@openora/core 0.4.1-canary.13 → 0.4.1-canary.131

package/dist/server/auth/admin-guard.js

@@ -1,8 +1,11 @@
 import { ORPCError } from '@orpc/server';
-import { createToken } from '@openora/core/contracts';
+import { createToken, AuthGuardReasonSchema, } from '@openora/core/contracts';
 import { sql } from 'drizzle-orm';
 import { roles } from './permissions.js';
+import { createLogger } from '../kernel/logger.js';
+import { extractClientMeta } from '../kernel/router-utils.js';
 export const ADMIN_GUARD = createToken('ADMIN_GUARD');
+const logger = createLogger('admin-guard');
 /**
  * The single admin-enforcement point - every admin route calls `assert()` as its
  * first line, never re-implementing the role check. Overload without
@@ -20,20 +23,35 @@ export class AdminGuard {
     sessions;
     permissionResolver;
     events;
+    identityReader;
+    securityPolicy;
     // Uses the shared SessionResolver (one better-auth init for the whole app) rather than a second createAuth over the same DB.
     constructor(drizzle, sessions, 
     // When bound (iam module loaded), grants come from DB; otherwise falls back to static roles.
-    permissionResolver, events) {
+    permissionResolver, events, 
+    // When bound (identity module loaded), resolves the PAM player.id for a
+    // player-role denial's audit attribution. This engine-zone file must not import
+    // the player schema directly (ADR-0019/0025), so it goes through this port instead.
+    identityReader, 
+    // When bound (identity module loaded), enforces mandatory 2FA enrolment and the
+    // session's device fingerprint. Same layering reason as identityReader.
+    securityPolicy) {
         this.drizzle = drizzle;
         this.sessions = sessions;
         this.permissionResolver = permissionResolver;
         this.events = events;
+        this.identityReader = identityReader;
+        this.securityPolicy = securityPolicy;
     }
     async assert(context, resource, action) {
         const request = context.request;
         if (!request || typeof request.headers !== 'object') {
-            throw new ORPCError('UNAUTHORIZED', { message: 'Missing request context' });
+            throw new ORPCError('UNAUTHORIZED', {
+                message: 'Missing request context',
+                data: { reason: AuthGuardReasonSchema.enum.missing_request_context },
+            });
         }
+        const { ip, userAgent } = extractClientMeta(request.headers);
         const headers = new Headers();
         for (const [k, v] of Object.entries(request.headers)) {
             if (v === undefined) {
@@ -41,68 +59,112 @@ export class AdminGuard {
             }
             headers.set(k, Array.isArray(v) ? v.join(', ') : v);
         }
-        const userId = await this.sessions.resolveUserId(headers);
+        const resolvedSession = await this.sessions.resolveSession(headers);
+        const userId = resolvedSession?.userId;
         if (!userId) {
-            throw new ORPCError('UNAUTHORIZED', { message: 'Authentication required' });
+            throw new ORPCError('UNAUTHORIZED', {
+                message: 'Authentication required',
+                data: { reason: AuthGuardReasonSchema.enum.authentication_required },
+            });
         }
         const result = await this.drizzle.db.execute(sql `SELECT id, role FROM "user" WHERE id = ${userId} LIMIT 1`);
         const userRecord = result.rows[0];
         if (!userRecord) {
             if (resource !== undefined && action !== undefined) {
-                this.emitUnauthorized(userId, undefined, resource, action, headers);
+                this.emitUnauthorized(userId, undefined, resource, action, ip, userAgent);
             }
             else {
-                this.emitUnauthorized(userId, undefined, 'admin', 'access', headers);
+                this.emitUnauthorized(userId, undefined, 'admin', 'access', ip, userAgent);
             }
-            throw new ORPCError('FORBIDDEN', { message: 'Admin access required' });
+            throw new ORPCError('FORBIDDEN', {
+                message: 'Admin access required',
+                data: { reason: AuthGuardReasonSchema.enum.admin_required },
+            });
         }
         const userRole = roles[userRecord.role];
         if (!userRole) {
             if (resource !== undefined && action !== undefined) {
-                this.emitUnauthorized(userId, userRecord.role, resource, action, headers);
+                this.emitUnauthorized(userId, userRecord.role, resource, action, ip, userAgent);
             }
             else {
-                this.emitUnauthorized(userId, userRecord.role, 'admin', 'access', headers);
+                this.emitUnauthorized(userId, userRecord.role, 'admin', 'access', ip, userAgent);
             }
-            throw new ORPCError('FORBIDDEN', { message: 'Admin access required' });
+            throw new ORPCError('FORBIDDEN', {
