@openora/core 0.4.1-canary.113 → 0.4.1-canary.115

package/dist/pam/identity/service/session.service.d.ts

@@ -1,7 +1,9 @@
 import { type EventBus, DrizzleService } from '@openora/core/server';
 import type { ClientMeta, IdentityReader, User, PaginationOptions } from '@openora/core/contracts';
+import { type Session } from '../schema/index.js';
 import { type SessionSortBy } from '../contract/index.js';
 export declare const SessionNotFoundError: new (id: string) => Error;
+export declare const CurrentSessionRevokeError: new () => Error;
 export type SessionServiceDeps = {
     drizzle: DrizzleService;
     events: EventBus;
@@ -14,7 +16,7 @@ export declare class SessionService {
     constructor({ drizzle, events, identityReader }: SessionServiceDeps);
     listSessions({ userId, currentSessionId, activeOnly, page, limit, sortBy, sortOrder, }: PaginationOptions<{
         userId: User['id'];
-        currentSessionId?: string;
+        currentSessionId?: Session['id'];
         activeOnly?: boolean;
     }, SessionSortBy>): Promise<{
         items: {
@@ -22,7 +24,41 @@ export declare class SessionService {
             expiresAt: string;
             createdAt: string;
             updatedAt: string;
+            lastSeenAt: string | null;
+            deviceLabel: string;
+            browser: string | null;
+            os: string | null;
+            current: boolean;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+        }[];
+        total: number;
+        page: number;
+        limit: number;
+    }>;
+    /**
+     * Every active session on the platform, newest first, with the account each belongs
+     * to. `listSessions` needs a userId and so cannot answer "who is logged in right now",
+     * which is what a Super Admin needs before revoking someone else's session.
+     */
+    listAllActiveSessions({ role, query, currentSessionId, page, limit, sortBy, sortOrder, }: PaginationOptions<{
+        role?: string | undefined;
+        query?: string | undefined;
+        currentSessionId?: string;
+    }, SessionSortBy>): Promise<{
+        items: {
+            id: string;
+            expiresAt: string;
+            createdAt: string;
+            updatedAt: string;
+            lastSeenAt: string | null;
+            deviceLabel: string;
+            browser: string | null;
+            os: string | null;
             current: boolean;
+            userId: string;
+            email: string;
+            role: string;
             ipAddress?: string | null | undefined;
             userAgent?: string | null | undefined;
         }[];
@@ -30,6 +66,14 @@ export declare class SessionService {
         page: number;
         limit: number;
     }>;
+    /**
+     * Self-service revoke. Refuses the caller's own session: ending it here would look
+     * like a silent logout rather than the deliberate "sign out" action, and the session
+     * list marks it as current precisely so it is not the one you cut off.
+     */
+    revokeOwnSession(userId: User['id'], id: Session['id'], currentSessionId: Session['id'] | undefined, meta?: ClientMeta): Promise<{
+        success: true;
+    }>;
     revokeSession(userId: User['id'], id: string, actorId?: User['id'], meta?: ClientMeta): Promise<{
         success: true;
     }>;

package/dist/pam/identity/service/session.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/session.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EACb,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEnG,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE5E,eAAO,MAAM,oBAAoB,2BAA+B,CAAC;AAEjE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;CAChC,CAAC;AAEF,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;gBAEpC,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,kBAAkB;IAM7D,YAAY,CAAC,EACjB,MAAM,EACN,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GACV,EAAE,iBAAiB,CAClB;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,EACvE,aAAa,CACd;;;;;;;;;;;;;;IA0CK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAwBrF,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;CAepF"}
+{"version":3,"file":"session.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/session.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EACb,cAAc,EAIf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAA4C,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIpG,eAAO,MAAM,oBAAoB,2BAA+B,CAAC;AACjE,eAAO,MAAM,yBAAyB,iBAGrC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;CAChC,CAAC;AAmBF,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;gBAEpC,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,kBAAkB;IAM7D,YAAY,CAAC,EACjB,MAAM,EACN,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GACV,EAAE,iBAAiB,CAClB;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,EAC9E,aAAa,CACd;;;;;;;;;;;;;;;;;;IAgCD;;;;OAIG;IACG,qBAAqB,CAAC,EAC1B,IAAI,EACJ,KAAK,EACL,gBAAgB,EAChB,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GACV,EAAE,iBAAiB,CAClB;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,EACpF,aAAa,CACd;;;;;;;;;;;;;;;;;;;;;IAiDD;;;;OAIG;IACG,gBAAgB,CACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EACjB,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,EAC3C,IAAI,CAAC,EAAE,UAAU;;;IAQb,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAwBrF,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;CAepF"}

