@nxgt/janus 0.11.0 → 0.13.0

package/dist/conformance/index.js

@@ -1,17 +1,17 @@
 import {
   mintId2,
   createMemoryStores2
-} from "../chunks/index-4m49cye4.js";
+} from "../chunks/index-rd2rddvv.js";
 import {
   JanusError2,
   StoreFailure2,
   StoreConflict2,
   NotFoundError2,
   formatSubject2
-} from "../chunks/index-5e2fw7he.js";
+} from "../chunks/index-j2gd8fry.js";
 import {
   createMemoryRelations2
-} from "../chunks/index-6f6wja93.js";
+} from "../chunks/index-km7ffctx.js";
 
 // src/conformance/assert.ts
 function equal(actual, expected, what) {
@@ -184,6 +184,7 @@ var outageCases = [
   outage("users", "listUsers", ({ stores }) => stores.users.listUsers({ type: user.type, after: null, limit: 10 }), seed),
   outage("sessions", "findSessionByTokenHash", ({ stores }) => stores.sessions.findSessionByTokenHash(session.tokenHash), seed),
   outage("sessions", "extendSession", ({ stores }) => stores.sessions.extendSession(session.id, at("2099-06-01T00:00:00.000Z")), seed),
+  outage("sessions", "reauthenticateSession", ({ stores }) => stores.sessions.reauthenticateSession(session.id, now), seed),
   outage("sessions", "revokeSession", ({ stores }) => stores.sessions.revokeSession(session.id, now), seed),
   outage("sessions", "revokeUserSessions", ({ stores }) => stores.sessions.revokeUserSessions(user.id, now), seed),
   outage("tokens", "consumeToken", ({ stores }) => stores.tokens.consumeToken(token.tokenHash, "resetPassword", now), seed),
@@ -320,12 +321,53 @@ var sessionReadCases = [
   }
 ];
 
-// src/conformance/cases/sessions/revocation.ts
+// src/conformance/cases/sessions/reauthentication.ts
 var group5 = "sessions";
+var sessionReauthenticationCases = [
+  {
+    id: "sessions.reauthenticate",
+    group: group5,
+    name: "moves authenticatedAt on a standing session, and never brings back a revoked one",
+    async run({ stores }) {
+      const standing = sessionRecord();
+      const revoked = sessionRecord({
+        revokedAt: at("2026-01-02T00:00:00.000Z")
+      });
+      await stores.sessions.insertSession(standing);
+      await stores.sessions.insertSession(revoked);
+      const now = at("2026-02-01T00:00:00.000Z");
+      equal(await stores.sessions.reauthenticateSession(standing.id, now), { ...standing, authenticatedAt: now }, "reauthenticateSession should answer the session with its new authenticatedAt, and every other field as it was");
+      equal(await stores.sessions.findSessionByTokenHash(standing.tokenHash), { ...standing, authenticatedAt: now }, "reauthenticateSession should have written authenticatedAt, and read back the same");
+      isNull(await stores.sessions.reauthenticateSession(revoked.id, now), "reauthenticateSession on a revoked session — a confirmation racing a revocation must never bring it back");
+      equal(await stores.sessions.findSessionByTokenHash(revoked.tokenHash), revoked, "reauthenticateSession refused on a revoked session should have written nothing");
+      isNull(await stores.sessions.reauthenticateSession(mintId2(), now), "reauthenticateSession on an unknown session");
+    }
+  },
+  {
+    id: "sessions.reauthenticateRace",
+    group: group5,
+    name: "never brings back a session whose revocation races its confirmation",
+    async run({ stores }) {
+      const now = at("2026-02-01T00:00:00.000Z");
+      for (let round = 0;round < 10; round += 1) {
+        const record = sessionRecord();
+        await stores.sessions.insertSession(record);
+        await Promise.all([
+          stores.sessions.reauthenticateSession(record.id, now),
+          stores.sessions.revokeSession(record.id, now)
+        ]);
+        equal((await stores.sessions.findSessionByTokenHash(record.tokenHash))?.revokedAt, now, "reauthenticateSession racing revokeSession: the session should stay revoked — one conditional write, never a read then a write");
+      }
+    }
+  }
+];
+
+// src/conformance/cases/sessions/revocation.ts
+var group6 = "sessions";
 var sessionRevocationCases = [
   {
     id: "sessions.revoke",
-    group: group5,
+    group: group6,
     name: "revokes once and keeps the first revokedAt; answers false only when there is no session",
     async run({ stores }) {
       const record = sessionRecord();
@@ -339,7 +381,7 @@ var sessionRevocationCases = [
   },
   {
     id: "sessions.revokeUser",
-    group: group5,
+    group: group6,
     name: "revokes every standing session of one user but the one excepted, and counts only what it revoked",
     async run({ stores }) {
       const userId = mintId2();
@@ -369,15 +411,16 @@ var sessionStoreCases = [
   ...sessionReadCases,
   ...sessionInsertCases,
   ...sessionExtensionCases,
+  ...sessionReauthenticationCases,
   ...sessionRevocationCases,
   ...sessionDeletionCases
 ];
 // src/conformance/cases/tokens/attempts.ts
-var group6 = "tokens";
+var group7 = "tokens";
 var tokenAttemptCases = [
   {
     id: "tokens.countAttempt",
-    group: group6,
+    group: group7,
     name: "counts an attempt at a code, and answers the token as it is after the call",
     async run({ stores }) {
       const record = tokenRecord({
@@ -392,7 +435,7 @@ var tokenAttemptCases = [
   },
   {
     id: "tokens.countAttemptConcurrency",
-    group: group6,
+    group: group7,
     name: "gives twenty concurrent attempts twenty distinct counts — one conditional write, never a read then a write",
     async run({ stores }) {
       const record = tokenRecord({ kind: "secondFactor" });
@@ -403,7 +446,7 @@ var tokenAttemptCases = [
   },
   {
     id: "tokens.countAttemptRace",
-    group: group6,
+    group: group7,
     name: "never counts an attempt once the token is spent, when attempts and a redemption race",
     async run({ stores }) {
       const record = tokenRecord({ kind: "signInCode" });
@@ -426,7 +469,7 @@ var tokenAttemptCases = [
   },
   {
     id: "tokens.countAttemptSpent",
-    group: group6,
+    group: group7,
     name: "does not count an attempt at a spent token, nor at a token of another kind, nor at none",
     async run({ stores }) {
       const spent = tokenRecord({
@@ -448,11 +491,11 @@ var tokenAttemptCases = [
 ];
 