+                message: 'Admin access required',
+                data: { reason: AuthGuardReasonSchema.enum.admin_required },
+            });
         }
         if (resource !== undefined && action !== undefined) {
-            const grants = this.permissionResolver
-                ? await this.permissionResolver.getGrants(userId)
-                : null;
-            if (grants !== null) {
-                const allowed = grants.some((g) => g.resource === resource && g.action === action);
-                if (!allowed) {
-                    this.emitUnauthorized(userId, userRecord.role, resource, action, headers);
-                    throw new ORPCError('FORBIDDEN', {
-                        message: `Missing permission: ${String(resource)}:${String(action)}`,
-                    });
-                }
-            }
-            else {
-                // Bootstrap path: seed admin has user.role='admin' but no DB assignment row. DB revocation is NOT authoritative while a static role still grants - revoke the static role to fully deny.
-                const check = userRole.authorize({ [resource]: [action] });
-                if (!check.success) {
-                    this.emitUnauthorized(userId, userRecord.role, resource, action, headers);
-                    throw new ORPCError('FORBIDDEN', {
-                        message: `Missing permission: ${String(resource)}:${String(action)}`,
-                    });
-                }
+            const grants = await this.resolveGrants(userId);
+            const allowed = this.checkGrant(grants, userRole, resource, action);
+            if (!allowed) {
+                this.emitUnauthorized(userId, userRecord.role, resource, action, ip, userAgent);
+                throw new ORPCError('FORBIDDEN', {
+                    message: `Missing permission: ${String(resource)}:${String(action)}`,
+                    data: {
+                        reason: AuthGuardReasonSchema.enum.permission_denied,
+                        resource: String(resource),
+                        action: String(action),
+                    },
+                });
             }
         }
-        return { userId, role: userRecord.role };
+        if (this.securityPolicy) {
+            const securityContext = {
+                userId,
+                sessionId: resolvedSession?.sessionId ?? null,
+                ip,
+                userAgent,
+            };
+            await this.securityPolicy.assertEnrolled(securityContext);
+            await this.securityPolicy.assertSessionIntact(securityContext);
+        }
+        return { userId, role: userRecord.role, ip, userAgent };
+    }
+    async assertSuperAdmin(context) {
+        const caller = await this.assert(context);
+        const assigned = await this.permissionResolver?.isSuperAdmin(caller.userId);
+        const isSuper = assigned ?? caller.role === 'admin';
+        if (!isSuper) {
+            this.emitUnauthorized(caller.userId, caller.role, 'admin', 'super-admin', caller.ip, caller.userAgent);
+            throw new ORPCError('FORBIDDEN', {
+                message: 'Super admin access required',
+                data: { reason: AuthGuardReasonSchema.enum.admin_required },
+            });
+        }
+        return caller;
     }
-    emitUnauthorized(userId, role, resource, action, headers) {
-        const ip = headers.get('x-forwarded-for')?.split(',')[0]?.trim() || headers.get('x-real-ip') || null;
-        const userAgent = headers.get('user-agent') || null;
-        this.events?.emit('identity.user.unauthorized_access', {
-            userId,
-            resource,
-            action,
-            ip,
-            userAgent,
-            role,
-        });
+    resolveGrants(userId) {
+        return this.permissionResolver
+            ? this.permissionResolver.getGrants(userId)
+            : Promise.resolve(null);
+    }
+    checkGrant(grants, userRole, resource, action) {
+        if (grants !== null) {
+            return grants.some((g) => g.resource === resource && g.action === action);
+        }
+        return userRole?.authorize({ [resource]: [action] }).success ?? false;
+    }
+    emitUnauthorized(userId, role, resource, action, ip, userAgent) {
+        void (async () => {
+            const playerId = role === 'player'
+                ? ((await this.identityReader?.getPlayerIdByUserIdSafe(userId)) ?? null)
+                : null;
+            try {
+                this.events?.emit('identity.user.unauthorized_access', {
+                    userId,
+                    playerId,
+                    resource,
+                    action,
+                    ip,
+                    userAgent,
+                    role,
+                });
+            }
+            catch (err) {
+                logger.error({ err, userId, resource, action }, 'denial audit event failed');
+            }
+        })();
     }
 }
 //# sourceMappingURL=admin-guard.js.map

