@openora/core 0.4.0 → 0.4.1-canary.100

package/dist/pam/identity/__tests__/admin-user-directory.int.test.js

@@ -0,0 +1,217 @@
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import { eq, sql } from 'drizzle-orm';
+import { createTestDb, seedUser } from '@openora/core/testing';
+import { player } from '@openora/core/pam/schema/profile';
+import { migrate as migrateProfile } from '@openora/core/pam/migrate/profile';
+import { mock, NO_CLIENT_META } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { user } from '../schema/index.js';
+import { DrizzleAdminUserDirectory } from '../admin-user-directory.js';
+let db;
+function makeDirectory() {
+    const emit = vi.fn();
+    return {
+        dir: new DrizzleAdminUserDirectory(db.drizzle, mock({ emit, on: vi.fn() })),
+        emit,
+    };
+}
+async function seedPlayer(userId, overrides = {}) {
+    const { username = 'alice', ...playerOverrides } = overrides;
+    await db.drizzle.db.update(user).set({ username }).where(eq(user.id, userId));
+    const [row] = await db.drizzle.db
+        .insert(player)
+        .values({ userId, ...playerOverrides })
+        .returning();
+    return row;
+}
+beforeAll(async () => {
+    db = await createTestDb([migrate, migrateProfile]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    await db.drizzle.db.execute(sql `TRUNCATE ${player}, ${user} RESTART IDENTITY CASCADE`);
+});
+describe('DrizzleAdminUserDirectory.update (real PG)', () => {
+    it('emits deactivated and persists the flip when isActive goes true -> false', async () => {
+        const { dir, emit } = makeDirectory();
+        const account = await seedUser(db, { isActive: true });
+        const actorId = randomUUID();
+        const updated = await dir.update(account.id, { isActive: false }, actorId, NO_CLIENT_META);
+        expect(updated).toMatchObject({ isActive: false });
+        const [stored] = await db.drizzle.db.select().from(user).where(eq(user.id, account.id));
+        expect(stored?.isActive).toBe(false);
+        expect(emit).toHaveBeenCalledWith('identity.user.deactivated', {
+            userId: account.id,
+            actorId,
+            ip: null,
+            userAgent: null,
+        });
+    });
+    it('emits reactivated when isActive goes false -> true', async () => {
+        const { dir, emit } = makeDirectory();
+        const account = await seedUser(db, { isActive: false });
+        const actorId = randomUUID();
+        await dir.update(account.id, { isActive: true }, actorId, NO_CLIENT_META);
+        expect(emit).toHaveBeenCalledWith('identity.user.reactivated', {
+            userId: account.id,
+            actorId,
+            ip: null,
+            userAgent: null,
+        });
+    });
+    it('stays quiet when isActive is written unchanged', async () => {
+        const { dir, emit } = makeDirectory();
+        const account = await seedUser(db, { isActive: true });
+        await dir.update(account.id, { isActive: true }, randomUUID());
+        expect(emit).not.toHaveBeenCalled();
+    });
+    it('stays quiet on a role-only update but still writes the role', async () => {
+        const { dir, emit } = makeDirectory();
+        const account = await seedUser(db, { isActive: true });
+        const updated = await dir.update(account.id, { role: 'admin' }, randomUUID());
+        expect(updated).toMatchObject({ role: 'admin' });
+        expect(emit).not.toHaveBeenCalled();
+    });
+    it('returns null for an unknown user', async () => {
+        const { dir, emit } = makeDirectory();
+        expect(await dir.update(randomUUID(), { isActive: false }, randomUUID())).toBeNull();
+        expect(emit).not.toHaveBeenCalled();
+    });
+});
+describe('DrizzleAdminUserDirectory reads (real PG)', () => {
+    it('counts every user row', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db);
+        await seedUser(db);
+        expect(await dir.count()).toBe(2);
+    });
+    it('gets a single user, or null when unknown', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db);
+        expect(await dir.get(account.id)).toMatchObject({ id: account.id, email: account.email });
+        expect(await dir.get(randomUUID())).toBeNull();
+    });
+    it('filters the list by an email substring and reports the filtered total', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db, { email: 'match-me@example.com' });
+        await seedUser(db, { email: 'other@example.com' });
+        const result = await dir.list({ page: 1, limit: 10, search: 'match-me' });
+        expect(result.total).toBe(1);
+        expect(result.rows[0]?.email).toBe('match-me@example.com');
+    });
+    it('sorts by email ascending when asked', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db, { email: 'b@example.com' });
+        await seedUser(db, { email: 'a@example.com' });
+        const result = await dir.list({ page: 1, limit: 10, sortBy: 'email', sortOrder: 'asc' });
