npm - @openora/core - Versions diffs - 0.4.1-canary.113 → 0.4.1-canary.115 - Mend

@openora/core 0.4.1-canary.113 → 0.4.1-canary.115

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (206) hide show

package/dist/pam/player-note/plugin.d.ts CHANGED Viewed

@@ -7,6 +7,7 @@ declare const _default: {
         ADMIN_PERMISSION_RESOLVER: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPermissionResolver>;
         ADMIN_PLAYER_ACTIVITY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPlayerActivity>;
         ADMIN_ROLE_ASSIGNMENT_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminRoleAssignmentDirectory>;
+        ADMIN_SECURITY_POLICY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminSecurityPolicy>;
         ADMIN_USER_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminUserDirectory>;
         ADMIN_WALLET_REPORTING: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminWalletReporting>;
         AUDIT_WRITER: import("@openora/core/contracts").SealedToken<import("@openora/core/contracts").AuditWritePort>;
@@ -81,6 +82,16 @@ declare const _default: {
             chat: {
                 allowedAttachmentHosts: string[];
             };
+            adminSecurity: {
+                requireTwoFactor: boolean;
+                bindSessionToDevice: boolean;
+                trustedDeviceDays: number;
+                ipChangePolicy: "any" | "country" | "off";
+                twoFactorLockout: {
+                    maxAttempts: number;
+                    durationMs: number;
+                };
+            };
             activeBrand?: string | undefined;
             kyc?: {
                 gateWithdrawals: boolean;

package/dist/pam/player-note/plugin.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/player-note/plugin.ts"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~AAMA,wBAY8C"}
1	+ {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/player-note/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA,wBAY8C"}

package/dist/pam/profile/plugin.d.ts CHANGED Viewed

@@ -6,6 +6,7 @@ declare const _default: {
         ADMIN_PERMISSION_RESOLVER: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPermissionResolver>;
         ADMIN_PLAYER_ACTIVITY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPlayerActivity>;
         ADMIN_ROLE_ASSIGNMENT_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminRoleAssignmentDirectory>;
+        ADMIN_SECURITY_POLICY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminSecurityPolicy>;
         ADMIN_USER_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminUserDirectory>;
         ADMIN_WALLET_REPORTING: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminWalletReporting>;
         AUDIT_WRITER: import("@openora/core/contracts").SealedToken<import("@openora/core/contracts").AuditWritePort>;
@@ -80,6 +81,16 @@ declare const _default: {
             chat: {
                 allowedAttachmentHosts: string[];
             };
+            adminSecurity: {
+                requireTwoFactor: boolean;
+                bindSessionToDevice: boolean;
+                trustedDeviceDays: number;
+                ipChangePolicy: "any" | "country" | "off";
+                twoFactorLockout: {
+                    maxAttempts: number;
+                    durationMs: number;
+                };
+            };
             activeBrand?: string | undefined;
             kyc?: {
                 gateWithdrawals: boolean;

package/dist/pam/profile/plugin.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/profile/plugin.ts"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~AASA,wBAM8C"}
1	+ {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/profile/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,wBAM8C"}

package/dist/pam/tag/plugin.d.ts CHANGED Viewed

@@ -7,6 +7,7 @@ declare const _default: {
         ADMIN_PERMISSION_RESOLVER: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPermissionResolver>;
         ADMIN_PLAYER_ACTIVITY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminPlayerActivity>;
         ADMIN_ROLE_ASSIGNMENT_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminRoleAssignmentDirectory>;
+        ADMIN_SECURITY_POLICY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminSecurityPolicy>;
         ADMIN_USER_DIRECTORY: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminUserDirectory>;
         ADMIN_WALLET_REPORTING: import("@openora/core/contracts").Token<import("@openora/core/contracts").AdminWalletReporting>;
         AUDIT_WRITER: import("@openora/core/contracts").SealedToken<import("@openora/core/contracts").AuditWritePort>;
@@ -81,6 +82,16 @@ declare const _default: {
             chat: {
                 allowedAttachmentHosts: string[];
             };
+            adminSecurity: {
+                requireTwoFactor: boolean;
+                bindSessionToDevice: boolean;
+                trustedDeviceDays: number;
+                ipChangePolicy: "any" | "country" | "off";
+                twoFactorLockout: {
+                    maxAttempts: number;
+                    durationMs: number;
+                };
+            };
             activeBrand?: string | undefined;
             kyc?: {
                 gateWithdrawals: boolean;

package/dist/pam/tag/plugin.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/tag/plugin.ts"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~AAuBA,wBAiF8C"}
1	+ {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/tag/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,wBAiF8C"}

package/dist/react/context/__tests__/realtime-client.test.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=realtime-client.test.d.ts.map

package/dist/react/context/__tests__/realtime-client.test.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"realtime-client.test.d.ts","sourceRoot":"","sources":["../../../../src/react/context/__tests__/realtime-client.test.ts"],"names":[],"mappings":""}