package/dist/server/auth/admin-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-guard.js","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAA4C,MAAM,yBAAyB,CAAC;AAEhG,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,KAAK,EAAoC,MAAM,kBAAkB,CAAC;AAG3E,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,UAAU;IAGF;IACA;IAEA;IACA;IANnB,6HAA6H;IAC7H,YACmB,OAAuB,EACvB,QAAyB;IAC1C,6FAA6F;IAC5E,kBAA4C,EAC5C,MAAiB;QAJjB,YAAO,GAAP,OAAO,CAAgB;QACvB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,uBAAkB,GAAlB,kBAAkB,CAA0B;QAC5C,WAAM,GAAN,MAAM,CAAW;IACjC,CAAC;IAQJ,KAAK,CAAC,MAAM,CACV,OAAgB,EAChB,QAAY,EACZ,MAAoB;QAEpB,MAAM,OAAO,GAAI,OAA+C,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAC1C,GAAG,CAAA,0CAA0C,MAAM,UAAU,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAA6C,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAA0B,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB;gBACpC,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC;gBACjD,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBACnF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;oBAC1E,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;wBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,yLAAyL;gBACzL,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACnB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;oBAC1E,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;wBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IAEO,gBAAgB,CACtB,MAAc,EACd,IAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,OAAgB;QAEhB,MAAM,EAAE,GACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE;YACrD,MAAM;YACN,QAAQ;YACR,MAAM;YACN,EAAE;YACF,SAAS;YACT,IAAI;SACL,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"admin-guard.js","sourceRoot":"","sources":["../../../src/server/auth/admin-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,WAAW,EACX,qBAAqB,GAOtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,KAAK,EAAoC,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,CAAC,MAAM,WAAW,GAAsB,WAAW,CAAC,aAAa,CAAC,CAAC;AAEzE,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAI3C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,UAAU;IAGF;IACA;IAEA;IACA;IAIA;IAGA;IAbnB,6HAA6H;IAC7H,YACmB,OAAuB,EACvB,QAAyB;IAC1C,6FAA6F;IAC5E,kBAA4C,EAC5C,MAAiB;IAClC,wEAAwE;IACxE,gFAAgF;IAChF,oFAAoF;IACnE,cAA+B;IAChD,gFAAgF;IAChF,wEAAwE;IACvD,cAAoC;QAXpC,YAAO,GAAP,OAAO,CAAgB;QACvB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,uBAAkB,GAAlB,kBAAkB,CAA0B;QAC5C,WAAM,GAAN,MAAM,CAAW;QAIjB,mBAAc,GAAd,cAAc,CAAiB;QAG/B,mBAAc,GAAd,cAAc,CAAsB;IACpD,CAAC;IAQJ,KAAK,CAAC,MAAM,CACV,OAAgB,EAChB,QAAY,EACZ,MAAoB;QAEpB,MAAM,OAAO,GAAI,OAA+C,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,eAAe,EAAE,MAAM,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE;gBAClC,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,uBAAuB,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAC1C,GAAG,CAAA,0CAA0C,MAAM,UAAU,CAC9D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAA6C,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAA0B,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;gBAChF,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;oBAC/B,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;oBACpE,IAAI,EAAE;wBACJ,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,iBAAiB;wBACpD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;wBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;qBACvB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,eAAe,GAAG;gBACtB,MAAM;gBACN,SAAS,EAAE,eAAe,EAAE,SAAS,IAAI,IAAI;gBAC7C,EAAE;gBACF,SAAS;aACV,CAAC;YACF,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAgB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;QAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,gBAAgB,CACnB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,OAAO,EACP,aAAa,EACb,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,6BAA6B;gBACtC,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,kBAAkB;YAC5B,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAEO,UAAU,CAChB,MAA2B,EAC3B,QAAwD,EACxD,QAAgB,EAChB,MAAc;QAEd,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;IACxE,CAAC;IAEO,gBAAgB,CACtB,MAAc,EACd,IAAwB,EACxB,QAAgB,EAChB,MAAc,EACd,EAAiB,EACjB,SAAwB;QAExB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,QAAQ,GACZ,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;gBACxE,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE;oBACrD,MAAM;oBACN,QAAQ;oBACR,QAAQ;oBACR,MAAM;oBACN,EAAE;oBACF,SAAS;oBACT,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;CACF"}

