@openora/core 0.4.1-canary.113 → 0.4.1-canary.115

package/dist/pam/identity/service/admin-security.service.js

@@ -0,0 +1,277 @@
+import { ORPCError } from '@orpc/server';
+import { createLogger, makeConflictError, } from '@openora/core/server';
+import { and, eq, gt, sql } from 'drizzle-orm';
+import { AuthGuardReasonSchema, } from '@openora/core/contracts';
+import { session, twoFactor, user, } from '../schema/index.js';
+import { isSameDevice, isSuspiciousIpChange } from './device-fingerprint.service.js';
+import { UserNotFoundError } from './identity.service.js';
+const logger = createLogger('admin-security');
+// A Super Admin cannot clear their own second factor - that would let a single
+// compromised account walk itself back to the unenrolled state. The reset always
+// goes through another Super Admin.
+export const SelfTwoFactorResetError = makeConflictError('SelfTwoFactorResetError', 'An admin cannot reset their own second factor - ask another Super Admin');
+// Recording activity on every admin request would be one write per call; the session
+// list only needs minute-level resolution.
+const LAST_SEEN_THROTTLE_MS = 5 * 60 * 1000;
+/**
+ * Enforcement half of the Backoffice session policy, resolved by `AdminGuard` on every
+ * admin request through ADMIN_SECURITY_POLICY.
+ *
+ * Both checks throw rather than return a verdict: a caller that forgets to branch on a
+ * boolean would silently grant access, which is the one failure mode this class exists
+ * to prevent.
+ */
+export class AdminSecurityService {
+    drizzle;
+    events;
+    sessions;
+    trustedDevices;
+    identityReader;
+    config;
+    geoIp;
+    constructor({ drizzle, events, sessions, trustedDevices, identityReader, config, geoIp, }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.sessions = sessions;
+        this.trustedDevices = trustedDevices;
+        this.identityReader = identityReader;
+        this.config = config;
+        this.geoIp = geoIp;
+        if (config.bindSessionToDevice && config.ipChangePolicy === 'country' && !geoIp) {
+            logger.warn('adminSecurity.ipChangePolicy is "country" but no GEO_IP_ADAPTER is bound - ' +
+                'IP changes will not end a session. Bind a geo-ip adapter or set the policy explicitly.');
+        }
+    }
+    async assertEnrolled({ userId, ip, userAgent }) {
+        if (!this.config.requireTwoFactor) {
+            return;
+        }
+        const [row] = await this.drizzle.db
+            .select({ twoFactorEnabled: user.twoFactorEnabled })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (row?.twoFactorEnabled === true) {
+            return;
+        }
+        this.events.emit('identity.2fa.enrollment_blocked', { userId, ip, userAgent });
+        throw new ORPCError('FORBIDDEN', {
+            message: 'Two-factor authentication must be configured before using the back office',
+            data: { reason: AuthGuardReasonSchema.enum.two_factor_required },
+        });
+    }
+    async assertSessionIntact({ userId, sessionId, ip, userAgent, }) {
+        if (!this.config.bindSessionToDevice || !sessionId) {
+            return;
+        }
+        const [row] = await this.drizzle.db
+            .select({
+            ipAddress: session.ipAddress,
+            userAgent: session.userAgent,
+            lastSeenAt: session.lastSeenAt,
+        })
+            .from(session)
+            .where(and(eq(session.id, sessionId), eq(session.userId, userId)))
+            .limit(1);
+        if (!row) {
+            return;
+        }
+        if (!isSameDevice(row.userAgent, userAgent)) {
+            await this.endCompromisedSession({ userId, sessionId, ip, userAgent }, 'user_agent');
+        }
+        if (await this.hasSuspiciousIpChange(row.ipAddress, ip)) {
+            await this.endCompromisedSession({ userId, sessionId, ip, userAgent }, 'ip');
+        }
+        await this.touchLastSeen(sessionId, row.lastSeenAt);
+    }
+    async hasSuspiciousIpChange(sessionIp, requestIp) {
+        const policy = this.config.ipChangePolicy;
+        if (policy === 'off' || !sessionIp || !requestIp || sessionIp === requestIp) {
+            return false;
+        }
+        if (policy === 'any') {
+            return true;
+        }
+        if (!this.geoIp) {
+            return false;
+        }
+        const [sessionCountry, requestCountry] = await Promise.all([
+            this.lookupCountry(sessionIp),
+            this.lookupCountry(requestIp),
+        ]);
+        return isSuspiciousIpChange({
+            policy,
+            sessionIp,
+            requestIp,
+            sessionCountry,
+            requestCountry,
+        });
+    }
+    async lookupCountry(ipAddress) {
+        try {
+            return (await this.geoIp?.lookup(ipAddress))?.countryCode ?? null;
+        }
+        catch (error) {
+            logger.warn(`geo-ip lookup failed for a session check: ${String(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Ends a session whose device or network no longer matches, and drops the trust that
+     * device held - otherwise the next login would silently skip the second factor on the
+     * very device that just failed the check.