package/dist/react/context/__tests__/realtime-client.test.js ADDED Viewed

@@ -0,0 +1,75 @@
+// @vitest-environment jsdom
+import { createElement } from 'react';
+import { renderHook } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+import { RealtimeClientProvider, useOptionalRealtimeClient, } from '../realtime-client.js';
+/**
+ * Stands in for a vendor adapter: it records what each channel was subscribed with, and
+ * `deliver`/`emit` play the two lanes back the way Ably's named events would. `subscribe` is
+ * generic, so the map cannot know a channel's payload type - it stores the handlers under
+ * `never`, which every `RealtimeSubscribeHandlers<T>` satisfies. Only `deliver` states a
+ * payload type, and it is the one this file subscribes with.
+ */
+function fakeAdapter() {
+    const channels = new Map();
+    const closed = vi.fn();
+    const adapter = {
+        subscribe(channel, handlers) {
+            channels.set(channel, handlers);
+            return () => channels.delete(channel);
+        },
+        close: closed,
+    };
+    return {
+        adapter,
+        closed,
+        deliver: (channel, message) => channels.get(channel)?.onMessage(message),
+        emit: (channel, name, payload) => channels.get(channel)?.onSignal?.(name, payload),
+    };
+}
+function mountWith(adapter) {
+    return renderHook(() => useOptionalRealtimeClient(), {
+        wrapper: ({ children }) => createElement(RealtimeClientProvider, { adapter, children }),
+    });
+}
+describe('RealtimeClientProvider', () => {
+    it('returns null when no provider is mounted, so the caller can fall back to SSE', () => {
+        expect(renderHook(() => useOptionalRealtimeClient()).result.current).toBeNull();
+    });
+    it('hands the mounted adapter to consumers and closes it on unmount', () => {
+        const { adapter, closed } = fakeAdapter();
+        const { result, unmount } = mountWith(adapter);
+        expect(result.current).toBe(adapter);
+        expect(closed).not.toHaveBeenCalled();
+        unmount();
+        expect(closed).toHaveBeenCalledOnce();
+    });
+    it('delivers a named signal to onSignal and never to the payload lane', () => {
+        const { adapter, deliver, emit } = fakeAdapter();
+        const onMessage = vi.fn();
+        const onSignal = vi.fn();
+        const { result } = mountWith(adapter);
+        result.current?.subscribe('chat:room:r1', { onMessage, onSignal });
+        emit('chat:room:r1', 'chat:member-role-changed', {
+            roomId: 'r1',
+            userId: 'u1',
+            role: 'moderator',
+        });
+        deliver('chat:room:r1', { id: 'm1' });
+        expect(onSignal.mock.calls).toEqual([
+            ['chat:member-role-changed', { roomId: 'r1', userId: 'u1', role: 'moderator' }],
+        ]);
+        expect(onMessage.mock.calls).toEqual([[{ id: 'm1' }]]);
+    });
+    it('leaves a caller that only wants messages unaffected by a signal', () => {
+        const { adapter, deliver, emit } = fakeAdapter();
+        const onMessage = vi.fn();
+        const { result } = mountWith(adapter);
+        // No onSignal: an SSE-backed adapter never calls it, and a caller need not supply it.
+        result.current?.subscribe('chat:room:r1', { onMessage });
+        expect(() => emit('chat:room:r1', 'chat:member-role-changed', {})).not.toThrow();
+        deliver('chat:room:r1', { id: 'm1' });
+        expect(onMessage.mock.calls).toEqual([[{ id: 'm1' }]]);
+    });
+});
+//# sourceMappingURL=realtime-client.test.js.map

package/dist/react/context/__tests__/realtime-client.test.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"realtime-client.test.js","sourceRoot":"","sources":["../../../../src/react/context/__tests__/realtime-client.test.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAkB,MAAM,OAAO,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAG1B,MAAM,uBAAuB,CAAC;AAI/B;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4C,CAAC;IACrE,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACvB,MAAM,OAAO,GAA0B;QACrC,SAAS,CAAI,OAAe,EAAE,QAAsC;YAClE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,EAAE,MAAM;KACd,CAAC;IACF,OAAO;QACL,OAAO;QACP,MAAM;QACN,OAAO,EAAE,CAAC,OAAe,EAAE,OAAgB,EAAE,EAAE,CAC7C,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAgB,CAAC;QACpD,IAAI,EAAE,CAAC,OAAe,EAAE,IAAY,EAAE,OAAgB,EAAE,EAAE,CACxD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAA8B;IAC/C,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,yBAAyB,EAAE,EAAE;QACnD,OAAO,EAAE,CAAC,EAAE,QAAQ,EAA2B,EAAE,EAAE,CACjD,aAAa,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,yBAAyB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QAC1C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAU,cAAc,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,cAAc,EAAE,0BAA0B,EAAE;YAC/C,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACH,OAAO,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YAClC,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;SAChF,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEtC,sFAAsF;QACtF,MAAM,CAAC,OAAO,EAAE,SAAS,CAAU,cAAc,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAElE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjF,OAAO,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/react/context/realtime-client.d.ts CHANGED Viewed

