@molecule/api-resource-user 1.0.0

package/dist/handlers/resetPassword.js

@@ -0,0 +1,147 @@
+import crypto from 'node:crypto';
+import { get, getAnalytics, getLogger } from '@molecule/api-bond';
+import { findOne, updateById } from '@molecule/api-database';
+import { t } from '@molecule/api-i18n';
+import { hash } from '@molecule/api-password';
+import { invalidateAllDeviceExistsCache } from '../authorization.js';
+import { hashResetToken } from '../utilities/hashResetToken.js';
+const analytics = getAnalytics();
+const logger = getLogger();
+const RESET_TOKEN_TTL_MS = 1000 * 60 * 60;
+/**
+ * Confirms a password reset by validating the one-time token previously generated by
+ * `forgotPassword`, then hashing and storing the new password and clearing the token.
+ *
+ * Token TTL is one hour. The handler responds with 400 for missing fields, 400 for
+ * passwords that fail length validation (matching `updatePassword`), and 401 for
+ * tokens that are unknown, expired, or already consumed.
+ *
+ * On success, all existing device sessions are invalidated to force a fresh login,
+ * mirroring the behavior of `updatePassword`.
+ *
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.tableName - The database table name for users.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { success: true } }` on success.
+ */
+export const resetPassword = ({ name: _name, tableName, schema: _schema }) => {
+    return async (req) => {
+        try {
+            const { token, password } = req.body;
+            if (!token) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.tokenRequired'),
+                        errorKey: 'user.error.tokenRequired',
+                    },
+                };
+            }
+            if (!password) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.newPasswordRequired'),
+                        errorKey: 'user.error.newPasswordRequired',
+                    },
+                };
+            }
+            if (password.length < 8) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.passwordTooShort', undefined, {
+                            defaultValue: 'Password must be at least 8 characters',
+                        }),
+                        errorKey: 'user.error.passwordTooShort',
+                    },
+                };
+            }
+            if (password.length > 1024) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.passwordTooLong', undefined, {
+                            defaultValue: 'Password must be at most 1024 characters',
+                        }),
+                        errorKey: 'user.error.passwordTooLong',
+                    },
+                };
+            }
+            // The stored value is sha256(token); look up + compare by that digest.
+            const tokenHash = hashResetToken(token);
+            const secrets = await findOne(`${tableName}Secrets`, [
+                { field: 'passwordResetToken', operator: '=', value: tokenHash },
+            ]);
+            if (!secrets || !secrets.passwordResetToken || !secrets.passwordResetTokenAt) {
+                return {
+                    statusCode: 401,
+                    body: {
+                        error: t('user.error.invalidToken'),
+                        errorKey: 'user.error.invalidToken',
+                    },
+                };
+            }
+            // Constant-time comparison to defeat timing attacks even though the lookup
+            // already matched — defense in depth.
+            const a = Buffer.from(tokenHash, 'utf-8');
+            const b = Buffer.from(secrets.passwordResetToken, 'utf-8');
+            if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+                return {
+                    statusCode: 401,
+                    body: {
+                        error: t('user.error.invalidToken'),
+                        errorKey: 'user.error.invalidToken',
+                    },
+                };
+            }
+            const tokenAge = Date.now() - new Date(secrets.passwordResetTokenAt).getTime();
+            if (!Number.isFinite(tokenAge) || tokenAge > RESET_TOKEN_TTL_MS || tokenAge < 0) {
+                return {
+                    statusCode: 401,
+                    body: {
+                        error: t('user.error.invalidToken'),
+                        errorKey: 'user.error.invalidToken',
+                    },
+                };
+            }
+            const userId = secrets.id;
+            if (!userId) {
+                return {
+                    statusCode: 500,
+                    body: {
+                        error: t('user.error.failedToUpdatePassword'),
+                        errorKey: 'user.error.failedToUpdatePassword',
+                    },
+                };
+            }
+            const passwordHash = await hash(password);
+            await updateById(`${tableName}Secrets`, userId, {
+                passwordHash,
+                passwordResetToken: null,
+                passwordResetTokenAt: null,
+            });
+            try {
+                await get('device')?.deleteByUserId(userId);
+                // Evict this process's positive device-exists cache so no just-deleted
+                // device keeps authenticating for the cache TTL — immediate revocation.
+                invalidateAllDeviceExistsCache();
+            }
+            catch (error) {
+                logger.warn('Failed to invalidate sessions after password reset', { userId, error });
+            }
+            analytics.track({ name: 'user.password_reset_completed', userId }).catch(() => { });
+            return { statusCode: 200, body: { success: true } };
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: {
+                    error: t('user.error.failedToUpdatePassword'),
+                    errorKey: 'user.error.failedToUpdatePassword',
+                },
+            };
+        }
+    };
+};
+//# sourceMappingURL=resetPassword.js.map