+     */
+    async endCompromisedSession({ userId, sessionId, ip, userAgent }, mismatch) {
+        // No actorId: the guard forced this itself, not the device owner nor an admin -
+        // passing `userId` here would read in the audit trail as a self-revoke.
+        await this.sessions.revokeSession(userId, sessionId, undefined, { ip, userAgent });
+        await this.trustedDevices.revokeForDevice(userId, userAgent, undefined);
+        this.events.emit('identity.session.fingerprint_mismatch', {
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            sessionId,
+            mismatch,
+            ip,
+            userAgent,
+        });
+        throw new ORPCError('UNAUTHORIZED', {
+            message: 'Session ended because the device or network changed',
+            data: { reason: AuthGuardReasonSchema.enum.session_fingerprint_mismatch },
+        });
+    }
+    async touchLastSeen(sessionId, lastSeenAt) {
+        if (lastSeenAt && Date.now() - lastSeenAt.getTime() < LAST_SEEN_THROTTLE_MS) {
+            return;
+        }
+        await this.drizzle.db
+            .update(session)
+            .set({ lastSeenAt: sql `now()` })
+            .where(eq(session.id, sessionId));
+    }
+    /**
+     * What the Backoffice needs before it renders anything: whether this account still
+     * has to enrol, and whether the browser it is on holds an unexpired trust grant.
+     */
+    async status(userId, userAgent) {
+        const [row] = await this.drizzle.db
+            .select({
+            twoFactorEnabled: user.twoFactorEnabled,
+            twoFactorLockoutUntil: user.twoFactorLockoutUntil,
+        })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        const twoFactorEnabled = row?.twoFactorEnabled === true;
+        const devices = await this.trustedDevices.list(userId, userAgent);
+        const currentDevice = devices.find((device) => device.isCurrent);
+        const lockedUntil = row?.twoFactorLockoutUntil ?? null;
+        return {
+            twoFactorEnabled,
+            backupCodesRemaining: twoFactorEnabled ? await this.countBackupCodes(userId) : null,
+            enrollmentRequired: this.config.requireTwoFactor && !twoFactorEnabled,
+            trustedDeviceDays: this.config.trustedDeviceDays,
+            trustedDeviceUntil: currentDevice?.expiresAt ?? null,
+            lockedUntil: lockedUntil ? lockedUntil.toISOString() : null,
+        };
+    }
+    /**
+     * Counts what is left of the recovery set. better-auth stores the codes as a JSON
+     * array unless the operator opts into encryption, so an unreadable column is reported
+     * as unknown rather than as zero - claiming no codes remain would be worse than
+     * admitting the count cannot be taken.
+     */
+    async countBackupCodes(userId) {
+        const [row] = await this.drizzle.db
+            .select({ backupCodes: twoFactor.backupCodes })
+            .from(twoFactor)
+            .where(eq(twoFactor.userId, userId))
+            .limit(1);
+        if (!row) {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(row.backupCodes);
+            return Array.isArray(parsed) ? parsed.length : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    listTrustedDevices(userId, userAgent) {
+        return this.trustedDevices.list(userId, userAgent);
+    }
+    async revokeTrustedDevice(userId, deviceId, actorId, meta, keepSessionId) {
+        const { userAgent } = await this.trustedDevices.revoke(userId, deviceId, actorId, meta);
+        await this.endSessionsOnDevice(userId, userAgent, actorId, meta, keepSessionId);
+        return { success: true };
+    }
+    /**
+     * A revoked device loses its live sessions in the same breath, so the grant cannot
+     * outlive the revoke on the browser that already holds one.