package/dist/pam/identity/service/session.service.js

@@ -1,7 +1,25 @@
-import { pageToOffset, makeNotFoundError, } from '@openora/core/server';
-import { eq, asc, desc, and, gt, count, sql } from 'drizzle-orm';
-import { session } from '../schema/index.js';
+import { pageToOffset, makeNotFoundError, makeConflictError, } from '@openora/core/server';
+import { eq, asc, desc, and, gt, count, ilike, sql } from 'drizzle-orm';
+import { session, user } from '../schema/index.js';
+import { describeDevice } from './device-fingerprint.service.js';
 export const SessionNotFoundError = makeNotFoundError('Session');
+export const CurrentSessionRevokeError = makeConflictError('CurrentSessionRevokeError', 'The current session cannot be revoked - sign out instead');
+function toSessionItem(row, currentSessionId) {
+    const { label, browser, os } = describeDevice(row.userAgent);
+    return {
+        id: row.id,
+        expiresAt: row.expiresAt.toISOString(),
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+        lastSeenAt: row.lastSeenAt?.toISOString() ?? null,
+        ipAddress: row.ipAddress,
+        userAgent: row.userAgent,
+        deviceLabel: label,
+        browser,
+        os,
+        current: row.id === currentSessionId,
+    };
+}
 export class SessionService {
     drizzle;
     events;
@@ -35,20 +53,71 @@ export class SessionService {
             db.select({ n: count() }).from(session).where(where),
         ]);
         return {
-            items: rows.map((s) => ({
-                id: s.id,
-                expiresAt: s.expiresAt.toISOString(),
-                createdAt: s.createdAt.toISOString(),
-                updatedAt: s.updatedAt.toISOString(),
-                ipAddress: s.ipAddress,
-                userAgent: s.userAgent,
-                current: s.id === currentSessionId,
-            })),
+            items: rows.map((s) => toSessionItem(s, currentSessionId)),
             total: Number(n),
             page,
             limit,
         };
     }
+    /**
+     * Every active session on the platform, newest first, with the account each belongs
+     * to. `listSessions` needs a userId and so cannot answer "who is logged in right now",
+     * which is what a Super Admin needs before revoking someone else's session.
+     */
+    async listAllActiveSessions({ role, query, currentSessionId, page, limit, sortBy, sortOrder, }) {
+        const db = this.drizzle.db;
+        const filters = [gt(session.expiresAt, sql `now()`)];
+        if (role) {
+            filters.push(eq(user.role, role));
+        }
+        if (query) {
+            filters.push(ilike(user.email, `%${query}%`));
+        }
+        const where = and(...filters);
+        const dir = (sortOrder ?? 'desc') === 'asc' ? asc : desc;
+        const col = sortBy === 'expiresAt'
+            ? session.expiresAt
+            : sortBy === 'updatedAt'
+                ? session.updatedAt
+                : session.createdAt;
+        const [rows, [countRow]] = await Promise.all([
+            db
+                .select({ session, email: user.email, role: user.role })
+                .from(session)
+                .innerJoin(user, eq(session.userId, user.id))
+                .where(where)
+                .orderBy(dir(col))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            db
+                .select({ n: count() })
+                .from(session)
+                .innerJoin(user, eq(session.userId, user.id))
+                .where(where),
+        ]);
+        return {
+            items: rows.map((row) => ({
+                ...toSessionItem(row.session, currentSessionId),
+                userId: row.session.userId,
+                email: row.email,
+                role: row.role,
+            })),
+            total: Number(countRow?.n ?? 0),
+            page,
+            limit,
+        };
+    }
+    /**
+     * Self-service revoke. Refuses the caller's own session: ending it here would look
+     * like a silent logout rather than the deliberate "sign out" action, and the session
+     * list marks it as current precisely so it is not the one you cut off.
+     */
+    async revokeOwnSession(userId, id, currentSessionId, meta) {
+        if (currentSessionId && id === currentSessionId) {
+            throw new CurrentSessionRevokeError();
+        }
+        return this.revokeSession(userId, id, userId, meta);
+    }
     async revokeSession(userId, id, actorId, meta) {
         const updated = await this.drizzle.db
             .update(session)