@@ -1,8 +1,22 @@
 import { type ReactNode } from 'react';
 export type RealtimeClientStatus = 'idle' | 'connecting' | 'open' | 'closed';
 export type RealtimeSubscribeHandlers<T> = {
+    /**
+     * The channel's payload stream - for chat, a `ChatMessage`. Its shape is the channel's
+     * contract, which is why it is typed and `onSignal`'s payload is not.
+     */
     onMessage: (event: T) => void;
     onStatus?: (status: RealtimeClientStatus) => void;
+    /**
+     * Optional: the receiving half of `RealtimeTransport.signal` (contracts/adapters/realtime.ts).
+     * A named control signal - "something about this channel changed, refetch" - delivered on its
+     * own lane, so it never reaches `onMessage` and cannot corrupt the payload stream. `payload` is
+     * `unknown` on purpose: the vocabulary of names is open, so the caller parses what it asked
+     * for (eg `ChatMemberRoleChangedSignalSchema` for `chat:member-role-changed`) and ignores the
+     * rest. A managed adapter feeds this from the vendor's named events; an SSE-backed one feeds
+     * it from the `/chat/signals` stream, which carries the same lane for the default transport.
+     */
+    onSignal?: (name: string, payload: unknown) => void;
 };
 export type RealtimeClientAdapter = {
     /** Returns an unsubscribe fn the caller MUST invoke on teardown. */

package/dist/react/context/realtime-client.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"realtime-client.d.ts","sourceRoot":"","sources":["../../../src/react/context/realtime-client.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAwC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAM7E,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7E,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IACzC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;IAE9B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;~~CACnD~~,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,oEAAoE;IACpE,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,yBAAyB,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC;IAGlF,KAAK,CAAC,IAAI,IAAI,CAAC;IAGf,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB,CAAC;AAIF,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACP,QAAQ,GACT,EAAE;IACD,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,SAAS,CAAC;CACrB,+BAKA;AAED,0FAA0F;AAC1F,wBAAgB,yBAAyB,IAAI,qBAAqB,GAAG,IAAI,CAExE"}
1	+ {"version":3,"file":"realtime-client.d.ts","sourceRoot":"","sources":["../../../src/react/context/realtime-client.tsx"],"names":[],"mappings":"AAEA,OAAO,EAAwC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAM7E,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7E,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IACzC;;;OAGG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;IAE9B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAClD;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,oEAAoE;IACpE,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,yBAAyB,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC;IAGlF,KAAK,CAAC,IAAI,IAAI,CAAC;IAGf,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB,CAAC;AAIF,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACP,QAAQ,GACT,EAAE;IACD,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,SAAS,CAAC;CACrB,+BAKA;AAED,0FAA0F;AAC1F,wBAAgB,yBAAyB,IAAI,qBAAqB,GAAG,IAAI,CAExE"}

package/dist/react/context/realtime-client.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"realtime-client.js","sourceRoot":"","sources":["../../../src/react/context/realtime-client.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAkB,MAAM,OAAO,CAAC;~~AAyB7E~~,MAAM,qBAAqB,GAAG,aAAa,CAA+B,IAAI,CAAC,CAAC;AAEhF,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EACP,QAAQ,GAIT;IACC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,OAAO,CACL,KAAC,qBAAqB,CAAC,QAAQ,IAAC,KAAK,EAAE,OAAO,YAAG,QAAQ,GAAkC,CAC5F,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,yBAAyB;IACvC,OAAO,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAC3C,CAAC"}
1	+ {"version":3,"file":"realtime-client.js","sourceRoot":"","sources":["../../../src/react/context/realtime-client.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAkB,MAAM,OAAO,CAAC;AAuC7E,MAAM,qBAAqB,GAAG,aAAa,CAA+B,IAAI,CAAC,CAAC;AAEhF,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EACP,QAAQ,GAIT;IACC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,OAAO,CACL,KAAC,qBAAqB,CAAC,QAAQ,IAAC,KAAK,EAAE,OAAO,YAAG,QAAQ,GAAkC,CAC5F,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,yBAAyB;IACvC,OAAO,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAC3C,CAAC"}

package/dist/server/auth/__tests__/admin-guard.int.test.js CHANGED Viewed

@@ -9,7 +9,9 @@ const requestContext = (headers) => ({ request: { headers } });
 const ADMIN_HEADERS = { 'x-real-ip': '127.0.0.1', 'user-agent': 'Mozilla/5.0' };
 function makeGuard({ userId, grants, superAdmin, } = {}) {
     const events = makeEventBus();
-    const sessions = mock({ resolveUserId: vi.fn(async () => userId) });
+    const sessions = mock({
+        resolveSession: vi.fn(async () => (userId ? { userId, sessionId: randomUUID() } : undefined)),
+    });
     const permissionResolver = grants
         ? mock({
             getGrants: vi.fn(async () => grants),

