@openora/core 0.4.1-canary.113 → 0.4.1-canary.115

package/dist/pam/identity/__tests__/device-fingerprint.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-fingerprint.test.d.ts.map

package/dist/pam/identity/__tests__/device-fingerprint.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/device-fingerprint.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/device-fingerprint.test.js

@@ -0,0 +1,105 @@
+import { describe, it, expect } from 'vitest';
+import { describeDevice, deviceHash, isSameDevice, isSuspiciousIpChange, normalizeUserAgent, trustedDeviceExpiry, } from '../service/device-fingerprint.service.js';
+const CHROME_MAC = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.86 Safari/537.36';
+const CHROME_MAC_NEXT_BUILD = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36';
+const CHROME_MAC_NEXT_MAJOR = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.83 Safari/537.36';
+const FIREFOX_WINDOWS = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0';
+describe('normalizeUserAgent', () => {
+    it('keeps the major version and drops the rest', () => {
+        expect(normalizeUserAgent('Chrome/131.0.6778.86')).toBe('chrome/131');
+    });
+    it('maps a missing user agent to an empty fingerprint', () => {
+        expect(normalizeUserAgent(null)).toBe('');
+        expect(normalizeUserAgent(undefined)).toBe('');
+    });
+});
+describe('isSameDevice', () => {
+    it('survives a patch-level browser auto-update', () => {
+        expect(isSameDevice(CHROME_MAC, CHROME_MAC_NEXT_BUILD)).toBe(true);
+    });
+    it('treats a different browser as a different device', () => {
+        expect(isSameDevice(CHROME_MAC, FIREFOX_WINDOWS)).toBe(false);
+    });
+    it('treats a major-version jump as a different device', () => {
+        expect(isSameDevice(CHROME_MAC, CHROME_MAC_NEXT_MAJOR)).toBe(false);
+    });
+    it('matches two sessions that both carry no user agent', () => {
+        expect(isSameDevice(null, null)).toBe(true);
+    });
+});
+describe('deviceHash', () => {
+    it('is stable across a patch-level update and differs across browsers', () => {
+        expect(deviceHash(CHROME_MAC)).toBe(deviceHash(CHROME_MAC_NEXT_BUILD));
+        expect(deviceHash(CHROME_MAC)).not.toBe(deviceHash(FIREFOX_WINDOWS));
+    });
+});
+describe('describeDevice', () => {
+    it('renders browser and operating system', () => {
+        expect(describeDevice(CHROME_MAC)).toEqual({
+            label: 'Chrome on macOS',
+            browser: 'Chrome',
+            os: 'macOS',
+        });
+        expect(describeDevice(FIREFOX_WINDOWS)).toEqual({
+            label: 'Firefox on Windows',
+            browser: 'Firefox',
+            os: 'Windows',
+        });
+    });
+    it('does not report Chrome for an Edge user agent', () => {
+        const edge = `${CHROME_MAC} Edg/131.0.2903.86`;
+        expect(describeDevice(edge).browser).toBe('Edge');
+    });
+    it('falls back to a placeholder when nothing is recognisable', () => {
+        expect(describeDevice(null)).toEqual({ label: 'Unknown device', browser: null, os: null });
+        expect(describeDevice('curl/8.4.0')).toEqual({
+            label: 'Unknown device',
+            browser: null,
+            os: null,
+        });
+    });
+});
+describe('isSuspiciousIpChange', () => {
+    const base = { sessionIp: '10.0.0.1', requestIp: '10.0.0.2' };
+    it('ignores every change while the policy is off', () => {
+        expect(isSuspiciousIpChange({ ...base, policy: 'off' })).toBe(false);
+    });
+    it('flags any change under the any policy', () => {
+        expect(isSuspiciousIpChange({ ...base, policy: 'any' })).toBe(true);
+    });
+    it('ignores an unchanged address under every policy', () => {
+        expect(isSuspiciousIpChange({ policy: 'any', sessionIp: '10.0.0.1', requestIp: '10.0.0.1' })).toBe(false);
+    });
+    it('flags a country hop and tolerates a same-country hop', () => {
+        expect(isSuspiciousIpChange({
+            ...base,
+            policy: 'country',
+            sessionCountry: 'PL',
+            requestCountry: 'RU',
+        })).toBe(true);
+        expect(isSuspiciousIpChange({
+            ...base,
+            policy: 'country',
+            sessionCountry: 'PL',
+            requestCountry: 'pl',
+        })).toBe(false);
+    });
