@openora/core 0.4.0

package/dist/pam/identity/__tests__/admin-user-directory.test.js

@@ -0,0 +1,93 @@
+import { describe, it, expect, vi } from 'vitest';
+import { mock, mockDb } from '../../../testing/mock.js';
+import { DrizzleAdminUserDirectory } from '../admin-user-directory.js';
+function makeDir(existing) {
+    const row = {
+        id: 'u1',
+        email: 'a@b.c',
+        name: 'A',
+        role: 'player',
+        createdAt: new Date(0),
+        isActive: existing.isActive,
+    };
+    const db = {
+        select: () => ({ from: () => ({ where: async () => [row] }) }),
+        update: () => ({
+            set: (s) => ({
+                where: () => ({ returning: async () => [{ ...row, ...s }] }),
+            }),
+        }),
+    };
+    const emit = vi.fn();
+    const dir = new DrizzleAdminUserDirectory(mockDb(db), mock({ emit }));
+    return { dir, emit };
+}
+describe('DrizzleAdminUserDirectory.update active-status events', () => {
+    it('emits identity.user.deactivated (with actor) when isActive flips true -> false', async () => {
+        const { dir, emit } = makeDir({ isActive: true });
+        await dir.update('u1', { isActive: false }, 'admin-1');
+        expect(emit).toHaveBeenCalledWith('identity.user.deactivated', {
+            userId: 'u1',
+            actorId: 'admin-1',
+        });
+    });
+    it('emits identity.user.reactivated (with actor) when isActive flips false -> true', async () => {
+        const { dir, emit } = makeDir({ isActive: false });
+        await dir.update('u1', { isActive: true }, 'admin-1');
+        expect(emit).toHaveBeenCalledWith('identity.user.reactivated', {
+            userId: 'u1',
+            actorId: 'admin-1',
+        });
+    });
+    it('does not emit when isActive is unchanged', async () => {
+        const { dir, emit } = makeDir({ isActive: true });
+        await dir.update('u1', { isActive: true }, 'admin-1');
+        expect(emit).not.toHaveBeenCalled();
+    });
+    it('does not emit on a role-only update', async () => {
+        const { dir, emit } = makeDir({ isActive: true });
+        await dir.update('u1', { role: 'admin' }, 'admin-1');
+        expect(emit).not.toHaveBeenCalled();
+    });
+});
+function makeDirWithSelect(rows) {
+    const queue = [...rows];
+    const db = {
+        select: () => ({
+            from: () => ({
+                innerJoin: () => ({ where: async () => queue.shift() ?? [] }),
+                where: () => ({ limit: async () => queue.shift() ?? [] }),
+            }),
+        }),
+    };
+    return new DrizzleAdminUserDirectory(mockDb(db), mock({ emit: vi.fn() }));
+}
+describe('DrizzleAdminUserDirectory.lookupPlayers', () => {
+    it('returns an empty array for no ids without querying', async () => {
+        const dir = makeDirWithSelect([]);
+        expect(await dir.lookupPlayers([])).toEqual([]);
+    });
+    it('includes email joined from the user table and coerces unknown kyc to null', async () => {
+        const dir = makeDirWithSelect([
+            [{ userId: 'u1', username: 'alice', kycStatus: 'bogus', email: 'alice@example.com' }],
+        ]);
+        const [summary] = await dir.lookupPlayers(['u1']);
+        expect(summary).toEqual({
+            userId: 'u1',
+            username: 'alice',
+            email: 'alice@example.com',
+            kycStatus: null,
+        });
+    });
+});
+describe('DrizzleAdminUserDirectory.findPlayerIds', () => {
+    it('unions email + displayName matches into a deduped id set', async () => {
+        const dir = makeDirWithSelect([
+            [{ id: 'u1' }, { id: 'u2' }],
+            [{ userId: 'u2' }, { userId: 'u3' }],
+        ]);
+        const ids = await dir.findPlayerIds('a');
+        expect([...ids].sort()).toEqual(['u1', 'u2', 'u3']);
+    });
+});
+//# sourceMappingURL=admin-user-directory.test.js.map