package/dist/pam/identity/service/session.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/session.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,YAAY,EACZ,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAQjE,MAAM,OAAO,cAAc;IACR,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,cAAc,CAAiB;IAEhD,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAsB;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EACjB,MAAM,EACN,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GAIV;QACC,MAAM,KAAK,GAAG,UAAU;YACtB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC;YACpE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,oFAAoF;QACpF,MAAM,WAAW,GAAG,GAAG,CAAQ,aAAa,OAAO,CAAC,SAAS,4BAA4B,CAAC;QAC1F,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,GAAG,GACP,MAAM,KAAK,WAAW;YACpB,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,MAAM,KAAK,WAAW;gBACtB,CAAC,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,EAAE;iBACC,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBAC3D,KAAK,CAAC,KAAK,CAAC;iBACZ,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;SACrD,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CACb,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC;gBACnB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;gBACpC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,gBAAgB;aACnC,CAAC,CACH;YACD,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAChB,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,EAAU,EAAE,OAAoB,EAAE,IAAiB;QACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,OAAO,CAAC;YAChB,yEAAyE;YACzE,+EAA+E;aAC9E,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1D,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,SAAS,EAAE,EAAE;YACb,OAAO;YACP,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAkB,EAAE,OAAoB,EAAE,IAAiB;QACjF,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,CAAC;QAE7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAChD,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,OAAO;YACP,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"session.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/session.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAgB,MAAM,oBAAoB,CAAC;AAGjE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CACxD,2BAA2B,EAC3B,0DAA0D,CAC3D,CAAC;AAQF,SAAS,aAAa,CAAC,GAAY,EAAE,gBAAgC;IACnE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;QACjD,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,KAAK;QAClB,OAAO;QACP,EAAE;QACF,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,gBAAgB;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACR,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,cAAc,CAAiB;IAEhD,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAsB;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EACjB,MAAM,EACN,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GAIV;QACC,MAAM,KAAK,GAAG,UAAU;YACtB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC;YACpE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,oFAAoF;QACpF,MAAM,WAAW,GAAG,GAAG,CAAQ,aAAa,OAAO,CAAC,SAAS,4BAA4B,CAAC;QAC1F,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,GAAG,GACP,MAAM,KAAK,WAAW;YACpB,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,MAAM,KAAK,WAAW;gBACtB,CAAC,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,EAAE;iBACC,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBAC3D,KAAK,CAAC,KAAK,CAAC;iBACZ,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;SACrD,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC1D,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAChB,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,qBAAqB,CAAC,EAC1B,IAAI,EACJ,KAAK,EACL,gBAAgB,EAChB,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GAIV;QACC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC;QACpD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,GAAG,GACP,MAAM,KAAK,WAAW;YACpB,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,MAAM,KAAK,WAAW;gBACtB,CAAC,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAE1B,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,EAAE;iBACC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;iBACvD,IAAI,CAAC,OAAO,CAAC;iBACb,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;iBAC5C,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;iBACjB,KAAK,CAAC,KAAK,CAAC;iBACZ,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,EAAE;iBACC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;iBACtB,IAAI,CAAC,OAAO,CAAC;iBACb,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;iBAC5C,KAAK,CAAC,KAAK,CAAC;SAChB,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CACb,CAAC,GAAG,EAAqB,EAAE,CAAC,CAAC;gBAC3B,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBAC/C,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;gBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CACH;YACD,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI;YACJ,KAAK;SACN,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAkB,EAClB,EAAiB,EACjB,gBAA2C,EAC3C,IAAiB;QAEjB,IAAI,gBAAgB,IAAI,EAAE,KAAK,gBAAgB,EAAE,CAAC;YAChD,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,EAAU,EAAE,OAAoB,EAAE,IAAiB;QACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,OAAO,CAAC;YAChB,yEAAyE;YACzE,+EAA+E;aAC9E,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1D,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,SAAS,EAAE,EAAE;YACb,OAAO;YACP,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAkB,EAAE,OAAoB,EAAE,IAAiB;QACjF,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,CAAC;QAE7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAChD,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,OAAO;YACP,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;CACF"}