+        expect(result.rows.map((r) => r.email)).toEqual(['a@example.com', 'b@example.com']);
+    });
+    it('pages while the total covers the whole set', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db);
+        await seedUser(db);
+        await seedUser(db);
+        const result = await dir.list({ page: 2, limit: 2 });
+        expect(result.total).toBe(3);
+        expect(result.rows).toHaveLength(1);
+    });
+});
+describe('DrizzleAdminUserDirectory.lookupPlayers (real PG)', () => {
+    it('returns an empty array for no ids', async () => {
+        const { dir } = makeDirectory();
+        expect(await dir.lookupPlayers([])).toEqual([]);
+    });
+    it('joins the email from the user table onto the player summary', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'alice@example.com' });
+        const seededPlayer = await seedPlayer(account.id, {
+            username: 'alice',
+            kycStatus: 'verified',
+        });
+        const [summary] = await dir.lookupPlayers([account.id]);
+        expect(summary).toEqual({
+            playerId: seededPlayer.id,
+            userId: account.id,
+            username: 'alice',
+            email: 'alice@example.com',
+            kycStatus: 'approved',
+            language: 'en',
+            avatarUrl: null,
+            createdAt: expect.any(Date),
+            level: 1,
+            currency: 'USD',
+        });
+        expect(summary?.playerId).toBe(seededPlayer.id);
+        expect(summary?.playerId).not.toBe(summary?.userId);
+    });
+    it('skips a user id that has no player profile', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db);
+        expect(await dir.lookupPlayers([account.id])).toEqual([]);
+    });
+});
+describe('DrizzleAdminUserDirectory.getPlayerByUsername (real PG)', () => {
+    it('returns an exact case-insensitive match', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'anna@example.com' });
+        const seededPlayer = await seedPlayer(account.id, { username: 'annabell' });
+        const summary = await dir.getPlayerByUsername('annabell');
+        expect(summary).toMatchObject({
+            playerId: seededPlayer.id,
+            userId: account.id,
+            username: 'annabell',
+        });
+        expect(summary?.playerId).toBe(seededPlayer.id);
+        expect(summary?.playerId).not.toBe(summary?.userId);
+    });
+    it('returns null when no player matches', async () => {
+        const { dir } = makeDirectory();
+        expect(await dir.getPlayerByUsername('ghost')).toBeNull();
+    });
+    it('does not substring-match, unlike findPlayerIds', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'annabell@example.com' });
+        await seedPlayer(account.id, { username: 'annabell' });
+        expect(await dir.getPlayerByUsername('Anna')).toBeNull();
+        expect(await dir.findPlayerIds('Anna')).toEqual([account.id]);
+    });
+});
+describe('DrizzleAdminUserDirectory.findPlayerIds (real PG)', () => {
+    it('unions email and username matches into a deduped id set', async () => {
+        const { dir } = makeDirectory();
+        const byEmailOnly = await seedUser(db, { email: 'anna@example.com' });
+        const byBoth = await seedUser(db, { email: 'anton@example.com' });
+        await seedPlayer(byBoth.id, { username: 'anton' });
+        const byNameOnly = await seedUser(db, { email: 'zoe@example.com' });
+        await seedPlayer(byNameOnly.id, { username: 'annabel' });
+        const ids = await dir.findPlayerIds('an');
+        expect([...ids].sort()).toEqual([byEmailOnly.id, byBoth.id, byNameOnly.id].sort());
+    });
+    it('returns nothing when the term matches neither column', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db, { email: 'alice@example.com' });
+        expect(await dir.findPlayerIds('zzzz')).toEqual([]);
+    });
+    it('matches an exact playerId', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'carlos@example.com' });
+        const seededPlayer = await seedPlayer(account.id, { username: 'carlos' });
+        expect(await dir.findPlayerIds(seededPlayer.id)).toEqual([account.id]);
+    });
+    it('matches an exact identity userId', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'dana@example.com' });
+        await seedPlayer(account.id, { username: 'dana' });
+        expect(await dir.findPlayerIds(account.id)).toEqual([account.id]);
+    });
+    it('does not substring-match a playerId, unlike email/displayName', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'erin@example.com' });
+        const seededPlayer = await seedPlayer(account.id, { username: 'erin' });
+        expect(await dir.findPlayerIds(seededPlayer.id.slice(0, 8))).toEqual([]);
+    });
+});
+//# sourceMappingURL=admin-user-directory.int.test.js.map