 // src/conformance/cases/tokens/deletion.ts
-var group7 = "tokens";
+var group8 = "tokens";
 var tokenDeletionCases = [
   {
     id: "tokens.deleteUser",
-    group: group7,
+    group: group8,
     name: "deletes every token of one user, spent or not, of either kind, and counts them",
     async run({ stores }) {
       const userId = mintId2();
@@ -477,11 +520,11 @@ var tokenDeletionCases = [
 ];
 
 // src/conformance/cases/tokens/inserts.ts
-var group8 = "tokens";
+var group9 = "tokens";
 var tokenInsertCases = [
   {
     id: "tokens.challenge",
-    group: group8,
+    group: group9,
     name: "keeps a second-factor challenge, whose address is '' — nothing was sent for it",
     async run({ stores }) {
       const record = tokenRecord({ kind: "secondFactor", address: "" });
@@ -492,7 +535,7 @@ var tokenInsertCases = [
   },
   {
     id: "tokens.lapsed",
-    group: group8,
+    group: group9,
     name: "spends a lapsed token all the same: expiry is compared by the core, after the call",
     async run({ stores }) {
       const record = tokenRecord({ expiresAt: at("2020-01-01T00:00:00.000Z") });
@@ -507,7 +550,7 @@ var tokenInsertCases = [
   },
   {
     id: "tokens.idempotentInsert",
-    group: group8,
+    group: group9,
     name: "is idempotent under retry: inserting an existing token hash writes nothing",
     async run({ stores }) {
       const record = tokenRecord();
@@ -521,12 +564,55 @@ var tokenInsertCases = [
   }
 ];
 