package/dist/handlers/resetPassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resetPassword.js","sourceRoot":"","sources":["../../src/handlers/resetPassword.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AAG7C,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAA;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAE1B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,CAAA;AAUzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAkB,EAAE,EAAE;IAC3F,OAAO,KAAK,EAAE,GAAyB,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAEpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,0BAA0B,CAAC;wBACpC,QAAQ,EAAE,0BAA0B;qBACrC;iBACF,CAAA;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,gCAAgC,CAAC;wBAC1C,QAAQ,EAAE,gCAAgC;qBAC3C;iBACF,CAAA;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,6BAA6B,EAAE,SAAS,EAAE;4BACjD,YAAY,EAAE,wCAAwC;yBACvD,CAAC;wBACF,QAAQ,EAAE,6BAA6B;qBACxC;iBACF,CAAA;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAC3B,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,4BAA4B,EAAE,SAAS,EAAE;4BAChD,YAAY,EAAE,0CAA0C;yBACzD,CAAC;wBACF,QAAQ,EAAE,4BAA4B;qBACvC;iBACF,CAAA;YACH,CAAC;YAED,uEAAuE;YACvE,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;YACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAoB,GAAG,SAAS,SAAS,EAAE;gBACtE,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE;aACjE,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;gBAC7E,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC;wBACnC,QAAQ,EAAE,yBAAyB;qBACpC;iBACF,CAAA;YACH,CAAC;YAED,2EAA2E;YAC3E,sCAAsC;YACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;YAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC;wBACnC,QAAQ,EAAE,yBAAyB;qBACpC;iBACF,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAA;YAC9E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,kBAAkB,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAChF,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC;wBACnC,QAAQ,EAAE,yBAAyB;qBACpC;iBACF,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAI,OAAqC,CAAC,EAAE,CAAA;YACxD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,mCAAmC,CAAC;wBAC7C,QAAQ,EAAE,mCAAmC;qBAC9C;iBACF,CAAA;YACH,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAA;YACzC,MAAM,UAAU,CAAC,GAAG,SAAS,SAAS,EAAE,MAAM,EAAE;gBAC9C,YAAY;gBACZ,kBAAkB,EAAE,IAAI;gBACxB,oBAAoB,EAAE,IAAI;aAC3B,CAAC,CAAA;YAEF,IAAI,CAAC;gBACH,MAAM,GAAG,CAAoD,QAAQ,CAAC,EAAE,cAAc,CACpF,MAAM,CACP,CAAA;gBACD,uEAAuE;gBACvE,wEAAwE;gBACxE,8BAA8B,EAAE,CAAA;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;YACtF,CAAC;YAED,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAElF,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,mCAAmC,CAAC;oBAC7C,QAAQ,EAAE,mCAAmC;iBAC9C;aACF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/update.d.ts

@@ -0,0 +1,28 @@
+import type { MoleculeRequest } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/**
+ * Updates a user's profile fields (username, name, email). Validates username format
+ * (alphanumeric, max 255 chars), email format, and uniqueness of both fields against
+ * other users before delegating to the resource update utility.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with the updated user props on success.
+ */
+export declare const update: ({ name, tableName, schema: _schema }: types.Resource) => (req: MoleculeRequest) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        props?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        props: Pick<import("@molecule/api-resource/types").Props, "updatedAt"> & Record<string, unknown>;
+        error?: undefined;
+        errorKey?: undefined;
+    };
+}>;
+//# sourceMappingURL=update.d.ts.map

package/dist/handlers/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/handlers/update.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAI7D,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AA0BzC;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,GAAI,sCAAsC,KAAK,CAAC,QAAQ,MAO3D,KAAK,eAAe;;;;;aArBL,CAAA;;;;;;;;;EAyP9B,CAAA"}