package/dist/pam/identity/__tests__/admin-user-directory.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-directory.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/admin-user-directory.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAC1D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,IAAI,EAAU,CAAC;AAEf,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACrB,OAAO;QACL,GAAG,EAAE,IAAI,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAW,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrF,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,YAAyE,EAAE;IAE3E,MAAM,EAAE,QAAQ,GAAG,OAAO,EAAE,GAAG,eAAe,EAAE,GAAG,SAAS,CAAC;IAC7D,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;SAC9B,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;SACtC,SAAS,EAAE,CAAC;IACf,OAAO,GAAI,CAAC;AACd,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,YAAY,MAAM,KAAK,IAAI,2BAA2B,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAE7B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QAE3F,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,2BAA2B,EAAE;YAC7D,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,OAAO;YACP,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAE7B,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,2BAA2B,EAAE;YAC7D,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,OAAO;YACP,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvD,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE/D,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE9E,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QAEtC,MAAM,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnB,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnB,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACtD,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnB,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnB,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAEhC,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE;YAChD,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,UAAU;SACtB,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAExD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,QAAQ,EAAE,YAAY,CAAC,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,mBAAmB;YAC1B,SAAS,EAAE,UAAU;YACrB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAC3B,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnC,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAE1D,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;YAC5B,QAAQ,EAAE,YAAY,CAAC,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAEhC,MAAM,CAAC,MAAM,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACtE,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,CAAC,MAAM,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAClE,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpE,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAEnD,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClE,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnD,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity.rate-limit.int.test.d.ts.map

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.rate-limit.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.js

@@ -0,0 +1,194 @@
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { RedisRateLimiter } from '@openora/core/server';
+import { createTestDb, createTestRedis } from '@openora/core/testing';
+import { definePlatformConfig } from '@openora/core/contracts';
+import { makeIdentityReader, mock, makeEventBus } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { IdentityService } from '../service/identity.service.js';
+const testTemplateRenderer = {
+    render: () => ({ subject: 'subject', body: 'body' }),
+};
+function withTemplateRenderer(deps) {
+    return new IdentityService({
+        templateRenderer: testTemplateRenderer,
+        playerProvisioning: mock({ createForRegistration: vi.fn() }),
+        ...deps,
+        identityReader: deps.identityReader ?? makeIdentityReader(),
+    });
+}
+// Keep the real @openora/core/server (so assertRateLimit + RedisRateLimiter are real); only
+// stub createAuth so the constructor doesn't touch a real DB.
+vi.mock('@openora/core/server', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        createAuth: vi.fn(() => ({
+            api: { getSession: vi.fn().mockResolvedValue(null), signUpEmail: vi.fn() },
+        })),
+    };
+});
+const events = makeEventBus();
+let db;
+let drizzle;
+let redis;
+const makeLimiter = () => new RedisRateLimiter(redis.client);
+beforeAll(async () => {
+    db = await createTestDb([migrate]);
+    drizzle = db.drizzle;
+    redis = await createTestRedis();
+});
+afterAll(async () => {
+    await db.drop();
+    await redis.quit();
+});
+beforeEach(async () => {
+    await redis.flush();
+});
+describe('IdentityService - rate limiting (real Redis)', () => {
+    it('rejects register with a 429 once the per-email limit is exhausted', async () => {
+        const email = 'abuse@x.dev';
+        const limiter = makeLimiter();
+        // Pre-exhaust the register bucket (5 per 15min) so the service's own consume is denied.