+// src/conformance/cases/tokens/kinds.ts
+var group10 = "tokens";
+var KINDS = Object.keys({
+  verifyEmail: true,
+  resetPassword: true,
+  secondFactor: true,
+  signInCode: true,
+  stepUp: true
+});
+var tokenKindCases = [
+  {
+    id: "tokens.everyKind",
+    group: group10,
+    name: "stores, counts and spends a token of every kind the port names",
+    async run({ stores }) {
+      const now = at("2026-02-01T00:00:00.000Z");
+      for (const kind of KINDS) {
+        const record = tokenRecord({ kind, codeHash: "c".repeat(64) });
+        await stores.tokens.insertToken(record);
+        equal(await stores.tokens.countAttempt(record.tokenHash, kind), { ...record, attempts: 1 }, `countAttempt on a ${kind} token should answer it with one attempt`);
+        equal(await stores.tokens.consumeToken(record.tokenHash, kind, now), { ...record, attempts: 1 }, `consumeToken on a ${kind} token should answer it as it was — spentAt null`);
+      }
+    }
+  },
+  {
+    id: "tokens.stepUpKind",
+    group: group10,
+    name: "keeps a step-up apart from a sign-in code: neither is counted, spent nor answered as the other",
+    async run({ stores }) {
+      const userId = mintId2();
+      const stepUp = tokenRecord({ userId, kind: "stepUp" });
+      const signInCode = tokenRecord({ userId, kind: "signInCode" });
+      await stores.tokens.insertToken(stepUp);
+      await stores.tokens.insertToken(signInCode);
+      const now = at("2026-02-01T00:00:00.000Z");
+      isNull(await stores.tokens.countAttempt(stepUp.tokenHash, "signInCode"), "countAttempt for a stepUp token counted as signInCode");
+      isNull(await stores.tokens.consumeToken(signInCode.tokenHash, "stepUp", now), "consumeToken for a signInCode token redeemed as stepUp");
+      equal(await stores.tokens.spendUserTokens(userId, "stepUp", now), 1, "spendUserTokens of stepUp: the step-up only");
+      equal(await stores.tokens.consumeToken(signInCode.tokenHash, "signInCode", now), signInCode, "spendUserTokens of stepUp should not touch a sign-in code, nor anything else have counted it");
+    }
+  }
+];
+
 // src/conformance/cases/tokens/redemption.ts
-var group9 = "tokens";
+var group11 = "tokens";
 var tokenRedemptionCases = [
   {
     id: "tokens.consume",
-    group: group9,
+    group: group11,
     name: "answers the token as it was before the call: spentAt null means this call spent it",
     async run({ stores }) {
       const record = tokenRecord();
@@ -538,7 +624,7 @@ var tokenRedemptionCases = [
   },
   {
     id: "tokens.concurrency",
-    group: group9,
+    group: group11,
     name: "lets exactly one of twenty concurrent redemptions spend a token — one conditional write, never a read then a write",
     async run({ stores }) {
       const record = tokenRecord();
@@ -550,7 +636,7 @@ var tokenRedemptionCases = [
   },
   {
     id: "tokens.kind",
-    group: group9,
+    group: group11,
     name: "does not know, and does not spend, a token of the other kind",
     async run({ stores }) {
       const record = tokenRecord({ kind: "verifyEmail" });
@@ -564,11 +650,11 @@ var tokenRedemptionCases = [
 ];
 
 // src/conformance/cases/tokens/spending.ts
-var group10 = "tokens";
+var group12 = "tokens";
 var tokenSpendingCases = [
   {
     id: "tokens.spendUserTokens",
-    group: group10,
+    group: group12,
     name: "spends every unspent token of one user and one kind, and counts them, leaving the rest as they were",
     async run({ stores }) {
       const userId = mintId2();
@@ -599,7 +685,7 @@ var tokenSpendingCases = [
   },
   {
     id: "tokens.spendUserTokensExcept",
-    group: group10,
+    group: group12,
     name: "spares the token named by except, and spends the rest",
     async run({ stores }) {
       const userId = mintId2();
@@ -621,7 +707,7 @@ var tokenSpendingCases = [
   },
   {
     id: "tokens.spendUserTokensRace",
-    group: group10,
+    group: group12,
     name: "spends a token once, when spending a user's tokens races a redemption",
     async run({ stores }) {
       const now = at("2026-02-01T00:00:00.000Z");
@@ -644,14 +730,15 @@ var tokenStoreCases = [
   ...tokenAttemptCases,
   ...tokenSpendingCases,
   ...tokenInsertCases,
+  ...tokenKindCases,
   ...tokenDeletionCases
 ];
 // src/conformance/cases/users/deletion.ts
-var group11 = "users";
+var group13 = "users";
 var userDeletionCases = [
   {
     id: "users.delete",
-    group: group11,
+    group: group13,
     name: "deletes a user and frees their logins, answers false for nobody, and touches no other user",
     async run({ stores }) {
       const record = userRecord();
@@ -671,11 +758,11 @@ var userDeletionCases = [
 ];
 