+    it('does not end a session when the country cannot be resolved', () => {
+        expect(isSuspiciousIpChange({
+            ...base,
+            policy: 'country',
+            sessionCountry: null,
+            requestCountry: 'RU',
+        })).toBe(false);
+    });
+    it('does not end a session when either address is unknown', () => {
+        expect(isSuspiciousIpChange({ policy: 'any', sessionIp: null, requestIp: '10.0.0.2' })).toBe(false);
+    });
+});
+describe('trustedDeviceExpiry', () => {
+    it('adds the configured number of days to the grant date', () => {
+        const now = new Date('2026-08-25T00:00:00.000Z');
+        expect(trustedDeviceExpiry(30, now).toISOString()).toBe('2026-09-24T00:00:00.000Z');
+    });
+});
+//# sourceMappingURL=device-fingerprint.test.js.map

package/dist/pam/identity/__tests__/device-fingerprint.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/device-fingerprint.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAElD,MAAM,UAAU,GACd,2HAA2H,CAAC;AAC9H,MAAM,qBAAqB,GACzB,4HAA4H,CAAC;AAC/H,MAAM,qBAAqB,GACzB,2HAA2H,CAAC;AAC9H,MAAM,eAAe,GACnB,kFAAkF,CAAC;AAErF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,QAAQ;YACjB,EAAE,EAAE,OAAO;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,SAAS;YAClB,EAAE,EAAE,SAAS;SACd,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,GAAG,UAAU,oBAAoB,CAAC;QAC/C,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,IAAI;YACb,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAE9D,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,oBAAoB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,oBAAoB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CACJ,oBAAoB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CACtF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CACJ,oBAAoB,CAAC;YACnB,GAAG,IAAI;YACP,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,oBAAoB,CAAC;YACnB,GAAG,IAAI;YACP,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CACJ,oBAAoB,CAAC;YACnB,GAAG,IAAI;YACP,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1F,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.js

@@ -97,7 +97,7 @@ describe('IdentityService - verify2fa rate-limit key stability (ABC-208 finding
         const svc = withTemplateRenderer({ drizzle, events, limiter });
         // Same two_factor cookie + different junk pairs must still hit the one exhausted bucket.
         for (let i = 0; i < 3; i++) {
-            await expect(svc.verifyTwoFactor({ code: '123456' }, { cookie: `better-auth.two_factor=${twoFactorIdentifier}; junk${i}=${i}` }, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+            await expect(svc.verifyTwoFactor({ code: '123456', method: 'totp', trustDevice: false }, { cookie: `better-auth.two_factor=${twoFactorIdentifier}; junk${i}=${i}` }, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
         }
     });
 });
@@ -143,7 +143,7 @@ describe('IdentityService - rate limiting on secret-guessing routes (ABC-208 fin
             await limiter.consume('disable2fa:anonymous', { limit: 5, windowMs: 5 * 60 * 1000 });
         }
         const svc = withTemplateRenderer({ drizzle, events, limiter });
-        await expect(svc.disableTwoFactor({ password: 'currentpw1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        await expect(svc.disableTwoFactor({ password: 'currentpw1', code: '123456' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
     });
 });
 describe('IdentityService - fail-closed limiter policy for credential-guessing keys', () => {
@@ -164,7 +164,7 @@ describe('IdentityService - fail-closed limiter policy for credential-guessing k
     it('passes onUnavailable: deny on the verify2fa: key', async () => {
         const { limiter, consume } = denyingLimiter();
         const svc = withTemplateRenderer({ drizzle, events, limiter });
-        await expect(svc.verifyTwoFactor({ code: '123456' }, {}, new Headers())).rejects.toMatchObject({
+        await expect(svc.verifyTwoFactor({ code: '123456', method: 'totp', trustDevice: false }, {}, new Headers())).rejects.toMatchObject({
             code: 'TOO_MANY_REQUESTS',
         });
         expect(consume).toHaveBeenCalledWith(expect.stringMatching(/^verify2fa:/), expect.objectContaining({ onUnavailable: 'deny' }));

