@openora/core 0.4.1-canary.13 → 0.4.1-canary.131

package/dist/mail/service/mail.service.js

@@ -0,0 +1,152 @@
+import { createLogger } from '@openora/core/server';
+import { MAIL_SEND_QUEUE } from '../contract/index.js';
+import { createMailPayloadCipher } from './mail-payload.service.js';
+const logger = createLogger('mail');
+const DEFAULT_LOCALE = 'en';
+const REGULATORY_KEYS = new Set([
+    'rgLimitUpdated',
+    'rgCoolingOffActivated',
+    'rgCoolingOffLifted',
+    'rgSelfExclusionActivated',
+    'rgSelfExclusionLifted',
+    'kycResubmissionRequested',
+]);
+const MAIL_ENQUEUE_OPTS = {
+    attempts: 5,
+    backoff: { type: 'exponential', delayMs: 1000 },
+};
+const ENQUEUE_RETRY_DELAYS_MS = [100, 300, 800];
+async function withEnqueueRetry(enqueue) {
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            await enqueue();
+            return;
+        }
+        catch (err) {
+            if (attempt >= ENQUEUE_RETRY_DELAYS_MS.length) {
+                throw err;
+            }
+            await new Promise((resolve) => setTimeout(resolve, ENQUEUE_RETRY_DELAYS_MS[attempt]));
+        }
+    }
+}
+export class MailService {
+    sender;
+    renderer;
+    directory;
+    jobQueue;
+    audit;
+    payloadCipher;
+    constructor(deps) {
+        this.sender = deps.sender;
+        this.renderer = deps.renderer;
+        this.directory = deps.directory;
+        this.jobQueue = deps.jobQueue;
+        this.audit = deps.audit;
+        this.payloadCipher = createMailPayloadCipher(deps.encryptionSecret);
+    }
+    async enqueueToUser({ userId, template, idempotencyKey }) {
+        await withEnqueueRetry(() => this.jobQueue.enqueue(MAIL_SEND_QUEUE, this.encrypt({ recipient: { kind: 'user', userId }, template }), { idempotencyKey, ...MAIL_ENQUEUE_OPTS }));
+    }
+    async enqueueToAddress({ email, locale, template, idempotencyKey, }) {
+        await withEnqueueRetry(() => this.jobQueue.enqueue(MAIL_SEND_QUEUE, this.encrypt({
+            recipient: { kind: 'address', email, ...(locale ? { locale } : {}) },
+            template,
+        }), { idempotencyKey, ...MAIL_ENQUEUE_OPTS }));
+    }
+    async deliver(job, attempt = 1) {
+        const resolved = await this.resolveRecipient(job);
+        if (!resolved) {
+            await this.recordRegulatoryOutcome('mail.regulatory_delivery.failed', job, {
+                reason: 'no_recipient_email',
+                attempt,
+            });
+            return;
+        }
+        const rendered = await this.renderer.render(job.template, resolved.locale, resolved.name);
+        await this.sender.send({
+            to: resolved.email,
+            subject: rendered.subject,
+            html: rendered.html,
+            text: rendered.text,
+        });
+        await this.recordRegulatoryOutcome('mail.regulatory_delivery.sent', job, {
+            locale: resolved.locale,
+            attempt,
+        });
+    }
+    async deliverEncrypted(job, attempt = 1) {
+        await this.deliver(this.payloadCipher.decrypt(job), attempt);
+    }
+    async onDeliveryExhausted(job, error, attempt = 1) {
+        logger.error({ err: error.name, key: job.template.key, recipient: job.recipient.kind }, 'mail delivery exhausted retries');
+        const locale = await this.resolveLocale(job);
+        await this.recordRegulatoryOutcome('mail.regulatory_delivery.failed', job, {
+            locale,
+            reason: error.name,
+            attempt,
+        });
+    }
+    async onEncryptedDeliveryExhausted(job, error, attempt = 1) {
+        let decrypted;
+        try {
+            decrypted = this.payloadCipher.decrypt(job);
+        }
+        catch (decryptErr) {
+            logger.error({ err: decryptErr.name, queue: MAIL_SEND_QUEUE }, 'mail dead-letter payload could not be decrypted');
+            await this.audit
+                ?.record({
+                actorType: 'system',
+                action: 'mail.regulatory_delivery.failed',
+                resourceType: 'email',
+                resourceId: null,
+                after: { reason: 'payload_undecryptable', queue: MAIL_SEND_QUEUE, attempt },
+            })
+                .catch((err) => logger.error({ err }, 'mail regulatory audit write failed'));
+            return;
+        }
+        await this.onDeliveryExhausted(decrypted, error, attempt);
+    }
+    // `after` carries no free text - error.name, not error.message: a provider bounce
+    // routinely embeds the recipient address, and audit_log is append-only.
