,CAAA;YACvE,MAAM,KAAK,GAAG,WAAW,CAAc,OAAO,CAAC,CAAA;YAE/C,IAAI,QAAQ,GAOD,IAAI,CAAA;YACf,IAAI,OAA2B,CAAA;YAE/B,iEAAiE;YACjE,MAAM,kBAAkB,GACtB,QAAQ,CAAC,UAAU,KAAK,cAAc;gBACtC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;YACzD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,yEAAyE;gBACzE,uEAAuE;gBACvE,0EAA0E;gBAC1E,yEAAyE;gBACzE,0EAA0E;gBAC1E,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc;oBAC9C,GAAG,CAAC,KAAK,EAAE,cAAc;oBACzB,GAAG,CAAC,KAAK,EAAE,eAAe;oBAC1B,GAAG,CAAC,KAAK,EAAE,KAAK,CAAuB,CAAA;gBAEzC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,qCAAqC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;4BAC3E,QAAQ,EAAE,qCAAqC;yBAChD;qBACF,CAAA;gBACH,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;oBACjC,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,wCAAwC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;4BAC9E,QAAQ,EAAE,wCAAwC;yBACnD;qBACF,CAAA;gBACH,CAAC;gBAED,QAAQ,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9D,CAAC;iBAAM,CAAC;gBACN,iDAAiD;gBACjD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;gBAC3B,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAA;gBAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAA;gBAElD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;oBACzB,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,qCAAqC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;4BAC3E,QAAQ,EAAE,qCAAqC;yBAChD;qBACF,CAAA;gBACH,CAAC;gBAED,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACpC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;oBAC/C,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;4BAChE,QAAQ,EAAE,0BAA0B;yBACrC;qBACF,CAAA;gBACH,CAAC;gBAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,cAAc,CAAA;gBAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,wCAAwC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;4BAC9E,QAAQ,EAAE,wCAAwC;yBACnD;qBACF,CAAA;gBACH,CAAC;gBAED,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC3E,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAA;gBAClC,SAAS;qBACN,KAAK,CAAC;oBACL,IAAI,EAAE,6BAA6B;oBACnC,MAAM,EAAE,EAAE;oBACV,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;iBACvC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;wBACvE,QAAQ,EAAE,iCAAiC;qBAC5C;iBACF,CAAA;YACH,CAAC;YAED,sEAAsE;YACtE,2EAA2E;YAC3E,2EAA2E;YAC3E,oBAAoB;YACpB,0EAA0E;YAC1E,sDAAsD;YACtD,mEAAmE;YACnE,2EAA2E;YAC3E,2EAA2E;YAC3E,uBAAuB;YACvB,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAA;gBACvC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAA0D,CAAA;gBAC3F,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAA;gBAC1C,MAAM,OAAO,GAAG,GAAG,CAAuB,gBAAgB,CAAC,CAAA;gBAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;gBACnF,MAAM,gBAAgB,GAAI,QAAQ,EAAE,IAA4C,EAAE,UAAU,CAAA;gBAE5F,MAAM,oBAAoB,GACxB,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,kBAAkB,IAAI,gBAAgB,KAAK,kBAAkB,CAAA;gBACvF,MAAM,mBAAmB,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAA;gBAEjF,IAAI,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAClD,SAAS;yBACN,KAAK,CAAC;wBACL,IAAI,EAAE,yCAAyC;wBAC/C,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;qBACvC,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAClB,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CACN,4CAA4C,EAC5C,EAAE,QAAQ,EAAE,YAAY,EAAE,EAC1B,EAAE,YAAY,EAAE,oDAAoD,EAAE,CACvE;4BACD,QAAQ,EAAE,4CAA4C;yBACvD;qBACF,CAAA;gBACH,CAAC;gBAED,wEAAwE;gBACxE,0EAA0E;gBAC1E,uEAAuE;gBACvE,0EAA0E;gBAC1E,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,wEAAwE;gBACxE,sCAAsC;gBACtC,EAAE;gBACF,oEAAoE;gBACpE,sEAAsE;gBACtE,8CAA8C;gBAC9C,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;oBAC5B,SAAS;yBACN,KAAK,CAAC;wBACL,IAAI,EAAE,6BAA6B;wBACnC,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,wBAAwB,EAAE;qBACzE,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAClB,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;4BACvE,QAAQ,EAAE,iCAAiC;yBAC5C;qBACF,CAAA;gBACH,CAAC;gBAED,MAAM,mBAAmB,GAAG,OAAO;oBACjC,CAAC,CAAC,MAAM,OAAO,CAAC,iBAAiB,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC;oBACvE,CAAC,CAAC,IAAI,CAAA;gBACR,IAAI,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAClE,SAAS;yBACN,KAAK,CAAC;wBACL,IAAI,EAAE,yCAAyC;wBAC/C,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;qBACvC,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAClB,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CACN,wCAAwC,EACxC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAC1B,EAAE,YAAY,EAAE,2DAA2D,EAAE,CAC9E;4BACD,QAAQ,EAAE,wCAAwC;yBACnD;qBACF,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,wEAAwE;gBACxE,qEAAqE;gBACrE,+DAA+D;gBAC/D,sEAAsE;gBACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAA;gBAEvC,uEAAuE;gBACvE,qEAAqE;gBACrE,sEAAsE;gBACtE,YAAY;gBACZ,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;oBAC5B,SAAS;yBACN,KAAK,CAAC;wBACL,IAAI,EAAE,6BAA6B;wBACnC,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,wBAAwB,EAAE;qBACzE,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAClB,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;4BACvE,QAAQ,EAAE,iCAAiC;yBAC5C;qBACF,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,GAAG,CAAuB,gBAAgB,CAAC,CAAA;gBAC3D,MAAM,QAAQ,GAAG,OAAO;oBACtB,CAAC,CAAC,MAAM,OAAO,CAAC,iBAAiB,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC;oBACvE,CAAC,CAAC,IAAI,CAAA;gBACR,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC5C,SAAS;yBACN,KAAK,CAAC;wBACL,IAAI,EAAE,yCAAyC;wBAC/C,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;qBACvC,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAClB,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CACN,wCAAwC,EACxC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAC1B,EAAE,YAAY,EAAE,2DAA2D,EAAE,CAC9E;4BACD,QAAQ,EAAE,wCAAwC;yBACnD;qBACF,CAAA;gBACH,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,yBAAyB;YACzB,MAAM,IAAI,GACR,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC7C,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACzE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;wBAChE,QAAQ,EAAE,0BAA0B;qBACrC;iBACF,CAAA;YACH,CAAC;YAED,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAA;YAClC,MAAM,OAAO,GAAG,GAAG,CAAuB,gBAAgB,CAAC,CAAA;YAE3D,+DAA+D;YAC/D,4EAA4E;YAC5E,iEAAiE;YACjE,uEAAuE;YACvE,2EAA2E;YAC3E,sEAAsE;YACtE,2EAA2E;YAC3E,iEAAiE;YACjE,IAAI,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,KAAK,CAAC;wBAClB,MAAM,EAAE,EAAE;wBACV,WAAW,EAAE,YAAY;wBACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;wBACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,EAAE;wBACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChC,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,oEAAoE;oBACpE,sEAAsE;oBACtE,+DAA+D;oBAC/D,uBAAuB;oBACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;oBACnF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;wBAClC,SAAS;6BACN,KAAK,CAAC;4BACL,IAAI,EAAE,yCAAyC;4BAC/C,MAAM,EAAE,EAAE;4BACV,UAAU,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;yBACvC,CAAC;6BACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;wBAClB,OAAO;4BACL,UAAU,EAAE,GAAG;4BACf,IAAI,EAAE;gCACJ,KAAK,EAAE,CAAC,CACN,wCAAwC,EACxC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAC1B,EAAE,YAAY,EAAE,2DAA2D,EAAE,CAC9E;gCACD,QAAQ,EAAE,wCAAwC;6BACnD;yBACF,CAAA;oBACH,CAAC;oBACD,kEAAkE;oBAClE,MAAM,CAAC,IAAI,CAAC,kEAAkE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC5F,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,+CAA+C;YAC/C,oEAAoE;YACpE,2CAA2C;YAC3C,MAAM,UAAU,GAAG,cAAc,CAAwB;gBACvD,IAAI;gBACJ,SAAS;gBACT,MAAM,EAAE,qBAAqB;aAC4C,CAAC,CAAA;YAE5E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,EAAE;gBACF,KAAK,EAAE;oBACL,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,aAAa,EAAE,QAAQ,CAAC,SAAS;oBACjC,cAAc,EAAE,QAAQ,CAAC,UAAU;iBACpC;aACF,CAAC,CAAA;YAEF,sEAAsE;YACtE,qEAAqE;YACrE,+BAA+B,CAAC,EAAE,CAAC,CAAA;YAEnC,SAAS;iBACN,KAAK,CAAC;gBACL,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE;oBACV,QAAQ,EAAE,YAAY;oBACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB;aACF,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAElB,uEAAuE;YACvE,yEAAyE;YACzE,wDAAwD;YAExD,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,4EAA4E;YAC5E,wEAAwE;YACxE,0EAA0E;YAC1E,qEAAqE;YACrE,oEAAoE;YACpE,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAA;gBAChF,OAAO;oBACL,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;iBACzD,CAAA;YACH,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,uBAAuB,EAAE,KAAK,CAAC,CAAA;YAC3D,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;oBACvE,QAAQ,EAAE,iCAAiC;iBAC5C;aACF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/read.d.ts