package/dist/server/auth/__tests__/admin-guard.int.test.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"admin-guard.int.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/admin-guard.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,YAAY,EAAe,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,IAAI,EAAU,CAAC;AAEf,MAAM,cAAc,GAAG,CAAC,OAA+B,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAEvF,MAAM,aAAa,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAEhF,SAAS,SAAS,CAAC,EACjB,MAAM,EACN,MAAM,EACN,UAAU,MAKR,EAAE;IACJ,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAkB,~~EAAE~~,~~aAAa,~~EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;~~IACrF~~,MAAM,kBAAkB,GAAG,MAAM;QAC/B,CAAC,CAAC,IAAI,CAA0B;YAC5B,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC;YACpC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,IAAI,IAAI,CAAC;SACpD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC/E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,yCAAyC,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC;QACtB,KAAK,EAAE,WAAW,EAAE,EAAE;YACpB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;QAC5C,CAAC;KACF,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,+DAA+D,CAAC,CAAC;AAClG,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,iBAAiB,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QAE9B,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC5C,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QAEtC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACvE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAClD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACvE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAC1F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC3B,MAAM;YACN,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,WAAW;YACf,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC/E,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,CACV,KAAK,CAAC,MAAM,CACV,cAAc,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,EAC3E,OAAO,EACP,QAAQ,CACT,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM;YACN,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,SAAS;SAChB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExC,MAAM,MAAM,CACV,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9D,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1F,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACtE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACvE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CACjF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAE3F,MAAM,MAAM,CACV,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAC/D,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAE5D,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1F,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CACxF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAE1F,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1F,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/E,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACjF,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CACtE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzF,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExC,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzF,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExC,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACjF,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"admin-guard.int.test.js","sourceRoot":"","sources":["../../../../src/server/auth/__tests__/admin-guard.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,YAAY,EAAe,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,IAAI,EAAU,CAAC;AAEf,MAAM,cAAc,GAAG,CAAC,OAA+B,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAEvF,MAAM,aAAa,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAEhF,SAAS,SAAS,CAAC,EACjB,MAAM,EACN,MAAM,EACN,UAAU,MAKR,EAAE;IACJ,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAkB;QACrC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KAC9F,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,MAAM;QAC/B,CAAC,CAAC,IAAI,CAA0B;YAC5B,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC;YACpC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,IAAI,IAAI,CAAC;SACpD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC/E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,yCAAyC,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC;QACtB,KAAK,EAAE,WAAW,EAAE,EAAE;YACpB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;QAC5C,CAAC;KACF,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,+DAA+D,CAAC,CAAC;AAClG,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,iBAAiB,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QAE9B,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC5C,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QAEtC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACvE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAClD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACvE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAC1F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC3B,MAAM;YACN,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,WAAW;YACf,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC/E,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,CACV,KAAK,CAAC,MAAM,CACV,cAAc,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,EAC3E,OAAO,EACP,QAAQ,CACT,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM;YACN,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,SAAS;SAChB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExC,MAAM,MAAM,CACV,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9D,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1F,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACtE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACvE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CACjF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAE3F,MAAM,MAAM,CACV,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAC/D,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAE5D,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1F,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CACxF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAE1F,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1F,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/E,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACjF,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CACtE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzF,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExC,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YACzF,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExC,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACjF,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/admin-guard.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { type Token, type AdminPermissionResolver, type IdentityReader, type ClientMeta } from '@openora/core/contracts';
+import { type Token, type AdminPermissionResolver, type AdminSecurityPolicy, type IdentityReader, type ClientMeta } from '@openora/core/contracts';
 import { DrizzleService } from '../db/index.js';
 import { SessionResolver } from './session-resolver.js';
 import { type ResourceName, type ActionOf } from './permissions.js';
@@ -26,7 +26,8 @@ export declare class AdminGuard {
     private readonly permissionResolver?;
     private readonly events?;
     private readonly identityReader?;
-    constructor(drizzle: DrizzleService, sessions: SessionResolver, permissionResolver?: AdminPermissionResolver | undefined, events?: EventBus | undefined, identityReader?: IdentityReader | undefined);
+    private readonly securityPolicy?;
+    constructor(drizzle: DrizzleService, sessions: SessionResolver, permissionResolver?: AdminPermissionResolver | undefined, events?: EventBus | undefined, identityReader?: IdentityReader | undefined, securityPolicy?: AdminSecurityPolicy | undefined);
     assert(context: unknown): Promise<AdminCaller>;
     assert<R extends ResourceName>(context: unknown, resource: R, action: ActionOf<R>): Promise<AdminCaller>;
     assertSuperAdmin(context: unknown): Promise<AdminCaller>;

