@openora/core 0.4.1-canary.16 → 0.4.1-canary.161

package/dist/pam/identity/__tests__/session.service.int.test.js

@@ -0,0 +1,127 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+import { eq, sql } from 'drizzle-orm';
+import { createTestDb, seedUser } from '@openora/core/testing';
+import { user, session } from '@openora/core/pam/schema/identity';
+import { makeEventBus, makeIdentityReader } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { SessionService, SessionNotFoundError } from '../service/session.service.js';
+const minutesAgo = (n) => new Date(Date.now() - n * 60_000);
+let db;
+const service = () => new SessionService({
+    drizzle: db.drizzle,
+    events: makeEventBus(),
+    identityReader: makeIdentityReader(),
+});
+const seedSession = (userId, overrides = {}) => db.drizzle.db
+    .insert(session)
+    .values({
+    userId,
+    token: crypto.randomUUID(),
+    expiresAt: new Date(Date.now() + 86_400_000),
+    updatedAt: new Date(),
+    ...overrides,
+})
+    .returning()
+    .then(([row]) => row);
+beforeAll(async () => {
+    db = await createTestDb([migrate]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    vi.clearAllMocks();
+    await db.drizzle.db.execute(sql `TRUNCATE ${user} RESTART IDENTITY CASCADE`);
+});
+describe('SessionService', () => {
+    it('flags only the caller session as current', async () => {
+        const account = await seedUser(db);
+        const here = await seedSession(account.id);
+        await seedSession(account.id);
+        const { items } = await service().listSessions({
+            userId: account.id,
+            currentSessionId: here.id,
+            page: 1,
+            limit: 20,
+        });
+        expect(items).toHaveLength(2);
+        expect(items.filter((s) => s.current).map((s) => s.id)).toEqual([here.id]);
+    });
+    it('drops a revoked session from the active list', async () => {
+        const account = await seedUser(db);
+        const target = await seedSession(account.id);
+        await seedSession(account.id);
+        await service().revokeSession(account.id, target.id);
+        const active = await service().listSessions({
+            userId: account.id,
+            activeOnly: true,
+            page: 1,
+            limit: 20,
+        });
+        expect(active.total).toBe(1);
+        expect(active.items.map((s) => s.id)).not.toContain(target.id);
+    });
+    it('expires the revoked session', async () => {
+        const account = await seedUser(db);
+        const target = await seedSession(account.id);
+        await service().revokeSession(account.id, target.id);
+        const { items } = await service().listSessions({ userId: account.id, page: 1, limit: 20 });
+        // revokeSession stamps expiresAt with the database clock, so read the same clock back:
+        // an app-side Date.now() a millisecond behind the database would fail this on nothing.
+        const { rows } = await db.drizzle.db.execute(sql `select now() as now`);
+        expect(new Date(items[0].expiresAt).getTime()).toBeLessThanOrEqual(new Date(rows[0].now).getTime());
+    });
+    it('keeps the last-used timestamp when a session is revoked', async () => {
+        const account = await seedUser(db);
+        const lastUsed = new Date(Date.now() - 3_600_000);
+        const target = await seedSession(account.id, { updatedAt: lastUsed });
+        await service().revokeSession(account.id, target.id);
+        const { items } = await service().listSessions({ userId: account.id, page: 1, limit: 20 });
+        expect(new Date(items[0].updatedAt).getTime()).toBe(lastUsed.getTime());
+    });
+    it('refuses to revoke a session owned by someone else', async () => {
+        const owner = await seedUser(db);
+        const stranger = await seedUser(db);
+        const target = await seedSession(owner.id);
+        await expect(service().revokeSession(stranger.id, target.id)).rejects.toBeInstanceOf(SessionNotFoundError);
+    });
+    it('drops a player session idled past its own window from the active list, even though it has not expired yet', async () => {
+        const account = await seedUser(db);
+        await db.drizzle.db
+            .update(user)
+            .set({ autoLogoutDuration: '15m' })
+            .where(eq(user.id, account.id));
+        const idled = await seedSession(account.id, { lastSeenAt: minutesAgo(20) });
+        const fresh = await seedSession(account.id, { lastSeenAt: minutesAgo(1) });
+        const active = await service().listSessions({
+            userId: account.id,
+            activeOnly: true,
+            page: 1,
+            limit: 20,
+        });
+        expect(active.items.map((s) => s.id)).toEqual([fresh.id]);
+        expect(active.items.map((s) => s.id)).not.toContain(idled.id);
+    });
+    it('does not idle out an admin session, which has no auto-logout window of its own', async () => {
+        const admin = await seedUser(db, { role: 'admin' });
+        const target = await seedSession(admin.id, { lastSeenAt: minutesAgo(60 * 24 * 30) });
+        const active = await service().listSessions({
+            userId: admin.id,
+            activeOnly: true,
+            page: 1,
+            limit: 20,
+        });
+        expect(active.items.map((s) => s.id)).toContain(target.id);
+    });
+    it('excludes an idled-out player session from the platform-wide active list', async () => {
+        const account = await seedUser(db);
+        await db.drizzle.db
+            .update(user)
+            .set({ autoLogoutDuration: '15m' })
+            .where(eq(user.id, account.id));
+        const idled = await seedSession(account.id, { lastSeenAt: minutesAgo(20) });
+        const { items } = await service().listAllActiveSessions({ page: 1, limit: 20 });
+        expect(items.map((s) => s.id)).not.toContain(idled.id);
+    });
+});
+//# sourceMappingURL=session.service.int.test.js.map

