@openora/core 0.4.1-canary.13 → 0.4.1-canary.130

package/dist/pam/identity/schema/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,aAAa,mEAA+B,CAAC;AAE1D,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoChB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBnB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBnB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaxB,CAAC;AAGF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAerB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;AAC5D,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,aAAa,mEAA+B,CAAC;AAE1D,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DhB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBnB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBnB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaxB,CAAC;AAGF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBrB,CAAC;AAKF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAezB,CAAC;AAKF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBpC,CAAC;AAMF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsB9B,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,YAAY,CAAC;AACpF,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;AAC5D,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,YAAY,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC"}

package/dist/pam/identity/schema/index.js

@@ -1,10 +1,11 @@
 import { sql } from 'drizzle-orm';
-import { pgTable, pgEnum, uuid, text, boolean, timestamp, index, integer, } from 'drizzle-orm/pg-core';
+import { pgTable, pgEnum, uuid, text, boolean, timestamp, index, integer, uniqueIndex, } from 'drizzle-orm/pg-core';
 import { THEMES } from '@openora/core/contracts';
 export const userThemeEnum = pgEnum('user_theme', THEMES);
 export const user = pgTable('user', {
     id: uuid().primaryKey().defaultRandom(),
     name: text().notNull(),
+    username: text().notNull(),
     email: text().notNull().unique(),
     emailVerified: boolean().notNull().default(false),
     image: text(),
@@ -21,8 +22,28 @@ export const user = pgTable('user', {
     // Use logical JS property names only; drizzle.config.ts maps camelCase -> snake_case
     // for SQL identifiers so migrations and runtime are consistent.
     twoFactorEnabled: boolean().default(false),
+    phoneNumber: text().unique(),
+    phoneVerified: boolean().notNull().default(false),
+    phoneVerifiedAt: timestamp({ withTimezone: true }),
+    // A hash does not reveal a legacy password's length, so existing rows start false
+    // and each qualifying password write records the policy state explicitly.
+    passwordMeetsPolicy: boolean().notNull().default(false),
+    loginWithdrawalAlertsEnabled: boolean().notNull().default(false),
     failedLoginAttempts: integer().notNull().default(0),
     lockoutUntil: timestamp({ withTimezone: true }),
+    // Second-factor lockout, counted separately from the password-login columns above:
+    // the two thresholds are configured independently and a 2FA lockout must not
+    // consume the password-login budget (or vice versa).
+    failedTwoFactorAttempts: integer().notNull().default(0),
+    twoFactorLockoutUntil: timestamp({ withTimezone: true }),
+    twoFactorLockoutCount: integer().notNull().default(0),
+    lastFailedTwoFactorAt: timestamp({ withTimezone: true }),
+    // Progressive lockout tiers: `lockoutCount` counts lockouts inside a rolling 24h
+    // window (reset once `lastLockoutAt` falls outside it), escalating the duration
+    // 1min -> 5min -> 15min. Shared by every login method.
+    lockoutCount: integer().notNull().default(0),
+    lastLockoutAt: timestamp({ withTimezone: true }),
+    lastFailedLoginAt: timestamp({ withTimezone: true }),
     // Responsible-Gambling login block (cooling-off / self-exclusion). Written only via
     // the LOGIN_ENFORCEMENT port. `rgBlockedUntil` null while blocked = indefinite
     // (self-exclusion); a Date is the cooling-off expiry the login gate auto-clears.
@@ -35,7 +56,12 @@ export const user = pgTable('user', {
 }, 
 // Trigram GIN index so the back-office player search (`ILIKE '%term%'` on email)
 // is index-backed instead of a seq scan. Requires the pg_trgm extension.
-(t) => [index('user_email_trgm_idx').using('gin', sql `${t.email} gin_trgm_ops`)]);
+(t) => [
+    uniqueIndex('user_username_unique').on(sql `lower(${t.username})`),