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.rate-limit.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,eAAe,EAA+B,MAAM,uBAAuB,CAAC;AAOnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,eAAe,EAA4B,MAAM,gCAAgC,CAAC;AAE3F,MAAM,oBAAoB,GAA0B;IAClD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;CACrD,CAAC;AAEF,SAAS,oBAAoB,CAC3B,IAEC;IAED,OAAO,IAAI,eAAe,CAAC;QACzB,gBAAgB,EAAE,oBAAoB;QACtC,kBAAkB,EAAE,IAAI,CAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QAChF,GAAG,IAAI;QACP,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,kBAAkB,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,8DAA8D;AAC9D,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAyC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;AAE9B,IAAI,EAAU,CAAC;AACf,IAAI,OAAuC,CAAC;AAC5C,IAAI,KAAgB,CAAC;AACrB,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAE7D,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACrB,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAChB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,aAAa,CAAC;QAC5B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,wFAAwF;QACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC;YAC/B,OAAO;YACP,MAAM;YACN,OAAO;YACP,cAAc,EAAE,oBAAoB,CAAC;gBACnC,YAAY,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;aAC3E,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CACV;YACE,KAAK;YACL,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,EACD,EAAE,CACH,CACF,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,wFAAwF;QACxF,yEAAyE;QACzE,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CACV;YACE,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,EACD,EAAE,CACH,CACF,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,mBAAmB,EAAE,EAAE;gBACxD,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,yFAAyF;QACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,EAAE,MAAM,EAAE,0BAA0B,mBAAmB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAC1E,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,cAAc,CAChB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,EAC9D,EAAE,EACF,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,4EAA4E;QAC5E,MAAM,MAAM,CACV,GAAG,CAAC,WAAW,CACb,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC3C,EAAE,WAAW,EAAE,aAAa,EAAE,EAC9B,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,+EAA+E;QAC/E,qDAAqD;QACrD,MAAM,MAAM,CACV,GAAG,CAAC,WAAW,CACb,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC1C,EAAE,WAAW,EAAE,aAAa,EAAE,EAC9B,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,gFAAgF;IAChF,iFAAiF;IACjF,4EAA4E;IAC5E,4EAA4E;IAC5E,SAAS,cAAc;QACrB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,kBAAkB,EAClB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7F,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EACpC,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CACvF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,oBAAoB,EACpB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,2BAA2B,EAC3B,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACpF,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"identity.rate-limit.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,eAAe,EAA+B,MAAM,uBAAuB,CAAC;AAOnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,eAAe,EAA4B,MAAM,gCAAgC,CAAC;AAE3F,MAAM,oBAAoB,GAA0B;IAClD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;CACrD,CAAC;AAEF,SAAS,oBAAoB,CAC3B,IAEC;IAED,OAAO,IAAI,eAAe,CAAC;QACzB,gBAAgB,EAAE,oBAAoB;QACtC,kBAAkB,EAAE,IAAI,CAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QAChF,GAAG,IAAI;QACP,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,kBAAkB,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,8DAA8D;AAC9D,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAyC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;AAE9B,IAAI,EAAU,CAAC;AACf,IAAI,OAAuC,CAAC;AAC5C,IAAI,KAAgB,CAAC;AACrB,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAE7D,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACrB,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAChB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,aAAa,CAAC;QAC5B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,wFAAwF;QACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC;YAC/B,OAAO;YACP,MAAM;YACN,OAAO;YACP,cAAc,EAAE,oBAAoB,CAAC;gBACnC,YAAY,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;aAC3E,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CACV;YACE,KAAK;YACL,