package/dist/pam/identity/__tests__/session.service.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.service.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/session.service.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErF,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAEpE,IAAI,EAAU,CAAC;AAEf,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,cAAc,CAAC;IACjB,OAAO,EAAE,EAAE,CAAC,OAAO;IACnB,MAAM,EAAE,YAAY,EAAE;IACtB,cAAc,EAAE,kBAAkB,EAAE;CACrC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,YAAkD,EAAE,EAAE,EAAE,CAC3F,EAAE,CAAC,OAAO,CAAC,EAAE;KACV,MAAM,CAAC,OAAO,CAAC;KACf,MAAM,CAAC;IACN,MAAM;IACN,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;IAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;IAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,GAAG,SAAS;CACb,CAAC;KACD,SAAS,EAAE;KACX,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAI,CAAC,CAAC;AAE3B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,YAAY,IAAI,2BAA2B,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE9B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC,YAAY,CAAC;YAC7C,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,gBAAgB,EAAE,IAAI,CAAC,EAAE;YACzB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE9B,MAAM,OAAO,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,YAAY,CAAC;YAC1C,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE7C,MAAM,OAAO,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3F,uFAAuF;QACvF,uFAAuF;QACvF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAkB,GAAG,CAAA,qBAAqB,CAAC,CAAC;QACxF,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,mBAAmB,CACjE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CACjC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEtE,MAAM,OAAO,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAErD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAE3C,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAClF,oBAAoB,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2GAA2G,EAAE,KAAK,IAAI,EAAE;QACzH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aAChB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;aAClC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE3E,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,YAAY,CAAC;YAC1C,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAErF,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,YAAY,CAAC;YAC1C,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aAChB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;aAClC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAE5E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/two-factor-delivery.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=two-factor-delivery.test.d.ts.map

package/dist/pam/identity/__tests__/two-factor-delivery.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-delivery.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/two-factor-delivery.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/two-factor-delivery.test.js