package/dist/pam/identity/service/trusted-device.service.d.ts

@@ -0,0 +1,54 @@
+import { type EventBus, DrizzleService } from '@openora/core/server';
+import type { ClientMeta, User } from '@openora/core/contracts';
+import { type AdminTrustedDevice } from '../schema/index.js';
+export declare const TrustedDeviceNotFoundError: new (id: string) => Error;
+export type TrustedDeviceItem = {
+    id: string;
+    label: string;
+    ipAddress: string | null;
+    browser: string | null;
+    os: string | null;
+    lastUsedAt: string;
+    expiresAt: string;
+    isCurrent: boolean;
+};
+export type TrustedDeviceServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    trustedDeviceDays: number;
+};
+/**
+ * Server-side half of "trusted device". better-auth issues an opaque trust cookie that
+ * nothing can enumerate or revoke; a device skips the second factor only when that
+ * cookie AND an unrevoked row here are both present, which is what makes the 30-day
+ * window listable, auditable, and revocable by the user or a Super Admin.
+ */
+export declare class TrustedDeviceService {
+    private readonly drizzle;
+    private readonly events;
+    private readonly trustedDeviceDays;
+    constructor({ drizzle, events, trustedDeviceDays }: TrustedDeviceServiceDeps);
+    trust(userId: User['id'], meta: ClientMeta): Promise<{
+        id: string;
+        expiresAt: Date;
+    } | null>;
+    isTrusted(userId: User['id'], userAgent: string | null): Promise<boolean>;
+    list(userId: User['id'], currentUserAgent: string | null): Promise<TrustedDeviceItem[]>;
+    revoke(userId: User['id'], deviceId: AdminTrustedDevice['id'], actorId: User['id'], meta?: ClientMeta): Promise<{
+        success: true;
+        userAgent: string | null;
+    }>;
+    /**
+     * Drops the trust granted to the device a compromised session was riding on, so the
+     * forced logout is followed by a full re-authentication instead of a silent skip.
+     */
+    /**
+     * `actorId` is absent when `AdminGuard` forces this itself (a fingerprint mismatch,
+     * not an admin or the device owner acting) - the audit trail attributes that case to
+     * the system rather than mislabeling it as a self-revoke.
+     */
+    revokeForDevice(userId: User['id'], userAgent: string | null, actorId?: User['id']): Promise<void>;
+    revokeAllForUser(userId: User['id'], actorId: User['id']): Promise<void>;
+    private activeDeviceWhere;
+}
+//# sourceMappingURL=trusted-device.service.d.ts.map

package/dist/pam/identity/service/trusted-device.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-device.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/trusted-device.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,cAAc,EAAqB,MAAM,sBAAsB,CAAC;AAExF,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGjF,eAAO,MAAM,0BAA0B,2BAAsC,CAAC;AAE9E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,wBAAwB;IAMtE,KAAK,CACT,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IA6C5C,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IASzE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAuBvF,MAAM,CACV,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAClC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EACnB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IA4BvD;;;OAGG;IACH;;;;OAIG;IACG,eAAe,CACnB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GACnB,OAAO,CAAC,IAAI,CAAC;IAkBV,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB9E,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/pam/identity/service/trusted-device.service.js