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume(`register:${email}`, { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({
+            drizzle,
+            events,
+            limiter,
+            platformConfig: definePlatformConfig({
+                registration: { termsVersion: '2026-08', webUrl: 'https://app.example.test' },
+            }),
+        });
+        await expect(svc.register({
+            email,
+            password: 'password123',
+            username: 'alpha',
+            acceptedTerms: true,
+            acceptedAge: true,
+        }, {})).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+            data: { retryAfterMs: expect.any(Number) },
+        });
+    });
+    it('allows register when no limiter is bound (test/no-auth edition)', async () => {
+        const svc = withTemplateRenderer({ drizzle, events });
+        // signUpEmail is a bare vi.fn returning undefined; a throw here would be a 429, not the
+        // downstream .json() failure we expect, so assert we got past the guard.
+        await expect(svc.register({
+            email: 'ok@x.dev',
+            password: 'password123',
+            username: 'alpha',
+            acceptedTerms: true,
+            acceptedAge: true,
+        }, {})).rejects.not.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+});
+describe('IdentityService - verify2fa rate-limit key stability (ABC-208 finding #3)', () => {
+    it('keys on the two_factor cookie VALUE, not the raw Cookie header, so junk cookie pairs cannot churn the bucket', async () => {
+        const limiter = makeLimiter();
+        const twoFactorIdentifier = 'pending-2fa-identifier-abc';
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume(`verify2fa:${twoFactorIdentifier}`, {
+                limit: 5,
+                windowMs: 5 * 60 * 1000,
+            });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        // Same two_factor cookie + different junk pairs must still hit the one exhausted bucket.
+        for (let i = 0; i < 3; i++) {
+            await expect(svc.verifyTwoFactor({ code: '123456' }, { cookie: `better-auth.two_factor=${twoFactorIdentifier}; junk${i}=${i}` }, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        }
+    });
+});
+describe('IdentityService - rate limiting on secret-guessing routes (ABC-208 finding #6)', () => {
+    it('rejects changePassword with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('change-password:anonymous', { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.changePassword({ currentPassword: 'currentpw1', newPassword: 'newpassword1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+    it('rejects verifyEmail with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('verify-email:203.0.113.5', { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.verifyEmail({ token: 'sometoken' }, { 'x-real-ip': '203.0.113.5' })).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+    it('buckets unauthenticated verifyEmail callers separately, so one cannot stall the rest', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('verify-email:203.0.113.6', { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        // Verification links are followed without a session. A shared bucket would let the
+        // exhausted caller above block every other sign-up in flight.
+        await expect(svc.verifyEmail({ token: 'sometoken' }, { 'x-real-ip': '203.0.113.7' })).rejects.not.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+    it('rejects enableTwoFactor with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('enable2fa:anonymous', { limit: 5, windowMs: 5 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.enableTwoFactor({ password: 'currentpw1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+    it('rejects disableTwoFactor with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('disable2fa:anonymous', { limit: 5, windowMs: 5 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.disableTwoFactor({ password: 'currentpw1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+});
+describe('IdentityService - fail-closed limiter policy for credential-guessing keys', () => {
+    // A spy limiter that always denies: consume is the first await on each of these
+    // paths, so the 429 short-circuits before any auth/DB work and we can assert the
+    // exact options the service passed for the key. (The RedisRateLimiter's own
+    // fail-closed behaviour is covered in the kernel redis-rate-limiter suite.)