+     *
+     * `keepSessionId` spares the caller's own session: revoking trust on the browser you
+     * are sitting in means "ask me for a code next time", not "sign me out now" - the same
+     * line `SessionService.revokeOwnSession` draws for sessions.
+     */
+    async endSessionsOnDevice(userId, deviceUserAgent, actorId, meta, keepSessionId) {
+        const active = await this.drizzle.db
+            .select({ id: session.id, userAgent: session.userAgent })
+            .from(session)
+            .where(and(eq(session.userId, userId), gt(session.expiresAt, sql `now()`)));
+        for (const row of active) {
+            if (row.id !== keepSessionId && isSameDevice(row.userAgent, deviceUserAgent)) {
+                await this.sessions.revokeSession(userId, row.id, actorId, meta);
+            }
+        }
+    }
+    /**
+     * Returns an account to the unenrolled state so its owner can set a second factor up
+     * again: the shared recovery path for a lost authenticator, since better-auth's own
+     * disable endpoint asks for the account's password and a locked-out admin has no way
+     * to reach it. The trust grants and live sessions go with it - leaving either behind
+     * would let a browser keep the access the reset exists to withdraw.
+     */
+    async resetTwoFactor(userId, actorId, reason, meta) {
+        if (userId === actorId) {
+            throw new SelfTwoFactorResetError();
+        }
+        const [account] = await this.drizzle.db
+            .select({ id: user.id })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (!account) {
+            throw new UserNotFoundError(userId);
+        }
+        // Both writes commit together: a process death between them would leave
+        // twoFactorEnabled true with no twoFactor row - locked out with no repair
+        // route, since resetting requires a Super Admin who is themselves gated on
+        // AdminGuard.assertEnrolled.
+        await this.drizzle.db.transaction(async (tx) => {
+            await tx.delete(twoFactor).where(eq(twoFactor.userId, userId));
+            await tx
+                .update(user)
+                .set({
+                twoFactorEnabled: false,
+                failedTwoFactorAttempts: 0,
+                twoFactorLockoutUntil: null,
+            })
+                .where(eq(user.id, userId));
+        });
+        await this.trustedDevices.revokeAllForUser(userId, actorId);
+        await this.sessions.revokeAllSessions(userId, actorId, meta);
+        this.events.emit('identity.2fa.reset', {
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            actorId,
+            reason,
+            ip: meta?.ip ?? null,
+            userAgent: meta?.userAgent ?? null,
+        });
+        return { success: true };
+    }
+    isTrustedDevice(userId, userAgent) {
+        return this.trustedDevices.isTrusted(userId, userAgent);
+    }
+}
+//# sourceMappingURL=admin-security.service.js.map

package/dist/pam/identity/service/admin-security.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-security.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/admin-security.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAGL,YAAY,EACZ,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,qBAAqB,GAQtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,OAAO,EACP,SAAS,EACT,IAAI,GAGL,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAGrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE9C,+EAA+E;AAC/E,iFAAiF;AACjF,oCAAoC;AACpC,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CACtD,yBAAyB,EACzB,yEAAyE,CAC1E,CAAC;AAEF,qFAAqF;AACrF,2CAA2C;AAC3C,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAY5C;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,QAAQ,CAAiB;IACzB,cAAc,CAAuB;IACrC,cAAc,CAAiB;IAC/B,MAAM,CAAsB;IAC5B,KAAK,CAA4B;IAElD,YAAY,EACV,OAAO,EACP,MAAM,EACN,QAAQ,EACR,cAAc,EACd,cAAc,EACd,MAAM,EACN,KAAK,GACoB;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CACT,6EAA6E;gBAC3E,wFAAwF,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAuB;QACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,GAAG,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;YAC/B,OAAO,EAAE,2EAA2E;YACpF,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,mBAAmB,EAAE;SACjE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,EACxB,MAAM,EACN,SAAS,EACT,EAAE,EACF,SAAS,GACW;QACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACjE,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,SAAwB,EACxB,SAAwB;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAC1C,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;SAC9B,CAAC,CAAC;QACH,OAAO,oBAAoB,CAAC;YAC1B,MAAM;YACN,SAAS;YACT,SAAS;YACT,cAAc;YACd,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,SAAiB;QAC3C,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,6CAA6C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAsD,EACxF,QAA6B;QAE7B,gFAAgF;QAChF,wEAAwE;QACxE,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACxD,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,SAAS;YACT