package/dist/pam/identity/__tests__/admin-user-directory.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-directory.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/admin-user-directory.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,SAAS,OAAO,CAAC,QAA+B;IAC9C,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,GAAG;QACT,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;IACF,MAAM,EAAE,GAAG;QACT,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACb,GAAG,EAAE,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;gBACpC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;aAC7D,CAAC;SACH,CAAC;KACH,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,2BAA2B,EAAE;YAC7D,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,2BAA2B,EAAE;YAC7D,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,IAAiC;IAC1D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG;QACT,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACb,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACX,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7D,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;aAC1D,CAAC;SACH,CAAC;KACH,CAAC;IACF,OAAO,IAAI,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAW,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,GAAG,GAAG,iBAAiB,CAAC;YAC5B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;SACtF,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,mBAAmB;YAC1B,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,iBAAiB,CAAC;YAC5B,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.rate-limit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity.rate-limit.test.d.ts.map

package/dist/pam/identity/__tests__/identity.rate-limit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.rate-limit.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/identity.rate-limit.test.js

@@ -0,0 +1,127 @@
+import { describe, it, expect, vi } from 'vitest';
+import { InProcessRateLimiter } from '@openora/core/server';
+import { mock, mockDb } from '../../../testing/mock.js';
+import { IdentityService } from '../service/identity.service.js';
+// Keep the real @openora/core/server (so assertRateLimit + InProcessRateLimiter
+// are real); only stub createAuth so the constructor doesn't touch a real DB.
+vi.mock('@openora/core/server', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        createAuth: vi.fn(() => ({
+            api: { getSession: vi.fn().mockResolvedValue(null), signUpEmail: vi.fn() },
+        })),
+    };
+});
+const drizzle = mockDb({});
+const events = mock({ emit: vi.fn(), on: vi.fn() });
+describe('IdentityService - rate limiting', () => {
+    it('rejects register with a 429 once the per-email limit is exhausted', async () => {
+        const email = 'abuse@x.dev';
+        const limiter = new InProcessRateLimiter();
+        // Pre-exhaust the register bucket (5 per 15min) so the service's own consume is denied.
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume(`register:${email}`, { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = new IdentityService({ drizzle, events, limiter });
+        await expect(svc.register({ email, password: 'password123', name: 'A' }, {}, new Headers())).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+            data: { retryAfterMs: expect.any(Number) },
+        });
+        limiter.close();
+    });
+    it('allows register when no limiter is bound (test/no-auth edition)', async () => {
+        const svc = new IdentityService({ drizzle, events });
+        // signUpEmail is a bare vi.fn returning undefined; a throw here would be a 429, not the
+        // downstream .json() failure we expect, so assert we got past the guard.
+        await expect(svc.register({ email: 'ok@x.dev', password: 'password123', name: 'A' }, {}, new Headers())).rejects.not.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+});
+describe('IdentityService - verify2fa rate-limit key stability (ABC-208 finding #3)', () => {
+    it('keys on the two_factor cookie VALUE, not the raw Cookie header, so junk cookie pairs cannot churn the bucket', async () => {
+        const limiter = new InProcessRateLimiter();
+        const twoFactorIdentifier = 'pending-2fa-identifier-abc';
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume(`verify2fa:${twoFactorIdentifier}`, {
+                limit: 5,
+                windowMs: 5 * 60 * 1000,
+            });
+        }
+        const svc = new IdentityService({ drizzle, events, limiter });
+        // Same two_factor cookie + different junk pairs must still hit the one exhausted bucket.