package/dist/server/auth/auth.d.ts

@@ -1,23 +1,66 @@
 import type { Auth as BetterAuthType } from 'better-auth';
 import type { DrizzleDb } from '../db/index.js';
-export type SendEmail = (args: {
+import { type MailTemplate } from '@openora/core/contracts';
+export type DispatchOtpMail = (args: {
     to: string;
-    subject: string;
-    body: string;
+    template: MailTemplate;
 }) => Promise<void> | void;
+export type SendTwoFactorOtp = (args: {
+    userId: string;
+    email: string;
+    phoneNumber: string | null;
+    code: string;
+}) => Promise<void> | void;
+export type TwoFactorOptions = {
+    /** Seconds a device stays trusted after a successful second factor. */
+    trustDeviceMaxAgeSec?: number;
+    /** Minutes a delivered OTP stays valid. */
+    otpPeriodMinutes?: number;
+    sendOtp?: SendTwoFactorOtp;
+};
 export type AuthOptions = {
     db: DrizzleDb;
     schema?: Record<string, unknown>;
-    sendEmail?: SendEmail;
+    dispatchOtpMail?: DispatchOtpMail;
+    onPasswordReset?: (user: {
+        id: string;
+        email: string;
+    }) => Promise<void> | void;
+    /**
+     * Blocks sign-in until the address is verified. Default off: unverified players stay
+     * unrestricted while the KYC toggle is off. Operators that need the stricter gate set
+     * `registration.requireEmailVerification` in platform config.
+     */
+    requireEmailVerification?: boolean;
+    onExistingUserSignUp?: (user: {
+        id: string;
+        email: string;
+    }) => Promise<void> | void;
+    /**
+     * True while the reset code being sent was triggered by a sign-up on an address that
+     * already has an account, rather than by its owner asking to reset. better-auth issues
+     * both through the same `forget-password` OTP type, so `sendVerificationOTP` cannot tell
+     * them apart on its own - and the two need different copy.
+     */
+    isExistingAccountSignUp?: (email: string) => boolean;
+    /** True while the reset code being sent was triggered by an administrator, not the owner. */
+    isAdminPasswordReset?: (email: string) => boolean | Promise<boolean>;
+    cookieDomain?: string;
+    twoFactor?: TwoFactorOptions;
 };
 /**
  * Builds the one shared better-auth instance for the whole app - both the
  * per-request session middleware and `AdminGuard` resolve sessions through it,
  * never a second `createAuth()` over the same DB. Bundles the org, admin
- * (role/permission), and two-factor plugins; `sendEmail` is a silent no-op
+ * (role/permission), and two-factor plugins; `dispatchOtpMail` is a silent no-op
  * when omitted (eg tests) rather than throwing. The explicit `BetterAuthType`
  * return annotation is load-bearing, not stylistic - it dodges a TS2883 Zod v4
  * `$strip` portability error the inferred type would otherwise surface.
+ *
+ * `cookieDomain` (or `AUTH_COOKIE_DOMAIN`) widens the session cookie to a parent
+ * domain, so a frontend on `app.example.com` still sends it to an API on
+ * `api.example.com`. Left unset the cookie stays host-only, which is correct when
+ * both run on one host and is the safer default everywhere else.
  */
 export declare function createAuth(options: AuthOptions): BetterAuthType;
 export type Auth = BetterAuthType;