,QAAQ;YACR,EAAE;YACF,SAAS;SACV,CAAC,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;YAClC,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,4BAA4B,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,SAAwB,EAAE,UAAuB;QAC3E,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAAkB,EAAE,SAAwB;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,MAAM,gBAAgB,GAAG,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,GAAG,EAAE,qBAAqB,IAAI,IAAI,CAAC;QAEvD,OAAO;YACL,gBAAgB;YAChB,oBAAoB,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YACnF,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,gBAAgB;YACrE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;YAChD,kBAAkB,EAAE,aAAa,EAAE,SAAS,IAAI,IAAI;YACpD,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;SAC5D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAAC,MAAkB;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;aAC9C,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,MAAkB,EAAE,SAAwB;QAC7D,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,MAAkB,EAClB,QAAkC,EAClC,OAAmB,EACnB,IAAiB,EACjB,aAA6B;QAE7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAkB,EAClB,eAA8B,EAC9B,OAAmB,EACnB,IAAiB,EACjB,aAA6B;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACjC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aACxD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,CAAC;QAE7E,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,EAAE,KAAK,aAAa,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,MAAkB,EAAE,OAAmB,EAAE,MAAc,EAAE,IAAiB;QAC7F,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACpC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACvB,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,6BAA6B;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC7C,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,MAAM,EAAE;iBACL,MAAM,CAAC,IAAI,CAAC;iBACZ,GAAG,CAAC;gBACH,gBAAgB,EAAE,KAAK;gBACvB,uBAAuB,EAAE,CAAC;gBAC1B,qBAAqB,EAAE,IAAI;aAC5B,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACrC,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,OAAO;YACP,MAAM;YACN,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED,eAAe,CAAC,MAAkB,EAAE,SAAwB;QAC1D,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/pam/identity/service/device-fingerprint.service.d.ts

@@ -0,0 +1,32 @@
+export type IpChangePolicy = 'off' | 'country' | 'any';
+export type DeviceDescription = {
+    label: string;
+    browser: string | null;
+    os: string | null;
+};
+export declare function normalizeUserAgent(userAgent: string | null | undefined): string;
+export declare function deviceHash(userAgent: string | null | undefined): string;
+export declare function isSameDevice(left: string | null | undefined, right: string | null | undefined): boolean;
+/**
+ * Turns a raw User-Agent into the browser/OS pair the session list shows. Deliberately
+ * a handful of patterns rather than a UA-parsing dependency: the value is a display
+ * label, and a wrong guess costs a cosmetic string, never an access decision.
+ */
+export declare function describeDevice(userAgent: string | null | undefined): DeviceDescription;
+/**
+ * Whether a mid-session IP change is suspicious enough to end the session.
+ *
+ * `country` needs both countries resolved - an unbound or failing geo-ip lookup
+ * yields nulls, and an unresolved lookup must never end a session on its own.
+ * `any` is the strictest setting and will log users out across NAT and mobile
+ * network hops, which is why it is not the default.
+ */
+export declare function isSuspiciousIpChange({ policy, sessionIp, requestIp, sessionCountry, requestCountry, }: {
+    policy: IpChangePolicy;
+    sessionIp: string | null;
+    requestIp: string | null;
+    sessionCountry?: string | null;
+    requestCountry?: string | null;
+}): boolean;
+export declare function trustedDeviceExpiry(trustedDeviceDays: number, now?: Date): Date;
+//# sourceMappingURL=device-fingerprint.service.d.ts.map

package/dist/pam/identity/service/device-fingerprint.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/device-fingerprint.service.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB,CAAC;AAOF,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAS/E;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEvE;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,OAAO,CAET;AAyBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAWtF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,EACd,cAAc,GACf,EAAE;IACD,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GAAG,OAAO,CAWV;AAED,wBAAgB,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,IAAI,CAErF"}

package/dist/pam/identity/service/device-fingerprint.service.js

@@ -0,0 +1,79 @@
+import { createHash } from 'node:crypto';
+const UNKNOWN_DEVICE_LABEL = 'Unknown device';
+// Browsers ship a new build every few weeks and every one of them changes the
+// User-Agent. Comparing raw strings would revoke every Backoffice session on each
+// auto-update, so the fingerprint keeps only the major version of each token.