+        for (let i = 0; i < 3; i++) {
+            await expect(svc.verifyTwoFactor({ code: '123456' }, { cookie: `better-auth.two_factor=${twoFactorIdentifier}; junk${i}=${i}` }, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        }
+        limiter.close();
+    });
+});
+describe('IdentityService - rate limiting on secret-guessing routes (ABC-208 finding #6)', () => {
+    it('rejects changePassword with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = new InProcessRateLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('change-password:anonymous', { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = new IdentityService({ drizzle, events, limiter });
+        await expect(svc.changePassword({ currentPassword: 'currentpw1', newPassword: 'newpassword1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        limiter.close();
+    });
+    it('rejects verifyEmail with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = new InProcessRateLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('verify-email:anonymous', { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = new IdentityService({ drizzle, events, limiter });
+        await expect(svc.verifyEmail({ token: 'sometoken' }, {})).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        limiter.close();
+    });
+    it('rejects enableTwoFactor with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = new InProcessRateLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('enable2fa:anonymous', { limit: 5, windowMs: 5 * 60 * 1000 });
+        }
+        const svc = new IdentityService({ drizzle, events, limiter });
+        await expect(svc.enableTwoFactor({ password: 'currentpw1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        limiter.close();
+    });
+    it('rejects disableTwoFactor with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = new InProcessRateLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('disable2fa:anonymous', { limit: 5, windowMs: 5 * 60 * 1000 });
+        }
+        const svc = new IdentityService({ drizzle, events, limiter });
+        await expect(svc.disableTwoFactor({ password: 'currentpw1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        limiter.close();
+    });
+});
+describe('IdentityService - fail-closed limiter policy for credential-guessing keys', () => {
+    // A spy limiter that always denies: consume is the first await on each of these
+    // paths, so the 429 short-circuits before any auth/DB work and we can assert the
+    // exact options the service passed for the key.
+    function denyingLimiter() {
+        const consume = vi.fn(async () => ({ allowed: false, retryAfterMs: 1 }));
+        return { limiter: mock({ consume }), consume };
+    }
+    it('passes onUnavailable: deny on the login: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = new IdentityService({ drizzle, events, limiter });
+        await expect(svc.login({ email: 'User@X.dev', password: 'password123' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('login:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('passes onUnavailable: deny on the verify2fa: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = new IdentityService({ drizzle, events, limiter });
+        await expect(svc.verifyTwoFactor({ code: '123456' }, {}, new Headers())).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(consume).toHaveBeenCalledWith(expect.stringMatching(/^verify2fa:/), expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('passes onUnavailable: deny on the pwreset: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = new IdentityService({ drizzle, events, limiter });
+        await expect(svc.resetPassword({ token: 'reset-tok', newPassword: 'newpassword1' })).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('pwreset:reset-tok', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+});
+//# sourceMappingURL=identity.rate-limit.test.js.map

package/dist/pam/identity/__tests__/identity.rate-limit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.rate-limit.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAiB,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,gFAAgF;AAChF,8EAA8E;AAC9E,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAyC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3B,MAAM,MAAM,GAAG,IAAI,CAAW,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAE9D,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,aAAa,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,wFAAwF;QACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SAC3C,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,wFAAwF;QACxF,yEAAyE;QACzE,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC3F,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,mBAAmB,EAAE,EAAE;gBACxD,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,yFAAyF;QACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,EAAE,MAAM,EAAE,0BAA0B,mBAAmB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAC1E,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,MAAM,CACV,GAAG,CAAC,cAAc,CAChB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,EAC9D,EAAE,EACF,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC9E,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,MAAM,CACV,GAAG,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,gFAAgF;IAChF,iFAAiF;IACjF,gDAAgD;IAChD,SAAS,cAAc;QACrB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,kBAAkB,EAClB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7F,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EACpC,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,MAAM,CACV,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CACvE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,mBAAmB,EACnB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity.service.test.d.ts.map

package/dist/pam/identity/__tests__/identity.service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.service.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.service.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/identity.service.test.js

@@ -0,0 +1,292 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { IdentityService } from '../service/identity.service.js';
+import { UnsupportedLanguageError } from '../../shared/language.js';
+import { ORPCError } from '@orpc/server';
+const { signInEmailMock, getSessionMock, updateUserMock } = vi.hoisted(() => ({
+    signInEmailMock: vi.fn(),
+    getSessionMock: vi.fn().mockResolvedValue(null),
+    updateUserMock: vi.fn(),
+}));
+vi.mock('@openora/core/server', async (importOriginal) => ({
+    ...(await importOriginal()),
+    createAuth: vi.fn(() => ({
+        api: {
+            getSession: getSessionMock,
+            signUpEmail: vi.fn(),
+            signInEmail: signInEmailMock,
+            signOut: vi.fn(),
+            updateUser: updateUserMock,
+        },
+    })),
+}));
+function makeDrizzle({ selectRows = [], updateReturning = [] } = {}) {
+    const selectQueue = [...selectRows];
+    const returningQueue = [...updateReturning];
+    const update = vi.fn(() => ({
+        set: () => ({
+            where: () => Object.assign(Promise.resolve(undefined), {
+                returning: () => Promise.resolve(returningQueue.shift() ?? []),
+            }),
+        }),
+    }));
+    const select = vi.fn(() => ({
+        from: () => ({ where: () => ({ limit: () => Promise.resolve(selectQueue.shift() ?? []) }) }),
+    }));
+    return { db: { select, update }, update, select };
+}
+function makeEvents() {
+    return { emit: vi.fn(), on: vi.fn() };
+}
+function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+const betterAuthUser = {
+    id: 'u1',
+    email: 'a@b.dev',
+    name: 'A',
+    emailVerified: true,
+    createdAt: '2020-01-01T00:00:00.000Z',
+    updatedAt: '2020-01-01T00:00:00.000Z',
+};
+beforeEach(() => {
+    vi.clearAllMocks();
+    getSessionMock.mockResolvedValue(null);
+});
+describe('IdentityService - SendEmailPort seam', () => {
+    it('constructs without a SendEmailPort (email delivery silently skipped)', () => {
+        const svc = new IdentityService({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        expect(svc).toBeInstanceOf(IdentityService);
+    });
+    it('constructs with a stub SendEmailPort and exposes it for use', () => {
+        const stub = { send: vi.fn().mockResolvedValue(undefined) };
+        const svc = new IdentityService({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+            email: stub,
+        });
+        expect(svc).toBeInstanceOf(IdentityService);
+    });
+    it('me returns null when no session exists', async () => {
+        const svc = new IdentityService({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        const result = await svc.me({});
+        expect(result).toBeNull();
+    });
+});
+describe('IdentityService - login lockout', () => {
+    it('locks the account once failed attempts reach the threshold and emits lockout.triggered', async () => {
+        const drizzle = makeDrizzle({
+            selectRows: [[{ id: 'u1', failedLoginAttempts: 4, lockoutUntil: null }]],
+            updateReturning: [[{ failedLoginAttempts: 5 }]],
+        });
+        const events = makeEvents();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        await expect(svc.login({ email: 'A@B.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
+        expect(events.emit).toHaveBeenCalledWith('identity.user.lockout.triggered', expect.objectContaining({ userId: 'u1', email: 'a@b.dev' }));
+    });
+    it('emits login.failed (not lockout) while still below the threshold', async () => {
+        const drizzle = makeDrizzle({
+            selectRows: [[{ id: 'u1', failedLoginAttempts: 0, lockoutUntil: null }]],
+            updateReturning: [[{ failedLoginAttempts: 1 }]],
+        });