+    index('user_email_trgm_idx').using('gin', sql `${t.email} gin_trgm_ops`),
+    index('user_username_trgm_idx').using('gin', sql `${t.username} gin_trgm_ops`),
+    index('user_created_at_idx').on(t.createdAt),
+]);
 export const session = pgTable('session', {
     id: uuid().primaryKey().defaultRandom(),
     expiresAt: timestamp({ withTimezone: true }).notNull(),
@@ -46,6 +72,10 @@ export const session = pgTable('session', {
         .$onUpdateFn(() => new Date()),
     ipAddress: text(),
     userAgent: text(),
+    // Written by the admin session guard, throttled. better-auth owns `updatedAt` and
+    // ties it to its own updateAge bookkeeping, so touching that column to record
+    // activity would shift session expiry - this one is ours and better-auth ignores it.
+    lastSeenAt: timestamp({ withTimezone: true }),
     userId: uuid()
         .notNull()
         .references(() => user.id, { onDelete: 'cascade' }),
@@ -88,8 +118,72 @@ export const twoFactor = pgTable('two_factor', {
         .notNull()
         .references(() => user.id, { onDelete: 'cascade' }),
     verified: boolean().default(true),
+    // Counter and cooldown the plugin maintains itself; the adapter rejects
+    // every twoFactor write while they are missing from the table.
+    failedVerificationCount: integer().notNull().default(0),
+    lockedUntil: timestamp({ withTimezone: true }),
 }, (t) => [
     index('two_factor_user_id_idx').on(t.userId),
     index('two_factor_secret_idx').on(t.secret),
 ]);
+// One active OTP per user: `requestOtp` upserts by `userId`, so a new code overwrites the previous one.
+// `codeHash` is SHA-256 of the 6-digit code - the plaintext OTP is never stored.
+// `failedAttempts` caps guessing at 5 per session.
+export const smsOtpSession = pgTable('sms_otp_session', {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid()
+        .notNull()
+        .unique()
+        .references(() => user.id, { onDelete: 'cascade' }),
+    phone: text().notNull(),
+    codeHash: text().notNull(),
+    expiresAt: timestamp({ withTimezone: true }).notNull(),
+    failedAttempts: integer().notNull().default(0),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+}, (t) => [index('sms_otp_session_phone_idx').on(t.phone)]);
+// One live phone-binding challenge per user. This is deliberately separate from
+// smsOtpSession, which belongs to unauthenticated phone login and must never confer
+// authority to change a standing login credential.
+export const phoneVerificationSession = pgTable('phone_verification_session', {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid()
+        .notNull()
+        .unique()
+        .references(() => user.id, { onDelete: 'cascade' }),
+    sessionId: uuid()
+        .notNull()
+        .references(() => session.id, { onDelete: 'cascade' }),
+    phone: text().notNull(),
+    codeHash: text().notNull(),
+    reauthenticatedAt: timestamp({ withTimezone: true }).notNull(),
+    expiresAt: timestamp({ withTimezone: true }).notNull(),
+    failedAttempts: integer().notNull().default(0),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+}, (t) => [
+    index('phone_verification_session_phone_idx').on(t.phone),
+    index('phone_verification_session_session_id_idx').on(t.sessionId),
+]);
+// Server-side trusted-device registry. better-auth issues its own opaque trust cookie,
+// which cannot be listed or revoked; a device only skips the second factor when BOTH
+// that cookie and an unrevoked row here are present, so revoking the row forces 2FA on
+// the very next request.
+export const adminTrustedDevice = pgTable('admin_trusted_device', {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid()
+        .notNull()
+        .references(() => user.id, { onDelete: 'cascade' }),
+    deviceHash: text().notNull(),
+    label: text().notNull(),
+    ipAddress: text(),
+    userAgent: text(),
+    lastUsedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp({ withTimezone: true }).notNull(),
+    revokedAt: timestamp({ withTimezone: true }),
+    revokedBy: uuid(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+}, (t) => [
+    uniqueIndex('admin_trusted_device_user_hash_idx').on(t.userId, t.deviceHash),
+    index('admin_trusted_device_user_id_idx').on(t.userId),
+    index('admin_trusted_device_expires_at_idx').on(t.expiresAt),
+]);
 //# sourceMappingURL=index.js.map