+    function denyingLimiter() {
+        const consume = vi.fn(async () => ({ allowed: false, retryAfterMs: 1 }));
+        return { limiter: mock({ consume }), consume };
+    }
+    it('passes onUnavailable: deny on the login: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.login({ email: 'User@X.dev', password: 'password123' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('login:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('passes onUnavailable: deny on the verify2fa: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.verifyTwoFactor({ code: '123456' }, {}, new Headers())).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(consume).toHaveBeenCalledWith(expect.stringMatching(/^verify2fa:/), expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('passes onUnavailable: deny on the pwreset: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.resetPassword({ email: 'user@x.dev', otp: '123456', newPassword: 'newpassword1' })).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('pwreset:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('passes onUnavailable: deny on the pwreset-verify: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.verifyPasswordResetOtp({ email: 'user@x.dev', otp: '123456' })).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('pwreset-verify:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('throttles requestPasswordReset on the pwreset-req: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        // The throttle is asserted before the anti-enumeration try/catch, so a denied
+        // request key surfaces as a 429 (only the better-auth call is swallowed).
+        await expect(svc.requestPasswordReset({ email: 'User@X.dev' })).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(consume).toHaveBeenCalledWith('pwreset-req:user@x.dev', expect.any(Object));
+    });
+});
+//# sourceMappingURL=identity.rate-limit.int.test.js.map

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.rate-limit.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,eAAe,EAA+B,MAAM,uBAAuB,CAAC;AAOnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,eAAe,EAA4B,MAAM,gCAAgC,CAAC;AAE3F,MAAM,oBAAoB,GAA0B;IAClD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;CACrD,CAAC;AAEF,SAAS,oBAAoB,CAC3B,IAEC;IAED,OAAO,IAAI,eAAe,CAAC;QACzB,gBAAgB,EAAE,oBAAoB;QACtC,kBAAkB,EAAE,IAAI,CAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QAChF,GAAG,IAAI;QACP,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,kBAAkB,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,8DAA8D;AAC9D,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAyC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;AAE9B,IAAI,EAAU,CAAC;AACf,IAAI,OAAuC,CAAC;AAC5C,IAAI,KAAgB,CAAC;AACrB,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAE7D,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACrB,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAChB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,aAAa,CAAC;QAC5B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,wFAAwF;QACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC;YAC/B,OAAO;YACP,MAAM;YACN,OAAO;YACP,cAAc,EAAE,oBAAoB,CAAC;gBACnC,YAAY,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE;aAC9E,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CACV;YACE,KAAK;YACL,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,EACD,EAAE,CACH,CACF,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,wFAAwF;QACxF,yEAAyE;QACzE,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CACV;YACE,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,EACD,EAAE,CACH,CACF,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,mBAAmB,EAAE,EAAE;gBACxD,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,yFAAyF;QACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,EAAE,MAAM,EAAE,0BAA0B,mBAAmB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAC1E,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,cAAc,CAChB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,EAC9D,EAAE,EACF,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CACxE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,mFAAmF;QACnF,8DAA8D;QAC9D,MAAM,MAAM,CACV,GAAG,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CACxE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,gFAAgF;IAChF,iFAAiF;IACjF,4EAA4E;IAC5E,4EAA4E;IAC5E,SAAS,cAAc;QACrB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,kBAAkB,EAClB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7F,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EACpC,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CACvF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,oBAAoB,EACpB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,2BAA2B,EAC3B,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACpF,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.registration-gates.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity.registration-gates.int.test.d.ts.map

package/dist/pam/identity/__tests__/identity.registration-gates.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.registration-gates.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.registration-gates.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/identity.registration-gates.int.test.js

@@ -0,0 +1,94 @@
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { RedisRateLimiter } from '@openora/core/server';
+import { createTestDb, createTestRedis } from '@openora/core/testing';
+import { definePlatformConfig } from '@openora/core/contracts';
+import { makeIdentityReader, mock, makeEventBus } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { IdentityService } from '../service/identity.service.js';