@@ -0,0 +1,23 @@
+import { describe, it, expect } from 'vitest';
+import { maskEmail, maskPhone } from '../service/two-factor-delivery.service.js';
+describe('maskEmail', () => {
+    it('keeps the first character and the domain', () => {
+        expect(maskEmail('player@example.com')).toBe('p***@example.com');
+    });
+    it('hides a one-character local part entirely', () => {
+        // Keeping the single character would spell out the whole address.
+        expect(maskEmail('p@example.com')).toBe('***@example.com');
+    });
+    it('masks a local part regardless of its length', () => {
+        expect(maskEmail('averylongaddress@example.com')).toBe('a***@example.com');
+    });
+});
+describe('maskPhone', () => {
+    it('keeps only the last two digits', () => {
+        expect(maskPhone('+48123456742')).toBe('+** *** *** 42');
+    });
+    it('does not widen the reveal for a short number', () => {
+        expect(maskPhone('+4812')).toBe('+** *** *** 12');
+    });
+});
+//# sourceMappingURL=two-factor-delivery.test.js.map

package/dist/pam/identity/__tests__/two-factor-delivery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-delivery.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/two-factor-delivery.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAEjF,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,kEAAkE;QAClE,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/user-commands.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=user-commands.int.test.d.ts.map

package/dist/pam/identity/__tests__/user-commands.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-commands.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/user-commands.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/user-commands.int.test.js

@@ -0,0 +1,33 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import { eq, sql } from 'drizzle-orm';
+import { createTestDb, seedUser } from '@openora/core/testing';
+import { user } from '@openora/core/pam/schema/identity';
+import { migrate } from '../migrate.js';
+import { DrizzleUserCommands } from '../service/user-commands.service.js';
+let db;
+const commands = () => new DrizzleUserCommands(db.drizzle);
+beforeAll(async () => {
+    db = await createTestDb([migrate]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    await db.drizzle.db.execute(sql `TRUNCATE ${user} RESTART IDENTITY CASCADE`);
+});
+describe('DrizzleUserCommands.setUsername', () => {
+    it('writes the new handle', async () => {
+        const account = await seedUser(db, { name: 'before_name', username: 'before_name' });
+        await commands().setUsername(account.id, 'after_name');
+        const [row] = await db.drizzle.db.select().from(user).where(eq(user.id, account.id));
+        expect(row?.username).toBe('after_name');
+    });
+    it('rejects a handle already taken, case-insensitively', async () => {
+        await seedUser(db, { name: 'taken_name', username: 'taken_name' });
+        const account = await seedUser(db, { name: 'free_name', username: 'free_name' });
+        await expect(commands().setUsername(account.id, 'TAKEN_NAME')).rejects.toMatchObject({
+            code: 'CONFLICT',
+        });
+    });
+});
+//# sourceMappingURL=user-commands.int.test.js.map

package/dist/pam/identity/__tests__/user-commands.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-commands.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/user-commands.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,IAAI,EAAU,CAAC;AAEf,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAE3D,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,YAAY,IAAI,2BAA2B,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAErF,MAAM,QAAQ,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAEvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAEjF,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACnF,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/username-backfill.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=username-backfill.int.test.d.ts.map

package/dist/pam/identity/__tests__/username-backfill.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"username-backfill.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/username-backfill.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/username-backfill.int.test.js