package/dist/pam/identity/schema/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,SAAS,EACT,KAAK,EACL,OAAO,GACR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CACzB,MAAM,EACN;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACtB,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,KAAK,EAAE,IAAI,EAAE;IACb,KAAK,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,kFAAkF;IAClF,qFAAqF;IACrF,gEAAgE;IAChE,gBAAgB,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,YAAY,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC/C,oFAAoF;IACpF,+EAA+E;IAC/E,iFAAiF;IACjF,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,cAAc,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC;AACD,iFAAiF;AACjF,yEAAyE;AACzE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CACjF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,IAAI,EAAE;IACjB,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,EAAE;IACnB,YAAY,EAAE,IAAI,EAAE;IACpB,OAAO,EAAE,IAAI,EAAE;IACf,oBAAoB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACvD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,KAAK,EAAE,IAAI,EAAE;IACb,QAAQ,EAAE,IAAI,EAAE;IAChB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC5C,CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,SAAS,EACT,KAAK,EACL,OAAO,EACP,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CACzB,MAAM,EACN;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACtB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,KAAK,EAAE,IAAI,EAAE;IACb,KAAK,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,kFAAkF;IAClF,qFAAqF;IACrF,gEAAgE;IAChE,gBAAgB,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,WAAW,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE;IAC5B,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,eAAe,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAClD,kFAAkF;IAClF,0EAA0E;IAC1E,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvD,4BAA4B,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChE,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,YAAY,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC/C,mFAAmF;IACnF,6EAA6E;IAC7E,qDAAqD;IACrD,uBAAuB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,qBAAqB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,iFAAiF;IACjF,gFAAgF;IAChF,uDAAuD;IACvD,YAAY,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,aAAa,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,iBAAiB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpD,oFAAoF;IACpF,+EAA+E;IAC/E,iFAAiF;IACjF,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,cAAc,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC;AACD,iFAAiF;AACjF,yEAAyE;AACzE,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAA,SAAS,CAAC,CAAC,QAAQ,GAAG,CAAC;IACjE,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC;IACvE,KAAK,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,QAAQ,eAAe,CAAC;IAC7E,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,IAAI,EAAE;IACjB,kFAAkF;IAClF,8EAA8E;IAC9E,qFAAqF;IACrF,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,EAAE;IACnB,YAAY,EAAE,IAAI,EAAE;IACpB,OAAO,EAAE,IAAI,EAAE;IACf,oBAAoB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACvD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,KAAK,EAAE,IAAI,EAAE;IACb,QAAQ,EAAE,IAAI,EAAE;IAChB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjC,wEAAwE;IACxE,+DAA+D;IAC/D,uBAAuB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,WAAW,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC/C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC5C,CACF,CAAC;AAEF,wGAAwG;AACxG,iFAAiF;AACjF,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAClC,iBAAiB,EACjB;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,cAAc,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAC7C,4BAA4B,EAC5B;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,SAAS,EAAE,IAAI,EAAE;SACd,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACxD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,iBAAiB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9D,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,cAAc,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,sCAAsC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,KAAK,CAAC,2CAA2C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CACnE,CACF,CAAC;AAEF,uFAAuF;AACvF,qFAAqF;AACrF,uFAAuF;AACvF,yBAAyB;AACzB,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CACvC,sBAAsB,EACtB;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,IAAI,EAAE;IACjB,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACpE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5C,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC;IAC5E,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7D,CACF,CAAC"}