@@ -0,0 +1,157 @@
+import { makeNotFoundError } from '@openora/core/server';
+import { and, desc, eq, gt, isNull, sql } from 'drizzle-orm';
+import { adminTrustedDevice } from '../schema/index.js';
+import { deviceHash, describeDevice, trustedDeviceExpiry } from './device-fingerprint.service.js';
+export const TrustedDeviceNotFoundError = makeNotFoundError('Trusted device');
+/**
+ * Server-side half of "trusted device". better-auth issues an opaque trust cookie that
+ * nothing can enumerate or revoke; a device skips the second factor only when that
+ * cookie AND an unrevoked row here are both present, which is what makes the 30-day
+ * window listable, auditable, and revocable by the user or a Super Admin.
+ */
+export class TrustedDeviceService {
+    drizzle;
+    events;
+    trustedDeviceDays;
+    constructor({ drizzle, events, trustedDeviceDays }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.trustedDeviceDays = trustedDeviceDays;
+    }
+    async trust(userId, meta) {
+        if (this.trustedDeviceDays <= 0) {
+            return null;
+        }
+        const hash = deviceHash(meta.userAgent);
+        const { label } = describeDevice(meta.userAgent);
+        const expiresAt = trustedDeviceExpiry(this.trustedDeviceDays);
+        const [row] = await this.drizzle.db
+            .insert(adminTrustedDevice)
+            .values({
+            userId,
+            deviceHash: hash,
+            label,
+            ipAddress: meta.ip ?? null,
+            userAgent: meta.userAgent ?? null,
+            expiresAt,
+        })
+            .onConflictDoUpdate({
+            target: [adminTrustedDevice.userId, adminTrustedDevice.deviceHash],
+            set: {
+                label,
+                ipAddress: meta.ip ?? null,
+                userAgent: meta.userAgent ?? null,
+                expiresAt,
+                lastUsedAt: sql `now()`,
+                revokedAt: null,
+                revokedBy: null,
+            },
+        })
+            .returning({ id: adminTrustedDevice.id, expiresAt: adminTrustedDevice.expiresAt });
+        if (!row) {
+            return null;
+        }
+        this.events.emit('identity.trusted_device.added', {
+            userId,
+            deviceId: row.id,
+            label,
+            expiresAt: row.expiresAt.toISOString(),
+            ip: meta.ip ?? null,
+            userAgent: meta.userAgent ?? null,
+        });
+        return row;
+    }
+    async isTrusted(userId, userAgent) {
+        const [row] = await this.drizzle.db
+            .select({ id: adminTrustedDevice.id })
+            .from(adminTrustedDevice)
+            .where(this.activeDeviceWhere(userId, deviceHash(userAgent)))
+            .limit(1);
+        return row !== undefined;
+    }
+    async list(userId, currentUserAgent) {
+        const currentHash = deviceHash(currentUserAgent);
+        const rows = await this.drizzle.db
+            .select()
+            .from(adminTrustedDevice)
+            .where(and(eq(adminTrustedDevice.userId, userId), isNull(adminTrustedDevice.revokedAt)))
+            .orderBy(desc(adminTrustedDevice.lastUsedAt));
+        return rows.map((row) => {
+            const { browser, os } = describeDevice(row.userAgent);
+            return {
+                id: row.id,
+                label: row.label,
+                ipAddress: row.ipAddress,
+                browser,
+                os,
+                lastUsedAt: row.lastUsedAt.toISOString(),
+                expiresAt: row.expiresAt.toISOString(),
+                isCurrent: row.deviceHash === currentHash,
+            };
+        });
+    }
+    async revoke(userId, deviceId, actorId, meta) {
+        const revoked = await this.drizzle.db
+            .update(adminTrustedDevice)
+            .set({ revokedAt: sql `now()`, revokedBy: actorId })
+            .where(and(eq(adminTrustedDevice.id, deviceId), eq(adminTrustedDevice.userId, userId), isNull(adminTrustedDevice.revokedAt)))
+            .returning({ id: adminTrustedDevice.id, userAgent: adminTrustedDevice.userAgent });
+        const [row] = revoked;
+        if (!row) {
+            throw new TrustedDeviceNotFoundError(deviceId);
+        }
+        this.events.emit('identity.trusted_device.revoked', {
+            userId,
+            deviceId,
+            actorId,
+            ip: meta?.ip ?? null,
+            userAgent: meta?.userAgent ?? null,
+        });
+        return { success: true, userAgent: row.userAgent };
+    }
+    /**
+     * Drops the trust granted to the device a compromised session was riding on, so the
+     * forced logout is followed by a full re-authentication instead of a silent skip.
+     */
+    /**
+     * `actorId` is absent when `AdminGuard` forces this itself (a fingerprint mismatch,
+     * not an admin or the device owner acting) - the audit trail attributes that case to
+     * the system rather than mislabeling it as a self-revoke.
+     */
+    async revokeForDevice(userId, userAgent, actorId) {
+        const revoked = await this.drizzle.db
+            .update(adminTrustedDevice)
+            .set({ revokedAt: sql `now()`, revokedBy: actorId ?? null })
+            .where(this.activeDeviceWhere(userId, deviceHash(userAgent)))
+            .returning({ id: adminTrustedDevice.id });
+        for (const row of revoked) {
+            this.events.emit('identity.trusted_device.revoked', {
+                userId,
+                deviceId: row.id,
+                actorId,
+                ip: null,
+                userAgent,
+            });
+        }
+    }
+    async revokeAllForUser(userId, actorId) {
+        const revoked = await this.drizzle.db
+            .update(adminTrustedDevice)
+            .set({ revokedAt: sql `now()`, revokedBy: actorId })
+            .where(and(eq(adminTrustedDevice.userId, userId), isNull(adminTrustedDevice.revokedAt), gt(adminTrustedDevice.expiresAt, sql `now()`)))
+            .returning({ id: adminTrustedDevice.id, userAgent: adminTrustedDevice.userAgent });
+        for (const row of revoked) {
+            this.events.emit('identity.trusted_device.revoked', {
+                userId,
+                deviceId: row.id,
+                actorId,
+                ip: null,
+                userAgent: row.userAgent,
+            });
+        }
+    }
+    activeDeviceWhere(userId, hash) {
+        return and(eq(adminTrustedDevice.userId, userId), eq(adminTrustedDevice.deviceHash, hash), isNull(adminTrustedDevice.revokedAt), gt(adminTrustedDevice.expiresAt, sql `now()`));
+    }
+}
+//# sourceMappingURL=trusted-device.service.js.map