package/dist/handlers/update.js

@@ -0,0 +1,250 @@
+import { getAnalytics, getLogger } from '@molecule/api-bond';
+import { findOne } from '@molecule/api-database';
+const logger = getLogger();
+const analytics = getAnalytics();
+import { t } from '@molecule/api-i18n';
+import { compare } from '@molecule/api-password';
+import { update as resourceUpdate } from '@molecule/api-resource';
+import { MAX_AVATAR_LENGTH, MAX_BIO_LENGTH, propsSchema, updatePropsSchema } from '../schema.js';
+import { normalizeEmail } from '../utilities/normalizeEmail.js';
+/**
+ * Extended update schema that also permits the application-specific
+ * `oauthData` bag to flow through the standard `PATCH /api/users/:id`
+ * endpoint. Apps frequently store per-user UI/feature preferences inside
+ * `oauthData` (it is the only freeform JSON field on the user row), so
+ * the update handler needs to accept and persist it.
+ *
+ * Username/name/email retain their existing validation paths above.
+ */
+const extendedUpdatePropsSchema = updatePropsSchema.extend({
+    oauthData: propsSchema.shape.oauthData,
+    // emailVerified is permitted through the schema ONLY so the handler can RESET it
+    // to false when the email changes (server-set below). It is NEVER copied from
+    // req.body — the same discipline as twoFactorEnabled — so a caller cannot
+    // self-verify by sending `emailVerified: true`.
+    emailVerified: propsSchema.shape.emailVerified,
+    // [M6-1] twoFactorEnabled is deliberately NOT writable here. The generic profile update is
+    // gated only by authSelf (no TOTP step-up), so allowing it would let a caller PATCH 2FA off
+    // without the current second factor — defeating verifyTwoFactor's disable step-up. ALL 2FA
+    // state transitions must go through verifyTwoFactor (enable/disable), which verifies the
+    // live TOTP token and updates the secret atomically.
+});
+/**
+ * Updates a user's profile fields (username, name, email). Validates username format
+ * (alphanumeric, max 255 chars), email format, and uniqueness of both fields against
+ * other users before delegating to the resource update utility.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with the updated user props on success.
+ */
+export const update = ({ name, tableName, schema: _schema }) => {
+    const updateResource = resourceUpdate({
+        name,
+        tableName,
+        schema: extendedUpdatePropsSchema,
+    });
+    return async (req) => {
+        try {
+            const id = req.params.id;
+            const props = {};
+            if (req.body.username !== undefined) {
+                props.username = String(req.body.username)
+                    .replace(/[^a-zA-Z0-9]/g, '')
+                    .substring(0, 255);
+                if (!props.username) {
+                    return {
+                        statusCode: 400,
+                        body: {
+                            error: t('user.error.usernameCannotBeEmpty'),
+                            errorKey: 'user.error.usernameCannotBeEmpty',
+                        },
+                    };
+                }
+                // Check if username is taken by another user.
+                const existing = await findOne(tableName, [
+                    { field: 'username', operator: '=', value: props.username },
+                    { field: 'id', operator: '!=', value: id },
+                ]);
+                if (existing) {
+                    return {
+                        statusCode: 403,
+                        body: {
+                            error: t('user.error.usernameUnavailable'),
+                            errorKey: 'user.error.usernameUnavailable',
+                        },
+                    };
+                }
+            }
+            if (req.body.name !== undefined) {
+                props.name = String(req.body.name).substring(0, 255);
+            }
+            if (req.body.email !== undefined) {
+                let nextEmail;
+                if (req.body.email === '' || req.body.email === null) {
+                    nextEmail = null;
+                }
+                else {
+                    // Normalize (lowercase) on store to match signup + the login/reset
+                    // lookups — otherwise a profile email change stores a mixed-case value
+                    // that those normalized lookups can't find, and lets a case-variant
+                    // duplicate slip past the uniqueness check below.
+                    nextEmail = (normalizeEmail(String(req.body.email)) ?? '').substring(0, 1023);
+                    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(nextEmail)) {
+                        return {
+                            statusCode: 400,
+                            body: { error: t('user.error.emailInvalid'), errorKey: 'user.error.emailInvalid' },
+                        };
+                    }
+                    // Check if email is taken by another user.
+                    const existing = await findOne(tableName, [
+                        { field: 'email', operator: '=', value: nextEmail },
+                        { field: 'id', operator: '!=', value: id },
+                    ]);
+                    if (existing) {
+                        return {
+                            statusCode: 403,
+                            body: {
+                                error: t('user.error.emailAlreadyRegistered'),
+                                errorKey: 'user.error.emailAlreadyRegistered',
+                            },
+                        };
+                    }
+                }
+                const current = await findOne(tableName, [
+                    { field: 'id', operator: '=', value: id },
+                ]);
+                const changingEmail = !current || (current.email ?? null) !== nextEmail;
+                if (changingEmail) {
+                    // Re-authentication gate: the email is the account-recovery anchor
+                    // (password reset goes to it), so changing OR clearing it with a