 // src/conformance/cases/users/inserts.ts
-var group12 = "users";
+var group14 = "users";
 var userInsertCases = [
   {
     id: "users.idempotentInsert",
-    group: group12,
+    group: group14,
     name: "is idempotent under retry: inserting an existing id answers the stored record and writes nothing",
     async run({ stores }) {
       const record = userRecord();
@@ -690,7 +777,7 @@ var userInsertCases = [
   },
   {
     id: "users.uniqueness",
-    group: group12,
+    group: group14,
     name: "lets exactly one of twenty concurrent inserts hold a login: uniqueness is a constraint, not a read",
     async run({ stores }) {
       const records = Array.from({ length: 20 }, () => userRecord({ logins: ["contested@example.test"] }));
@@ -715,11 +802,11 @@ var userInsertCases = [
 ];
 
 // src/conformance/cases/users/listing.ts
-var group13 = "users";
+var group15 = "users";
 var userListingCases = [
   {
     id: "users.pagination",
-    group: group13,
+    group: group15,
     name: "pages 25 users of one type by 10 in ascending id order, with no gap, no repeat and no other type, and ends on a null cursor",
     async run({ stores }) {
       const records = Array.from({ length: 25 }, () => userRecord());
@@ -820,11 +907,11 @@ async function nullClearsCodes(stores, id) {
 }
 
 // src/conformance/cases/users/patches.ts
-var group14 = "users";
+var group16 = "users";
 var userPatchCases = [
   {
     id: "users.omission",
-    group: group14,
+    group: group16,
     name: "omission — the Kratos PUT trap: an update leaves every field it does not name exactly as it was",
     async run({ stores }) {
       const record = userRecord({
@@ -849,7 +936,7 @@ var userPatchCases = [
   },
   {
     id: "users.passwordSlot",
-    group: group14,
+    group: group16,
     name: "keeps a password the patch does not name, and removes one the patch names null",
     async run({ stores }) {
       const record = userRecord();
@@ -863,7 +950,7 @@ var userPatchCases = [
   secondFactorSlotCase,
   {
     id: "users.loginsMove",
-    group: group14,
+    group: group16,
     name: "moves logins on update: the old one is free, the new one found, one held elsewhere refused",
     async run({ stores }) {
       const record = userRecord();
@@ -884,11 +971,11 @@ var userPatchCases = [
 ];
 
 // src/conformance/cases/users/reads.ts
-var group15 = "users";
+var group17 = "users";
 var userReadCases = [
   {
     id: "users.roundTrip",
-    group: group15,
+    group: group17,
     name: 'round-trips a record byte for byte: nested fields, a 1 that stays a number, a "1" that stays a string',
     async run({ stores }) {
       const record = userRecord({
@@ -912,7 +999,7 @@ var userReadCases = [
   },
   {
     id: "users.edgeCharacters",
-    group: group15,
+    group: group17,
     name: "round-trips every character the core lets through: control characters, U+FFFF and a surrogate pair",
     async run({ stores }) {
       const edge = "a\x01\x1F￿ \uD83D\uDE00 z";
@@ -927,7 +1014,7 @@ var userReadCases = [
   },
   {
     id: "users.absence",
-    group: group15,
+    group: group17,
     name: "answers null for an absence, never undefined, and an empty page for an empty store",
     async run({ stores }) {
       isNull(await stores.users.findUser(mintId2()), "findUser for an unknown id");
@@ -937,7 +1024,7 @@ var userReadCases = [
   },
   {
     id: "users.loginBytes",
-    group: group15,
+    group: group17,
     name: "compares logins as bytes, within one type: no case folding, no trimming, no collation",
     async run({ stores }) {
       const upper = userRecord({ logins: ["Ada@Example.test"] });
@@ -954,11 +1041,11 @@ var userReadCases = [
 ];
 
 // src/conformance/cases/users/versions.ts
-var group16 = "users";
+var group18 = "users";
 var userVersionCases = [
   {
     id: "users.versionIncrements",
-    group: group16,
+    group: group18,
     name: "applies an update at the expected version, and answers the record written with its version one higher",
     async run({ stores }) {
       const record = userRecord();
@@ -976,7 +1063,7 @@ var userVersionCases = [
   },
   {
     id: "users.versionConflict",
-    group: group16,
+    group: group18,
     name: "refuses a stale version with both versions, and leaves the record identical byte for byte",
     async run({ stores }) {
       const record = userRecord();
@@ -997,7 +1084,7 @@ var userVersionCases = [
   },
   {
     id: "users.unknownUpdate",
-    group: group16,
+    group: group18,
     name: "refuses an update to an unknown id with NotFoundError, told apart from a version conflict",
     async run({ stores }) {
       const error = await rejects(stores.users.updateUser(mintId2(), { updatedAt: at("2026-02-01T00:00:00.000Z") }, 0), "updateUser on an unknown id should reject");
@@ -1140,11 +1227,11 @@ var tuple = (object, relation, subject) => ({ object, relation, subject });
 var sorted = (subjects) => subjects.map(formatSubject2).sort();
 