+export function normalizeUserAgent(userAgent) {
+    if (!userAgent) {
+        return '';
+    }
+    return userAgent
+        .toLowerCase()
+        .replace(/(\d+)(?:\.\d+)+/g, '$1')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+export function deviceHash(userAgent) {
+    return createHash('sha256').update(normalizeUserAgent(userAgent)).digest('hex');
+}
+export function isSameDevice(left, right) {
+    return normalizeUserAgent(left) === normalizeUserAgent(right);
+}
+const BROWSER_PATTERNS = [
+    [/edg[ea]?\//i, 'Edge'],
+    [/opr\/|opera/i, 'Opera'],
+    [/chrome\/|crios\//i, 'Chrome'],
+    [/firefox\/|fxios\//i, 'Firefox'],
+    [/safari\//i, 'Safari'],
+];
+const OS_PATTERNS = [
+    [/windows nt/i, 'Windows'],
+    [/iphone|ipad|ipod/i, 'iOS'],
+    [/mac os x|macintosh/i, 'macOS'],
+    [/android/i, 'Android'],
+    [/linux/i, 'Linux'],
+];
+function matchFirst(userAgent, patterns) {
+    return patterns.find(([pattern]) => pattern.test(userAgent))?.[1] ?? null;
+}
+/**
+ * Turns a raw User-Agent into the browser/OS pair the session list shows. Deliberately
+ * a handful of patterns rather than a UA-parsing dependency: the value is a display
+ * label, and a wrong guess costs a cosmetic string, never an access decision.
+ */
+export function describeDevice(userAgent) {
+    if (!userAgent) {
+        return { label: UNKNOWN_DEVICE_LABEL, browser: null, os: null };
+    }
+    const browser = matchFirst(userAgent, BROWSER_PATTERNS);
+    const os = matchFirst(userAgent, OS_PATTERNS);
+    if (!browser && !os) {
+        return { label: UNKNOWN_DEVICE_LABEL, browser: null, os: null };
+    }
+    const label = [browser, os].filter((part) => part !== null).join(' on ');
+    return { label, browser, os };
+}
+/**
+ * Whether a mid-session IP change is suspicious enough to end the session.
+ *
+ * `country` needs both countries resolved - an unbound or failing geo-ip lookup
+ * yields nulls, and an unresolved lookup must never end a session on its own.
+ * `any` is the strictest setting and will log users out across NAT and mobile
+ * network hops, which is why it is not the default.
+ */
+export function isSuspiciousIpChange({ policy, sessionIp, requestIp, sessionCountry, requestCountry, }) {
+    if (policy === 'off' || !sessionIp || !requestIp || sessionIp === requestIp) {
+        return false;
+    }
+    if (policy === 'any') {
+        return true;
+    }
+    if (!sessionCountry || !requestCountry) {
+        return false;
+    }
+    return sessionCountry.toUpperCase() !== requestCountry.toUpperCase();
+}
+export function trustedDeviceExpiry(trustedDeviceDays, now = new Date()) {
+    return new Date(now.getTime() + trustedDeviceDays * 24 * 60 * 60 * 1000);
+}
+//# sourceMappingURL=device-fingerprint.service.js.map

package/dist/pam/identity/service/device-fingerprint.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/device-fingerprint.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUzC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C,8EAA8E;AAC9E,kFAAkF;AAClF,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,SAAoC;IACrE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS;SACb,WAAW,EAAE;SACb,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC;SACjC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAoC;IAC7D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAA+B,EAC/B,KAAgC;IAEhC,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,gBAAgB,GAA6C;IACjE,CAAC,aAAa,EAAE,MAAM,CAAC;IACvB,CAAC,cAAc,EAAE,OAAO,CAAC;IACzB,CAAC,mBAAmB,EAAE,QAAQ,CAAC;IAC/B,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjC,CAAC,WAAW,EAAE,QAAQ,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,GAA6C;IAC5D,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,CAAC,mBAAmB,EAAE,KAAK,CAAC;IAC5B,CAAC,qBAAqB,EAAE,OAAO,CAAC;IAChC,CAAC,UAAU,EAAE,SAAS,CAAC;IACvB,CAAC,QAAQ,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,SAAS,UAAU,CACjB,SAAiB,EACjB,QAAkD;IAElD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAoC;IACjE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,EACd,cAAc,GAOf;IACC,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,iBAAyB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC7E,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAC3E,CAAC"}

