@openora/core 0.4.1-canary.13 → 0.4.1-canary.130

package/dist/pam/identity/__tests__/device-fingerprint.test.js

@@ -0,0 +1,105 @@
+import { describe, it, expect } from 'vitest';
+import { describeDevice, deviceHash, isSameDevice, isSuspiciousIpChange, normalizeUserAgent, trustedDeviceExpiry, } from '../service/device-fingerprint.service.js';
+const CHROME_MAC = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.86 Safari/537.36';
+const CHROME_MAC_NEXT_BUILD = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36';
+const CHROME_MAC_NEXT_MAJOR = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.83 Safari/537.36';
+const FIREFOX_WINDOWS = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0';
+describe('normalizeUserAgent', () => {
+    it('keeps the major version and drops the rest', () => {
+        expect(normalizeUserAgent('Chrome/131.0.6778.86')).toBe('chrome/131');
+    });
+    it('maps a missing user agent to an empty fingerprint', () => {
+        expect(normalizeUserAgent(null)).toBe('');
+        expect(normalizeUserAgent(undefined)).toBe('');
+    });
+});
+describe('isSameDevice', () => {
+    it('survives a patch-level browser auto-update', () => {
+        expect(isSameDevice(CHROME_MAC, CHROME_MAC_NEXT_BUILD)).toBe(true);
+    });
+    it('treats a different browser as a different device', () => {
+        expect(isSameDevice(CHROME_MAC, FIREFOX_WINDOWS)).toBe(false);
+    });
+    it('treats a major-version jump as a different device', () => {
+        expect(isSameDevice(CHROME_MAC, CHROME_MAC_NEXT_MAJOR)).toBe(false);
+    });
+    it('matches two sessions that both carry no user agent', () => {
+        expect(isSameDevice(null, null)).toBe(true);
+    });
+});
+describe('deviceHash', () => {
+    it('is stable across a patch-level update and differs across browsers', () => {
+        expect(deviceHash(CHROME_MAC)).toBe(deviceHash(CHROME_MAC_NEXT_BUILD));
+        expect(deviceHash(CHROME_MAC)).not.toBe(deviceHash(FIREFOX_WINDOWS));
+    });
+});
+describe('describeDevice', () => {
+    it('renders browser and operating system', () => {
+        expect(describeDevice(CHROME_MAC)).toEqual({
+            label: 'Chrome on macOS',
+            browser: 'Chrome',
+            os: 'macOS',
+        });
+        expect(describeDevice(FIREFOX_WINDOWS)).toEqual({
+            label: 'Firefox on Windows',
+            browser: 'Firefox',
+            os: 'Windows',
+        });
+    });
+    it('does not report Chrome for an Edge user agent', () => {
+        const edge = `${CHROME_MAC} Edg/131.0.2903.86`;
+        expect(describeDevice(edge).browser).toBe('Edge');
+    });
+    it('falls back to a placeholder when nothing is recognisable', () => {
+        expect(describeDevice(null)).toEqual({ label: 'Unknown device', browser: null, os: null });
+        expect(describeDevice('curl/8.4.0')).toEqual({
+            label: 'Unknown device',
+            browser: null,
+            os: null,
+        });
+    });
+});
+describe('isSuspiciousIpChange', () => {
+    const base = { sessionIp: '10.0.0.1', requestIp: '10.0.0.2' };
+    it('ignores every change while the policy is off', () => {
+        expect(isSuspiciousIpChange({ ...base, policy: 'off' })).toBe(false);
+    });
+    it('flags any change under the any policy', () => {
+        expect(isSuspiciousIpChange({ ...base, policy: 'any' })).toBe(true);
+    });
+    it('ignores an unchanged address under every policy', () => {
+        expect(isSuspiciousIpChange({ policy: 'any', sessionIp: '10.0.0.1', requestIp: '10.0.0.1' })).toBe(false);
+    });
+    it('flags a country hop and tolerates a same-country hop', () => {
+        expect(isSuspiciousIpChange({
+            ...base,
+            policy: 'country',
+            sessionCountry: 'PL',
+            requestCountry: 'RU',
+        })).toBe(true);
+        expect(isSuspiciousIpChange({
+            ...base,
+            policy: 'country',
+            sessionCountry: 'PL',
+            requestCountry: 'pl',
+        })).toBe(false);
+    });
+    it('does not end a session when the country cannot be resolved', () => {
+        expect(isSuspiciousIpChange({
+            ...base,
+            policy: 'country',
+            sessionCountry: null,
+            requestCountry: 'RU',
+        })).toBe(false);
+    });
+    it('does not end a session when either address is unknown', () => {
+        expect(isSuspiciousIpChange({ policy: 'any', sessionIp: null, requestIp: '10.0.0.2' })).toBe(false);
+    });
+});
+describe('trustedDeviceExpiry', () => {
+    it('adds the configured number of days to the grant date', () => {
+        const now = new Date('2026-08-25T00:00:00.000Z');
+        expect(trustedDeviceExpiry(30, now).toISOString()).toBe('2026-09-24T00:00:00.000Z');
+    });
+});
+//# sourceMappingURL=device-fingerprint.test.js.map