 // src/conformance/relations/cases/deletion.ts
-var group17 = "relations";
+var group19 = "relations";
 var relationDeletionCases = [
   {
     id: "relations.deleteEntity",
-    group: group17,
+    group: group19,
     name: "deletes every tuple naming an entity — as object, as subject, as a set’s entity — and counts them",
     async run({ store }) {
       const team = entity("team");
@@ -1171,11 +1258,11 @@ var relationDeletionCases = [
 ];
 
 // src/conformance/relations/cases/reads.ts
-var group18 = "relations";
+var group20 = "relations";
 var relationReadCases = [
   {
     id: "relations.roundTrip",
-    group: group18,
+    group: group20,
     name: "holds exactly the tuples written, byte for byte: staff:u1 is not patient:u1, and a set is not its entity",
     async run({ store }) {
       const record = entity("record", "Ｒ:1 — ÿ");
@@ -1191,7 +1278,7 @@ var relationReadCases = [
   },
   {
     id: "relations.edgeCharacters",
-    group: group18,
+    group: group20,
     name: "round-trips every character the core lets through in an id: control characters, U+FFFF and a surrogate pair",
     async run({ store }) {
       const edge = "a\x01\x1F￿ \uD83D\uDE00 z";
@@ -1214,7 +1301,7 @@ var relationReadCases = [
   },
   {
     id: "relations.undefinedRelation",
-    group: group18,
+    group: group20,
     name: "reads a subject whose relation is undefined as its entity, not as a set",
     async run({ store }) {
       const record = entity("record");
@@ -1244,7 +1331,7 @@ var relationReadCases = [
   },
   {
     id: "relations.absence",
-    group: group18,
+    group: group20,
     name: "answers false, [], an empty page and 0 for an empty store — never null or undefined",
     async run({ store }) {
       const record = entity("record");
@@ -1265,11 +1352,11 @@ var relationReadCases = [
 ];
 
 // src/conformance/relations/cases/traversal.ts
-var group19 = "relations";
+var group21 = "relations";
 var relationTraversalCases = [
   {
     id: "relations.oneHop",
-    group: group19,
+    group: group21,
     name: "answers one hop: the subject sets and the entities holding one relation on one object, and nothing else",
     async run({ store }) {
       const record = entity("record");
@@ -1293,7 +1380,7 @@ var relationTraversalCases = [
   },
   {
     id: "relations.objects",
-    group: group19,
+    group: group21,
     name: "pages 25 objects by 10 in ascending id order, for one type, relation and exact subject, and ends on a null cursor",
     async run({ store }) {
       const staff = entity("staff");
@@ -1340,11 +1427,11 @@ var relationTraversalCases = [
 ];
 
 // src/conformance/relations/cases/writes.ts
-var group20 = "relations";
+var group22 = "relations";
 var relationWriteCases = [
   {
     id: "relations.idempotentWrite",
-    group: group20,
+    group: group22,
     name: "is idempotent under retry: adding a stored tuple and removing an absent one write nothing",
     async run({ store }) {
       const record = entity("record");
@@ -1357,7 +1444,7 @@ var relationWriteCases = [
   },
   {
     id: "relations.uniqueness",
-    group: group20,
+    group: group22,
     name: "keeps one tuple when twenty concurrent writes add it: uniqueness is a constraint, not a read",
     async run({ store }) {
       const record = entity("record");
@@ -1368,7 +1455,7 @@ var relationWriteCases = [
   },
   {
     id: "relations.removeThenAdd",
-    group: group20,
+    group: group22,
     name: "applies one write’s removals and additions together",
     async run({ store }) {
       const record = entity("record");
@@ -1503,5 +1590,5 @@ export {
   userStoreCases
 };
 
-//# debugId=62F9C4A440C84DC064756E2164756E21
+//# debugId=B2CA4E7F432AAE2464756E2164756E21
 //# sourceMappingURL=index.js.map