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,EACD,EAAE,CACH,CACF,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,wFAAwF;QACxF,yEAAyE;QACzE,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CACV;YACE,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,EACD,EAAE,CACH,CACF,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,mBAAmB,EAAE,EAAE;gBACxD,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,yFAAyF;QACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,EACtD,EAAE,MAAM,EAAE,0BAA0B,mBAAmB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAC1E,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,cAAc,CAChB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,EAC9D,EAAE,EACF,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,4EAA4E;QAC5E,MAAM,MAAM,CACV,GAAG,CAAC,WAAW,CACb,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC3C,EAAE,WAAW,EAAE,aAAa,EAAE,EAC9B,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,+EAA+E;QAC/E,qDAAqD;QACrD,MAAM,MAAM,CACV,GAAG,CAAC,WAAW,CACb,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC1C,EAAE,WAAW,EAAE,aAAa,EAAE,EAC9B,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACpF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,gFAAgF;IAChF,iFAAiF;IACjF,4EAA4E;IAC5E,4EAA4E;IAC5E,SAAS,cAAc;QACrB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,kBAAkB,EAClB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,EACtD,EAAE,EACF,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EACpC,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CACvF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,oBAAoB,EACpB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,2BAA2B,EAC3B,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACpF,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.service.int.test.js

@@ -9,9 +9,15 @@ import { migrate as migrateProfile } from '@openora/core/pam/migrate/profile';
 import { IdentityService, SESSION_DURATION_IN_SECONDS, } from '../service/identity.service.js';
 import { UnsupportedLanguageError } from '../../shared/language.js';
 import { user, session } from '../schema/index.js';
+import { TrustedDeviceService } from '../service/trusted-device.service.js';
+import { SessionService } from '../service/session.service.js';
 import { makeIdentityReader, mock, makeEventBus } from '../../../testing/mock.js';
-const { signInEmailMock, getSessionMock, updateUserMock, requestPasswordResetEmailOTPMock, checkVerificationOTPMock, resetPasswordEmailOTPMock, capturedAuthOptions, } = vi.hoisted(() => ({
+const { signInEmailMock, verifyTotpMock, verifyBackupCodeMock, generateBackupCodesMock, disableTwoFactorMock, getSessionMock, updateUserMock, requestPasswordResetEmailOTPMock, checkVerificationOTPMock, resetPasswordEmailOTPMock, capturedAuthOptions, } = vi.hoisted(() => ({
     signInEmailMock: vi.fn(),
+    verifyTotpMock: vi.fn(),
+    verifyBackupCodeMock: vi.fn(),
+    generateBackupCodesMock: vi.fn(),
+    disableTwoFactorMock: vi.fn(),
     getSessionMock: vi.fn().mockResolvedValue(null),
     updateUserMock: vi.fn(),
     requestPasswordResetEmailOTPMock: vi.fn(),
@@ -35,6 +41,10 @@ vi.mock('@openora/core/server', async (importOriginal) => ({
                 getSession: getSessionMock,
                 signUpEmail: vi.fn(),
                 signInEmail: signInEmailMock,
+                verifyTOTP: verifyTotpMock,
+                verifyBackupCode: verifyBackupCodeMock,
+                generateBackupCodes: generateBackupCodesMock,
+                disableTwoFactor: disableTwoFactorMock,
                 signOut: vi.fn(),
                 updateUser: updateUserMock,
                 requestPasswordResetEmailOTP: requestPasswordResetEmailOTPMock,
@@ -423,6 +433,52 @@ describe('IdentityService - player-status login gate (real PG)', () => {
         expect(events.emit).not.toHaveBeenCalledWith('player.login_blocked', expect.anything());
     });
 });
+describe('IdentityService - trusted device login (real PG)', () => {
+    const TRUSTED_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+    const trustedHeaders = {
+        cookie: 'better-auth.session_token=tok; better-auth.trust_device=signed-trust-value',
+        'user-agent': TRUSTED_UA,
+    };
+    const honourTrustCookie = (userId) => signInEmailMock.mockImplementation(async ({ headers }) => headers.get('cookie')?.includes('.trust_device')