@@ -0,0 +1,103 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
+import { sql } from 'drizzle-orm';
+import { createTestDb } from '@openora/core/testing';
+import { user } from '@openora/core/pam/schema/identity';
+import { player } from '@openora/core/pam/schema/profile';
+import { migrate as migrateProfile } from '@openora/core/pam/migrate/profile';
+import { migrate } from '../migrate.js';
+// The shipped backfill statement, read from the migration itself so this test cannot
+// drift from what actually runs. Statement 2 of 3, between the ADD COLUMN and the index.
+const BACKFILL_SQL = readFileSync(fileURLToPath(new URL('../drizzle/migrations/0007_fuzzy_barracuda.sql', import.meta.url)), 'utf8').split('--> statement-breakpoint')[1];
+let db;
+async function seedLegacy(legacyName, name = 'Fallback Name') {
+    const userId = randomUUID();
+    await db.drizzle.db.insert(user).values({
+        id: userId,
+        name,
+        username: `seed_${userId.replaceAll('-', '').slice(0, 13)}`,
+        email: `${userId}@legacy.test`,
+        role: 'player',
+    });
+    if (legacyName !== null) {
+        await db.drizzle.db.insert(player).values({ userId });
+        await db.drizzle.db.execute(sql `UPDATE player SET display_name = ${legacyName} WHERE user_id = ${userId}`);
+    }
+    return userId;
+}
+/**
+ * Rewinds to the shape an existing installation has when 0007 runs: no usernames, and
+ * `player.display_name` still present (profile drops it in a later migration).
+ */
+async function runBackfill() {
+    await db.drizzle.db.execute(sql `ALTER TABLE "user" ALTER COLUMN username DROP NOT NULL`);
+    await db.drizzle.db.execute(sql `UPDATE "user" SET username = NULL`);
+    await db.drizzle.db.execute(sql.raw(BACKFILL_SQL));
+    await db.drizzle.db.execute(sql `ALTER TABLE "user" ALTER COLUMN username SET NOT NULL`);
+    const rows = await db.drizzle.db.select({ id: user.id, username: user.username }).from(user);
+    return new Map(rows.map((r) => [r.id, r.username]));
+}
+beforeAll(async () => {
+    db = await createTestDb([migrate, migrateProfile]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    await db.drizzle.db.execute(sql `TRUNCATE ${player}, ${user} RESTART IDENTITY CASCADE`);
+    await db.drizzle.db.execute(sql `ALTER TABLE player ADD COLUMN IF NOT EXISTS display_name text`);
+});
+describe('0007 username backfill', () => {
+    it('sanitises a legacy display name into a valid handle', async () => {
+        const id = await seedLegacy("Alice O'Hara!");
+        expect((await runBackfill()).get(id)).toBe('alice_o_hara_');
+    });
+    it('falls back to the user name, then to a generic handle', async () => {
+        const noPlayerRow = await seedLegacy(null, 'Bob Builder');
+        const tooShort = await seedLegacy('ab');
+        const byId = await runBackfill();
+        expect(byId.get(noPlayerRow)).toBe('bob_builder');
+        expect(byId.get(tooShort)).toBe('player');
+    });
+    it('gives colliding legacy names globally unique handles', async () => {
+        const ids = await Promise.all([
+            seedLegacy('Duplicate'),
+            seedLegacy('Duplicate'),
+            seedLegacy('Duplicate'),
+        ]);
+        const byId = await runBackfill();
+        const handles = ids.map((id) => byId.get(id));
+        expect(new Set(handles).size).toBe(3);
+        expect(handles).toContain('duplicate');
+    });
+    it('never exceeds the 20 character username limit', async () => {
+        const ids = await Promise.all([
+            seedLegacy('A Very Long Display Name Indeed'),
+            seedLegacy('A Very Long Display Name Indeed'),
+        ]);
+        const byId = await runBackfill();
+        for (const id of ids) {
+            const handle = byId.get(id);
+            expect(handle).toMatch(/^[a-z0-9_]{3,20}$/);
+        }
+    });
+    it('gives non-player accounts a username too, so the column can be NOT NULL', async () => {
+        const userId = randomUUID();
+        await db.drizzle.db.insert(user).values({
+            id: userId,
+            name: 'Admin',
+            username: `seed_${userId.replaceAll('-', '').slice(0, 13)}`,
+            email: `${userId}@legacy.test`,
+            role: 'admin',
+        });
+        expect((await runBackfill()).get(userId)).toBe('admin');
+    });
+    it('satisfies the unique index it runs before', async () => {
+        await Promise.all(Array.from({ length: 25 }, () => seedLegacy('Same Name')));
+        const handles = [...(await runBackfill()).values()];
+        expect(new Set(handles.map((h) => h?.toLowerCase())).size).toBe(handles.length);
+    });
+});
+//# sourceMappingURL=username-backfill.int.test.js.map