package/dist/pam/identity/service/identity.service.d.ts

@@ -1,5 +1,8 @@
 import { type EventBus, type NodeHeaders, DrizzleService } from '@openora/core/server';
-import type { CacheAdapter, RateLimiterAdapter, RateLimitKey, SendEmailPort, EmailTemplateRenderer, LoginInput, RegisterInput, Enable2faInput, Verify2faInput, Disable2faInput, RequestPasswordResetInput, VerifyPasswordResetOtpInput, ResetPasswordInput, ResendEmailVerificationInput, VerifyEmailInput, UpdateProfileInput, User, IdentityReader, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig, ClientMeta, GeoCheckCommands, PlayerProvisioning } from '@openora/core/contracts';
+import type { SessionService } from './session.service.js';
+import type { TrustedDeviceService } from './trusted-device.service.js';
+import type { TwoFactorLockoutService } from './two-factor-lockout.service.js';
+import type { CacheAdapter, RateLimiterAdapter, RateLimitKey, SendEmailPort, EmailTemplateRenderer, LoginInput, RegisterInput, Enable2faInput, Verify2faInput, Disable2faInput, RegenerateBackupCodesInput, TrustCurrentDeviceInput, RequestPasswordResetInput, VerifyPasswordResetOtpInput, ResetPasswordInput, ResendEmailVerificationInput, VerifyEmailInput, UpdateProfileInput, User, IdentityReader, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig, ClientMeta, GeoCheckCommands, PlayerProvisioning } from '@openora/core/contracts';
 export declare const UserNotFoundError: new (id: string) => Error;
 export declare const UsernameConflictError: new () => Error;
 export declare const SESSION_DURATION_IN_SECONDS: number;
@@ -15,6 +18,9 @@ export type IdentityServiceDeps = {
     geoCheck?: GeoCheckCommands;
     playerProvisioning?: PlayerProvisioning;
     cache?: CacheAdapter;
+    trustedDevices?: TrustedDeviceService;
+    twoFactorLockout?: TwoFactorLockoutService;
+    sessions?: SessionService;
 };
 /**
  * Thin wrapper over the shared better-auth instance (register/login/2FA/
@@ -39,7 +45,10 @@ export declare class IdentityService {
     private readonly geoCheck?;
     private readonly cache?;
     private readonly existingAccountSignUps;
-    constructor({ drizzle, events, identityReader, email, templateRenderer, options, limiter, platformConfig, geoCheck, playerProvisioning, cache, }: IdentityServiceDeps);
+    private readonly trustedDevices?;
+    private readonly twoFactorLockout?;
+    private readonly sessions?;
+    constructor({ drizzle, events, identityReader, email, templateRenderer, options, limiter, platformConfig, geoCheck, playerProvisioning, cache, trustedDevices, twoFactorLockout, sessions, }: IdentityServiceDeps);
     private findUserByEmail;
     private resolveUserLanguage;
     private get api();
@@ -92,6 +101,7 @@ export declare class IdentityService {
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         } | {
@@ -103,6 +113,7 @@ export declare class IdentityService {
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         };
@@ -138,6 +149,7 @@ export declare class IdentityService {
         emailVerified: boolean;
         theme: "light" | "dark" | "system";
         language: string;
+        twoFactorEnabled: boolean;
         createdAt: string;
         updatedAt: string;
     } | null>;
@@ -148,6 +160,25 @@ export declare class IdentityService {
     verifyTwoFactor(input: Verify2faInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;
+    /**
+     * Grants this browser its trust window without a sign-out. better-auth issues the
+     * trust cookie only on the sign-in leg of a challenge, so the grant has to replay
+     * that leg: the account proves its password and a fresh second factor, and the
+     * cookies better-auth returns are the ones the browser keeps.