+    async recordRegulatoryOutcome(action, job, after) {
+        if (!this.audit || !REGULATORY_KEYS.has(job.template.key)) {
+            return;
+        }
+        await this.audit
+            .record({
+            actorType: 'system',
+            action,
+            resourceType: 'email',
+            resourceId: job.recipient.kind === 'user' ? job.recipient.userId : null,
+            after: { templateKey: job.template.key, ...after },
+        })
+            .catch((err) => logger.error({ err }, 'mail regulatory audit write failed'));
+    }
+    encrypt(job) {
+        return this.payloadCipher.encrypt(job);
+    }
+    async resolveLocale(job) {
+        if (job.recipient.kind === 'address') {
+            return job.recipient.locale ?? DEFAULT_LOCALE;
+        }
+        const row = await this.directory.get(job.recipient.userId);
+        return row?.language ?? DEFAULT_LOCALE;
+    }
+    async resolveRecipient(job) {
+        if (job.recipient.kind === 'address') {
+            return {
+                email: job.recipient.email,
+                locale: job.recipient.locale ?? DEFAULT_LOCALE,
+                name: null,
+            };
+        }
+        const row = await this.directory.get(job.recipient.userId);
+        if (!row?.email) {
+            logger.warn({ userId: job.recipient.userId, key: job.template.key }, 'mail skipped: no email for user');
+            return null;
+        }
+        return { email: row.email, locale: row.language ?? DEFAULT_LOCALE, name: row.name };
+    }
+}
+//# sourceMappingURL=mail.service.js.map

package/dist/mail/service/mail.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.service.js","sourceRoot":"","sources":["../../../src/mail/service/mail.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAWpD,OAAO,EAAE,eAAe,EAA+C,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,uBAAuB,EAA0B,MAAM,2BAA2B,CAAC;AAE5F,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEpC,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAsB;IACnD,gBAAgB;IAChB,uBAAuB;IACvB,oBAAoB;IACpB,0BAA0B;IAC1B,uBAAuB;IACvB,0BAA0B;CAC3B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG;IACxB,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE;CACvC,CAAC;AAEX,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEhD,KAAK,UAAU,gBAAgB,CAAC,OAA+B;IAC7D,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,IAAI,uBAAuB,CAAC,MAAM,EAAE,CAAC;gBAC9C,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;AACH,CAAC;AAWD,MAAM,OAAO,WAAW;IACL,MAAM,CAAkB;IACxB,QAAQ,CAAwB;IAChC,SAAS,CAAqB;IAC9B,QAAQ,CAAkB;IAC1B,KAAK,CAAwB;IAC7B,aAAa,CAAoB;IAElD,YAAY,IAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAmB;QACvE,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,CACnB,eAAe,EACf,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,EAC/D,EAAE,cAAc,EAAE,GAAG,iBAAiB,EAAE,CACzC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EACrB,KAAK,EACL,MAAM,EACN,QAAQ,EACR,cAAc,GACK;QACnB,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,CACnB,eAAe,EACf,IAAI,CAAC,OAAO,CAAC;YACX,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACpE,QAAQ;SACT,CAAC,EACF,EAAE,cAAc,EAAE,GAAG,iBAAiB,EAAE,CACzC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAgB,EAAE,OAAO,GAAG,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,uBAAuB,CAAC,iCAAiC,EAAE,GAAG,EAAE;gBACzE,MAAM,EAAE,oBAAoB;gBAC5B,OAAO;aACR,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1F,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,EAAE,EAAE,QAAQ,CAAC,KAAK;YAClB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAyB,EAAE,OAAO,GAAG,CAAC;QAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAgB,EAAE,KAAY,EAAE,OAAO,GAAG,CAAC;QACnE,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EACzE,iCAAiC,CAClC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,uBAAuB,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzE,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,IAAI;YAClB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,4BAA4B,CAChC,GAAyB,EACzB,KAAY,EACZ,OAAO,GAAG,CAAC;QAEX,IAAI,SAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAG,UAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,EAC3D,iDAAiD,CAClD,CAAC;YACF,MAAM,IAAI,CAAC,KAAK;gBACd,EAAE,MAAM,CAAC;gBACP,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,iCAAiC;gBACzC,YAAY,EAAE,OAAO;gBACrB,UAAU,EAAE,IAAI;gBAChB,KAAK,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE;aAC5E,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,kFAAkF;IAClF,wEAAwE;IAChE,KAAK,CAAC,uBAAuB,CACnC,MAA2E,EAC3E,GAAgB,EAChB,KAA4D;QAE5D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,KAAK;aACb,MAAM,CAAC;YACN,SAAS,EAAE,QAAQ;YACnB,MAAM;YACN,YAAY,EAAE,OAAO;YACrB,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YACvE,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE;SACnD,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC,CAAC;IACjF,CAAC;IAEO,OAAO,CAAC,GAAgB;QAC9B,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAgB;QAC1C,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,cAAc,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,GAAG,EAAE,QAAQ,IAAI,cAAc,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,GAAgB;QAEhB,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO;gBACL,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK;gBAC1B,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,cAAc;gBAC9C,IAAI,EAAE,IAAI;aACX,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EACvD,iCAAiC,CAClC,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACtF,CAAC;CACF"}

package/dist/pam/identity/__tests__/admin-security.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin-security.int.test.d.ts.map

package/dist/pam/identity/__tests__/admin-security.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-security.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/admin-security.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/admin-security.int.test.js

@@ -0,0 +1,137 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+import { eq, sql } from 'drizzle-orm';
+import { createTestDb, seedUser } from '@openora/core/testing';
+import { AdminSecurityConfigSchema } from '@openora/core/contracts';
+import { user, session, twoFactor, adminTrustedDevice } from '../schema/index.js';
+import { makeEventBus, makeIdentityReader } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { AdminSecurityService, SelfTwoFactorResetError, } from '../service/admin-security.service.js';
+import { SessionService } from '../service/session.service.js';
+import { TrustedDeviceService } from '../service/trusted-device.service.js';
+const CHROME_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+const SAFARI_UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15';
+let db;
+function buildService() {
+    const events = makeEventBus();
+    const drizzle = db.drizzle;
+    const trustedDevices = new TrustedDeviceService({ drizzle, events, trustedDeviceDays: 30 });
+    const service = new AdminSecurityService({
+        drizzle,
+        events,
+        sessions: new SessionService({ drizzle, events, identityReader: makeIdentityReader() }),
+        trustedDevices,
+        identityReader: makeIdentityReader(),
+        config: AdminSecurityConfigSchema.parse({ requireTwoFactor: true, bindSessionToDevice: true }),
+    });
+    return { service, trustedDevices, events };
+}
+const seedSession = (userId, userAgent) => db.drizzle.db
+    .insert(session)
+    .values({
+    userId,
+    token: crypto.randomUUID(),
+    userAgent,
+    expiresAt: new Date(Date.now() + 86_400_000),
+    updatedAt: new Date(),
+})
+    .returning({ id: session.id })
+    .then(([row]) => row?.id ?? '');
+async function isActive(sessionId) {
+    const [row] = await db.drizzle.db
+        .select({ expiresAt: session.expiresAt })
+        .from(session)
+        .where(eq(session.id, sessionId));
+    return row !== undefined && row.expiresAt.getTime() > Date.now();
+}
+beforeAll(async () => {
+    db = await createTestDb([migrate]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    vi.clearAllMocks();
+    await db.drizzle.db.execute(sql `TRUNCATE ${user}, ${session}, ${twoFactor}, ${adminTrustedDevice} RESTART IDENTITY CASCADE`);
+});
+describe('AdminSecurityService.revokeTrustedDevice (real PG)', () => {
+    it('ends the sessions the revoked device was holding', async () => {
+        const admin = await seedUser(db, { name: 'Admin', email: 'admin@b.dev', role: 'admin' });
+        const revokedSession = await seedSession(admin.id, CHROME_UA);
+        const otherSession = await seedSession(admin.id, SAFARI_UA);
+        const { service, trustedDevices } = buildService();
