@openora/core 0.4.1-canary.113 → 0.4.1-canary.115

package/dist/pam/identity/schema/index.d.ts

@@ -326,6 +326,74 @@ export declare const user: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        failedTwoFactorAttempts: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failedTwoFactorAttempts";
+            tableName: "user";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        twoFactorLockoutUntil: import("drizzle-orm/pg-core").PgColumn<{
+            name: "twoFactorLockoutUntil";
+            tableName: "user";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        twoFactorLockoutCount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "twoFactorLockoutCount";
+            tableName: "user";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastFailedTwoFactorAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lastFailedTwoFactorAt";
+            tableName: "user";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         lockoutCount: import("drizzle-orm/pg-core").PgColumn<{
             name: "lockoutCount";
             tableName: "user";
@@ -571,6 +639,23 @@ export declare const session: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        lastSeenAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lastSeenAt";
+            tableName: "session";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         userId: import("drizzle-orm/pg-core").PgColumn<{
             name: "userId";
             tableName: "session";
@@ -1017,6 +1102,40 @@ export declare const twoFactor: import("drizzle-orm/pg-core").PgTableWithColumns
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        failedVerificationCount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failedVerificationCount";
+            tableName: "two_factor";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lockedUntil: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lockedUntil";
+            tableName: "two_factor";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "pg";
 }>;
@@ -1146,10 +1265,205 @@ export declare const smsOtpSession: import("drizzle-orm/pg-core").PgTableWithCol
     };
     dialect: "pg";
 }>;
+export declare const adminTrustedDevice: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "admin_trusted_device";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "admin_trusted_device";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "userId";
+            tableName: "admin_trusted_device";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deviceHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deviceHash";
+            tableName: "admin_trusted_device";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        label: import("drizzle-orm/pg-core").PgColumn<{
+            name: "label";
+            tableName: "admin_trusted_device";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        ipAddress: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ipAddress";
+            tableName: "admin_trusted_device";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userAgent: import("drizzle-orm/pg-core").PgColumn<{
+            name: "userAgent";
+            tableName: "admin_trusted_device";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lastUsedAt";
+            tableName: "admin_trusted_device";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expiresAt";
+            tableName: "admin_trusted_device";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revokedAt";
+            tableName: "admin_trusted_device";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedBy: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revokedBy";
+            tableName: "admin_trusted_device";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "admin_trusted_device";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 export type User = typeof user.$inferSelect;
 export type Session = typeof session.$inferSelect;
 export type SmsOtpSession = typeof smsOtpSession.$inferSelect;
 export type Account = typeof account.$inferSelect;
 export type Verification = typeof verification.$inferSelect;
 export type TwoFactor = typeof twoFactor.$inferSelect;
+export type AdminTrustedDevice = typeof adminTrustedDevice.$inferSelect;
 //# sourceMappingURL=index.d.ts.map

package/dist/pam/identity/schema/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,aAAa,mEAA+B,CAAC;AAE1D,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmDhB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBnB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBnB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaxB,CAAC;AAGF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAerB,CAAC;AAKF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAezB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;AAC5D,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,aAAa,mEAA+B,CAAC;AAE1D,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0DhB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBnB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBnB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaxB,CAAC;AAGF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBrB,CAAC;AAKF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAezB,CAAC;AAMF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsB9B,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;AAC5D,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,YAAY,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC"}