package/dist/pam/identity/service/admin-security.service.d.ts

@@ -0,0 +1,84 @@
+import { type EventBus, DrizzleService } from '@openora/core/server';
+import { type AdminSecurityPolicy, type AdminSessionContext, type AdminSecurityConfig, type GeoIpAdapter, type ClientMeta, type IdentityReader, type User } from '@openora/core/contracts';
+import { type AdminTrustedDevice, type Session } from '../schema/index.js';
+import type { AdminSecurityStatus, TrustedDeviceItem } from '../contract/index.js';
+import type { SessionService } from './session.service.js';
+import type { TrustedDeviceService } from './trusted-device.service.js';
+export declare const SelfTwoFactorResetError: new () => Error & {
+    data?: Record<string, string>;
+};
+export type AdminSecurityServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    sessions: SessionService;
+    trustedDevices: TrustedDeviceService;
+    identityReader: IdentityReader;
+    config: AdminSecurityConfig;
+    geoIp?: GeoIpAdapter | undefined;
+};
+/**
+ * Enforcement half of the Backoffice session policy, resolved by `AdminGuard` on every
+ * admin request through ADMIN_SECURITY_POLICY.
+ *
+ * Both checks throw rather than return a verdict: a caller that forgets to branch on a
+ * boolean would silently grant access, which is the one failure mode this class exists
+ * to prevent.
+ */
+export declare class AdminSecurityService implements AdminSecurityPolicy {
+    private readonly drizzle;
+    private readonly events;
+    private readonly sessions;
+    private readonly trustedDevices;
+    private readonly identityReader;
+    private readonly config;
+    private readonly geoIp?;
+    constructor({ drizzle, events, sessions, trustedDevices, identityReader, config, geoIp, }: AdminSecurityServiceDeps);
+    assertEnrolled({ userId, ip, userAgent }: AdminSessionContext): Promise<void>;
+    assertSessionIntact({ userId, sessionId, ip, userAgent, }: AdminSessionContext): Promise<void>;
+    private hasSuspiciousIpChange;
+    private lookupCountry;
+    /**
+     * Ends a session whose device or network no longer matches, and drops the trust that
+     * device held - otherwise the next login would silently skip the second factor on the
+     * very device that just failed the check.
+     */
+    private endCompromisedSession;
+    private touchLastSeen;
+    /**
+     * What the Backoffice needs before it renders anything: whether this account still
+     * has to enrol, and whether the browser it is on holds an unexpired trust grant.
+     */
+    status(userId: User['id'], userAgent: string | null): Promise<AdminSecurityStatus>;
+    /**
+     * Counts what is left of the recovery set. better-auth stores the codes as a JSON
+     * array unless the operator opts into encryption, so an unreadable column is reported
+     * as unknown rather than as zero - claiming no codes remain would be worse than
+     * admitting the count cannot be taken.
+     */
+    private countBackupCodes;
+    listTrustedDevices(userId: User['id'], userAgent: string | null): Promise<TrustedDeviceItem[]>;
+    revokeTrustedDevice(userId: User['id'], deviceId: AdminTrustedDevice['id'], actorId: User['id'], meta?: ClientMeta, keepSessionId?: Session['id']): Promise<{
+        success: true;
+    }>;
+    /**
+     * A revoked device loses its live sessions in the same breath, so the grant cannot
+     * outlive the revoke on the browser that already holds one.
+     *
+     * `keepSessionId` spares the caller's own session: revoking trust on the browser you
+     * are sitting in means "ask me for a code next time", not "sign me out now" - the same
+     * line `SessionService.revokeOwnSession` draws for sessions.
+     */
+    private endSessionsOnDevice;
+    /**
+     * Returns an account to the unenrolled state so its owner can set a second factor up
+     * again: the shared recovery path for a lost authenticator, since better-auth's own
+     * disable endpoint asks for the account's password and a locked-out admin has no way
+     * to reach it. The trust grants and live sessions go with it - leaving either behind
+     * would let a browser keep the access the reset exists to withdraw.
+     */
+    resetTwoFactor(userId: User['id'], actorId: User['id'], reason: string, meta?: ClientMeta): Promise<{
+        success: true;
+    }>;
+    isTrustedDevice(userId: User['id'], userAgent: string | null): Promise<boolean>;
+}
+//# sourceMappingURL=admin-security.service.d.ts.map

package/dist/pam/identity/service/admin-security.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-security.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/admin-security.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,QAAQ,EACb,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,IAAI,EACV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAQxE,eAAO,MAAM,uBAAuB;QA7BR,CAAC;CAgC5B,CAAC;AAMF,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,cAAc,EAAE,oBAAoB,CAAC;IACrC,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CAClC,CAAC;AAEF;;;;;;;GAOG;AACH,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAA2B;gBAEtC,EACV,OAAO,EACP,MAAM,EACN,QAAQ,EACR,cAAc,EACd,cAAc,EACd,MAAM,EACN,KAAK,GACN,EAAE,wBAAwB;IAgBrB,cAAc,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB7E,mBAAmB,CAAC,EACxB,MAAM,EACN,SAAS,EACT,EAAE,EACF,SAAS,GACV,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;YA6BxB,qBAAqB;YA2BrB,aAAa;IAS3B;;;;OAIG;YACW,qBAAqB;YAsBrB,aAAa;IAU3B;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyBxF;;;;;OAKG;YACW,gBAAgB;IAkB9B,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAIxF,mBAAmB,CACvB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAClC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EACnB,IAAI,CAAC,EAAE,UAAU,EACjB,aAAa,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;;;IAO/B;;;;;;;OAOG;YACW,mBAAmB;IAmBjC;;;;;;OAMG;IACG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU;;;IA4C/F,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;CAGhF"}