+        const device = await trustedDevices.trust(admin.id, { ip: null, userAgent: CHROME_UA });
+        if (!device) {
+            throw new Error('trust() stored no device');
+        }
+        await service.revokeTrustedDevice(admin.id, device.id, admin.id);
+        expect(await isActive(revokedSession)).toBe(false);
+        expect(await isActive(otherSession)).toBe(true);
+    });
+    it('spares the session the revoke was issued from', async () => {
+        const admin = await seedUser(db, { name: 'Admin', email: 'admin@b.dev', role: 'admin' });
+        const callerSession = await seedSession(admin.id, CHROME_UA);
+        const otherTab = await seedSession(admin.id, CHROME_UA);
+        const { service, trustedDevices } = buildService();
+        const device = await trustedDevices.trust(admin.id, { ip: null, userAgent: CHROME_UA });
+        if (!device) {
+            throw new Error('trust() stored no device');
+        }
+        await service.revokeTrustedDevice(admin.id, device.id, admin.id, undefined, callerSession);
+        expect(await isActive(callerSession)).toBe(true);
+        expect(await isActive(otherTab)).toBe(false);
+        expect(await service.isTrustedDevice(admin.id, CHROME_UA)).toBe(false);
+    });
+    it('drops the trust so the device stops being listed', async () => {
+        const admin = await seedUser(db, { name: 'Admin', email: 'admin@b.dev', role: 'admin' });
+        const { service, trustedDevices } = buildService();
+        const device = await trustedDevices.trust(admin.id, { ip: null, userAgent: CHROME_UA });
+        if (!device) {
+            throw new Error('trust() stored no device');
+        }
+        await service.revokeTrustedDevice(admin.id, device.id, admin.id);
+        expect(await service.isTrustedDevice(admin.id, CHROME_UA)).toBe(false);
+        expect(await service.listTrustedDevices(admin.id, CHROME_UA)).toEqual([]);
+    });
+});
+describe('AdminSecurityService.resetTwoFactor (real PG)', () => {
+    const enrol = async (userId) => {
+        await db.drizzle.db
+            .update(user)
+            .set({ twoFactorEnabled: true, failedTwoFactorAttempts: 4 })
+            .where(eq(user.id, userId));
+        await db.drizzle.db
+            .insert(twoFactor)
+            .values({ userId, secret: 'seed-secret', backupCodes: '["aaaaa-bbbbb"]' });
+    };
+    it('returns the account to the unenrolled state', async () => {
+        const admin = await seedUser(db, { name: 'Admin', email: 'admin@b.dev', role: 'admin' });
+        const superAdmin = await seedUser(db, { name: 'Boss', email: 'boss@b.dev', role: 'admin' });
+        await enrol(admin.id);
+        const { service } = buildService();
+        await service.resetTwoFactor(admin.id, superAdmin.id, 'lost authenticator');
+        const status = await service.status(admin.id, CHROME_UA);
+        expect(status.twoFactorEnabled).toBe(false);
+        expect(status.enrollmentRequired).toBe(true);
+        expect(status.lockedUntil).toBeNull();
+    });
+    it('takes the trusted devices and live sessions with it', async () => {
+        const admin = await seedUser(db, { name: 'Admin', email: 'admin@b.dev', role: 'admin' });
+        const superAdmin = await seedUser(db, { name: 'Boss', email: 'boss@b.dev', role: 'admin' });
+        await enrol(admin.id);
+        const chrome = await seedSession(admin.id, CHROME_UA);
+        const safari = await seedSession(admin.id, SAFARI_UA);
+        const { service, trustedDevices } = buildService();
+        await trustedDevices.trust(admin.id, { ip: null, userAgent: CHROME_UA });
+        await service.resetTwoFactor(admin.id, superAdmin.id, 'lost authenticator');
+        expect(await isActive(chrome)).toBe(false);
+        expect(await isActive(safari)).toBe(false);
+        expect(await service.isTrustedDevice(admin.id, CHROME_UA)).toBe(false);
+    });
+    it('refuses to reset the acting admin’s own second factor', async () => {
+        const admin = await seedUser(db, { name: 'Admin', email: 'admin@b.dev', role: 'admin' });
+        await enrol(admin.id);
+        const { service } = buildService();
+        await expect(service.resetTwoFactor(admin.id, admin.id, 'self')).rejects.toThrow(SelfTwoFactorResetError);
+    });
+});
+//# sourceMappingURL=admin-security.int.test.js.map