+        const events = makeEvents();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        await expect(svc.login({ email: 'a@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login.failed', expect.objectContaining({ email: 'a@b.dev', reason: 'invalid_credentials' }));
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.lockout.triggered', expect.anything());
+    });
+    it('rejects a currently-locked account before attempting sign-in', async () => {
+        const future = new Date(Date.now() + 60_000);
+        const drizzle = makeDrizzle({
+            selectRows: [[{ id: 'u1', failedLoginAttempts: 5, lockoutUntil: future }]],
+        });
+        const svc = new IdentityService({ drizzle: drizzle, events: makeEvents() });
+        const promise = svc.login({ email: 'a@b.dev', password: 'whatever1' }, {}, new Headers());
+        await expect(promise).rejects.toThrow(ORPCError);
+        await expect(promise).rejects.toMatchObject({
+            code: 'UNAUTHORIZED',
+            message: 'Account is temporarily locked. Please try again later.',
+            data: {
+                code: 'ACCOUNT_LOCKED',
+                lockoutUntil: future.toISOString(),
+            },
+        });
+        expect(signInEmailMock).not.toHaveBeenCalled();
+    });
+    it('clears the counter and emits login on success', async () => {
+        const drizzle = makeDrizzle({
+            selectRows: [[{ id: 'u1', failedLoginAttempts: 2, lockoutUntil: null }]],
+        });
+        const events = makeEvents();
+        signInEmailMock.mockResolvedValue(jsonResponse({ user: betterAuthUser, token: 'tok', session: { expiresAt: '2020-02-01T00:00:00.000Z' } }, 200));
+        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        const result = await svc.login({ email: 'a@b.dev', password: 'rightpass1' }, {}, new Headers());
+        expect(result).toMatchObject({ session: { token: 'tok' } });
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login', expect.objectContaining({ userId: 'u1' }));
+        expect(drizzle.update).toHaveBeenCalled();
+    });
+    it('bypasses lockout for admins if configured with bypassForAdmins: true', async () => {
+        const drizzle = makeDrizzle({
+            selectRows: [[{ id: 'u1', failedLoginAttempts: 4, lockoutUntil: null, role: 'admin' }]],
+        });
+        const events = makeEvents();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = new IdentityService({
+            drizzle: drizzle,
+            events: events,
+            options: {
+                lockout: {
+                    enabled: true,
+                    bypassForAdmins: true,
+                },
+            },
+        });
+        await expect(svc.login({ email: 'admin@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
+        // It should not increment the failed attempts or trigger lockout
+        expect(drizzle.update).not.toHaveBeenCalled();
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login.failed', expect.objectContaining({ email: 'admin@b.dev' }));
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.lockout.triggered', expect.anything());
+    });
+    it('does not bypass lockout for other backoffice roles if bypassForAdmins is true', async () => {
+        const drizzle = makeDrizzle({
+            selectRows: [
+                [{ id: 'u1', failedLoginAttempts: 4, lockoutUntil: null, role: 'support' }],
+                [{ failedLoginAttempts: 5 }],
+            ],
+        });
+        const events = makeEvents();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = new IdentityService({
+            drizzle: drizzle,
+            events: events,
+            options: {
+                lockout: {
+                    enabled: true,
+                    bypassForAdmins: true,
+                    maxAttempts: 5,
+                },
+            },
+        });
+        await expect(svc.login({ email: 'support@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
+        // It should increment the failed attempts and trigger lockout
+        expect(drizzle.update).toHaveBeenCalled();
+        expect(events.emit).toHaveBeenCalledWith('identity.user.lockout.triggered', expect.objectContaining({ userId: 'u1', email: 'support@b.dev' }));
+    });
+});
+describe('IdentityService - RG login gate', () => {
+    it('blocks a self-excluded login AFTER credentials verify and emits rg.exclusion.login_blocked', async () => {
+        const drizzle = makeDrizzle({
+            selectRows: [
+                [
+                    {
+                        id: 'u1',
+                        failedLoginAttempts: 0,
+                        lockoutUntil: null,
+                        rgBlocked: true,
+                        rgBlockedUntil: null,
+                    },
+                ],
+            ],
+        });
+        const events = makeEvents();
+        // Valid credentials (200) - the gate must still block.