+                    // hijacked session must not be silent. Accounts WITH a password must
+                    // present it (same contract + i18n keys as updatePassword); OAuth-only
+                    // accounts have no password to present, so their (provider-backed)
+                    // session remains the credential.
+                    const secrets = await findOne(`${tableName}Secrets`, [
+                        { field: 'id', operator: '=', value: id },
+                    ]);
+                    if (secrets?.passwordHash) {
+                        const currentPassword = typeof req.body.currentPassword === 'string' ? req.body.currentPassword : '';
+                        if (!currentPassword) {
+                            return {
+                                statusCode: 400,
+                                body: {
+                                    error: t('user.error.currentPasswordRequired'),
+                                    errorKey: 'user.error.currentPasswordRequired',
+                                },
+                            };
+                        }
+                        if (!(await compare(currentPassword, secrets.passwordHash))) {
+                            return {
+                                statusCode: 403,
+                                body: {
+                                    error: t('user.error.currentPasswordIncorrect'),
+                                    errorKey: 'user.error.currentPasswordIncorrect',
+                                },
+                            };
+                        }
+                    }
+                    // Changing the address invalidates the verified flag — the new email is
+                    // unproven, and leaving emailVerified=true would let a caller point a
+                    // "verified" email anywhere (poisoning password-reset and email-gated
+                    // access). Reset ONLY on a real change so an unchanged profile save does
+                    // not needlessly un-verify. Server-set — never read from req.body.
+                    props.emailVerified = false;
+                }
+                props.email = nextEmail;
+            }
+            if (req.body.avatar !== undefined) {
+                // `null` or '' clears the avatar; anything else is coerced to a string and length-capped.
+                if (req.body.avatar === null || req.body.avatar === '') {
+                    props.avatar = null;
+                }
+                else {
+                    const avatar = String(req.body.avatar);
+                    if (avatar.length > MAX_AVATAR_LENGTH) {
+                        return {
+                            statusCode: 400,
+                            body: {
+                                error: t('user.error.avatarTooLarge', { max: MAX_AVATAR_LENGTH }, {
+                                    defaultValue: 'Avatar must be {{max}} characters or fewer.',
+                                }),
+                                errorKey: 'user.error.avatarTooLarge',
+                            },
+                        };
+                    }
+                    props.avatar = avatar;
+                }
+            }
+            if (req.body.bio !== undefined) {
+                // `null` clears the bio; otherwise coerce to a string and length-cap (empty string is allowed).
+                if (req.body.bio === null) {
+                    props.bio = null;
+                }
+                else {
+                    const bio = String(req.body.bio);
+                    if (bio.length > MAX_BIO_LENGTH) {
+                        return {
+                            statusCode: 400,
+                            body: {
+                                error: t('user.error.bioTooLong', { max: MAX_BIO_LENGTH }, {
+                                    defaultValue: 'Bio must be {{max}} characters or fewer.',
+                                }),
+                                errorKey: 'user.error.bioTooLong',
+                            },
+                        };
+                    }
+                    props.bio = bio;
+                }
+            }
+            // [M6-1] twoFactorEnabled is intentionally NOT copied from the request body — see the
+            // extendedUpdatePropsSchema note above. 2FA toggles go through verifyTwoFactor only.
+            if (req.body.oauthData !== undefined) {
+                if (req.body.oauthData === null || typeof req.body.oauthData !== 'object') {
+                    return {
+                        statusCode: 400,
+                        body: {
+                            error: t('user.error.oauthDataInvalid', undefined, {
+                                defaultValue: 'oauthData must be an object.',
+                            }),
+                            errorKey: 'user.error.oauthDataInvalid',
+                        },
+                    };
+                }
+                props.oauthData = req.body.oauthData;
+            }
+            if (Object.keys(props).length === 0) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.noUpdatableFields', undefined, {
+                            defaultValue: 'No updatable fields were provided.',
+                        }),
+                        errorKey: 'user.error.noUpdatableFields',
+                    },
+                };
+            }
+            const result = await updateResource({ id: id, props });
+            analytics
+                .track({
+                name: 'user.profile_updated',
+                userId: id,
+                properties: { fields: Object.keys(props) },
+            })
+                .catch(() => { });
+            return result;
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: {
+                    error: t('user.error.failedToUpdateUser'),
+                    errorKey: 'user.error.failedToUpdateUser',
+                },
+            };
+        }
+    };
+};
+//# sourceMappingURL=update.js.map