package/dist/pam/identity/__tests__/admin-security.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-security.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/admin-security.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,MAAM,SAAS,GACb,iHAAiH,CAAC;AACpH,MAAM,SAAS,GACb,uHAAuH,CAAC;AAE1H,IAAI,EAAU,CAAC;AAEf,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IAC3B,MAAM,cAAc,GAAG,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC;QACvC,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC;QACvF,cAAc;QACd,cAAc,EAAE,kBAAkB,EAAE;QACpC,MAAM,EAAE,yBAAyB,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;KAC/F,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,SAAiB,EAAE,EAAE,CACxD,EAAE,CAAC,OAAO,CAAC,EAAE;KACV,MAAM,CAAC,OAAO,CAAC;KACf,MAAM,CAAC;IACN,MAAM;IACN,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;IAC1B,SAAS;IACT,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;IAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;KACD,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;KAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAEpC,KAAK,UAAU,QAAQ,CAAC,SAAiB;IACvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;SAC9B,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SACxC,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACzB,GAAG,CAAA,YAAY,IAAI,KAAK,OAAO,KAAK,SAAS,KAAK,kBAAkB,2BAA2B,CAChG,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,YAAY,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAEjE,MAAM,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,YAAY,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAE3F,MAAM,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,YAAY,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAEjE,MAAM,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,MAAM,KAAK,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACrC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aAChB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC;aAC3D,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aAChB,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;QAEnC,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,YAAY,EAAE,CAAC;QACnD,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzE,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAE5E,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;QAEnC,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC9E,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/admin-user-directory.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin-user-directory.int.test.d.ts.map

package/dist/pam/identity/__tests__/admin-user-directory.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-directory.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/admin-user-directory.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/admin-user-directory.int.test.js

@@ -0,0 +1,234 @@
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
+import { randomUUID } from 'node:crypto';
+import { eq, sql } from 'drizzle-orm';
+import { createTestDb, seedUser } from '@openora/core/testing';
+import { player } from '@openora/core/pam/schema/profile';
+import { migrate as migrateProfile } from '@openora/core/pam/migrate/profile';
+import { mock, NO_CLIENT_META } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { user } from '../schema/index.js';
+import { DrizzleAdminUserDirectory } from '../admin-user-directory.js';
+let db;
+function makeDirectory() {
+    const emit = vi.fn();
+    return {
+        dir: new DrizzleAdminUserDirectory(db.drizzle, mock({ emit, on: vi.fn() })),
+        emit,
+    };
+}
+async function seedPlayer(userId, overrides = {}) {
+    const { username = 'alice', ...playerOverrides } = overrides;
+    await db.drizzle.db.update(user).set({ username }).where(eq(user.id, userId));
+    const [row] = await db.drizzle.db
+        .insert(player)
+        .values({ userId, ...playerOverrides })
+        .returning();
+    return row;
+}
+beforeAll(async () => {
+    db = await createTestDb([migrate, migrateProfile]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    await db.drizzle.db.execute(sql `TRUNCATE ${player}, ${user} RESTART IDENTITY CASCADE`);
+});
+describe('DrizzleAdminUserDirectory.update (real PG)', () => {
+    it('emits deactivated and persists the flip when isActive goes true -> false', async () => {