package/dist/pam/identity/__tests__/device-fingerprint.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/device-fingerprint.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAElD,MAAM,UAAU,GACd,2HAA2H,CAAC;AAC9H,MAAM,qBAAqB,GACzB,4HAA4H,CAAC;AAC/H,MAAM,qBAAqB,GACzB,2HAA2H,CAAC;AAC9H,MAAM,eAAe,GACnB,kFAAkF,CAAC;AAErF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,QAAQ;YACjB,EAAE,EAAE,OAAO;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,SAAS;YAClB,EAAE,EAAE,SAAS;SACd,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,GAAG,UAAU,oBAAoB,CAAC;QAC/C,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,IAAI;YACb,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAE9D,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,oBAAoB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,oBAAoB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CACJ,oBAAoB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CACtF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CACJ,oBAAoB,CAAC;YACnB,GAAG,IAAI;YACP,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,oBAAoB,CAAC;YACnB,GAAG,IAAI;YACP,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CACJ,oBAAoB,CAAC;YACnB,GAAG,IAAI;YACP,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAC1F,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity.rate-limit.int.test.d.ts.map

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.rate-limit.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.js

@@ -0,0 +1,191 @@
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { RedisRateLimiter } from '@openora/core/server';
+import { createTestDb, createTestRedis } from '@openora/core/testing';
+import { definePlatformConfig } from '@openora/core/contracts';
+import { makeIdentityReader, mock, makeEventBus } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { IdentityService } from '../service/identity.service.js';
+function withTemplateRenderer(deps) {
+    return new IdentityService({
+        playerProvisioning: mock({ createForRegistration: vi.fn() }),
+        ...deps,
+        identityReader: deps.identityReader ?? makeIdentityReader(),
+    });
+}
+// Keep the real @openora/core/server (so assertRateLimit + RedisRateLimiter are real); only
+// stub createAuth so the constructor doesn't touch a real DB.
+vi.mock('@openora/core/server', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        createAuth: vi.fn(() => ({
+            api: { getSession: vi.fn().mockResolvedValue(null), signUpEmail: vi.fn() },
+        })),
+    };
+});
+const events = makeEventBus();
+let db;
+let drizzle;
+let redis;
+const makeLimiter = () => new RedisRateLimiter(redis.client);
+beforeAll(async () => {
+    db = await createTestDb([migrate]);
+    drizzle = db.drizzle;
+    redis = await createTestRedis();
+});
+afterAll(async () => {
+    await db.drop();
+    await redis.quit();
+});
+beforeEach(async () => {
+    await redis.flush();
+});
+describe('IdentityService - rate limiting (real Redis)', () => {
+    it('rejects register with a 429 once the per-email limit is exhausted', async () => {
+        const email = 'abuse@x.dev';
+        const limiter = makeLimiter();
+        // Pre-exhaust the register bucket (5 per 15min) so the service's own consume is denied.
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume(`register:${email}`, { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({
+            drizzle,
+            events,
+            limiter,
+            platformConfig: definePlatformConfig({
+                registration: { termsVersion: '2026-08', requireEmailVerification: false },
+            }),
+        });
+        await expect(svc.register({
+            email,
+            password: 'password1234',
+            username: 'alpha',
+            acceptedTerms: true,
+            acceptedAge: true,
+        }, {})).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+            data: { retryAfterMs: expect.any(Number) },
+        });
+    });
+    it('allows register when no limiter is bound (test/no-auth edition)', async () => {
+        const svc = withTemplateRenderer({ drizzle, events });
+        // signUpEmail is a bare vi.fn returning undefined; a throw here would be a 429, not the
+        // downstream .json() failure we expect, so assert we got past the guard.
+        await expect(svc.register({
+            email: 'ok@x.dev',
+            password: 'password1234',
+            username: 'alpha',
+            acceptedTerms: true,
+            acceptedAge: true,
+        }, {})).rejects.not.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+});
+describe('IdentityService - verify2fa rate-limit key stability (ABC-208 finding #3)', () => {
+    it('keys on the two_factor cookie VALUE, not the raw Cookie header, so junk cookie pairs cannot churn the bucket', async () => {
+        const limiter = makeLimiter();
+        const twoFactorIdentifier = 'pending-2fa-identifier-abc';
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume(`verify2fa:${twoFactorIdentifier}`, {
+                limit: 5,
+                windowMs: 5 * 60 * 1000,