package/dist/pam/identity/service/trusted-device.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-device.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/trusted-device.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,kBAAkB,EAA2B,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAElG,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;AAmB9E;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,iBAAiB,CAAS;IAE3C,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAA4B;QAC1E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAAkB,EAClB,IAAgB;QAEhB,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,MAAM,CAAC;YACN,MAAM;YACN,UAAU,EAAE,IAAI;YAChB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YAC1B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,SAAS;SACV,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC;YAClE,GAAG,EAAE;gBACH,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;gBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,SAAS;gBACT,UAAU,EAAE,GAAG,CAAA,OAAO;gBACtB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,IAAI;aAChB;SACF,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;QAErF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAChD,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,KAAK;YACL,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;YACtC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;SAClC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAkB,EAAE,SAAwB;QAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC;aACrC,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;aAC5D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAkB,EAAE,gBAA+B;QAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAC/B,MAAM,EAAE;aACR,IAAI,CAAC,kBAAkB,CAAC;aACxB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;aACvF,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAqB,EAAE;YACzC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO;gBACP,EAAE;gBACF,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;gBACxC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;gBACtC,SAAS,EAAE,GAAG,CAAC,UAAU,KAAK,WAAW;aAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CACV,MAAkB,EAClB,QAAkC,EAClC,OAAmB,EACnB,IAAiB;QAEjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;aAClD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,EACnC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CACrC,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;QAErF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;QACtB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAClD,MAAM;YACN,QAAQ;YACR,OAAO;YACP,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,MAAkB,EAClB,SAAwB,EACxB,OAAoB;QAEpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;aAC1D,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;aAC5D,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAClD,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAChB,OAAO;gBACP,EAAE,EAAE,IAAI;gBACR,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAkB,EAAE,OAAmB;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;aAClD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACpC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAC7C,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;QAErF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAClD,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAChB,OAAO;gBACP,EAAE,EAAE,IAAI;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,MAAkB,EAAE,IAAY;QACxD,OAAO,GAAG,CACR,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,EACvC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACpC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/pam/identity/service/two-factor-lockout.service.d.ts

@@ -0,0 +1,25 @@
+import { type EventBus, DrizzleService } from '@openora/core/server';
+import type { AdminSecurityConfig, ClientMeta, IdentityReader, User } from '@openora/core/contracts';
+export type TwoFactorLockoutServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    identityReader: IdentityReader;
+    config: AdminSecurityConfig['twoFactorLockout'];
+};
+/**
+ * Consecutive-failure lockout for the second factor, counted per account and kept in
+ * columns of its own: a second-factor lockout must not consume the password-login
+ * budget, and the two thresholds are configured independently.
+ */
+export declare class TwoFactorLockoutService {
+    private readonly drizzle;
+    private readonly events;
+    private readonly identityReader;
+    private readonly config;
+    constructor({ drizzle, events, identityReader, config }: TwoFactorLockoutServiceDeps);
+    resolvePendingUserId(cookieValue: string | undefined): Promise<User['id'] | undefined>;
+    assertNotLocked(userId: User['id']): Promise<void>;
+    recordFailure(userId: User['id'], meta: ClientMeta): Promise<void>;
+    reset(userId: User['id']): Promise<void>;
+}
+//# sourceMappingURL=two-factor-lockout.service.d.ts.map