+        const { dir, emit } = makeDirectory();
+        const account = await seedUser(db, { isActive: true });
+        const actorId = randomUUID();
+        const updated = await dir.update(account.id, { isActive: false }, actorId, NO_CLIENT_META);
+        expect(updated).toMatchObject({ isActive: false });
+        const [stored] = await db.drizzle.db.select().from(user).where(eq(user.id, account.id));
+        expect(stored?.isActive).toBe(false);
+        expect(emit).toHaveBeenCalledWith('identity.user.deactivated', {
+            userId: account.id,
+            actorId,
+            ip: null,
+            userAgent: null,
+        });
+    });
+    it('emits reactivated when isActive goes false -> true', async () => {
+        const { dir, emit } = makeDirectory();
+        const account = await seedUser(db, { isActive: false });
+        const actorId = randomUUID();
+        await dir.update(account.id, { isActive: true }, actorId, NO_CLIENT_META);
+        expect(emit).toHaveBeenCalledWith('identity.user.reactivated', {
+            userId: account.id,
+            actorId,
+            ip: null,
+            userAgent: null,
+        });
+    });
+    it('stays quiet when isActive is written unchanged', async () => {
+        const { dir, emit } = makeDirectory();
+        const account = await seedUser(db, { isActive: true });
+        await dir.update(account.id, { isActive: true }, randomUUID());
+        expect(emit).not.toHaveBeenCalled();
+    });
+    it('stays quiet on a role-only update but still writes the role', async () => {
+        const { dir, emit } = makeDirectory();
+        const account = await seedUser(db, { isActive: true });
+        const updated = await dir.update(account.id, { role: 'admin' }, randomUUID());
+        expect(updated).toMatchObject({ role: 'admin' });
+        expect(emit).not.toHaveBeenCalled();
+    });
+    it('returns null for an unknown user', async () => {
+        const { dir, emit } = makeDirectory();
+        expect(await dir.update(randomUUID(), { isActive: false }, randomUUID())).toBeNull();
+        expect(emit).not.toHaveBeenCalled();
+    });
+});
+describe('DrizzleAdminUserDirectory reads (real PG)', () => {
+    it('counts every user row', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db);
+        await seedUser(db);
+        expect(await dir.count()).toBe(2);
+    });
+    it('gets a single user, or null when unknown', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db);
+        expect(await dir.get(account.id)).toMatchObject({ id: account.id, email: account.email });
+        expect(await dir.get(randomUUID())).toBeNull();
+    });
+    it('filters the list by an email substring and reports the filtered total', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db, { email: 'match-me@example.com' });
+        await seedUser(db, { email: 'other@example.com' });
+        const result = await dir.list({ page: 1, limit: 10, search: 'match-me' });
+        expect(result.total).toBe(1);
+        expect(result.rows[0]?.email).toBe('match-me@example.com');
+    });
+    it('sorts by email ascending when asked', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db, { email: 'b@example.com' });
+        await seedUser(db, { email: 'a@example.com' });
+        const result = await dir.list({ page: 1, limit: 10, sortBy: 'email', sortOrder: 'asc' });
+        expect(result.rows.map((r) => r.email)).toEqual(['a@example.com', 'b@example.com']);
+    });
+    it('pages while the total covers the whole set', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db);
+        await seedUser(db);
+        await seedUser(db);
+        const result = await dir.list({ page: 2, limit: 2 });
+        expect(result.total).toBe(3);
+        expect(result.rows).toHaveLength(1);
+    });
+});
+describe('DrizzleAdminUserDirectory.lookupPlayers (real PG)', () => {
+    it('returns an empty array for no ids', async () => {
+        const { dir } = makeDirectory();
+        expect(await dir.lookupPlayers([])).toEqual([]);
+    });
+    it('joins the email from the user table onto the player summary', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'alice@example.com' });
+        const seededPlayer = await seedPlayer(account.id, {
+            username: 'alice',