@@ -0,0 +1,17 @@
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/**
+ * Reads a user by ID from the database. Attaches plan info (with expiration/renewal status) via the
+ * bonded PlanService if available. When reading the authenticated user's own record, also includes
+ * two-factor authentication status from the secrets table.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { props, plan?, twoFactorEnabled? } }`.
+ */
+export declare const read: ({ name: _name, tableName, schema: _schema }: types.Resource) => (req: MoleculeRequest, res: MoleculeResponse) => Promise<{
+    statusCode: number;
+    body: Record<string, unknown>;
+}>;
+//# sourceMappingURL=read.d.ts.map

package/dist/handlers/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/handlers/read.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAE/E,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAMzC;;;;;;;;;GASG;AACH,eAAO,MAAM,IAAI,GAAI,6CAA6C,KAAK,CAAC,QAAQ,MAChE,KAAK,eAAe,EAAE,KAAK,gBAAgB;;;EA8C1D,CAAA"}

package/dist/handlers/read.js

@@ -0,0 +1,60 @@
+import { getLogger } from '@molecule/api-bond';
+import { findById } from '@molecule/api-database';
+import { t } from '@molecule/api-i18n';
+import { getPlan } from '../utilities/getPlan.js';
+import { stripSensitiveUserColumns } from '../utilities/stripSensitiveUserColumns.js';
+const logger = getLogger();
+/**
+ * Reads a user by ID from the database. Attaches plan info (with expiration/renewal status) via the
+ * bonded PlanService if available. When reading the authenticated user's own record, also includes
+ * two-factor authentication status from the secrets table.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { props, plan?, twoFactorEnabled? } }`.
+ */
+export const read = ({ name: _name, tableName, schema: _schema }) => {
+    return async (req, res) => {
+        try {
+            const { session } = res.locals;
+            const id = req.params.id;
+            const user = await findById(tableName, id);
+            if (!user) {
+                return {
+                    statusCode: 404,
+                    body: { error: t('user.error.notFound'), errorKey: 'user.error.notFound' },
+                };
+            }
+            // Attach plan info if available.
+            const plan = await getPlan(user);
+            const body = { props: stripSensitiveUserColumns(user) };
+            if (plan) {
+                body.plan = plan;
+            }
+            // If reading self, also include two-factor setup info.
+            if (session?.userId === id) {
+                try {
+                    const secrets = await findById(`${tableName}Secrets`, id);
+                    if (secrets) {
+                        body.twoFactorEnabled = user.twoFactorEnabled || false;
+                        body.hasPendingTwoFactor = Boolean(secrets.pendingTwoFactorSecret);
+                    }
+                }
+                catch (_error) {
+                    // Non-critical: the secrets table may not exist yet (pre-migration) or the row may be absent.
+                    // Omitting twoFactorEnabled/hasPendingTwoFactor from the response is safe — callers treat absence as false.
+                }
+            }
+            return { statusCode: 200, body };
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: { error: t('user.error.failedToReadUser'), errorKey: 'user.error.failedToReadUser' },
+            };
+        }
+    };
+};
+//# sourceMappingURL=read.js.map