package/dist/pam/identity/service/admin-security.service.js

@@ -0,0 +1,277 @@
+import { ORPCError } from '@orpc/server';
+import { createLogger, makeConflictError, } from '@openora/core/server';
+import { and, eq, gt, sql } from 'drizzle-orm';
+import { AuthGuardReasonSchema, } from '@openora/core/contracts';
+import { session, twoFactor, user, } from '../schema/index.js';
+import { isSameDevice, isSuspiciousIpChange } from './device-fingerprint.service.js';
+import { UserNotFoundError } from './identity.service.js';
+const logger = createLogger('admin-security');
+// A Super Admin cannot clear their own second factor - that would let a single
+// compromised account walk itself back to the unenrolled state. The reset always
+// goes through another Super Admin.
+export const SelfTwoFactorResetError = makeConflictError('SelfTwoFactorResetError', 'An admin cannot reset their own second factor - ask another Super Admin');
+// Recording activity on every admin request would be one write per call; the session
+// list only needs minute-level resolution.
+const LAST_SEEN_THROTTLE_MS = 5 * 60 * 1000;
+/**
+ * Enforcement half of the Backoffice session policy, resolved by `AdminGuard` on every
+ * admin request through ADMIN_SECURITY_POLICY.
+ *
+ * Both checks throw rather than return a verdict: a caller that forgets to branch on a
+ * boolean would silently grant access, which is the one failure mode this class exists
+ * to prevent.
+ */
+export class AdminSecurityService {
+    drizzle;
+    events;
+    sessions;
+    trustedDevices;
+    identityReader;
+    config;
+    geoIp;
+    constructor({ drizzle, events, sessions, trustedDevices, identityReader, config, geoIp, }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.sessions = sessions;
+        this.trustedDevices = trustedDevices;
+        this.identityReader = identityReader;
+        this.config = config;
+        this.geoIp = geoIp;
+        if (config.bindSessionToDevice && config.ipChangePolicy === 'country' && !geoIp) {
+            logger.warn('adminSecurity.ipChangePolicy is "country" but no GEO_IP_ADAPTER is bound - ' +
+                'IP changes will not end a session. Bind a geo-ip adapter or set the policy explicitly.');
+        }
+    }
+    async assertEnrolled({ userId, ip, userAgent }) {
+        if (!this.config.requireTwoFactor) {
+            return;
+        }
+        const [row] = await this.drizzle.db
+            .select({ twoFactorEnabled: user.twoFactorEnabled })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (row?.twoFactorEnabled === true) {
+            return;
+        }
+        this.events.emit('identity.2fa.enrollment_blocked', { userId, ip, userAgent });
+        throw new ORPCError('FORBIDDEN', {
+            message: 'Two-factor authentication must be configured before using the back office',
+            data: { reason: AuthGuardReasonSchema.enum.two_factor_required },
+        });
+    }
+    async assertSessionIntact({ userId, sessionId, ip, userAgent, }) {
+        if (!this.config.bindSessionToDevice || !sessionId) {
+            return;
+        }
+        const [row] = await this.drizzle.db
+            .select({
+            ipAddress: session.ipAddress,
+            userAgent: session.userAgent,
+            lastSeenAt: session.lastSeenAt,
+        })
+            .from(session)
+            .where(and(eq(session.id, sessionId), eq(session.userId, userId)))
+            .limit(1);
+        if (!row) {
+            return;
+        }
+        if (!isSameDevice(row.userAgent, userAgent)) {
+            await this.endCompromisedSession({ userId, sessionId, ip, userAgent }, 'user_agent');
+        }
+        if (await this.hasSuspiciousIpChange(row.ipAddress, ip)) {
+            await this.endCompromisedSession({ userId, sessionId, ip, userAgent }, 'ip');
+        }
+        await this.touchLastSeen(sessionId, row.lastSeenAt);
+    }
+    async hasSuspiciousIpChange(sessionIp, requestIp) {
+        const policy = this.config.ipChangePolicy;
+        if (policy === 'off' || !sessionIp || !requestIp || sessionIp === requestIp) {
+            return false;
+        }
+        if (policy === 'any') {
+            return true;
+        }
+        if (!this.geoIp) {
+            return false;
+        }
+        const [sessionCountry, requestCountry] = await Promise.all([
+            this.lookupCountry(sessionIp),
+            this.lookupCountry(requestIp),
+        ]);
+        return isSuspiciousIpChange({
+            policy,
+            sessionIp,
+            requestIp,
+            sessionCountry,
+            requestCountry,
+        });
+    }
+    async lookupCountry(ipAddress) {
+        try {
+            return (await this.geoIp?.lookup(ipAddress))?.countryCode ?? null;
+        }
+        catch (error) {
+            logger.warn(`geo-ip lookup failed for a session check: ${String(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Ends a session whose device or network no longer matches, and drops the trust that
+     * device held - otherwise the next login would silently skip the second factor on the
+     * very device that just failed the check.
+     */
+    async endCompromisedSession({ userId, sessionId, ip, userAgent }, mismatch) {
+        // No actorId: the guard forced this itself, not the device owner nor an admin -
+        // passing `userId` here would read in the audit trail as a self-revoke.
+        await this.sessions.revokeSession(userId, sessionId, undefined, { ip, userAgent });
+        await this.trustedDevices.revokeForDevice(userId, userAgent, undefined);
+        this.events.emit('identity.session.fingerprint_mismatch', {
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            sessionId,
+            mismatch,
+            ip,
+            userAgent,
+        });
+        throw new ORPCError('UNAUTHORIZED', {
+            message: 'Session ended because the device or network changed',