+        signInEmailMock.mockResolvedValue(jsonResponse({ user: betterAuthUser, token: 'tok', session: {} }, 200));
+        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        await expect(svc.login({ email: 'a@b.dev', password: 'rightpass1' }, {}, new Headers())).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect(signInEmailMock).toHaveBeenCalled();
+        expect(events.emit).toHaveBeenCalledWith('rg.exclusion.login_blocked', expect.objectContaining({ userId: 'u1' }));
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.login', expect.anything());
+        expect(events.emit).not.toHaveBeenCalledWith('identity.user.login.failed', expect.anything());
+        // The just-issued session is revoked.
+        expect(drizzle.update).toHaveBeenCalled();
+    });
+    it('allows login once a lapsed cooling-off block has elapsed', async () => {
+        const past = new Date(Date.now() - 60_000);
+        const drizzle = makeDrizzle({
+            selectRows: [
+                [
+                    {
+                        id: 'u1',
+                        failedLoginAttempts: 0,
+                        lockoutUntil: null,
+                        rgBlocked: true,
+                        rgBlockedUntil: past,
+                    },
+                ],
+            ],
+        });
+        const events = makeEvents();
+        signInEmailMock.mockResolvedValue(jsonResponse({ user: betterAuthUser, token: 'tok', session: {} }, 200));
+        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        const result = await svc.login({ email: 'a@b.dev', password: 'rightpass1' }, {}, new Headers());
+        expect(result).toMatchObject({ session: { token: 'tok' } });
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login', expect.objectContaining({ userId: 'u1' }));
+        expect(events.emit).not.toHaveBeenCalledWith('rg.exclusion.login_blocked', expect.anything());
+    });
+});
+describe('IdentityService - unlockUser', () => {
+    it('clears the lockout and emits unlocked with the prior state', async () => {
+        const drizzle = makeDrizzle({
+            selectRows: [
+                [
+                    {
+                        id: 'u1',
+                        email: 'a@b.dev',
+                        failedLoginAttempts: 5,
+                        lockoutUntil: new Date('2020-01-01T00:00:00.000Z'),
+                    },
+                ],
+            ],
+        });
+        const events = makeEvents();
+        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        const res = await svc.unlockUser('u1', 'admin1');
+        expect(res).toEqual({ success: true });
+        expect(drizzle.update).toHaveBeenCalled();
+        expect(events.emit).toHaveBeenCalledWith('identity.user.unlocked', expect.objectContaining({
+            userId: 'u1',
+            actorId: 'admin1',
+            previousFailedAttempts: 5,
+            previousLockoutUntil: '2020-01-01T00:00:00.000Z',
+        }));
+    });
+    it('throws when the user does not exist', async () => {
+        const drizzle = makeDrizzle({ selectRows: [[]] });
+        const svc = new IdentityService({ drizzle: drizzle, events: makeEvents() });
+        await expect(svc.unlockUser('missing', 'admin1')).rejects.toThrow();
+    });
+});
+describe('IdentityService.updateProfile language validation', () => {
+    it('rejects an unsupported language before calling updateUser', async () => {
+        const svc = new IdentityService({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+            platformConfig: { supportedLanguages: ['en', 'fr'] },
+        });
+        await expect(svc.updateProfile({ language: 'de' }, {}, new Headers())).rejects.toThrow(UnsupportedLanguageError);
+        expect(updateUserMock).not.toHaveBeenCalled();
+    });
+    it('accepts a supported language and forwards it to updateUser', async () => {
+        updateUserMock.mockResolvedValue(jsonResponse({ status: true }, 200));
+        getSessionMock.mockResolvedValueOnce({ user: { ...betterAuthUser, language: 'fr' } });
+        const svc = new IdentityService({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+            platformConfig: { supportedLanguages: ['en', 'fr'] },
+        });
+        const result = await svc.updateProfile({ language: 'fr' }, {}, new Headers());
+        expect(updateUserMock).toHaveBeenCalledWith(expect.objectContaining({ body: expect.objectContaining({ language: 'fr' }) }));
+        expect(result.user.language).toBe('fr');
+    });
+});
+//# sourceMappingURL=identity.service.test.js.map