+const testTemplateRenderer = {
+    render: () => ({ subject: 'subject', body: 'body' }),
+};
+vi.mock('@openora/core/server', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        createAuth: vi.fn(() => ({
+            api: { getSession: vi.fn().mockResolvedValue(null), signUpEmail: vi.fn() },
+        })),
+    };
+});
+const events = makeEventBus();
+const registrationConfig = definePlatformConfig({
+    registration: { termsVersion: 'test-v1', webUrl: 'https://app.example.test' },
+});
+let db;
+let drizzle;
+let redis;
+const validInput = () => ({
+    email: `gate-${Math.random().toString(36).slice(2)}@x.dev`,
+    password: 'password123',
+    username: 'alpha',
+    acceptedTerms: true,
+    acceptedAge: true,
+});
+function makeService(overrides = {}) {
+    return new IdentityService({
+        drizzle,
+        events,
+        templateRenderer: testTemplateRenderer,
+        identityReader: makeIdentityReader(),
+        platformConfig: registrationConfig,
+        playerProvisioning: mock({
+            createForRegistration: vi.fn().mockResolvedValue({ created: true }),
+        }),
+        ...overrides,
+    });
+}
+beforeAll(async () => {
+    db = await createTestDb([migrate]);
+    drizzle = db.drizzle;
+    redis = await createTestRedis();
+});
+afterAll(async () => {
+    await db.drop();
+    await redis.quit();
+});
+beforeEach(async () => {
+    await redis.flush();
+});
+describe('IdentityService.register - availability gates', () => {
+    it('rejects registration when the operator has not configured it', async () => {
+        const svc = makeService({ platformConfig: undefined });
+        await expect(svc.register(validInput(), {})).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+    });
+    it('rejects registration when no player provisioning port is bound', async () => {
+        const svc = makeService({ playerProvisioning: undefined });
+        await expect(svc.register(validInput(), {})).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+    });
+    it('rejects registration from a geo-blocked address', async () => {
+        const checkRegistration = vi.fn().mockResolvedValue({ allowed: false });
+        const svc = makeService({ geoCheck: mock({ checkRegistration }) });
+        await expect(svc.register(validInput(), { 'x-real-ip': '203.0.113.7' })).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        expect(checkRegistration).toHaveBeenCalledWith('203.0.113.7');
+    });
+    it('throttles registrations coming from one address, across different emails', async () => {
+        const svc = makeService({ limiter: new RedisRateLimiter(redis.client) });
+        const headers = { 'x-real-ip': '203.0.113.9' };
+        // Each call uses a fresh email, so only the per-IP bucket can reject them. The
+        // early attempts fail downstream on the stubbed auth call - that is fine, the
+        // limiter is consumed before that happens.
+        for (let i = 0; i < 5; i++) {
+            await svc.register(validInput(), headers).catch(() => undefined);
+        }
+        await expect(svc.register(validInput(), headers)).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+    });
+});
+//# sourceMappingURL=identity.registration-gates.int.test.js.map

package/dist/pam/identity/__tests__/identity.registration-gates.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.registration-gates.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.registration-gates.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,eAAe,EAA+B,MAAM,uBAAuB,CAAC;AAMnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,eAAe,EAA4B,MAAM,gCAAgC,CAAC;AAE3F,MAAM,oBAAoB,GAA0B;IAClD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;CACrD,CAAC;AAEF,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAyC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;AAC9B,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;IAC9C,YAAY,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE;CAC9E,CAAC,CAAC;AAEH,IAAI,EAAU,CAAC;AACf,IAAI,OAAuC,CAAC;AAC5C,IAAI,KAAgB,CAAC;AAErB,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC;IACxB,KAAK,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;IAC1D,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,OAAO;IACjB,aAAa,EAAE,IAAa;IAC5B,WAAW,EAAE,IAAa;CAC3B,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,YAA0C,EAAE;IAC/D,OAAO,IAAI,eAAe,CAAC;QACzB,OAAO;QACP,MAAM;QACN,gBAAgB,EAAE,oBAAoB;QACtC,cAAc,EAAE,kBAAkB,EAAE;QACpC,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,IAAI,CAAqB;YAC3C,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACpE,CAAC;QACF,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACrB,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAChB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACjE,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3D,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACjE,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAmB,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;QAErF,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7F,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;QAE/C,+EAA+E;QAC/E,8EAA8E;QAC9E,2CAA2C;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACtE,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.service.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity.service.int.test.d.ts.map

package/dist/pam/identity/__tests__/identity.service.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.service.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.service.int.test.ts"],"names":[],"mappings":""}