package/dist/handlers/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/handlers/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAChD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAC1B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAEhD,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAEjE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhG,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,MAAM,CAAC;IACzD,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS;IACtC,iFAAiF;IACjF,8EAA8E;IAC9E,0EAA0E;IAC1E,gDAAgD;IAChD,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,aAAa;IAC9C,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,yFAAyF;IACzF,qDAAqD;CACtD,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAkB,EAAE,EAAE;IAC7E,MAAM,cAAc,GAAG,cAAc,CAAC;QACpC,IAAI;QACJ,SAAS;QACT,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAA;IAEF,OAAO,KAAK,EAAE,GAAoB,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAA;YAClC,MAAM,KAAK,GAIP,EAAE,CAAA;YAEN,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACpC,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;qBACvC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;qBAC5B,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;gBAEpB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACpB,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,kCAAkC,CAAC;4BAC5C,QAAQ,EAAE,kCAAkC;yBAC7C;qBACF,CAAA;gBACH,CAAC;gBAED,8CAA8C;gBAC9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAiB,SAAS,EAAE;oBACxD,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;oBAC3D,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;iBAC3C,CAAC,CAAA;gBAEF,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,gCAAgC,CAAC;4BAC1C,QAAQ,EAAE,gCAAgC;yBAC3C;qBACF,CAAA;gBACH,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YACtD,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,SAAwB,CAAA;gBAC5B,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;oBACrD,SAAS,GAAG,IAAI,CAAA;gBAClB,CAAC;qBAAM,CAAC;oBACN,mEAAmE;oBACnE,uEAAuE;oBACvE,oEAAoE;oBACpE,kDAAkD;oBAClD,SAAS,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;oBAC7E,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;wBAClD,OAAO;4BACL,UAAU,EAAE,GAAG;4BACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,yBAAyB,EAAE;yBACnF,CAAA;oBACH,CAAC;oBAED,2CAA2C;oBAC3C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAiB,SAAS,EAAE;wBACxD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE;wBACnD,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;qBAC3C,CAAC,CAAA;oBAEF,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO;4BACL,UAAU,EAAE,GAAG;4BACf,IAAI,EAAE;gCACJ,KAAK,EAAE,CAAC,CAAC,mCAAmC,CAAC;gCAC7C,QAAQ,EAAE,mCAAmC;6BAC9C;yBACF,CAAA;oBACH,CAAC;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAA4B,SAAS,EAAE;oBAClE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;iBAC1C,CAAC,CAAA;gBACF,MAAM,aAAa,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAA;gBAEvE,IAAI,aAAa,EAAE,CAAC;oBAClB,mEAAmE;oBACnE,iEAAiE;oBACjE,