package/dist/server/auth/admin-guard.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"admin-guard.d.ts","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,uBAAuB,EAE5B,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAI/D,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAIzE,MAAM,MAAM,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,qBAAa,UAAU;IAGnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;~~gBARf~~,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EAEzB,kBAAkB,CAAC,EAAE,uBAAuB,YAAA,EAC5C,MAAM,CAAC,EAAE,QAAQ,YAAA,EAIjB,cAAc,CAAC,EAAE,cAAc,YAAA;~~IAG5C~~,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAC9C,MAAM,CAAC,CAAC,SAAS,YAAY,EACjC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC,WAAW,CAAC;~~IA+EjB~~,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAsB9D,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,gBAAgB;CA4BzB"}
1	+ {"version":3,"file":"admin-guard.d.ts","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,uBAAuB,EAE5B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAI/D,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,UAAU,CAA8B,CAAC;AAIzE,MAAM,MAAM,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,qBAAa,UAAU;IAGnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAGhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAXf,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EAEzB,kBAAkB,CAAC,EAAE,uBAAuB,YAAA,EAC5C,MAAM,CAAC,EAAE,QAAQ,YAAA,EAIjB,cAAc,CAAC,EAAE,cAAc,YAAA,EAG/B,cAAc,CAAC,EAAE,mBAAmB,YAAA;IAGjD,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAC9C,MAAM,CAAC,CAAC,SAAS,YAAY,EACjC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,CAAC,EACX,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC,WAAW,CAAC;IA2FjB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAsB9D,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,gBAAgB;CA4BzB"}

package/dist/server/auth/admin-guard.js CHANGED Viewed

@@ -24,6 +24,7 @@ export class AdminGuard {
     permissionResolver;
     events;
     identityReader;
+    securityPolicy;
     // Uses the shared SessionResolver (one better-auth init for the whole app) rather than a second createAuth over the same DB.
     constructor(drizzle, sessions,
     // When bound (iam module loaded), grants come from DB; otherwise falls back to static roles.
@@ -31,12 +32,16 @@ export class AdminGuard {
     // When bound (identity module loaded), resolves the PAM player.id for a
     // player-role denial's audit attribution. This engine-zone file must not import
     // the player schema directly (ADR-0019/0025), so it goes through this port instead.
-    identityReader) {
+    identityReader,
+    // When bound (identity module loaded), enforces mandatory 2FA enrolment and the
+    // session's device fingerprint. Same layering reason as identityReader.
+    securityPolicy) {
         this.drizzle = drizzle;
         this.sessions = sessions;
         this.permissionResolver = permissionResolver;
         this.events = events;
         this.identityReader = identityReader;
+        this.securityPolicy = securityPolicy;
     }
     async assert(context, resource, action) {
         const request = context.request;
@@ -54,7 +59,8 @@ export class AdminGuard {
             }
             headers.set(k, Array.isArray(v) ? v.join(', ') : v);
         }
-        const userId = await this.sessions.resolveUserId(headers);
+        const resolvedSession = await this.sessions.resolveSession(headers);
+        const userId = resolvedSession?.userId;
         if (!userId) {
             throw new ORPCError('UNAUTHORIZED', {
                 message: 'Authentication required',
@@ -103,6 +109,16 @@ export class AdminGuard {
                 });
             }
         }
+        if (this.securityPolicy) {
+            const securityContext = {
+                userId,
+                sessionId: resolvedSession?.sessionId ?? null,
+                ip,
+                userAgent,
+            };
+            await this.securityPolicy.assertEnrolled(securityContext);
+            await this.securityPolicy.assertSessionIntact(securityContext);
+        }
         return { userId, role: userRecord.role, ip, userAgent };
     }
     async assertSuperAdmin(context) {