package/dist/pam/identity/__tests__/identity.service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.service.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5E,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;IAC/C,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;CACxB,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IACzD,GAAG,CAAC,MAAM,cAAc,EAAU,CAAC;IACnC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QACvB,GAAG,EAAE;YACH,UAAU,EAAE,cAAc;YAC1B,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;YACpB,WAAW,EAAE,eAAe;YAC5B,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;YAChB,UAAU,EAAE,cAAc;SAC3B;KACF,CAAC,CAAC;CACJ,CAAC,CAAC,CAAC;AAIJ,SAAS,WAAW,CAAC,EAAE,UAAU,GAAG,EAAE,EAAE,eAAe,GAAG,EAAE,KAAkB,EAAE;IAC9E,MAAM,WAAW,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACV,KAAK,EAAE,GAAG,EAAE,CACV,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;gBACxC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;aAC/D,CAAC;SACL,CAAC;KACH,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;KAC7F,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,EAAE,EAAE,IAAI;IACR,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,GAAG;IACT,aAAa,EAAE,IAAI;IACnB,SAAS,EAAE,0BAA0B;IACrC,SAAS,EAAE,0BAA0B;CACtC,CAAC;AAEF,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;YAC9B,OAAO,EAAE,WAAW,EAAW;YAC/B,MAAM,EAAE,UAAU,EAAW;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;YAC9B,OAAO,EAAE,WAAW,EAAW;YAC/B,MAAM,EAAE,UAAU,EAAW;YAC7B,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;YAC9B,OAAO,EAAE,WAAW,EAAW;YAC/B,MAAM,EAAE,UAAU,EAAW;SAC9B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,eAAe,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,OAAgB,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC3E,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,iCAAiC,EACjC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,eAAe,EAAE,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,OAAgB,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC3E,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,4BAA4B,EAC5B,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAC7E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAC1C,iCAAiC,EACjC,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;SAC3E,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,OAAgB,EAAE,MAAM,EAAE,UAAU,EAAW,EAAE,CAAC,CAAC;QAE9F,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC1C,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,wDAAwD;YACjE,IAAI,EAAE;gBACJ,IAAI,EAAE,gBAAgB;gBACtB,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE;aACnC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;SACzE,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,eAAe,CAAC,iBAAiB,CAC/B,YAAY,CACV,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,EAAE,EAC1F,GAAG,CACJ,CACF,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,OAAgB,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QAEhG,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,qBAAqB,EACrB,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC1C,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;SACxF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;YAC9B,OAAO,EAAE,OAAgB;YACzB,MAAM,EAAE,MAAe;YACvB,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,eAAe,EAAE,IAAI;iBACtB;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEpB,iEAAiE;QACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,4BAA4B,EAC5B,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAClD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAC1C,iCAAiC,EACjC,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU,EAAE;gBACV,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC3E,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;aAC7B;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;YAC9B,OAAO,EAAE,OAAgB;YACzB,MAAM,EAAE,MAAe;YACvB,OAAO,EAAE;gBACP,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,eAAe,EAAE,IAAI;oBACrB,WAAW,EAAE,CAAC;iBACf;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACjF,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEpB,8DAA8D;QAC9D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,iCAAiC,EACjC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU,EAAE;gBACV;oBACE;wBACE,EAAE,EAAE,IAAI;wBACR,mBAAmB,EAAE,CAAC;wBACtB,YAAY,EAAE,IAAI;wBAClB,SAAS,EAAE,IAAI;wBACf,cAAc,EAAE,IAAI;qBACrB;iBACF;aACF;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,uDAAuD;QACvD,eAAe,CAAC,iBAAiB,CAC/B,YAAY,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CACvE,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,OAAgB,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC3E,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/C,MAAM,CAAC,eAAe,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,4BAA4B,EAC5B,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC1C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,qBAAqB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,4BAA4B,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9F,sCAAsC;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU,EAAE;gBACV;oBACE;wBACE,EAAE,EAAE,IAAI;wBACR,mBAAmB,EAAE,CAAC;wBACtB,YAAY,EAAE,IAAI;wBAClB,SAAS,EAAE,IAAI;wBACf,