+        ? signInSuccess(userId)
+        : jsonResponse({ twoFactorRedirect: true }, 200));
+    const makeTrustedDevices = () => new TrustedDeviceService({
+        drizzle: db.drizzle,
+        events: makeEventBus(),
+        trustedDeviceDays: 30,
+    });
+    it('signs in without a second factor while the trusted-device row is live', async () => {
+        const account = await seedUser();
+        const trustedDevices = makeTrustedDevices();
+        await trustedDevices.trust(account.id, { ip: null, userAgent: TRUSTED_UA });
+        honourTrustCookie(account.id);
+        const svc = buildService({ trustedDevices });
+        const result = await svc.login({ email: EMAIL, password: 'rightpass1' }, trustedHeaders, new Headers());
+        expect(result).toMatchObject({ session: { token: 'tok' } });
+    });
+    it('challenges again once the trusted device is revoked', async () => {
+        const account = await seedUser();
+        const trustedDevices = makeTrustedDevices();
+        const device = await trustedDevices.trust(account.id, { ip: null, userAgent: TRUSTED_UA });
+        if (!device) {
+            throw new Error('trust() stored no device');
+        }
+        await trustedDevices.revoke(account.id, device.id, account.id);
+        honourTrustCookie(account.id);
+        const svc = buildService({ trustedDevices });
+        const result = await svc.login({ email: EMAIL, password: 'rightpass1' }, trustedHeaders, new Headers());
+        expect(result).toEqual({ twoFactorRedirect: true });
+    });
+    it('challenges a device whose cookie was replayed from another browser', async () => {
+        const account = await seedUser();
+        const trustedDevices = makeTrustedDevices();
+        await trustedDevices.trust(account.id, { ip: null, userAgent: TRUSTED_UA });
+        honourTrustCookie(account.id);
+        const svc = buildService({ trustedDevices });
+        const result = await svc.login({ email: EMAIL, password: 'rightpass1' }, { ...trustedHeaders, 'user-agent': 'Mozilla/5.0 (Macintosh) Safari/605.1.15' }, new Headers());
+        expect(result).toEqual({ twoFactorRedirect: true });
+    });
+});
 describe('IdentityService.unlockUser (real PG)', () => {
     it('clears the lockout row and emits unlocked with the prior state', async () => {
         const lockedUntil = new Date('2020-01-01T00:00:00.000Z');
@@ -583,4 +639,168 @@ describe('IdentityService.updateProfile language validation', () => {
         expect(result.user.language).toBe('fr');
     });
 });
+describe('IdentityService.verifyTwoFactor', () => {
+    const okResponse = () => jsonResponse({ status: true }, 200);
+    const pendingChallenge = (userId) => mock({
+        resolvePendingUserId: vi.fn(async () => userId),
+        assertNotLocked: vi.fn(async () => undefined),
+        recordFailure: vi.fn(async () => undefined),
+        reset: vi.fn(async () => undefined),
+    });
+    it('spends a backup code through better-auth instead of the authenticator', async () => {
+        const account = await seedUser();
+        verifyBackupCodeMock.mockResolvedValue(okResponse());
+        const events = makeEventBus();
+        const svc = buildService({ events, twoFactorLockout: pendingChallenge(account.id) });
+        await svc.verifyTwoFactor({ code: 'lH2MN-bvPJb', method: 'backup_code', trustDevice: false }, {}, new Headers());
+        expect(verifyBackupCodeMock).toHaveBeenCalledWith(expect.objectContaining({ body: { code: 'lH2MN-bvPJb', trustDevice: false } }));
+        expect(verifyTotpMock).not.toHaveBeenCalled();
+        expect(events.emit).toHaveBeenCalledWith('identity.2fa.verified', expect.objectContaining({ userId: account.id, method: 'backup_code' }));
+    });
+    it('counts a rejected backup code against the lockout', async () => {
+        const account = await seedUser();
+        verifyBackupCodeMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const lockout = pendingChallenge(account.id);
+        const svc = buildService({ twoFactorLockout: lockout });
+        await expect(svc.verifyTwoFactor({ code: 'lH2MN-bvPJb', method: 'backup_code', trustDevice: false }, {}, new Headers())).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        expect(lockout.recordFailure).toHaveBeenCalledWith(account.id, expect.anything());