package/dist/server/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAKhD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE3B,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CAqD/D;AAED,MAAM,MAAM,IAAI,GAAG,cAAc,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAuC,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAIjG,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;CACxB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAM3B,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAChF;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrF;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CAwG/D;AAED,MAAM,MAAM,IAAI,GAAG,cAAc,CAAC"}

package/dist/server/auth/auth.js

@@ -1,19 +1,26 @@
 import { randomUUID } from 'node:crypto';
 import { betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
-import { organization, admin as adminPlugin, twoFactor } from 'better-auth/plugins';
+import { organization, admin as adminPlugin, twoFactor, emailOTP } from 'better-auth/plugins';
 import { ac, roles } from './permissions.js';
+import { OTP_CODE_LENGTH, OTP_EXPIRES_IN_SEC } from '@openora/core/contracts';
 /**
  * Builds the one shared better-auth instance for the whole app - both the
  * per-request session middleware and `AdminGuard` resolve sessions through it,
  * never a second `createAuth()` over the same DB. Bundles the org, admin
- * (role/permission), and two-factor plugins; `sendEmail` is a silent no-op
+ * (role/permission), and two-factor plugins; `dispatchOtpMail` is a silent no-op
  * when omitted (eg tests) rather than throwing. The explicit `BetterAuthType`
  * return annotation is load-bearing, not stylistic - it dodges a TS2883 Zod v4
  * `$strip` portability error the inferred type would otherwise surface.
+ *
+ * `cookieDomain` (or `AUTH_COOKIE_DOMAIN`) widens the session cookie to a parent
+ * domain, so a frontend on `app.example.com` still sends it to an API on
+ * `api.example.com`. Left unset the cookie stays host-only, which is correct when
+ * both run on one host and is the safer default everywhere else.
  */
 export function createAuth(options) {
-    const sendEmail = options.sendEmail ?? (() => { });
+    const dispatchOtpMail = options.dispatchOtpMail ?? (() => { });
+    const cookieDomain = options.cookieDomain ?? process.env['AUTH_COOKIE_DOMAIN'];
     return betterAuth({
         database: drizzleAdapter(options.db, {
             provider: 'pg',
@@ -23,6 +30,7 @@ export function createAuth(options) {
             database: {
                 generateId: () => randomUUID(),
             },
+            ...(cookieDomain ? { crossSubDomainCookies: { enabled: true, domain: cookieDomain } } : {}),
         },
         session: {
             expiresIn: 30 * 24 * 60 * 60,
@@ -34,33 +42,81 @@ export function createAuth(options) {
             // are validated at the route (theme against the enum, language against
             // PlatformConfig.supportedLanguages).
             additionalFields: {
+                username: { type: 'string', required: false, input: true },
                 theme: { type: 'string', required: false, input: true, defaultValue: 'system' },
                 language: { type: 'string', required: false, input: true, defaultValue: 'en' },
             },
         },
         emailAndPassword: {
             enabled: true,
-            rememberMeDuration: 30 * 24 * 60 * 60,
-            sendResetPassword: async ({ user, url, token }) => {
-                await sendEmail({
-                    to: user.email,
-                    subject: 'Reset your password',
-                    body: `Reset your password using this link: ${url}\n\nReset token: ${token}`,
-                });
-            },
+            // Sign-up never mints a session: better-auth only returns the indistinguishable
+            // duplicate-email response when autoSignIn is off (or verification is required,
+            // which is now operator-configurable). The session is minted by the OTP
+            // verification step instead - see `autoSignInAfterVerification` below.