+            data: { reason: AuthGuardReasonSchema.enum.session_fingerprint_mismatch },
+        });
+    }
+    async touchLastSeen(sessionId, lastSeenAt) {
+        if (lastSeenAt && Date.now() - lastSeenAt.getTime() < LAST_SEEN_THROTTLE_MS) {
+            return;
+        }
+        await this.drizzle.db
+            .update(session)
+            .set({ lastSeenAt: sql `now()` })
+            .where(eq(session.id, sessionId));
+    }
+    /**
+     * What the Backoffice needs before it renders anything: whether this account still
+     * has to enrol, and whether the browser it is on holds an unexpired trust grant.
+     */
+    async status(userId, userAgent) {
+        const [row] = await this.drizzle.db
+            .select({
+            twoFactorEnabled: user.twoFactorEnabled,
+            twoFactorLockoutUntil: user.twoFactorLockoutUntil,
+        })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        const twoFactorEnabled = row?.twoFactorEnabled === true;
+        const devices = await this.trustedDevices.list(userId, userAgent);
+        const currentDevice = devices.find((device) => device.isCurrent);
+        const lockedUntil = row?.twoFactorLockoutUntil ?? null;
+        return {
+            twoFactorEnabled,
+            backupCodesRemaining: twoFactorEnabled ? await this.countBackupCodes(userId) : null,
+            enrollmentRequired: this.config.requireTwoFactor && !twoFactorEnabled,
+            trustedDeviceDays: this.config.trustedDeviceDays,
+            trustedDeviceUntil: currentDevice?.expiresAt ?? null,
+            lockedUntil: lockedUntil ? lockedUntil.toISOString() : null,
+        };
+    }
+    /**
+     * Counts what is left of the recovery set. better-auth stores the codes as a JSON
+     * array unless the operator opts into encryption, so an unreadable column is reported
+     * as unknown rather than as zero - claiming no codes remain would be worse than
+     * admitting the count cannot be taken.
+     */
+    async countBackupCodes(userId) {
+        const [row] = await this.drizzle.db
+            .select({ backupCodes: twoFactor.backupCodes })
+            .from(twoFactor)
+            .where(eq(twoFactor.userId, userId))
+            .limit(1);
+        if (!row) {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(row.backupCodes);
+            return Array.isArray(parsed) ? parsed.length : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    listTrustedDevices(userId, userAgent) {
+        return this.trustedDevices.list(userId, userAgent);
+    }
+    async revokeTrustedDevice(userId, deviceId, actorId, meta, keepSessionId) {
+        const { userAgent } = await this.trustedDevices.revoke(userId, deviceId, actorId, meta);
+        await this.endSessionsOnDevice(userId, userAgent, actorId, meta, keepSessionId);
+        return { success: true };
+    }
+    /**
+     * A revoked device loses its live sessions in the same breath, so the grant cannot
+     * outlive the revoke on the browser that already holds one.
+     *
+     * `keepSessionId` spares the caller's own session: revoking trust on the browser you
+     * are sitting in means "ask me for a code next time", not "sign me out now" - the same
+     * line `SessionService.revokeOwnSession` draws for sessions.
+     */
+    async endSessionsOnDevice(userId, deviceUserAgent, actorId, meta, keepSessionId) {
+        const active = await this.drizzle.db
+            .select({ id: session.id, userAgent: session.userAgent })
+            .from(session)
+            .where(and(eq(session.userId, userId), gt(session.expiresAt, sql `now()`)));
+        for (const row of active) {
+            if (row.id !== keepSessionId && isSameDevice(row.userAgent, deviceUserAgent)) {
+                await this.sessions.revokeSession(userId, row.id, actorId, meta);
+            }
+        }
+    }
+    /**
+     * Returns an account to the unenrolled state so its owner can set a second factor up
+     * again: the shared recovery path for a lost authenticator, since better-auth's own
+     * disable endpoint asks for the account's password and a locked-out admin has no way
+     * to reach it. The trust grants and live sessions go with it - leaving either behind
+     * would let a browser keep the access the reset exists to withdraw.
+     */
+    async resetTwoFactor(userId, actorId, reason, meta) {
+        if (userId === actorId) {
+            throw new SelfTwoFactorResetError();
+        }
+        const [account] = await this.drizzle.db
+            .select({ id: user.id })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (!account) {
+            throw new UserNotFoundError(userId);
+        }
+        // Both writes commit together: a process death between them would leave
+        // twoFactorEnabled true with no twoFactor row - locked out with no repair
+        // route, since resetting requires a Super Admin who is themselves gated on
+        // AdminGuard.assertEnrolled.
+        await this.drizzle.db.transaction(async (tx) => {
+            await tx.delete(twoFactor).where(eq(twoFactor.userId, userId));
+            await tx
+                .update(user)
+                .set({
+                twoFactorEnabled: false,
+                failedTwoFactorAttempts: 0,
+                twoFactorLockoutUntil: null,
+            })
+                .where(eq(user.id, userId));
+        });
+        await this.trustedDevices.revokeAllForUser(userId, actorId);
+        await this.sessions.revokeAllSessions(userId, actorId, meta);
+        this.events.emit('identity.2fa.reset', {
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            actorId,
+            reason,
+            ip: meta?.ip ?? null,
+            userAgent: meta?.userAgent ?? null,
+        });
+        return { success: true };
+    }
+    isTrustedDevice(userId, userAgent) {
+        return this.trustedDevices.isTrusted(userId, userAgent);
+    }
+}
+//# sourceMappingURL=admin-security.service.js.map