+    });
+    it('announces enrolment only for the challenge answered from a live session', async () => {
+        const account = await seedUser();
+        verifyTotpMock.mockResolvedValue(okResponse());
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        const enrolment = makeEventBus();
+        await buildService({ events: enrolment }).verifyTwoFactor({ code: '123456', method: 'totp', trustDevice: false }, {}, new Headers());
+        expect(enrolment.emit).toHaveBeenCalledWith('identity.2fa.enabled', expect.objectContaining({ userId: account.id }));
+        getSessionMock.mockResolvedValue(null);
+        const signIn = makeEventBus();
+        await buildService({
+            events: signIn,
+            twoFactorLockout: pendingChallenge(account.id),
+        }).verifyTwoFactor({ code: '123456', method: 'totp', trustDevice: false }, {}, new Headers());
+        expect(signIn.emit).toHaveBeenCalledWith('identity.2fa.verified', expect.objectContaining({ userId: account.id }));
+        expect(signIn.emit).not.toHaveBeenCalledWith('identity.2fa.enabled', expect.anything());
+    });
+});
+describe('IdentityService 2fa step-up teardown', () => {
+    const BROWSER_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+    const okResponse = () => jsonResponse({ status: true }, 200);
+    const seedSession = (userId) => db.drizzle.db
+        .insert(session)
+        .values({
+        userId,
+        token: randomUUID(),
+        userAgent: BROWSER_UA,
+        expiresAt: new Date(Date.now() + 86_400_000),
+        updatedAt: new Date(),
+    })
+        .returning({ id: session.id })
+        .then(([row]) => row?.id ?? '');
+    const buildTeardownDeps = (userId) => {
+        const events = makeEventBus();
+        const trustedDevices = new TrustedDeviceService({
+            drizzle: db.drizzle,
+            events: makeEventBus(),
+            trustedDeviceDays: 30,
+        });
+        const sessions = new SessionService({
+            drizzle: db.drizzle,
+            events: makeEventBus(),
+            identityReader: makeIdentityReader(),
+        });
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: userId } });
+        return { events, trustedDevices, sessions };
+    };
+    it('does not buy the trust window for a spent backup code', async () => {
+        const account = await seedUser();
+        verifyBackupCodeMock.mockResolvedValue(okResponse());
+        const { events, trustedDevices } = buildTeardownDeps(account.id);
+        getSessionMock.mockResolvedValue(null);
+        const lockout = mock({
+            resolvePendingUserId: vi.fn(async () => account.id),
+            assertNotLocked: vi.fn(async () => undefined),
+            recordFailure: vi.fn(async () => undefined),
+            reset: vi.fn(async () => undefined),
+        });
+        await buildService({ events, trustedDevices, twoFactorLockout: lockout }).verifyTwoFactor({ code: 'lH2MN-bvPJb', method: 'backup_code', trustDevice: true }, { 'user-agent': BROWSER_UA }, new Headers());
+        expect(verifyBackupCodeMock).toHaveBeenCalledWith(expect.objectContaining({ body: { code: 'lH2MN-bvPJb', trustDevice: false } }));
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(false);
+    });
+    it('disableTwoFactor takes a fresh authenticator code, then drops trust and sessions', async () => {
+        const account = await seedUser({ twoFactorEnabled: true });
+        const { events, trustedDevices, sessions } = buildTeardownDeps(account.id);
+        await trustedDevices.trust(account.id, { ip: null, userAgent: BROWSER_UA });
+        const liveSession = await seedSession(account.id);
+        verifyTotpMock.mockResolvedValue(okResponse());
+        disableTwoFactorMock.mockResolvedValue(okResponse());
+        const svc = buildService({ events, trustedDevices, sessions });
+        await svc.disableTwoFactor({ password: 'rightpass1', code: '123456' }, { cookie: 'better-auth.session_token=live', 'user-agent': BROWSER_UA }, new Headers());
+        expect(verifyTotpMock).toHaveBeenCalledWith(expect.objectContaining({ body: { code: '123456', trustDevice: false } }));
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(false);
+        const [row] = await db.drizzle.db
+            .select({ expiresAt: session.expiresAt })