package/dist/pam/identity/__tests__/username-backfill.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"username-backfill.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/username-backfill.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,YAAY,EAAe,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAC1D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,qFAAqF;AACrF,yFAAyF;AACzF,MAAM,YAAY,GAAG,YAAY,CAC/B,aAAa,CAAC,IAAI,GAAG,CAAC,gDAAgD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACzF,MAAM,CACP,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAE,CAAC;AAExC,IAAI,EAAU,CAAC;AAEf,KAAK,UAAU,UAAU,CAAC,UAAyB,EAAE,IAAI,GAAG,eAAe;IACzE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACtC,EAAE,EAAE,MAAM;QACV,IAAI;QACJ,QAAQ,EAAE,QAAQ,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QAC3D,KAAK,EAAE,GAAG,MAAM,cAAc;QAC9B,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IACH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACzB,GAAG,CAAA,oCAAoC,UAAU,oBAAoB,MAAM,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW;IACxB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,wDAAwD,CAAC,CAAC;IACzF,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mCAAmC,CAAC,CAAC;IACpE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACnD,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,uDAAuD,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,YAAY,MAAM,KAAK,IAAI,2BAA2B,CAAC,CAAC;IACvF,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,+DAA+D,CAAC,CAAC;AAClG,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAE7C,MAAM,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,UAAU,CAAC,WAAW,CAAC;YACvB,UAAU,CAAC,WAAW,CAAC;YACvB,UAAU,CAAC,WAAW,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,UAAU,CAAC,iCAAiC,CAAC;YAC7C,UAAU,CAAC,iCAAiC,CAAC;SAC9C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACtC,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,QAAQ,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YAC3D,KAAK,EAAE,GAAG,MAAM,cAAc;YAC9B,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAE7E,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/withdrawal-pin.service.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=withdrawal-pin.service.int.test.d.ts.map

package/dist/pam/identity/__tests__/withdrawal-pin.service.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withdrawal-pin.service.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/withdrawal-pin.service.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/withdrawal-pin.service.int.test.js