package/dist/pam/identity/service/admin-security.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-security.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/admin-security.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAGL,YAAY,EACZ,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,qBAAqB,GAQtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,OAAO,EACP,SAAS,EACT,IAAI,GAGL,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAGrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE9C,+EAA+E;AAC/E,iFAAiF;AACjF,oCAAoC;AACpC,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CACtD,yBAAyB,EACzB,yEAAyE,CAC1E,CAAC;AAEF,qFAAqF;AACrF,2CAA2C;AAC3C,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAY5C;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,QAAQ,CAAiB;IACzB,cAAc,CAAuB;IACrC,cAAc,CAAiB;IAC/B,MAAM,CAAsB;IAC5B,KAAK,CAA4B;IAElD,YAAY,EACV,OAAO,EACP,MAAM,EACN,QAAQ,EACR,cAAc,EACd,cAAc,EACd,MAAM,EACN,KAAK,GACoB;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CACT,6EAA6E;gBAC3E,wFAAwF,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAuB;QACjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,GAAG,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;YAC/B,OAAO,EAAE,2EAA2E;YACpF,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,mBAAmB,EAAE;SACjE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,EACxB,MAAM,EACN,SAAS,EACT,EAAE,EACF,SAAS,GACW;QACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACjE,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,SAAwB,EACxB,SAAwB;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAC1C,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;SAC9B,CAAC,CAAC;QACH,OAAO,oBAAoB,CAAC;YAC1B,MAAM;YACN,SAAS;YACT,SAAS;YACT,cAAc;YACd,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,SAAiB;QAC3C,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,6CAA6C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAsD,EACxF,QAA6B;QAE7B,gFAAgF;QAChF,wEAAwE;QACxE,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACxD,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,SAAS;YACT,QAAQ;YACR,EAAE;YACF,SAAS;SACV,CAAC,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;YAClC,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,4BAA4B,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,SAAwB,EAAE,UAAuB;QAC3E,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAAkB,EAAE,SAAwB;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,MAAM,gBAAgB,GAAG,GAAG,EAAE,gBAAgB,KAAK,IAAI,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,GAAG,EAAE,qBAAqB,IAAI,IAAI,CAAC;QAEvD,OAAO;YACL,gBAAgB;YAChB,oBAAoB,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YACnF,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,gBAAgB;YACrE,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;YAChD,kBAAkB,EAAE,aAAa,EAAE,SAAS,IAAI,IAAI;YACpD,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;SAC5D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAAC,MAAkB;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;aAC9C,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,MAAkB,EAAE,SAAwB;QAC7D,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,MAAkB,EAClB,QAAkC,EAClC,OAAmB,EACnB,IAAiB,EACjB,aAA6B;QAE7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAkB,EAClB,eAA8B,EAC9B,OAAmB,EACnB,IAAiB,EACjB,aAA6B;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACjC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aACxD,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,CAAC;QAE7E,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,EAAE,KAAK,aAAa,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,MAAkB,EAAE,OAAmB,EAAE,MAAc,EAAE,IAAiB;QAC7F,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACpC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACvB,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,6BAA6B;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC7C,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,MAAM,EAAE;iBACL,MAAM,CAAC,IAAI,CAAC;iBACZ,GAAG,CAAC;gBACH,gBAAgB,EAAE,KAAK;gBACvB,uBAAuB,EAAE,CAAC;gBAC1B,qBAAqB,EAAE,IAAI;aAC5B,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACrC,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,OAAO;YACP,MAAM;YACN,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACpB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED,eAAe,CAAC,MAAkB,EAAE,SAAwB;QAC1D,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/pam/identity/service/capture-timezone.service.d.ts