+            .from(session)
+            .where(eq(session.id, liveSession));
+        expect(row && row.expiresAt.getTime() > Date.now()).toBe(false);
+        expect(events.emit).toHaveBeenCalledWith('identity.2fa.disabled', expect.anything());
+    });
+    it('rejects disableTwoFactor when the authenticator code is wrong, before better-auth is called', async () => {
+        const account = await seedUser({ twoFactorEnabled: true });
+        const { events, trustedDevices, sessions } = buildTeardownDeps(account.id);
+        verifyTotpMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
+        const svc = buildService({ events, trustedDevices, sessions });
+        await expect(svc.disableTwoFactor({ password: 'rightpass1', code: '000000' }, { cookie: 'better-auth.session_token=live' }, new Headers())).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        expect(disableTwoFactorMock).not.toHaveBeenCalled();
+    });
+    it('regenerateBackupCodes takes a fresh authenticator code and revokes old trust', async () => {
+        const account = await seedUser({ twoFactorEnabled: true });
+        const { events, trustedDevices, sessions } = buildTeardownDeps(account.id);
+        await trustedDevices.trust(account.id, { ip: null, userAgent: BROWSER_UA });
+        verifyTotpMock.mockResolvedValue(okResponse());
+        generateBackupCodesMock.mockResolvedValue(jsonResponse({ backupCodes: ['aaaaa-bbbbb'] }, 200));
+        const svc = buildService({ events, trustedDevices, sessions });
+        const result = await svc.regenerateBackupCodes({ password: 'rightpass1', code: '123456' }, { cookie: 'better-auth.session_token=live', 'user-agent': BROWSER_UA }, new Headers());
+        expect(result.backupCodes).toEqual(['aaaaa-bbbbb']);
+        expect(verifyTotpMock).toHaveBeenCalled();
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(false);
+    });
+});
+describe('IdentityService.trustCurrentDevice', () => {
+    const BROWSER_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+    const challengeResponse = () => {
+        const res = jsonResponse({ twoFactorRedirect: true }, 200);
+        res.headers.append('set-cookie', 'better-auth.two_factor=pending-value; Path=/; HttpOnly');
+        return res;
+    };
+    const makeTrustedDevices = () => new TrustedDeviceService({
+        drizzle: db.drizzle,
+        events: makeEventBus(),
+        trustedDeviceDays: 30,
+    });
+    it('replays the sign-in leg so better-auth issues its trust cookie', async () => {
+        const account = await seedUser();
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        signInEmailMock.mockResolvedValue(challengeResponse());
+        const trusted = jsonResponse({ status: true }, 200);
+        trusted.headers.append('set-cookie', 'better-auth.trust_device=granted; Path=/; HttpOnly');
+        verifyTotpMock.mockResolvedValue(trusted);
+        const trustedDevices = makeTrustedDevices();
+        const resHeaders = new Headers();
+        await buildService({ trustedDevices }).trustCurrentDevice({ password: 'rightpass1', code: '123456' }, { cookie: 'better-auth.session_token=live', 'user-agent': BROWSER_UA }, resHeaders);
+        const [call] = verifyTotpMock.mock.calls;
+        expect(call?.[0].body).toEqual({ code: '123456', trustDevice: true });
+        expect(call?.[0].headers.get('cookie')).toBe('better-auth.two_factor=pending-value');
+        expect(resHeaders.getSetCookie().join(';')).toContain('trust_device=granted');
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(true);
+    });
+    it('refuses an account that has no second factor to trust', async () => {
+        const account = await seedUser();
+        getSessionMock.mockResolvedValue({ user: { ...betterAuthUser, id: account.id } });
+        signInEmailMock.mockResolvedValue(signInSuccess(account.id));
+        const trustedDevices = makeTrustedDevices();
+        await expect(buildService({ trustedDevices }).trustCurrentDevice({ password: 'rightpass1', code: '123456' }, { 'user-agent': BROWSER_UA }, new Headers())).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+        expect(verifyTotpMock).not.toHaveBeenCalled();
+        expect(await trustedDevices.isTrusted(account.id, BROWSER_UA)).toBe(false);
+    });
+});
 //# sourceMappingURL=identity.service.int.test.js.map