+            });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        // Same two_factor cookie + different junk pairs must still hit the one exhausted bucket.
+        for (let i = 0; i < 3; i++) {
+            await expect(svc.verifyTwoFactor({ code: '123456', method: 'totp', trustDevice: false }, { cookie: `better-auth.two_factor=${twoFactorIdentifier}; junk${i}=${i}` }, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        }
+    });
+});
+describe('IdentityService - rate limiting on secret-guessing routes (ABC-208 finding #6)', () => {
+    it('rejects changePassword with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('change-password:anonymous', { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.changePassword({ currentPassword: 'currentpw1', newPassword: 'newpassword1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+    it('rejects verifyEmail with a 429 once the per-address limit is exhausted', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('verify-email:target@e2e.test', { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        // Six digits are guessable, so the budget follows the address under attack.
+        await expect(svc.verifyEmail({ email: 'target@e2e.test', otp: '000000' }, { 'x-real-ip': '203.0.113.5' }, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+    it('buckets verifyEmail addresses separately, so one target cannot stall the rest', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('verify-email:target@e2e.test', { limit: 5, windowMs: 15 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        // Codes are entered without a session. A shared bucket would let the exhausted
+        // address above block every other sign-up in flight.
+        await expect(svc.verifyEmail({ email: 'other@e2e.test', otp: '000000' }, { 'x-real-ip': '203.0.113.7' }, new Headers())).rejects.not.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+    it('rejects enableTwoFactor with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('enable2fa:anonymous', { limit: 5, windowMs: 5 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.enableTwoFactor({ password: 'currentpw1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+    it('rejects disableTwoFactor with a 429 once the per-caller limit is exhausted', async () => {
+        const limiter = makeLimiter();
+        for (let i = 0; i < 5; i++) {
+            await limiter.consume('disable2fa:anonymous', { limit: 5, windowMs: 5 * 60 * 1000 });
+        }
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.disableTwoFactor({ password: 'currentpw1', code: '123456' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+});
+describe('IdentityService - fail-closed limiter policy for credential-guessing keys', () => {
+    // A spy limiter that always denies: consume is the first await on each of these
+    // paths, so the 429 short-circuits before any auth/DB work and we can assert the
+    // exact options the service passed for the key. (The RedisRateLimiter's own
+    // fail-closed behaviour is covered in the kernel redis-rate-limiter suite.)
+    function denyingLimiter() {
+        const consume = vi.fn(async () => ({ allowed: false, retryAfterMs: 1 }));
+        return { limiter: mock({ consume }), consume };
+    }
+    it('passes onUnavailable: deny on the login: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.login({ email: 'User@X.dev', password: 'password123' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('login:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('passes onUnavailable: deny on the verify2fa: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.verifyTwoFactor({ code: '123456', method: 'totp', trustDevice: false }, {}, new Headers())).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(consume).toHaveBeenCalledWith(expect.stringMatching(/^verify2fa:/), expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('passes onUnavailable: deny on the pwreset: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.resetPassword({ email: 'user@x.dev', otp: '123456', newPassword: 'newpassword1' })).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('pwreset:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('passes onUnavailable: deny on the pwreset-verify: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.verifyPasswordResetOtp({ email: 'user@x.dev', otp: '123456' })).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('pwreset-verify:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('throttles requestPasswordReset on the pwreset-req: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        // The throttle is asserted before the anti-enumeration try/catch, so a denied
+        // request key surfaces as a 429 (only the better-auth call is swallowed).
+        await expect(svc.requestPasswordReset({ email: 'User@X.dev' })).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(consume).toHaveBeenCalledWith('pwreset-req:user@x.dev', expect.any(Object));
+    });
+});
+//# sourceMappingURL=identity.rate-limit.int.test.js.map