+            kycStatus: 'verified',
+        });
+        const [summary] = await dir.lookupPlayers([account.id]);
+        expect(summary).toEqual({
+            playerId: seededPlayer.id,
+            userId: account.id,
+            username: 'alice',
+            email: 'alice@example.com',
+            kycStatus: 'approved',
+            language: 'en',
+            avatarUrl: null,
+            createdAt: expect.any(Date),
+            level: 1,
+            currency: 'USD',
+        });
+        expect(summary?.playerId).toBe(seededPlayer.id);
+        expect(summary?.playerId).not.toBe(summary?.userId);
+    });
+    it('skips a user id that has no player profile', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db);
+        expect(await dir.lookupPlayers([account.id])).toEqual([]);
+    });
+});
+describe('DrizzleAdminUserDirectory.getPlayerByUsername (real PG)', () => {
+    it('returns an exact case-insensitive match', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'anna@example.com' });
+        const seededPlayer = await seedPlayer(account.id, { username: 'annabell' });
+        const summary = await dir.getPlayerByUsername('annabell');
+        expect(summary).toMatchObject({
+            playerId: seededPlayer.id,
+            userId: account.id,
+            username: 'annabell',
+        });
+        expect(summary?.playerId).toBe(seededPlayer.id);
+        expect(summary?.playerId).not.toBe(summary?.userId);
+    });
+    it('returns null when no player matches', async () => {
+        const { dir } = makeDirectory();
+        expect(await dir.getPlayerByUsername('ghost')).toBeNull();
+    });
+    it('does not substring-match, unlike findPlayerIds', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'annabell@example.com' });
+        await seedPlayer(account.id, { username: 'annabell' });
+        expect(await dir.getPlayerByUsername('Anna')).toBeNull();
+        expect(await dir.findPlayerIds('Anna')).toEqual([account.id]);
+    });
+});
+describe('DrizzleAdminUserDirectory.findPlayerIds (real PG)', () => {
+    it('unions email and username matches into a deduped id set', async () => {
+        const { dir } = makeDirectory();
+        const byEmailOnly = await seedUser(db, { email: 'anna@example.com' });
+        const byBoth = await seedUser(db, { email: 'anton@example.com' });
+        await seedPlayer(byBoth.id, { username: 'anton' });
+        const byNameOnly = await seedUser(db, { email: 'zoe@example.com' });
+        await seedPlayer(byNameOnly.id, { username: 'annabel' });
+        const ids = await dir.findPlayerIds('an');
+        expect([...ids].sort()).toEqual([byEmailOnly.id, byBoth.id, byNameOnly.id].sort());
+    });
+    it('returns nothing when the term matches neither column', async () => {
+        const { dir } = makeDirectory();
+        await seedUser(db, { email: 'alice@example.com' });
+        expect(await dir.findPlayerIds('zzzz')).toEqual([]);
+    });
+    it('excludes ids before applying the limit for player-only searches', async () => {
+        const { dir } = makeDirectory();
+        const excluded = await seedUser(db, { email: 'candidate-excluded@example.com' });
+        await seedUser(db, { email: 'candidate-without-profile@example.com' });
+        const first = await seedUser(db, { email: 'candidate-first@example.com' });
+        const second = await seedUser(db, { email: 'candidate-second@example.com' });
+        await Promise.all([
+            seedPlayer(excluded.id, { username: 'candidate-excluded' }),
+            seedPlayer(first.id, { username: 'candidate-first' }),
+            seedPlayer(second.id, { username: 'candidate-second' }),
+        ]);
+        const ids = await dir.findPlayerIds('candidate', 2, {
+            excludeUserIds: [excluded.id],
+            playerOnly: true,
+        });
+        expect([...ids].sort()).toEqual([first.id, second.id].sort());
+    });
+    it('matches an exact playerId', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'carlos@example.com' });
+        const seededPlayer = await seedPlayer(account.id, { username: 'carlos' });
+        expect(await dir.findPlayerIds(seededPlayer.id)).toEqual([account.id]);
+    });
+    it('matches an exact identity userId', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'dana@example.com' });