package/dist/pam/identity/service/two-factor-lockout.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-lockout.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/two-factor-lockout.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,KAAK,EACV,mBAAmB,EACnB,UAAU,EACV,cAAc,EACd,IAAI,EACL,MAAM,yBAAyB,CAAC;AAuBjC,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;CACjD,CAAC;AAEF;;;;GAIG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAErD,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,2BAA2B;IAO9E,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAatF,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlD,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DlE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}

package/dist/pam/identity/service/two-factor-lockout.service.js

@@ -0,0 +1,121 @@
+import { eq, sql } from 'drizzle-orm';
+import { user, verification } from '../schema/index.js';
+import { computeLockoutTier, createAccountLockedError, isActiveLockout, } from './lockout-policy.service.js';
+// better-auth withholds the session until the second factor clears, so a failing
+// attempt has no session to identify. It does store the pending user id in a
+// verification row keyed by the identifier it puts in the signed two-factor cookie
+// (`2fa-<random>`), which is what lets the lockout follow the account rather than
+// only the browser. Cookie value is `<identifier>.<signature>`.
+const PENDING_2FA_IDENTIFIER_PREFIX = '2fa-';
+function pendingIdentifier(cookieValue) {
+    if (!cookieValue) {
+        return undefined;
+    }
+    const [identifier = ''] = cookieValue.split('.');
+    return identifier.startsWith(PENDING_2FA_IDENTIFIER_PREFIX) ? identifier : undefined;
+}
+/**
+ * Consecutive-failure lockout for the second factor, counted per account and kept in
+ * columns of its own: a second-factor lockout must not consume the password-login
+ * budget, and the two thresholds are configured independently.
+ */
+export class TwoFactorLockoutService {
+    drizzle;
+    events;
+    identityReader;
+    config;
+    constructor({ drizzle, events, identityReader, config }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.identityReader = identityReader;
+        this.config = config;
+    }
+    async resolvePendingUserId(cookieValue) {
+        const identifier = pendingIdentifier(cookieValue);
+        if (!identifier) {
+            return undefined;
+        }
+        const [row] = await this.drizzle.db
+            .select({ value: verification.value })
+            .from(verification)
+            .where(eq(verification.identifier, identifier))
+            .limit(1);
+        return row?.value;
+    }
+    async assertNotLocked(userId) {
+        const [row] = await this.drizzle.db
+            .select({ lockoutUntil: user.twoFactorLockoutUntil })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (isActiveLockout(row?.lockoutUntil)) {
+            throw createAccountLockedError(row?.lockoutUntil ?? new Date());
+        }
+    }
+    async recordFailure(userId, meta) {
+        const [row] = await this.drizzle.db
+            .select({
+            failedAttempts: user.failedTwoFactorAttempts,
+            lockoutCount: user.twoFactorLockoutCount,
+            lastFailedAt: user.lastFailedTwoFactorAt,
+        })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (!row) {
+            return;
+        }
+        const attempts = row.failedAttempts + 1;
+        const isLocking = attempts >= this.config.maxAttempts;
+        const { durationMs } = computeLockoutTier({
+            lockoutCount: row.lockoutCount,
+            lastFailedLoginAt: row.lastFailedAt,
+            nowMs: Date.now(),
+            fallbackDurationMs: this.config.durationMs,
+        });
+        const lockoutUntil = isLocking ? new Date(Date.now() + durationMs) : null;
+        await this.drizzle.db
+            .update(user)
+            .set({
+            failedTwoFactorAttempts: isLocking ? 0 : attempts,
+            lastFailedTwoFactorAt: sql `now()`,
+            ...(isLocking
+                ? {
+                    twoFactorLockoutUntil: lockoutUntil,
+                    twoFactorLockoutCount: row.lockoutCount + 1,
+                }
+                : {}),
+        })
+            .where(eq(user.id, userId));
+        const playerId = await this.identityReader.getPlayerIdByUserIdSafe(userId);
+        this.events.emit('identity.2fa.failed', {
+            userId,
+            playerId,
+            method: 'totp',
+            attemptsRemaining: isLocking ? 0 : Math.max(this.config.maxAttempts - attempts, 0),
+            ip: meta.ip ?? null,
+            userAgent: meta.userAgent ?? null,
+        });
+        if (lockoutUntil) {
+            this.events.emit('identity.2fa.lockout.triggered', {
+                userId,
+                playerId,
+                lockoutUntil: lockoutUntil.toISOString(),
+                ip: meta.ip ?? null,
+                userAgent: meta.userAgent ?? null,
+            });
+            throw createAccountLockedError(lockoutUntil);
+        }
+    }
+    async reset(userId) {
+        await this.drizzle.db
+            .update(user)
+            .set({
+            failedTwoFactorAttempts: 0,
+            twoFactorLockoutUntil: null,
+            lastFailedTwoFactorAt: null,
+        })
+            .where(eq(user.id, userId));
+    }
+}
+//# sourceMappingURL=two-factor-lockout.service.js.map