package/dist/pam/identity/schema/index.js

@@ -27,6 +27,13 @@ export const user = pgTable('user', {
     phoneVerifiedAt: timestamp({ withTimezone: true }),
     failedLoginAttempts: integer().notNull().default(0),
     lockoutUntil: timestamp({ withTimezone: true }),
+    // Second-factor lockout, counted separately from the password-login columns above:
+    // the two thresholds are configured independently and a 2FA lockout must not
+    // consume the password-login budget (or vice versa).
+    failedTwoFactorAttempts: integer().notNull().default(0),
+    twoFactorLockoutUntil: timestamp({ withTimezone: true }),
+    twoFactorLockoutCount: integer().notNull().default(0),
+    lastFailedTwoFactorAt: timestamp({ withTimezone: true }),
     // Progressive lockout tiers: `lockoutCount` counts lockouts inside a rolling 24h
     // window (reset once `lastLockoutAt` falls outside it), escalating the duration
     // 1min -> 5min -> 15min. Shared by every login method.
@@ -61,6 +68,10 @@ export const session = pgTable('session', {
         .$onUpdateFn(() => new Date()),
     ipAddress: text(),
     userAgent: text(),
+    // Written by the admin session guard, throttled. better-auth owns `updatedAt` and
+    // ties it to its own updateAge bookkeeping, so touching that column to record
+    // activity would shift session expiry - this one is ours and better-auth ignores it.
+    lastSeenAt: timestamp({ withTimezone: true }),
     userId: uuid()
         .notNull()
         .references(() => user.id, { onDelete: 'cascade' }),
@@ -103,6 +114,10 @@ export const twoFactor = pgTable('two_factor', {
         .notNull()
         .references(() => user.id, { onDelete: 'cascade' }),
     verified: boolean().default(true),
+    // Counter and cooldown the plugin maintains itself; the adapter rejects
+    // every twoFactor write while they are missing from the table.
+    failedVerificationCount: integer().notNull().default(0),
+    lockedUntil: timestamp({ withTimezone: true }),
 }, (t) => [
     index('two_factor_user_id_idx').on(t.userId),
     index('two_factor_secret_idx').on(t.secret),
@@ -122,4 +137,27 @@ export const smsOtpSession = pgTable('sms_otp_session', {
     failedAttempts: integer().notNull().default(0),
     createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
 }, (t) => [index('sms_otp_session_phone_idx').on(t.phone)]);
+// Server-side trusted-device registry. better-auth issues its own opaque trust cookie,
+// which cannot be listed or revoked; a device only skips the second factor when BOTH
+// that cookie and an unrevoked row here are present, so revoking the row forces 2FA on
+// the very next request.
+export const adminTrustedDevice = pgTable('admin_trusted_device', {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid()
+        .notNull()
+        .references(() => user.id, { onDelete: 'cascade' }),
+    deviceHash: text().notNull(),
+    label: text().notNull(),
+    ipAddress: text(),
+    userAgent: text(),
+    lastUsedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp({ withTimezone: true }).notNull(),
+    revokedAt: timestamp({ withTimezone: true }),
+    revokedBy: uuid(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+}, (t) => [
+    uniqueIndex('admin_trusted_device_user_hash_idx').on(t.userId, t.deviceHash),
+    index('admin_trusted_device_user_id_idx').on(t.userId),
+    index('admin_trusted_device_expires_at_idx').on(t.expiresAt),
+]);
 //# sourceMappingURL=index.js.map