package/dist/pam/identity/__tests__/identity.rate-limit.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.rate-limit.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,eAAe,EAA+B,MAAM,uBAAuB,CAAC;AAMnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,eAAe,EAA4B,MAAM,gCAAgC,CAAC;AAE3F,SAAS,oBAAoB,CAC3B,IAEC;IAED,OAAO,IAAI,eAAe,CAAC;QACzB,kBAAkB,EAAE,IAAI,CAAqB,EAAE,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QAChF,GAAG,IAAI;QACP,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,kBAAkB,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,8DAA8D;AAC9D,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAyC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;AAE9B,IAAI,EAAU,CAAC;AACf,IAAI,OAAuC,CAAC;AAC5C,IAAI,KAAgB,CAAC;AACrB,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAE7D,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACrB,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAChB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,aAAa,CAAC;QAC5B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,wFAAwF;QACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC;YAC/B,OAAO;YACP,MAAM;YACN,OAAO;YACP,cAAc,EAAE,oBAAoB,CAAC;gBACnC,YAAY,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;aAC3E,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CACV;YACE,KAAK;YACL,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,EACD,EAAE,CACH,CACF,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,wFAAwF;QACxF,yEAAyE;QACzE,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CACV;YACE,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,EACD,EAAE,CACH,CACF,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,mBAAmB,EAAE,EAAE;gBACxD,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,yFAAyF;QACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,EACtD,EAAE,MAAM,EAAE,0BAA0B,mBAAmB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAC1E,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,cAAc,CAChB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,EAC9D,EAAE,EACF,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,4EAA4E;QAC5E,MAAM,MAAM,CACV,GAAG,CAAC,WAAW,CACb,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC3C,EAAE,WAAW,EAAE,aAAa,EAAE,EAC9B,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,+EAA+E;QAC/E,qDAAqD;QACrD,MAAM,MAAM,CACV,GAAG,CAAC,WAAW,CACb,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,EAC1C,EAAE,WAAW,EAAE,aAAa,EAAE,EAC9B,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACpF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,gFAAgF;IAChF,iFAAiF;IACjF,4EAA4E;IAC5E,4EAA4E;IAC5E,SAAS,cAAc;QACrB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,kBAAkB,EAClB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,EACtD,EAAE,EACF,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EACpC,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CACvF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,oBAAoB,EACpB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,2BAA2B,EAC3B,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACpF,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.registration-gates.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity.registration-gates.int.test.d.ts.map

package/dist/pam/identity/__tests__/identity.registration-gates.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.registration-gates.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.registration-gates.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/identity.registration-gates.int.test.js