package/dist/server/auth/admin-guard.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"admin-guard.js","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,WAAW,EACX,qBAAqB,~~GAMtB~~,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,KAAK,EAAoC,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AAEzE,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAI3C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,UAAU;IAGF;IACA;IAEA;IACA;IAIA;~~IAVnB~~,6HAA6H;IAC7H,YACmB,OAAuB,EACvB,QAAyB;IAC1C,6FAA6F;IAC5E,kBAA4C,EAC5C,MAAiB;IAClC,wEAAwE;IACxE,gFAAgF;IAChF,oFAAoF;IACnE,cAA+B;~~QAR/B~~,YAAO,GAAP,OAAO,CAAgB;QACvB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,uBAAkB,GAAlB,kBAAkB,CAA0B;QAC5C,WAAM,GAAN,MAAM,CAAW;QAIjB,mBAAc,GAAd,cAAc,CAAiB;~~IAC~~/C,CAAC;IAQJ,KAAK,CAAC,MAAM,CACV,OAAgB,EAChB,QAAY,EACZ,MAAoB;QAEpB,MAAM,OAAO,GAAI,OAA+C,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,~~MAAM~~,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,~~aAAa~~,CAAC,OAAO,CAAC,CAAC;~~QAC1D~~,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAC1C,GAAG,CAAA,0CAA0C,MAAM,UAAU,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAA6C,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAA0B,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;gBAChF,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;oBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;oBACpE,IAAI,EAAE;wBACJ,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,iBAAiB;wBACpD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;wBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;qBACvB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAgB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;QAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,gBAAgB,CACnB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,OAAO,EACP,aAAa,EACb,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,6BAA6B;gBACtC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,kBAAkB;YAC5B,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAEO,UAAU,CAChB,MAA2B,EAC3B,QAAwD,EACxD,QAAgB,EAChB,MAAc;QAEd,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;IACxE,CAAC;IAEO,gBAAgB,CACtB,MAAc,EACd,IAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,EAAiB,EACjB,SAAwB;QAExB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,QAAQ,GACZ,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;gBACxE,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE;oBACrD,MAAM;oBACN,QAAQ;oBACR,QAAQ;oBACR,MAAM;oBACN,EAAE;oBACF,SAAS;oBACT,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;CACF"}
1	+ {"version":3,"file":"admin-guard.js","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,WAAW,EACX,qBAAqB,GAOtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,KAAK,EAAoC,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AAEzE,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAI3C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,UAAU;IAGF;IACA;IAEA;IACA;IAIA;IAGA;IAbnB,6HAA6H;IAC7H,YACmB,OAAuB,EACvB,QAAyB;IAC1C,6FAA6F;IAC5E,kBAA4C,EAC5C,MAAiB;IAClC,wEAAwE;IACxE,gFAAgF;IAChF,oFAAoF;IACnE,cAA+B;IAChD,gFAAgF;IAChF,wEAAwE;IACvD,cAAoC;QAXpC,YAAO,GAAP,OAAO,CAAgB;QACvB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,uBAAkB,GAAlB,kBAAkB,CAA0B;QAC5C,WAAM,GAAN,MAAM,CAAW;QAIjB,mBAAc,GAAd,cAAc,CAAiB;QAG/B,mBAAc,GAAd,cAAc,CAAsB;IACpD,CAAC;IAQJ,KAAK,CAAC,MAAM,CACV,OAAgB,EAChB,QAAY,EACZ,MAAoB;QAEpB,MAAM,OAAO,GAAI,OAA+C,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,eAAe,EAAE,MAAM,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAC1C,GAAG,CAAA,0CAA0C,MAAM,UAAU,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAA6C,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAA0B,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;gBAChF,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;oBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;oBACpE,IAAI,EAAE;wBACJ,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,iBAAiB;wBACpD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;wBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;qBACvB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,eAAe,GAAG;gBACtB,MAAM;gBACN,SAAS,EAAE,eAAe,EAAE,SAAS,IAAI,IAAI;gBAC7C,EAAE;gBACF,SAAS;aACV,CAAC;YACF,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAgB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;QAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,gBAAgB,CACnB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,OAAO,EACP,aAAa,EACb,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,6BAA6B;gBACtC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,kBAAkB;YAC5B,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAEO,UAAU,CAChB,MAA2B,EAC3B,QAAwD,EACxD,QAAgB,EAChB,MAAc;QAEd,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;IACxE,CAAC;IAEO,gBAAgB,CACtB,MAAc,EACd,IAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,EAAiB,EACjB,SAAwB;QAExB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,QAAQ,GACZ,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;gBACxE,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE;oBACrD,MAAM;oBACN,QAAQ;oBACR,QAAQ;oBACR,MAAM;oBACN,EAAE;oBACF,SAAS;oBACT,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;CACF"}

package/dist/server/auth/auth.d.ts CHANGED Viewed

@@ -6,6 +6,19 @@ export type SendEmail = (args: {
     subject: string;
     body: string;
 }) => Promise<void> | void;
+export type SendTwoFactorOtp = (args: {
+    userId: string;
+    email: string;
+    phoneNumber: string | null;
+    code: string;
+}) => Promise<void> | void;
+export type TwoFactorOptions = {
+    /** Seconds a device stays trusted after a successful second factor. */
+    trustDeviceMaxAgeSec?: number;
+    /** Minutes a delivered OTP stays valid. */
+    otpPeriodMinutes?: number;
+    sendOtp?: SendTwoFactorOtp;
+};
 export type AuthOptions = {
     db: DrizzleDb;
     schema?: Record<string, unknown>;
@@ -34,6 +47,7 @@ export type AuthOptions = {
      */
     isExistingAccountSignUp?: (email: string) => boolean;
     cookieDomain?: string;
+    twoFactor?: TwoFactorOptions;
 };
 /**
  * Builds the one shared better-auth instance for the whole app - both the

package/dist/server/auth/auth.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE3B,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAChF,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrF;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;~~CACvB~~,CAAC;AAWF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,~~CAyF~~/D;AAED,MAAM,MAAM,IAAI,GAAG,cAAc,CAAC"}
1	+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAM3B,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAChF,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrF;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B,CAAC;AAWF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CA0G/D;AAED,MAAM,MAAM,IAAI,GAAG,cAAc,CAAC"}

package/dist/server/auth/auth.js CHANGED Viewed

@@ -88,7 +88,24 @@ export function createAuth(options) {
         plugins: [
             organization(),
             adminPlugin({ ac, roles, defaultRole: 'player' }),
-            twoFactor(),
+            twoFactor({
+                ...(options.twoFactor?.trustDeviceMaxAgeSec !== undefined
+                    ? { trustDeviceMaxAge: options.twoFactor.trustDeviceMaxAgeSec }
+                    : {}),
+                otpOptions: {
+                    ...(options.twoFactor?.otpPeriodMinutes !== undefined
+                        ? { period: options.twoFactor.otpPeriodMinutes }
+                        : {}),
+                    sendOTP: async ({ user, otp }) => {
+                        await options.twoFactor?.sendOtp?.({
+                            userId: user.id,
+                            email: user.email,
+                            phoneNumber: user.phoneNumber ?? null,
+                            code: otp,
+                        });
+                    },
+                },
+            }),
             emailOTP({
                 otpLength: OTP_CODE_LENGTH,
                 expiresIn: OTP_EXPIRES_IN_SEC,