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,kCAAkC;oBAClC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAmC,GAAG,SAAS,SAAS,EAAE;wBACrF,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;qBAC1C,CAAC,CAAA;oBACF,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;wBAC1B,MAAM,eAAe,GACnB,OAAO,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAA;wBAC9E,IAAI,CAAC,eAAe,EAAE,CAAC;4BACrB,OAAO;gCACL,UAAU,EAAE,GAAG;gCACf,IAAI,EAAE;oCACJ,KAAK,EAAE,CAAC,CAAC,oCAAoC,CAAC;oCAC9C,QAAQ,EAAE,oCAAoC;iCAC/C;6BACF,CAAA;wBACH,CAAC;wBACD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;4BAC5D,OAAO;gCACL,UAAU,EAAE,GAAG;gCACf,IAAI,EAAE;oCACJ,KAAK,EAAE,CAAC,CAAC,qCAAqC,CAAC;oCAC/C,QAAQ,EAAE,qCAAqC;iCAChD;6BACF,CAAA;wBACH,CAAC;oBACH,CAAC;oBAED,wEAAwE;oBACxE,sEAAsE;oBACtE,sEAAsE;oBACtE,yEAAyE;oBACzE,mEAAmE;oBACnE,KAAK,CAAC,aAAa,GAAG,KAAK,CAAA;gBAC7B,CAAC;gBAED,KAAK,CAAC,KAAK,GAAG,SAA8B,CAAA;YAC9C,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,0FAA0F;gBAC1F,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;oBACvD,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;gBACrB,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBACtC,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;wBACtC,OAAO;4BACL,UAAU,EAAE,GAAG;4BACf,IAAI,EAAE;gCACJ,KAAK,EAAE,CAAC,CACN,2BAA2B,EAC3B,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAC1B;oCACE,YAAY,EAAE,6CAA6C;iCAC5D,CACF;gCACD,QAAQ,EAAE,2BAA2B;6BACtC;yBACF,CAAA;oBACH,CAAC;oBACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;gBACvB,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC/B,gGAAgG;gBAChG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;oBAC1B,KAAK,CAAC,GAAG,GAAG,IAAI,CAAA;gBAClB,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAChC,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;wBAChC,OAAO;4BACL,UAAU,EAAE,GAAG;4BACf,IAAI,EAAE;gCACJ,KAAK,EAAE,CAAC,CACN,uBAAuB,EACvB,EAAE,GAAG,EAAE,cAAc,EAAE,EACvB;oCACE,YAAY,EAAE,0CAA0C;iCACzD,CACF;gCACD,QAAQ,EAAE,uBAAuB;6BAClC;yBACF,CAAA;oBACH,CAAC;oBACD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAA;gBACjB,CAAC;YACH,CAAC;YAED,sFAAsF;YACtF,qFAAqF;YAErF,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC1E,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,6BAA6B,EAAE,SAAS,EAAE;gCACjD,YAAY,EAAE,8BAA8B;6BAC7C,CAAC;4BACF,QAAQ,EAAE,6BAA6B;yBACxC;qBACF,CAAA;gBACH,CAAC;gBACD,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,SAAoC,CAAA;YACjE,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,8BAA8B,EAAE,SAAS,EAAE;4BAClD,YAAY,EAAE,oCAAoC;yBACnD,CAAC;wBACF,QAAQ,EAAE,8BAA8B;qBACzC;iBACF,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,EAAY,EAAE,KAAK,EAAE,CAAC,CAAA;YAChE,SAAS;iBACN,KAAK,CAAC;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,EAAE;gBACV,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;aAC3C,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAClB,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC;oBACzC,QAAQ,EAAE,+BAA+B;iBAC1C;aACF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/updatePassword.d.ts