package/dist/pam/identity/schema/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,SAAS,EACT,KAAK,EACL,OAAO,EACP,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CACzB,MAAM,EACN;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACtB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,KAAK,EAAE,IAAI,EAAE;IACb,KAAK,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,kFAAkF;IAClF,qFAAqF;IACrF,gEAAgE;IAChE,gBAAgB,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,WAAW,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE;IAC5B,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,eAAe,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAClD,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,YAAY,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC/C,iFAAiF;IACjF,gFAAgF;IAChF,uDAAuD;IACvD,YAAY,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,aAAa,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,iBAAiB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpD,oFAAoF;IACpF,+EAA+E;IAC/E,iFAAiF;IACjF,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,cAAc,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC;AACD,iFAAiF;AACjF,yEAAyE;AACzE,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAA,SAAS,CAAC,CAAC,QAAQ,GAAG,CAAC;IACjE,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC;IACvE,KAAK,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,QAAQ,eAAe,CAAC;IAC7E,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,IAAI,EAAE;IACjB,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,EAAE;IACnB,YAAY,EAAE,IAAI,EAAE;IACpB,OAAO,EAAE,IAAI,EAAE;IACf,oBAAoB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACvD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,KAAK,EAAE,IAAI,EAAE;IACb,QAAQ,EAAE,IAAI,EAAE;IAChB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC5C,CACF,CAAC;AAEF,wGAAwG;AACxG,iFAAiF;AACjF,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAClC,iBAAiB,EACjB;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,cAAc,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,SAAS,EACT,KAAK,EACL,OAAO,EACP,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CACzB,MAAM,EACN;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACtB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,KAAK,EAAE,IAAI,EAAE;IACb,KAAK,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,kFAAkF;IAClF,qFAAqF;IACrF,gEAAgE;IAChE,gBAAgB,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,WAAW,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE;IAC5B,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,eAAe,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAClD,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,YAAY,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC/C,mFAAmF;IACnF,6EAA6E;IAC7E,qDAAqD;IACrD,uBAAuB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,qBAAqB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,iFAAiF;IACjF,gFAAgF;IAChF,uDAAuD;IACvD,YAAY,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,aAAa,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,iBAAiB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpD,oFAAoF;IACpF,+EAA+E;IAC/E,iFAAiF;IACjF,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,cAAc,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC;AACD,iFAAiF;AACjF,yEAAyE;AACzE,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAA,SAAS,CAAC,CAAC,QAAQ,GAAG,CAAC;IACjE,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC;IACvE,KAAK,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,QAAQ,eAAe,CAAC;IAC7E,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,IAAI,EAAE;IACjB,kFAAkF;IAClF,8EAA8E;IAC9E,qFAAqF;IACrF,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,EAAE;IACnB,YAAY,EAAE,IAAI,EAAE;IACpB,OAAO,EAAE,IAAI,EAAE;IACf,oBAAoB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACvD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,KAAK,EAAE,IAAI,EAAE;IACb,QAAQ,EAAE,IAAI,EAAE;IAChB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjC,wEAAwE;IACxE,+DAA+D;IAC/D,uBAAuB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,WAAW,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC/C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC5C,CACF,CAAC;AAEF,wGAAwG;AACxG,iFAAiF;AACjF,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAClC,iBAAiB,EACjB;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,cAAc,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;AAEF,uFAAuF;AACvF,qFAAqF;AACrF,uFAAuF;AACvF,yBAAyB;AACzB,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CACvC,sBAAsB,EACtB;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,IAAI,EAAE;IACjB,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACpE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5C,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;IAC5E,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7D,CACF,CAAC"}