package/dist/handlers/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/handlers/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AAItC,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAA;AAErF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAkB,EAAE,EAAE;IAClF,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAA;YAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAA;YAElC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAc,SAAS,EAAE,EAAE,CAAC,CAAA;YAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE;iBAC3E,CAAA;YACH,CAAC;YAED,iCAAiC;YACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;YAChC,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAA;YAEhF,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;YAClB,CAAC;YAED,uDAAuD;YACvD,IAAI,OAAO,EAAE,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAoB,GAAG,SAAS,SAAS,EAAE,EAAE,CAAC,CAAA;oBAE5E,IAAI,OAAO,EAAE,CAAC;wBACZ,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAA;wBACtD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;oBACpE,CAAC;gBACH,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,8FAA8F;oBAC9F,4GAA4G;gBAC9G,CAAC;YACH,CAAC;YAED,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,6BAA6B,CAAC,EAAE,QAAQ,EAAE,6BAA6B,EAAE;aAC3F,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/readSelf.d.ts

@@ -0,0 +1,23 @@
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/**
+ * Reads the AUTHENTICATED user from the session — no `:id` param. Backs
+ * `GET /users/me`, which the app's auth client calls on init to RESTORE the
+ * session after a full page load.
+ *
+ * [M1-1] The bearer token is held in memory (a localStorage copy is
+ * XSS-exfiltratable and is forbidden), so it is lost on reload; the httpOnly
+ * session cookie is the persistent credential. The `auth` middleware reads that
+ * cookie into `res.locals.session`, and this handler returns the current user
+ * so the client can re-establish `authenticated` state WITHOUT the token ever
+ * being exposed to JavaScript. Always self, so it mirrors `read`'s self branch
+ * (plan + two-factor status).
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.tableName - The database table name for users.
+ * @returns A request handler responding `{ statusCode: 200, body: { props, plan?, twoFactorEnabled? } }`, or 401 when unauthenticated.
+ */
+export declare const readSelf: ({ tableName }: types.Resource) => (_req: MoleculeRequest, res: MoleculeResponse) => Promise<{
+    statusCode: number;
+    body: Record<string, unknown>;
+}>;
+//# sourceMappingURL=readSelf.d.ts.map

package/dist/handlers/readSelf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readSelf.d.ts","sourceRoot":"","sources":["../../src/handlers/readSelf.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAE/E,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAMzC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ,GAAI,eAAe,KAAK,CAAC,QAAQ,MACtC,MAAM,eAAe,EAAE,KAAK,gBAAgB;;;EAsD3D,CAAA"}

package/dist/handlers/readSelf.js

@@ -0,0 +1,77 @@
+import { getLogger } from '@molecule/api-bond';
+import { findById } from '@molecule/api-database';
+import { t } from '@molecule/api-i18n';
+import { getPlan } from '../utilities/getPlan.js';
+import { stripSensitiveUserColumns } from '../utilities/stripSensitiveUserColumns.js';
+const logger = getLogger();
+/**
+ * Reads the AUTHENTICATED user from the session — no `:id` param. Backs
+ * `GET /users/me`, which the app's auth client calls on init to RESTORE the
+ * session after a full page load.
+ *
+ * [M1-1] The bearer token is held in memory (a localStorage copy is
+ * XSS-exfiltratable and is forbidden), so it is lost on reload; the httpOnly
+ * session cookie is the persistent credential. The `auth` middleware reads that
+ * cookie into `res.locals.session`, and this handler returns the current user
+ * so the client can re-establish `authenticated` state WITHOUT the token ever
+ * being exposed to JavaScript. Always self, so it mirrors `read`'s self branch
+ * (plan + two-factor status).
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.tableName - The database table name for users.
+ * @returns A request handler responding `{ statusCode: 200, body: { props, plan?, twoFactorEnabled? } }`, or 401 when unauthenticated.
+ */
+export const readSelf = ({ tableName }) => {
+    return async (_req, res) => {
+        try {
+            const userId = res.locals.session?.userId;
+            if (!userId) {
+                return {
+                    statusCode: 401,
+                    body: {
+                        error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+                        errorKey: 'resource.error.unauthorized',
+                    },
+                };
+            }
+            const user = await findById(tableName, userId);
+            if (!user) {
+                // Valid session whose user row no longer exists (deleted account holding
+                // a still-live cookie) — treat as unauthenticated so the client clears
+                // its state, not 404.
+                return {
+                    statusCode: 401,
+                    body: {
+                        error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+                        errorKey: 'resource.error.unauthorized',
+                    },
+                };
+            }
+            const plan = await getPlan(user);
+            const body = { props: stripSensitiveUserColumns(user) };
+            if (plan) {
+                body.plan = plan;
+            }
+            // Always self — include two-factor setup info like `read`'s self branch.
+            try {
+                const secrets = await findById(`${tableName}Secrets`, userId);
+                if (secrets) {
+                    body.twoFactorEnabled = user.twoFactorEnabled || false;
+                    body.hasPendingTwoFactor = Boolean(secrets.pendingTwoFactorSecret);
+                }
+            }
+            catch (_error) {
+                // Non-critical: the secrets table may not exist yet (pre-migration) or the
+                // row may be absent. Callers treat absence as false.
+            }
+            return { statusCode: 200, body };
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: { error: t('user.error.failedToReadUser'), errorKey: 'user.error.failedToReadUser' },
+            };
+        }
+    };
+};
+//# sourceMappingURL=readSelf.js.map