@@ -0,0 +1,35 @@
+import type { MoleculeRequest } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/** Request body for password update, with current password verification and new password. */
+export interface UpdatePasswordRequest extends MoleculeRequest {
+    body: {
+        currentPassword?: string;
+        newPassword?: string;
+    };
+}
+/**
+ * Updates a user's password. If the user already has a password hash, the current password
+ * must be provided and verified first. The new password is hashed via `@molecule/api-password`
+ * and stored in the secrets table.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { success: true } }` on success.
+ */
+export declare const updatePassword: ({ name: _name, tableName, schema: _schema }: types.Resource) => (req: UpdatePasswordRequest) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        success?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        success: boolean;
+        error?: undefined;
+        errorKey?: undefined;
+    };
+}>;
+//# sourceMappingURL=updatePassword.d.ts.map

package/dist/handlers/updatePassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updatePassword.d.ts","sourceRoot":"","sources":["../../src/handlers/updatePassword.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAG7D,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAKzC,6FAA6F;AAC7F,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,EAAE;QACJ,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;CACF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAAI,6CAA6C,KAAK,CAAC,QAAQ,MAC1E,KAAK,qBAAqB;;;;;;;;;;;;;;EAqGzC,CAAA"}

package/dist/handlers/updatePassword.js

@@ -0,0 +1,113 @@
+import { get, getAnalytics, getLogger } from '@molecule/api-bond';
+import { findById, updateById } from '@molecule/api-database';
+import { t } from '@molecule/api-i18n';
+import { compare, hash } from '@molecule/api-password';
+import { invalidateAllDeviceExistsCache } from '../authorization.js';
+const analytics = getAnalytics();
+const logger = getLogger();
+/**
+ * Updates a user's password. If the user already has a password hash, the current password
+ * must be provided and verified first. The new password is hashed via `@molecule/api-password`
+ * and stored in the secrets table.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler that responds with `{ statusCode: 200, body: { success: true } }` on success.
+ */
+export const updatePassword = ({ name: _name, tableName, schema: _schema }) => {
+    return async (req) => {
+        try {
+            const id = req.params.id;
+            const { currentPassword, newPassword } = req.body;
+            if (!newPassword) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.newPasswordRequired'),
+                        errorKey: 'user.error.newPasswordRequired',
+                    },
+                };
+            }
+            if (newPassword.length < 8) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.passwordTooShort', undefined, {
+                            defaultValue: 'Password must be at least 8 characters',
+                        }),
+                        errorKey: 'user.error.passwordTooShort',
+                    },
+                };
+            }
+            if (newPassword.length > 1024) {
+                return {
+                    statusCode: 400,
+                    body: {
+                        error: t('user.error.passwordTooLong', undefined, {
+                            defaultValue: 'Password must be at most 1024 characters',
+                        }),
+                        errorKey: 'user.error.passwordTooLong',
+                    },
+                };
+            }
+            // Get current password hash.
+            const secrets = await findById(`${tableName}Secrets`, id);
+            // If user has a password, verify the current one.
+            if (secrets?.passwordHash) {
+                if (!currentPassword) {
+                    return {
+                        statusCode: 400,
+                        body: {
+                            error: t('user.error.currentPasswordRequired'),
+                            errorKey: 'user.error.currentPasswordRequired',
+                        },
+                    };
+                }
+                const isValid = await compare(currentPassword, secrets.passwordHash);
+                if (!isValid) {
+                    return {
+                        statusCode: 403,
+                        body: {
+                            error: t('user.error.currentPasswordIncorrect'),
+                            errorKey: 'user.error.currentPasswordIncorrect',
+                        },
+                    };
+                }
+            }
+            // Hash and store the new password, and clear any outstanding reset token.
+            const passwordHash = await hash(newPassword);
+            await updateById(`${tableName}Secrets`, id, {
+                passwordHash,
+                passwordResetToken: null,
+                passwordResetTokenAt: null,
+            });
+            // Invalidate all existing sessions by deleting all devices for this user.
+            // This forces re-login on every device, preventing compromised sessions
+            // from persisting after a password change.
+            try {
+                await get('device')?.deleteByUserId(id);
+                // Evict this process's positive device-exists cache so no just-deleted
+                // device keeps authenticating for the cache TTL — immediate revocation.
+                invalidateAllDeviceExistsCache();
+            }
+            catch (error) {
+                // Non-critical — password was already changed successfully
+                logger.warn('Failed to invalidate sessions after password change', { error, userId: id });
+            }
+            analytics.track({ name: 'user.password_changed', userId: id }).catch(() => { });
+            return { statusCode: 200, body: { success: true } };
+        }
+        catch (error) {
+            logger.error(error);
+            return {
+                statusCode: 500,
+                body: {
+                    error: t('user.error.failedToUpdatePassword'),
+                    errorKey: 'user.error.failedToUpdatePassword',
+                },
+            };
+        }
+    };
+};
+//# sourceMappingURL=updatePassword.js.map