package/dist/server/auth/auth.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;~~AAkCjC~~,wFAAwF;AACxF,sFAAsF;AACtF,oFAAoF;AACpF,6FAA6F;AAC7F,6EAA6E;AAC7E,MAAM,wBAAwB,GAA0B;IACtD,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;IAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/E,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;YACD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC1D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,gFAAgF;YAChF,gFAAgF;YAChF,wEAAwE;YACxE,uEAAuE;YACvE,UAAU,EAAE,KAAK;YACjB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,IAAI,KAAK;YACnE,6BAA6B,EAAE,IAAI;YACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAChD,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACH,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe;gBACtC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,CAAC;gBACH,CAAC,CAAC,SAAS;SACd;QACD,iBAAiB,EAAE;YACjB,oFAAoF;YACpF,oFAAoF;YACpF,iEAAiE;YACjE,YAAY,EAAE,KAAK;YACnB,2BAA2B,EAAE,IAAI;SAClC;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE;YACP,YAAY,EAAE;YACd,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;YACjD,SAAS,EAAE;~~YACX~~,QAAQ,CAAC;gBACP,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,kBAAkB;gBAC7B,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;oBAC5C,0EAA0E;oBAC1E,8EAA8E;oBAC9E,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBAChE,OAAO;oBACT,CAAC;oBACD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;oBAChE,iFAAiF;oBACjF,iFAAiF;oBACjF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GACrB,IAAI,KAAK,oBAAoB;wBAC3B,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC;wBAC/D,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,CAAC;4BACxC,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC;4BAChF,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;oBAClF,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;aACF,CAAC;SACH;QACD,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}
1	+ {"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;AAsDjC,wFAAwF;AACxF,sFAAsF;AACtF,oFAAoF;AACpF,6FAA6F;AAC7F,6EAA6E;AAC7E,MAAM,wBAAwB,GAA0B;IACtD,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;CAC1D,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;IAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/E,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;YACD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC1D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,gFAAgF;YAChF,gFAAgF;YAChF,wEAAwE;YACxE,uEAAuE;YACvE,UAAU,EAAE,KAAK;YACjB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,IAAI,KAAK;YACnE,6BAA6B,EAAE,IAAI;YACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAChD,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACH,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe;gBACtC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,CAAC;gBACH,CAAC,CAAC,SAAS;SACd;QACD,iBAAiB,EAAE;YACjB,oFAAoF;YACpF,oFAAoF;YACpF,iEAAiE;YACjE,YAAY,EAAE,KAAK;YACnB,2BAA2B,EAAE,IAAI;SAClC;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE;YACP,YAAY,EAAE;YACd,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;YACjD,SAAS,CAAC;gBACR,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,KAAK,SAAS;oBACvD,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,oBAAoB,EAAE;oBAC/D,CAAC,CAAC,EAAE,CAAC;gBACP,UAAU,EAAE;oBACV,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,KAAK,SAAS;wBACnD,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,gBAAgB,EAAE;wBAChD,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;wBAC/B,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;4BACjC,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,WAAW,EAAG,IAAwC,CAAC,WAAW,IAAI,IAAI;4BAC1E,IAAI,EAAE,GAAG;yBACV,CAAC,CAAC;oBACL,CAAC;iBACF;aACF,CAAC;YACF,QAAQ,CAAC;gBACP,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,kBAAkB;gBAC7B,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;oBAC5C,0EAA0E;oBAC1E,8EAA8E;oBAC9E,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBAChE,OAAO;oBACT,CAAC;oBACD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;oBAChE,iFAAiF;oBACjF,iFAAiF;oBACjF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GACrB,IAAI,KAAK,oBAAoB;wBAC3B,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC;wBAC/D,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,CAAC;4BACxC,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC;4BAChF,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;oBAClF,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;aACF,CAAC;SACH;QACD,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}

package/dist/server/kernel/realtime-transport.d.ts CHANGED Viewed

@@ -1,13 +1,21 @@
-import type { RealtimePresence, RealtimeTransport } from '@openora/core/contracts';
+import type { RealtimePresence, RealtimeSignal, RealtimeTransport } from '@openora/core/contracts';
 /** First-party process-local fan-out used by the default SSE transport. */
 export declare class InProcessRealtimeTransport implements RealtimeTransport {
     private readonly channels;
+    private readonly signalChannels;
     private readonly inProcessPresence;
     readonly presence: RealtimePresence;
     publish<T>(channel: string, event: T): void;
     remove<T>(channel: string, event: T): void;
-    subscribe<T>(channel: string, handler: (event: T) => void, clientId?: string): () => void;
-    revokeClientFromChannel(clientId: string, channel: string): void;
+    subscribe<T>(channel: string, handler: (event: T) => void, userId?: string): () => void;
+    signal(channel: string, name: string, payload: unknown): void;
+    subscribeSignal(channel: string, handler: (signal: RealtimeSignal) => void, userId?: string): () => void;
+    /**
+     * Cuts every subscription this user holds on the channel. Both lanes are pruned
+     * independently: a client can hold a signal stream without a message stream, and revoked
+     * access has to end both.
+     */
+    revokeUserFromChannel(userId: string, channel: string): void;
     getOnlineUserIds(channel: string): Promise<string[]>;
 }
 //# sourceMappingURL=realtime-transport.d.ts.map