+            autoSignIn: false,
+            requireEmailVerification: options.requireEmailVerification ?? false,
+            revokeSessionsOnPasswordReset: true,
+            onExistingUserSignUp: options.onExistingUserSignUp
+                ? async ({ user }) => {
+                    await options.onExistingUserSignUp?.({ id: user.id, email: user.email });
+                }
+                : undefined,
+            onPasswordReset: options.onPasswordReset
+                ? async ({ user }) => {
+                    await options.onPasswordReset?.({ id: user.id, email: user.email });
+                }
+                : undefined,
         },
         emailVerification: {
-            sendVerificationEmail: async ({ user, url, token }) => {
-                await sendEmail({
-                    to: user.email,
-                    subject: 'Verify your email',
-                    body: `Verify your email using this link: ${url}\n\nVerification token: ${token}`,
-                });
-            },
+            // The verification OTP is sent by IdentityService.register(), never by better-auth:
+            // its sign-up hook fires on the synthetic duplicate-email response too, which would
+            // mail a valid code to an existing account's address (takeover).
+            sendOnSignUp: false,
+            autoSignInAfterVerification: true,
         },
         // Without this, better-auth's admin plugin defaults new signups to its own
         // 'user' role, which UserRoleSchema (player|admin) rejects everywhere downstream.
-        plugins: [organization(), adminPlugin({ ac, roles, defaultRole: 'player' }), twoFactor()],
+        plugins: [
+            organization(),
+            adminPlugin({ ac, roles, defaultRole: 'player' }),
+            twoFactor({
+                ...(options.twoFactor?.trustDeviceMaxAgeSec !== undefined
+                    ? { trustDeviceMaxAge: options.twoFactor.trustDeviceMaxAgeSec }
+                    : {}),
+                otpOptions: {
+                    ...(options.twoFactor?.otpPeriodMinutes !== undefined
+                        ? { period: options.twoFactor.otpPeriodMinutes }
+                        : {}),
+                    sendOTP: async ({ user, otp }) => {
+                        await options.twoFactor?.sendOtp?.({
+                            userId: user.id,
+                            email: user.email,
+                            phoneNumber: user.phoneNumber ?? null,
+                            code: otp,
+                        });
+                    },
+                },
+            }),
+            emailOTP({
+                otpLength: OTP_CODE_LENGTH,
+                expiresIn: OTP_EXPIRES_IN_SEC,
+                async sendVerificationOTP({ email, otp, type }) {
+                    // Allow-list, not a fallback: an OTP type this app never issues (sign-in,
+                    // change-email) must send nothing rather than borrow another template's copy.
+                    if (type !== 'email-verification' && type !== 'forget-password') {
+                        return;
+                    }
+                    const template = type === 'email-verification'
+                        ? { key: 'verifyEmail', data: { otp } }
+                        : options.isExistingAccountSignUp?.(email)
+                            ? { key: 'existingAccountSignUp', data: { otp, email } }
+                            : (await options.isAdminPasswordReset?.(email))
+                                ? { key: 'adminResetPasswordOtp', data: { otp, email } }
+                                : { key: 'resetPasswordOtp', data: { otp, email } };
+                    await dispatchOtpMail({ to: email, template });
+                },
+            }),
+        ],
         // Library boundary: better-auth infers an options-specific instantiation that isn't
         // assignable to its own exported `Auth` alias. No way to narrow without matching the
         // full generic - the one sanctioned cast, see conventions.