package/dist/handlers/updatePassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updatePassword.js","sourceRoot":"","sources":["../../src/handlers/updatePassword.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AAGtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAA;AAGpE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;AAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;AAU1B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAkB,EAAE,EAAE;IAC5F,OAAO,KAAK,EAAE,GAA0B,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAA;YACxB,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAEjD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,gCAAgC,CAAC;wBAC1C,QAAQ,EAAE,gCAAgC;qBAC3C;iBACF,CAAA;YACH,CAAC;YAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,6BAA6B,EAAE,SAAS,EAAE;4BACjD,YAAY,EAAE,wCAAwC;yBACvD,CAAC;wBACF,QAAQ,EAAE,6BAA6B;qBACxC;iBACF,CAAA;YACH,CAAC;YAED,IAAI,WAAW,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAC9B,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC,CAAC,4BAA4B,EAAE,SAAS,EAAE;4BAChD,YAAY,EAAE,0CAA0C;yBACzD,CAAC;wBACF,QAAQ,EAAE,4BAA4B;qBACvC;iBACF,CAAA;YACH,CAAC;YAED,6BAA6B;YAC7B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAoB,GAAG,SAAS,SAAS,EAAE,EAAE,CAAC,CAAA;YAE5E,kDAAkD;YAClD,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC1B,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,oCAAoC,CAAC;4BAC9C,QAAQ,EAAE,oCAAoC;yBAC/C;qBACF,CAAA;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;gBACpE,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO;wBACL,UAAU,EAAE,GAAG;wBACf,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,qCAAqC,CAAC;4BAC/C,QAAQ,EAAE,qCAAqC;yBAChD;qBACF,CAAA;gBACH,CAAC;YACH,CAAC;YAED,0EAA0E;YAC1E,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAA;YAC5C,MAAM,UAAU,CAAC,GAAG,SAAS,SAAS,EAAE,EAAE,EAAE;gBAC1C,YAAY;gBACZ,kBAAkB,EAAE,IAAI;gBACxB,oBAAoB,EAAE,IAAI;aAC3B,CAAC,CAAA;YAEF,0EAA0E;YAC1E,wEAAwE;YACxE,2CAA2C;YAC3C,IAAI,CAAC;gBACH,MAAM,GAAG,CAAoD,QAAQ,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,CAAA;gBAC1F,uEAAuE;gBACvE,wEAAwE;gBACxE,8BAA8B,EAAE,CAAA;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,2DAA2D;gBAC3D,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;YAC3F,CAAC;YAED,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAE9E,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,IAAI,EAAE;oBACJ,KAAK,EAAE,CAAC,CAAC,mCAAmC,CAAC;oBAC7C,QAAQ,EAAE,mCAAmC;iBAC9C;aACF,CAAA;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/handlers/updatePlan.d.ts

@@ -0,0 +1,41 @@
+import type { MoleculeRequest } from '@molecule/api-resource';
+import type * as types from '../types.js';
+/** Request body for plan update, containing the target plan key. */
+export interface UpdatePlanRequest extends MoleculeRequest {
+    body: {
+        planKey?: string;
+    };
+}
+/**
+ * Updates a user's subscription plan. Uses the bonded PlanService to look up plan metadata and
+ * delegates to the appropriate bonded PaymentProvider based on the plan's `platformKey`. Handles
+ * cross-platform subscription cancellation when switching providers. Returns a checkout URL
+ * (status 201) for new subscriptions, or directly updates the user record for in-place changes
+ * and free plan downgrades.
+ * @param resource - The user resource configuration (name, tableName, schema).
+ * @param resource.name - The resource name.
+ * @param resource.tableName - The database table name for users.
+ * @param resource.schema - The validation schema for user properties.
+ * @returns A request handler for plan updates.
+ */
+export declare const updatePlan: ({ name, tableName, schema: _schema }: types.Resource) => (req: UpdatePlanRequest) => Promise<{
+    statusCode: number;
+    body: {
+        error: string;
+        errorKey: string;
+        props?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        props: Pick<import("@molecule/api-resource/types").Props, "updatedAt"> & Record<string, unknown>;
+        error?: undefined;
+        errorKey?: undefined;
+    };
+} | {
+    statusCode: number;
+    body: {
+        checkoutUrl: string;
+    };
+}>;
+//# sourceMappingURL=updatePlan.d.ts.map

package/dist/handlers/updatePlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updatePlan.d.ts","sourceRoot":"","sources":["../../src/handlers/updatePlan.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAI7D,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AAMzC,oEAAoE;AACpE,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,IAAI,EAAE;QACJ,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;CACF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,GAAI,sCAAsC,KAAK,CAAC,QAAQ,MAO/D,KAAK,iBAAiB;;;;;aAAL,CAAC;;;;;;;;;;;;;;EAuOjC,CAAA"}