+        await seedPlayer(account.id, { username: 'dana' });
+        expect(await dir.findPlayerIds(account.id)).toEqual([account.id]);
+    });
+    it('does not substring-match a playerId, unlike email/displayName', async () => {
+        const { dir } = makeDirectory();
+        const account = await seedUser(db, { email: 'erin@example.com' });
+        const seededPlayer = await seedPlayer(account.id, { username: 'erin' });
+        expect(await dir.findPlayerIds(seededPlayer.id.slice(0, 8))).toEqual([]);
+    });
+});
+//# sourceMappingURL=admin-user-directory.int.test.js.map

package/dist/pam/identity/__tests__/admin-user-directory.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-directory.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/admin-user-directory.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAC1D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,IAAI,EAAU,CAAC;AAEf,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACrB,OAAO;QACL,GAAG,EAAE,IAAI,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAW,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrF,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,YAAyE,EAAE;IAE3E,MAAM,EAAE,QAAQ,GAAG,OAAO,EAAE,GAAG,eAAe,EAAE,GAAG,SAAS,CAAC;IAC7D,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;SAC9B,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;SACtC,SAAS,EAAE,CAAC;IACf,OAAO,GAAI,CAAC;AACd,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,YAAY,MAAM,KAAK,IAAI,2BAA2B,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAE7B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QAE3F,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,2BAA2B,EAAE;YAC7D,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,OAAO;YACP,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAE7B,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QAE1E,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,2BAA2B,EAAE;YAC7D,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,OAAO;YACP,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvD,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE/D,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE9E,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QAEtC,MAAM,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnB,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnB,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACtD,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnB,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnB,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAEhC,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE;YAChD,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,UAAU;SACtB,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAExD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,QAAQ,EAAE,YAAY,CAAC,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,mBAAmB;YAC1B,SAAS,EAAE,UAAU;YACrB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAC3B,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnC,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAE1D,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;YAC5B,QAAQ,EAAE,YAAY,CAAC,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAEhC,MAAM,CAAC,MAAM,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACtE,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,CAAC,MAAM,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAClE,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpE,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAEnD,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACjF,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;YAC3D,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACrD,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;SACxD,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAAE;YAClD,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClE,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnD,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,MAAM,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/device-fingerprint.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-fingerprint.test.d.ts.map

package/dist/pam/identity/__tests__/device-fingerprint.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/device-fingerprint.test.ts"],"names":[],"mappings":""}