@@ -0,0 +1,114 @@
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { RedisRateLimiter } from '@openora/core/server';
+import { createTestDb, createTestRedis } from '@openora/core/testing';
+import { definePlatformConfig } from '@openora/core/contracts';
+import { makeIdentityReader, mock, makeEventBus } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { IdentityService } from '../service/identity.service.js';
+vi.mock('@openora/core/server', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        createAuth: vi.fn(() => ({
+            api: { getSession: vi.fn().mockResolvedValue(null), signUpEmail: vi.fn() },
+        })),
+    };
+});
+const events = makeEventBus();
+const registrationConfig = definePlatformConfig({
+    registration: { termsVersion: 'test-v1', requireEmailVerification: false },
+});
+let db;
+let drizzle;
+let redis;
+const validInput = () => ({
+    email: `gate-${Math.random().toString(36).slice(2)}@x.dev`,
+    password: 'password1234',
+    username: 'alpha',
+    acceptedTerms: true,
+    acceptedAge: true,
+});
+function makeService(overrides = {}) {
+    return new IdentityService({
+        drizzle,
+        events,
+        identityReader: makeIdentityReader(),
+        platformConfig: registrationConfig,
+        playerProvisioning: mock({
+            createForRegistration: vi.fn().mockResolvedValue({ created: true }),
+        }),
+        ...overrides,
+    });
+}
+beforeAll(async () => {
+    db = await createTestDb([migrate]);
+    drizzle = db.drizzle;
+    redis = await createTestRedis();
+});
+afterAll(async () => {
+    await db.drop();
+    await redis.quit();
+});
+beforeEach(async () => {
+    await redis.flush();
+    events.emit.mockClear();
+});
+const failureReasons = () => events.emit.mock.calls
+    .filter(([topic]) => topic === 'identity.user.registration.failed')
+    .map(([, payload]) => payload.reason);
+describe('IdentityService.register - availability gates', () => {
+    it('rejects registration when the operator has not configured it', async () => {
+        const svc = makeService({ platformConfig: undefined });
+        await expect(svc.register(validInput(), {})).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        expect(failureReasons()).toEqual(['registration_disabled']);
+    });
+    it('rejects registration when no player provisioning port is bound', async () => {
+        const svc = makeService({ playerProvisioning: undefined });
+        await expect(svc.register(validInput(), {})).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+    });
+    it('rejects registration from a geo-blocked address', async () => {
+        const checkRegistration = vi.fn().mockResolvedValue({ allowed: false });
+        const svc = makeService({ geoCheck: mock({ checkRegistration }) });
+        await expect(svc.register(validInput(), { 'x-real-ip': '203.0.113.7' })).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        expect(checkRegistration).toHaveBeenCalledWith('203.0.113.7');
+        expect(failureReasons()).toEqual(['geo_blocked']);
+    });
+    it('throttles registrations coming from one address, across different emails', async () => {
+        const svc = makeService({ limiter: new RedisRateLimiter(redis.client) });
+        const headers = { 'x-real-ip': '203.0.113.9' };
+        // Each call uses a fresh email, so only the per-IP bucket can reject them. The
+        // early attempts fail downstream on the stubbed auth call - that is fine, the
+        // limiter is consumed before that happens.
+        for (let i = 0; i < 5; i++) {
+            await svc.register(validInput(), headers).catch(() => undefined);
+        }
+        await expect(svc.register(validInput(), headers)).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(failureReasons()).toContain('rate_limited');
+    });
+    // Every attempt has to leave a record with its origin, not only the ones that produce
+    // an account. A rejected attempt is unauthenticated, so the address is the only subject
+    // there is to record it against.
+    it('records the origin of a rejected attempt, since there is no account to attribute it to', async () => {
+        const svc = makeService({ platformConfig: undefined });
+        const input = validInput();
+        await svc
+            .register(input, { 'x-real-ip': '203.0.113.7', 'user-agent': 'Mozilla/5.0' })
+            .catch(() => undefined);
+        expect(events.emit).toHaveBeenCalledWith('identity.user.registration.failed', {
+            email: input.email,
+            username: input.username,
+            reason: 'registration_disabled',
+            ip: '203.0.113.7',
+            userAgent: 'Mozilla/5.0',
+        });
+    });
+});
+//# sourceMappingURL=identity.registration-gates.int.test.js.map

package/dist/pam/identity/__tests__/identity.registration-gates.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.registration-gates.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.registration-gates.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,eAAe,EAA+B,MAAM,uBAAuB,CAAC;AAEnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,eAAe,EAA4B,MAAM,gCAAgC,CAAC;AAE3F,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAyC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;AAC9B,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;IAC9C,YAAY,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE;CAC3E,CAAC,CAAC;AAEH,IAAI,EAAU,CAAC;AACf,IAAI,OAAuC,CAAC;AAC5C,IAAI,KAAgB,CAAC;AAErB,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC;IACxB,KAAK,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;IAC1D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,OAAO;IACjB,aAAa,EAAE,IAAa;IAC5B,WAAW,EAAE,IAAa;CAC3B,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,YAA0C,EAAE;IAC/D,OAAO,IAAI,eAAe,CAAC;QACzB,OAAO;QACP,MAAM;QACN,cAAc,EAAE,kBAAkB,EAAE;QACpC,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,IAAI,CAAqB;YAC3C,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACpE,CAAC;QACF,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACrB,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAChB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,GAAG,EAAE,CAC1B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;KACnB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,mCAAmC,CAAC;KAClE,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAE,OAA8B,CAAC,MAAM,CAAC,CAAC;AAElE,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACjE,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3D,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACjE,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAmB,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;QAErF,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7F,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAC9D,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;QAE/C,+EAA+E;QAC/E,8EAA8E;QAC9E,2CAA2C;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACtE,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,wFAAwF;IACxF,iCAAiC;IACjC,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAE3B,MAAM,GAAG;aACN,QAAQ,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;aAC5E,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,mCAAmC,EAAE;YAC5E,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,uBAAuB;YAC/B,EAAE,EAAE,aAAa;YACjB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.service.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity.service.int.test.d.ts.map

package/dist/pam/identity/__tests__/identity.service.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.service.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.service.int.test.ts"],"names":[],"mappings":""}