@@ -0,0 +1,10 @@
+import type { PlayerProvisioning, User } from '@openora/core/contracts';
+/**
+ * Hands the browser-reported zone to the player module. Every caller invokes this only after
+ * the credentials have passed, so an unauthenticated request can never write someone else's
+ * row. Best-effort throughout - an absent zone, an unbound port and a failed write are all
+ * swallowed, as is a provisioning adapter that does not implement the optional method,
+ * because a cosmetic column must never cost a player their session.
+ */
+export declare function captureTimezone(provisioning: PlayerProvisioning | undefined, userId: User['id'], timezone: string | undefined): Promise<void>;
+//# sourceMappingURL=capture-timezone.service.d.ts.map

package/dist/pam/identity/service/capture-timezone.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-timezone.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/capture-timezone.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAIxE;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,kBAAkB,GAAG,SAAS,EAC5C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CASf"}

package/dist/pam/identity/service/capture-timezone.service.js

@@ -0,0 +1,21 @@
+import { createLogger } from '@openora/core/server';
+const logger = createLogger('player-timezone');
+/**
+ * Hands the browser-reported zone to the player module. Every caller invokes this only after
+ * the credentials have passed, so an unauthenticated request can never write someone else's
+ * row. Best-effort throughout - an absent zone, an unbound port and a failed write are all
+ * swallowed, as is a provisioning adapter that does not implement the optional method,
+ * because a cosmetic column must never cost a player their session.
+ */
+export async function captureTimezone(provisioning, userId, timezone) {
+    if (!timezone || !provisioning) {
+        return;
+    }
+    try {
+        await provisioning.recordTimezone?.(userId, timezone);
+    }
+    catch (err) {
+        logger.warn({ err, userId }, 'player timezone capture failed - ignored');
+    }
+}
+//# sourceMappingURL=capture-timezone.service.js.map

package/dist/pam/identity/service/capture-timezone.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-timezone.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/capture-timezone.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAA4C,EAC5C,MAAkB,EAClB,QAA4B;IAE5B,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,0CAA0C,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/dist/pam/identity/service/device-fingerprint.service.d.ts

@@ -0,0 +1,32 @@
+export type IpChangePolicy = 'off' | 'country' | 'any';
+export type DeviceDescription = {
+    label: string;
+    browser: string | null;
+    os: string | null;
+};
+export declare function normalizeUserAgent(userAgent: string | null | undefined): string;
+export declare function deviceHash(userAgent: string | null | undefined): string;
+export declare function isSameDevice(left: string | null | undefined, right: string | null | undefined): boolean;
+/**
+ * Turns a raw User-Agent into the browser/OS pair the session list shows. Deliberately
+ * a handful of patterns rather than a UA-parsing dependency: the value is a display
+ * label, and a wrong guess costs a cosmetic string, never an access decision.
+ */
+export declare function describeDevice(userAgent: string | null | undefined): DeviceDescription;
+/**
+ * Whether a mid-session IP change is suspicious enough to end the session.
+ *
+ * `country` needs both countries resolved - an unbound or failing geo-ip lookup
+ * yields nulls, and an unresolved lookup must never end a session on its own.
+ * `any` is the strictest setting and will log users out across NAT and mobile
+ * network hops, which is why it is not the default.
+ */
+export declare function isSuspiciousIpChange({ policy, sessionIp, requestIp, sessionCountry, requestCountry, }: {
+    policy: IpChangePolicy;
+    sessionIp: string | null;
+    requestIp: string | null;
+    sessionCountry?: string | null;
+    requestCountry?: string | null;
+}): boolean;
+export declare function trustedDeviceExpiry(trustedDeviceDays: number, now?: Date): Date;
+//# sourceMappingURL=device-fingerprint.service.d.ts.map