package/dist/server/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAgB7C;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAc,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;SACF;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YACrC,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,qBAAqB;oBAC9B,IAAI,EAAE,wCAAwC,GAAG,oBAAoB,KAAK,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;SACF;QACD,iBAAiB,EAAE;YACjB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;gBACpD,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,mBAAmB;oBAC5B,IAAI,EAAE,sCAAsC,GAAG,2BAA2B,KAAK,EAAE;iBAClF,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QACzF,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/server/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAqB,MAAM,yBAAyB,CAAC;AAqDjG;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB;IAC7C,MAAM,eAAe,GAAoB,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/E,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;aAC/B;YACD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;SACxB;QACD,IAAI,EAAE;YACJ,6EAA6E;YAC7E,6EAA6E;YAC7E,uEAAuE;YACvE,sCAAsC;YACtC,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC1D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;gBAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;aAC/E;SACF;QACD,gBAAgB,EAAE;YAChB,OAAO,EAAE,IAAI;YACb,gFAAgF;YAChF,gFAAgF;YAChF,wEAAwE;YACxE,uEAAuE;YACvE,UAAU,EAAE,KAAK;YACjB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,IAAI,KAAK;YACnE,6BAA6B,EAAE,IAAI;YACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAChD,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACH,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe;gBACtC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBACjB,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtE,CAAC;gBACH,CAAC,CAAC,SAAS;SACd;QACD,iBAAiB,EAAE;YACjB,oFAAoF;YACpF,oFAAoF;YACpF,iEAAiE;YACjE,YAAY,EAAE,KAAK;YACnB,2BAA2B,EAAE,IAAI;SAClC;QACD,2EAA2E;QAC3E,kFAAkF;QAClF,OAAO,EAAE;YACP,YAAY,EAAE;YACd,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;YACjD,SAAS,CAAC;gBACR,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,KAAK,SAAS;oBACvD,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,oBAAoB,EAAE;oBAC/D,CAAC,CAAC,EAAE,CAAC;gBACP,UAAU,EAAE;oBACV,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,KAAK,SAAS;wBACnD,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,gBAAgB,EAAE;wBAChD,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;wBAC/B,MAAM,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;4BACjC,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,KAAK,EAAE,IAAI,CAAC,KAAK;4BACjB,WAAW,EAAG,IAAwC,CAAC,WAAW,IAAI,IAAI;4BAC1E,IAAI,EAAE,GAAG;yBACV,CAAC,CAAC;oBACL,CAAC;iBACF;aACF,CAAC;YACF,QAAQ,CAAC;gBACP,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,kBAAkB;gBAC7B,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE;oBAC5C,0EAA0E;oBAC1E,8EAA8E;oBAC9E,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBAChE,OAAO;oBACT,CAAC;oBACD,MAAM,QAAQ,GACZ,IAAI,KAAK,oBAAoB;wBAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE;wBACvC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,CAAC;4BACxC,CAAC,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;4BACxD,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC;gCAC7C,CAAC,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gCACxD,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC5D,MAAM,eAAe,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjD,CAAC;aACF,CAAC;SACH;QACD,oFAAoF;QACpF,qFAAqF;QACrF,2DAA2D;KAC5D,CAA8B,CAAC;AAClC,CAAC"}

package/dist/server/auth/index.d.ts

@@ -1,7 +1,9 @@
-export type { AuthOptions, Auth, SendEmail } from './auth.js';
+export type { AuthOptions, Auth, DispatchOtpMail } from './auth.js';
 export { createAuth } from './auth.js';
 export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
+export type { AdminCaller } from './admin-guard.js';
 export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { signSessionCookie, type SessionCookieConfig } from './sign-session-cookie.js';
 export { ac, roles, statement } from './permissions.js';
 export type { RoleName, ResourceName, ActionOf } from './permissions.js';
 export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';

package/dist/server/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/server/auth/index.js

@@ -1,6 +1,7 @@
 export { createAuth } from './auth.js';
 export { AdminGuard, ADMIN_GUARD } from './admin-guard.js';
 export { SessionResolver, AUTH_SESSION } from './session-resolver.js';
+export { signSessionCookie } from './sign-session-cookie.js';
 export { ac, roles, statement } from './permissions.js';
 export { PERMISSION_LEVELS, SUPPORTED_LEVELS, readActions, levelRank, isLevelSufficient, levelToActions, actionsToLevel, } from './permission-levels.js';
 //# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAA4B,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,cAAc,GACf,MAAM,wBAAwB,CAAC"}