package/dist/pam/identity/service/two-factor-lockout.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-lockout.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/two-factor-lockout.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAOtC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,6BAA6B,CAAC;AAErC,iFAAiF;AACjF,6EAA6E;AAC7E,mFAAmF;AACnF,kFAAkF;AAClF,gEAAgE;AAChE,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAE7C,SAAS,iBAAiB,CAAC,WAA+B;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AASD;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IACjB,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,cAAc,CAAiB;IAC/B,MAAM,CAA0C;IAEjE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAA+B;QAClF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAA+B;QACxD,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;aACrC,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAkB;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;aACpD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACvC,MAAM,wBAAwB,CAAC,GAAG,EAAE,YAAY,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,IAAgB;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,cAAc,EAAE,IAAI,CAAC,uBAAuB;YAC5C,YAAY,EAAE,IAAI,CAAC,qBAAqB;YACxC,YAAY,EAAE,IAAI,CAAC,qBAAqB;SACzC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACtD,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC;YACxC,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,iBAAiB,EAAE,GAAG,CAAC,YAAY;YACnC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YACjB,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;SAC3C,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1E,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC;YACH,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;YACjD,qBAAqB,EAAE,GAAG,CAAA,OAAO;YACjC,GAAG,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,qBAAqB,EAAE,YAAY;oBACnC,qBAAqB,EAAE,GAAG,CAAC,YAAY,GAAG,CAAC;iBAC5C;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAE9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACtC,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,MAAM;YACd,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,QAAQ,EAAE,CAAC,CAAC;YAClF,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;SAClC,CAAC,CAAC;QAEH,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACjD,MAAM;gBACN,QAAQ;gBACR,YAAY,EAAE,YAAY,CAAC,WAAW,EAAE;gBACxC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;aAClC,CAAC,CAAC;YACH,MAAM,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAkB;QAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC;YACH,uBAAuB,EAAE,CAAC;YAC1B,qBAAqB,EAAE,IAAI;YAC3B,qBAAqB,EAAE,IAAI;SAC5B,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/pam/player-management/plugin.d.ts

@@ -7,6 +7,7 @@ declare const _default: {
         ADMIN_PERMISSION_RESOLVER: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPermissionResolver>;
         ADMIN_PLAYER_ACTIVITY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPlayerActivity>;
         ADMIN_ROLE_ASSIGNMENT_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminRoleAssignmentDirectory>;
+        ADMIN_SECURITY_POLICY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminSecurityPolicy>;
         ADMIN_USER_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminUserDirectory>;
         ADMIN_WALLET_REPORTING: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminWalletReporting>;
         AUDIT_WRITER: import("@openora/core/contracts").SealedToken<import("@openora/core/contracts").AuditWritePort>;
@@ -81,6 +82,16 @@ declare const _default: {
             chat: {
                 allowedAttachmentHosts: string[];
             };
+            adminSecurity: {
+                requireTwoFactor: boolean;
+                bindSessionToDevice: boolean;
+                trustedDeviceDays: number;
+                ipChangePolicy: "any" | "country" | "off";
+                twoFactorLockout: {
+                    maxAttempts: number;
+                    durationMs: number;
+                };
+            };
             activeBrand?: string | undefined;
             kyc?: {
                 gateWithdrawals: boolean;

package/dist/pam/player-management/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/player-management/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,wBAa8C"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/player-management/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,wBAa8C"}