package/dist/handlers/readSelf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readSelf.js","sourceRoot":"","sources":["../../src/handlers/readSelf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AAItC,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAA;AAErF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAE,SAAS,EAAkB,EAAE,EAAE;IACxD,OAAO,KAAK,EAAE,IAAqB,EAAE,GAAqB,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,MAAM,GAAI,GAAG,CAAC,MAAM,CAAC,OAA2C,EAAE,MAAM,CAAA;YAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,6BAA6B,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;wBACpF,QAAQ,EAAE,6BAA6B;qBACxC;iBACF,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAc,SAAS,EAAE,MAAM,CAAC,CAAA;YAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,yEAAyE;gBACzE,uEAAuE;gBACvE,sBAAsB;gBACtB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,6BAA6B,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;wBACpF,QAAQ,EAAE,6BAA6B;qBACxC;iBACF,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;YAChC,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAA;YAChF,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;YAClB,CAAC;YAED,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAoB,GAAG,SAAS,SAAS,EAAE,MAAM,CAAC,CAAA;gBAChF,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAA;oBACtD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;gBACpE,CAAC;YACH,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,2EAA2E;gBAC3E,qDAAqD;YACvD,CAAC;YAED,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,6BAA6B,CAAC,EAAE,QAAQ,EAAE,6BAA6B,EAAE;aAC3F,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/resetPassword.d.ts

@@ -0,0 +1,40 @@
+import type { MoleculeRequest } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/** Request body for confirming a password reset using a token. */
+export interface ResetPasswordRequest extends MoleculeRequest {
+    body: {
+        token?: string;
+        password?: string;
+    };
+}
+/**
+ * Confirms a password reset by validating the one-time token previously generated by
+ * `forgotPassword`, then hashing and storing the new password and clearing the token.
+ *
+ * Token TTL is one hour. The handler responds with 400 for missing fields, 400 for
+ * passwords that fail length validation (matching `updatePassword`), and 401 for
+ * tokens that are unknown, expired, or already consumed.
+ *
+ * On success, all existing device sessions are invalidated to force a fresh login,
+ * mirroring the behavior of `updatePassword`.
+ *
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.tableName - The database table name for users.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { success: true } }` on success.
+ */
+export declare const resetPassword: ({ name: _name, tableName, schema: _schema }: types.Resource) => (req: ResetPasswordRequest) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        success?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        success: boolean;
+        error?: undefined;
+        errorKey?: undefined;
+    };
+}>;
+//# sourceMappingURL=resetPassword.d.ts.map

package/dist/handlers/resetPassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../src/handlers/resetPassword.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAG7D,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAQzC,kEAAkE;AAClE,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,IAAI,EAAE;QACJ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GAAI,6CAA6C,KAAK,CAAC,QAAQ,MACzE,KAAK,oBAAoB;;;;;;;;;;;;;;EAoIxC,CAAA"}