cAAc,EAAE,IAAI;qBACrB;iBACF;aACF;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,eAAe,CAAC,iBAAiB,CAC/B,YAAY,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CACvE,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,OAAgB,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QAEhG,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,qBAAqB,EACrB,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC1C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,4BAA4B,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,UAAU,EAAE;gBACV;oBACE;wBACE,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,SAAS;wBAChB,mBAAmB,EAAE,CAAC;wBACtB,YAAY,EAAE,IAAI,IAAI,CAAC,0BAA0B,CAAC;qBACnD;iBACF;aACF;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,OAAgB,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC;QAExF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,wBAAwB,EACxB,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,QAAQ;YACjB,sBAAsB,EAAE,CAAC;YACzB,oBAAoB,EAAE,0BAA0B;SACjD,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,OAAgB,EAAE,MAAM,EAAE,UAAU,EAAW,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;YAC9B,OAAO,EAAE,WAAW,EAAW;YAC/B,MAAM,EAAE,UAAU,EAAW;YAC7B,cAAc,EAAE,EAAE,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAW;SAC9D,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpF,wBAAwB,CACzB,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,cAAc,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACtE,cAAc,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;YAC9B,OAAO,EAAE,WAAW,EAAW;YAC/B,MAAM,EAAE,UAAU,EAAW;YAC7B,cAAc,EAAE,EAAE,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAW;SAC9D,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QAE9E,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CACzC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAC/E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/login-enforcement.service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=login-enforcement.service.test.d.ts.map

package/dist/pam/identity/__tests__/login-enforcement.service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-enforcement.service.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/login-enforcement.service.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/login-enforcement.service.test.js

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi } from 'vitest';
+import { mock, mockDb } from '../../../testing/mock.js';
+import { LoginEnforcementService } from '../service/login-enforcement.service.js';
+function captureDb() {
+    const sets = [];
+    const db = {
+        update: () => ({
+            set: (s) => {
+                sets.push(s);
+                return { where: () => Promise.resolve(undefined) };
+            },
+        }),
+    };
+    return { drizzle: mockDb(db), sets };
+}
+function makeSessions() {
+    return mock({ revokeAllSessions: vi.fn().mockResolvedValue({ success: true }) });
+}
+describe('LoginEnforcementService', () => {
+    it('block sets the RG columns and revokes all sessions', async () => {
+        const { drizzle, sets } = captureDb();
+        const sessions = makeSessions();
+        const until = new Date('2026-08-01T00:00:00.000Z');
+        await new LoginEnforcementService(drizzle, sessions).block('u1', { until });
+        expect(sets[0]).toEqual({ rgBlocked: true, rgBlockedUntil: until });
+        expect(sessions.revokeAllSessions).toHaveBeenCalledWith('u1');
+    });
+    it('block with until:null sets an indefinite block', async () => {
+        const { drizzle, sets } = captureDb();
+        await new LoginEnforcementService(drizzle, makeSessions()).block('u1', { until: null });
+        expect(sets[0]).toEqual({ rgBlocked: true, rgBlockedUntil: null });
+    });
+    it('unblock clears the RG columns', async () => {
+        const { drizzle, sets } = captureDb();
+        const sessions = makeSessions();
+        await new LoginEnforcementService(drizzle, sessions).unblock('u1');
+        expect(sets[0]).toEqual({ rgBlocked: false, rgBlockedUntil: null });
+        expect(sessions.revokeAllSessions).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=login-enforcement.service.test.js.map

package/dist/pam/identity/__tests__/login-enforcement.service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-enforcement.service.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/login-enforcement.service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,SAAS,SAAS;IAChB,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG;QACT,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACb,GAAG,EAAE,CAAC,CAAU,EAAE,EAAE;gBAClB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,CAAC;SACF,CAAC;KACH,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAmB,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,CAAiB,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}