+     */
+    trustCurrentDevice(input: TrustCurrentDeviceInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        success: true;
+    }>;
+    /**
+     * A step-up gate for the self-service routes that change standing 2FA state: the
+     * caller has to clear a live authenticator code, not just the account password.
+     * Routed through TwoFactorLockoutService so a hijacked session plus a reused
+     * password cannot grind the second factor here the way the password-only paths let it.
+     */
+    private assertFreshSecondFactor;
+    regenerateBackupCodes(input: RegenerateBackupCodesInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        backupCodes: string[];
+    }>;
     disableTwoFactor(input: Disable2faInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;
@@ -193,6 +224,7 @@ export declare class IdentityService {
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         } | {
@@ -204,6 +236,7 @@ export declare class IdentityService {
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         };
@@ -225,6 +258,7 @@ export declare class IdentityService {
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         } | {
@@ -236,6 +270,7 @@ export declare class IdentityService {
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         };

package/dist/pam/identity/service/identity.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAQf,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,UAAU,EAEV,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAqGjC,eAAO,MAAM,iBAAiB,2BAA4B,CAAC;AAC3D,eAAO,MAAM,qBAAqB,iBAA8D,CAAC;AA+CjG,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAkF7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IAMtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;gBAEhD,EACV,OAAO,EACP,MAAM,EACN,cAAc,EACd,KAAK,EACL,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,KAAK,GACN,EAAE,mBAAmB;YA+CR,eAAe;YAaf,mBAAmB;IAKjC,OAAO,KAAK,GAAG,GAId;IAED,OAAO,CAAC,cAAc;YAOR,aAAa;IAM3B,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAcxB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;;;YA0G9C,oBAAoB;YASpB,iBAAiB;IAS/B;;;;OAIG;YACW,yBAAyB;IAoCjC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW;;;IAUjE;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6T3E,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAYd,cAAc;IAc5B,OAAO,CAAC,2BAA2B;IAI7B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAwCpF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAiCrE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;;IAS1B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAmBnF,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAyBnF,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA2BrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAsBrD,sBAAsB,CAAC,KAAK,EAAE,2BAA2B;;;IAgBzD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAqBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAkB7F;;;;;;OAMG;IACG,qBAAqB,CAAC,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,WAAW;;;IAsBxF;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8EjF,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAYjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;CAgC5F"}
+{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAQf,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,UAAU,EAEV,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAwJjC,eAAO,MAAM,iBAAiB,2BAA4B,CAAC;AAC3D,eAAO,MAAM,qBAAqB,iBAA8D,CAAC;AA+CjG,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAkF7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAG3C,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IAMtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAuB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiB;gBAE/B,EACV,OAAO,EACP,MAAM,EACN,cAAc,EACd,KAAK,EACL,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,gBAAgB,EAChB,QAAQ,GACT,EAAE,mBAAmB;YAkDR,eAAe;YAaf,mBAAmB;IAKjC,OAAO,KAAK,GAAG,GAId;IAED,OAAO,CAAC,cAAc;YAOR,aAAa;IAM3B,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAcxB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;;;YA0G9C,oBAAoB;YASpB,iBAAiB;IAS/B;;;;OAIG;YACW,yBAAyB;IAoCjC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW;;;IAUjE;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwU3E,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAYd,cAAc;IAc5B,OAAO,CAAC,2BAA2B;IAI7B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAwCpF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAiCrE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;;;IAS1B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAmBnF,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA+DzF;;;;;OAKG;IACG,kBAAkB,CACtB,KAAK,EAAE,uBAAuB,EAC9B,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAiErB;;;;;OAKG;YACW,uBAAuB;IAmB/B,qBAAqB,CACzB,KAAK,EAAE,0BAA0B,EACjC,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAqCf,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAqCrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAsBrD,sBAAsB,CAAC,KAAK,EAAE,2BAA2B;;;IAgBzD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAqBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAkB7F;;;;;;OAMG;IACG,qBAAqB,CAAC,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,WAAW;;;IAsBxF;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8EjF,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAYjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC5F"}