package/dist/server/kernel/realtime-transport.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"realtime-transport.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;~~AA6CnF~~,2EAA2E;AAC3E,qBAAa,0BAA2B,YAAW,iBAAiB;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;~~IACjE~~,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAC7D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAA0B;IAE7D,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAe3C,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAI1C,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,~~QAAQ~~,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;~~IAiBzF~~,~~uBAAuB~~,CAAC,~~QAAQ~~,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;~~IAehE~~,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAGrD"}
1	+ {"version":3,"file":"realtime-transport.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/realtime-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAkEnG,2EAA2E;AAC3E,qBAAa,0BAA2B,YAAW,iBAAiB;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IAGjE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8C;IAC7E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAC7D,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAA0B;IAE7D,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAe3C,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAI1C,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IAiBvF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IAc7D,eAAe,CACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,EACzC,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,IAAI;IAiBb;;;;OAIG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAK5D,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAGrD"}

package/dist/server/kernel/realtime-transport.js CHANGED Viewed

@@ -1,3 +1,18 @@
+/** Drops one user's subscriptions from a single lane, forgetting the channel once empty. */
+function pruneUser(lanes, channel, userId) {
+    const subscribers = lanes.get(channel);
+    if (!subscribers) {
+        return;
+    }
+    for (const subscription of Array.from(subscribers)) {
+        if (subscription.userId === userId) {
+            subscribers.delete(subscription);
+        }
+    }
+    if (subscribers.size === 0) {
+        lanes.delete(channel);
+    }
+}
 class InProcessPresence {
     members = new Map();
     join(channel, memberId, connectionId) {
@@ -36,6 +51,9 @@ class InProcessPresence {
 /** First-party process-local fan-out used by the default SSE transport. */
 export class InProcessRealtimeTransport {
     channels = new Map();
+    // Second, independent lane per channel: a signal must never reach a payload subscriber,
+    // which is the whole reason `signal` exists next to `publish`.
+    signalChannels = new Map();
     inProcessPresence = new InProcessPresence();
     presence = this.inProcessPresence;
     publish(channel, event) {
@@ -56,9 +74,9 @@ export class InProcessRealtimeTransport {
     remove(channel, event) {
         this.publish(channel, event);
     }
-    subscribe(channel, handler, clientId) {
+    subscribe(channel, handler, userId) {
         const subscribers = this.channels.get(channel) ?? new Set();
-        const subscription = { handler: handler, clientId };
+        const subscription = { handler: handler, userId };
         subscribers.add(subscription);
         this.channels.set(channel, subscribers);
         return () => {
@@ -72,19 +90,44 @@ export class InProcessRealtimeTransport {
             }
         };
     }
-    revokeClientFromChannel(clientId, channel) {
-        const subscribers = this.channels.get(channel);
+    signal(channel, name, payload) {
+        const subscribers = this.signalChannels.get(channel);
         if (!subscribers) {
             return;
         }
-        for (const subscription of Array.from(subscribers)) {
-            if (subscription.clientId === clientId) {
-                subscribers.delete(subscription);
+        for (const { handler } of Array.from(subscribers)) {
+            try {
+                handler({ name, payload });
+            }
+            catch {
+                // One disconnected subscriber must not stop fan-out to others.
             }
         }
-        if (subscribers.size === 0) {
-            this.channels.delete(channel);
-        }
+    }
+    subscribeSignal(channel, handler, userId) {
+        const subscribers = this.signalChannels.get(channel) ?? new Set();
+        const subscription = { handler, userId };
+        subscribers.add(subscription);
+        this.signalChannels.set(channel, subscribers);
+        return () => {
+            const current = this.signalChannels.get(channel);
+            if (!current) {
+                return;
+            }
+            current.delete(subscription);
+            if (current.size === 0) {
+                this.signalChannels.delete(channel);
+            }
+        };
+    }
+    /**
+     * Cuts every subscription this user holds on the channel. Both lanes are pruned
+     * independently: a client can hold a signal stream without a message stream, and revoked
+     * access has to end both.
+     */
+    revokeUserFromChannel(userId, channel) {
+        pruneUser(this.channels, channel, userId);
+        pruneUser(this.signalChannels, channel, userId);
     }
     getOnlineUserIds(channel) {
         return Promise.resolve(this.inProcessPresence.getUserIds(channel));