package/dist/pam/identity/service/admin-security.service.d.ts

@@ -0,0 +1,82 @@
+import { type EventBus, DrizzleService } from '@openora/core/server';
+import { type AdminSecurityPolicy, type AdminSessionContext, type AdminSecurityConfig, type GeoIpAdapter, type ClientMeta, type IdentityReader, type User } from '@openora/core/contracts';
+import { type AdminTrustedDevice, type Session } from '../schema/index.js';
+import type { AdminSecurityStatus, TrustedDeviceItem } from '../contract/index.js';
+import type { SessionService } from './session.service.js';
+import type { TrustedDeviceService } from './trusted-device.service.js';
+export declare const SelfTwoFactorResetError: new () => Error;
+export type AdminSecurityServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    sessions: SessionService;
+    trustedDevices: TrustedDeviceService;
+    identityReader: IdentityReader;
+    config: AdminSecurityConfig;
+    geoIp?: GeoIpAdapter | undefined;
+};
+/**
+ * Enforcement half of the Backoffice session policy, resolved by `AdminGuard` on every
+ * admin request through ADMIN_SECURITY_POLICY.
+ *
+ * Both checks throw rather than return a verdict: a caller that forgets to branch on a
+ * boolean would silently grant access, which is the one failure mode this class exists
+ * to prevent.
+ */
+export declare class AdminSecurityService implements AdminSecurityPolicy {
+    private readonly drizzle;
+    private readonly events;
+    private readonly sessions;
+    private readonly trustedDevices;
+    private readonly identityReader;
+    private readonly config;
+    private readonly geoIp?;
+    constructor({ drizzle, events, sessions, trustedDevices, identityReader, config, geoIp, }: AdminSecurityServiceDeps);
+    assertEnrolled({ userId, ip, userAgent }: AdminSessionContext): Promise<void>;
+    assertSessionIntact({ userId, sessionId, ip, userAgent, }: AdminSessionContext): Promise<void>;
+    private hasSuspiciousIpChange;
+    private lookupCountry;
+    /**
+     * Ends a session whose device or network no longer matches, and drops the trust that
+     * device held - otherwise the next login would silently skip the second factor on the
+     * very device that just failed the check.
+     */
+    private endCompromisedSession;
+    private touchLastSeen;
+    /**
+     * What the Backoffice needs before it renders anything: whether this account still
+     * has to enrol, and whether the browser it is on holds an unexpired trust grant.
+     */
+    status(userId: User['id'], userAgent: string | null): Promise<AdminSecurityStatus>;
+    /**
+     * Counts what is left of the recovery set. better-auth stores the codes as a JSON
+     * array unless the operator opts into encryption, so an unreadable column is reported
+     * as unknown rather than as zero - claiming no codes remain would be worse than
+     * admitting the count cannot be taken.
+     */
+    private countBackupCodes;
+    listTrustedDevices(userId: User['id'], userAgent: string | null): Promise<TrustedDeviceItem[]>;
+    revokeTrustedDevice(userId: User['id'], deviceId: AdminTrustedDevice['id'], actorId: User['id'], meta?: ClientMeta, keepSessionId?: Session['id']): Promise<{
+        success: true;
+    }>;
+    /**
+     * A revoked device loses its live sessions in the same breath, so the grant cannot
+     * outlive the revoke on the browser that already holds one.
+     *
+     * `keepSessionId` spares the caller's own session: revoking trust on the browser you
+     * are sitting in means "ask me for a code next time", not "sign me out now" - the same
+     * line `SessionService.revokeOwnSession` draws for sessions.
+     */
+    private endSessionsOnDevice;
+    /**
+     * Returns an account to the unenrolled state so its owner can set a second factor up
+     * again: the shared recovery path for a lost authenticator, since better-auth's own
+     * disable endpoint asks for the account's password and a locked-out admin has no way
+     * to reach it. The trust grants and live sessions go with it - leaving either behind
+     * would let a browser keep the access the reset exists to withdraw.
+     */
+    resetTwoFactor(userId: User['id'], actorId: User['id'], reason: string, meta?: ClientMeta): Promise<{
+        success: true;
+    }>;
+    isTrustedDevice(userId: User['id'], userAgent: string | null): Promise<boolean>;
+}
+//# sourceMappingURL=admin-security.service.d.ts.map

package/dist/pam/identity/service/admin-security.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-security.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/admin-security.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,QAAQ,EACb,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,IAAI,EACV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAQxE,eAAO,MAAM,uBAAuB,iBAGnC,CAAC;AAMF,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,cAAc,EAAE,oBAAoB,CAAC;IACrC,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CAClC,CAAC;AAEF;;;;;;;GAOG;AACH,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAA2B;gBAEtC,EACV,OAAO,EACP,MAAM,EACN,QAAQ,EACR,cAAc,EACd,cAAc,EACd,MAAM,EACN,KAAK,GACN,EAAE,wBAAwB;IAgBrB,cAAc,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB7E,mBAAmB,CAAC,EACxB,MAAM,EACN,SAAS,EACT,EAAE,EACF,SAAS,GACV,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;YA6BxB,qBAAqB;YA2BrB,aAAa;IAS3B;;;;OAIG;YACW,qBAAqB;YAsBrB,aAAa;IAU3B;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyBxF;;;;;OAKG;YACW,gBAAgB;IAkB9B,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAIxF,mBAAmB,CACvB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAClC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EACnB,IAAI,CAAC,EAAE,UAAU,EACjB,aAAa,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;;;IAO/B;;;;;;;OAOG;YACW,mBAAmB;IAmBjC;;;;;;OAMG;IACG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU;;;IA4C/F,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;CAGhF"}