@@ -0,0 +1,172 @@
+import { randomUUID } from 'node:crypto';
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { eq, sql } from 'drizzle-orm';
+import { createTestDb, createTestRedis, seedUser as insertUser, } from '@openora/core/testing';
+import { migrate as migrateIdentity } from '@openora/core/pam/migrate/identity';
+import { RedisRateLimiter } from '@openora/core/server';
+import { SetWithdrawalPinInputSchema } from '@openora/core/contracts';
+import { account, user } from '../schema/index.js';
+import { WithdrawalPinService } from '../service/withdrawal-pin.service.js';
+import { makeEventBus, makeIdentityReader, mock, NO_CLIENT_META } from '../../../testing/mock.js';
+const PASSWORD = 'current-password';
+const HMAC_SECRET = 'a'.repeat(32);
+const PIN = '1234';
+let db;
+const allowLimiter = () => mock({
+    consume: vi.fn().mockResolvedValue({ allowed: true, retryAfterMs: 0 }),
+    reset: vi.fn(),
+});
+function build({ passwordMatches = true, limiter, } = {}) {
+    const events = makeEventBus();
+    const auth = mock({
+        $context: Promise.resolve({
+            password: { verify: vi.fn().mockResolvedValue(passwordMatches) },
+        }),
+        api: { verifyTOTP: vi.fn().mockResolvedValue(new Response(null, { status: 200 })) },
+    });
+    const svc = new WithdrawalPinService({
+        drizzle: db.drizzle,
+        events,
+        limiter: limiter ?? allowLimiter(),
+        auth,
+        identityReader: makeIdentityReader(),
+        hmacSecret: HMAC_SECRET,
+        trustedDeviceDays: 30,
+    });
+    return { svc, events, auth };
+}
+async function seedAuthenticatedUser(overrides = {}) {
+    const accountUser = await insertUser(db, {
+        name: 'A',
+        email: overrides.email ?? `withdrawal-pin-${randomUUID()}@test.dev`,
+        ...(overrides.role ? { role: overrides.role } : {}),
+        ...(overrides.twoFactorEnabled !== undefined
+            ? { twoFactorEnabled: overrides.twoFactorEnabled }
+            : {}),
+    });
+    await db.drizzle.db.insert(account).values({
+        userId: accountUser.id,
+        accountId: accountUser.id,
+        providerId: 'credential',
+        password: 'stored-password-hash',
+    });
+    return accountUser;
+}
+async function readUser(userId) {
+    const [row] = await db.drizzle.db.select().from(user).where(eq(user.id, userId));
+    return row;
+}
+beforeAll(async () => {
+    db = await createTestDb([migrateIdentity]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    await db.drizzle.db.execute(sql `TRUNCATE ${user}, ${account} RESTART IDENTITY CASCADE`);
+});
+describe('WithdrawalPinService (real PG)', () => {
+    it('refuses a non-player role, leaves the row untouched, and audits the denial', async () => {
+        const accountUser = await seedAuthenticatedUser({ role: 'admin' });
+        const { svc, events } = build();
+        await expect(svc.set(accountUser.id, { pin: PIN, confirmPin: PIN, currentPassword: PASSWORD }, {}, NO_CLIENT_META)).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect((await readUser(accountUser.id))?.withdrawalPinHash).toBeNull();
+        expect(events.emit).toHaveBeenCalledWith('identity.user.unauthorized_access', expect.objectContaining({
+            userId: accountUser.id,
+            resource: 'identity.security.withdrawal_pin',
+            action: 'set',
+            role: 'admin',
+        }));
+    });
+    it('sets a PIN for the first time', async () => {
+        const accountUser = await seedAuthenticatedUser();
+        const { svc, events } = build();
+        const controls = await svc.set(accountUser.id, { pin: PIN, confirmPin: PIN, currentPassword: PASSWORD }, {}, NO_CLIENT_META);
+        expect(controls.withdrawalPinSet).toBe(true);
+        const row = await readUser(accountUser.id);
+        expect(row?.withdrawalPinHash).not.toBeNull();
+        expect(row?.withdrawalPinSetAt).not.toBeNull();
+        expect(events.emit).toHaveBeenCalledWith('identity.security.withdrawal_pin.set', expect.objectContaining({ userId: accountUser.id, wasAlreadySet: false }));
+    });
+    it('changes an existing PIN, overwriting the hash and flagging wasAlreadySet', async () => {
+        const accountUser = await seedAuthenticatedUser();
+        const { svc, events } = build();
+        await svc.set(accountUser.id, { pin: PIN, confirmPin: PIN, currentPassword: PASSWORD }, {}, NO_CLIENT_META);
+        const firstHash = (await readUser(accountUser.id))?.withdrawalPinHash;
+        await svc.set(accountUser.id, { pin: '5678', confirmPin: '5678', currentPassword: PASSWORD }, {}, NO_CLIENT_META);
+        const secondHash = (await readUser(accountUser.id))?.withdrawalPinHash;
+        expect(secondHash).not.toEqual(firstHash);
+        expect(events.emit).toHaveBeenCalledWith('identity.security.withdrawal_pin.set', expect.objectContaining({ userId: accountUser.id, wasAlreadySet: true }));
+    });
+    it('rejects a wrong current password, leaves the row untouched, and emits nothing', async () => {
+        const accountUser = await seedAuthenticatedUser();
+        const { svc, events } = build({ passwordMatches: false });
+        await expect(svc.set(accountUser.id, { pin: PIN, confirmPin: PIN, currentPassword: 'wrong-password' }, {}, NO_CLIENT_META)).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        expect((await readUser(accountUser.id))?.withdrawalPinHash).toBeNull();
+        expect(events.emit).not.toHaveBeenCalledWith('identity.security.withdrawal_pin.set', expect.anything());
+    });
+    it('requires a fresh authenticator code once 2FA is enabled', async () => {
+        const accountUser = await seedAuthenticatedUser({ twoFactorEnabled: true });
+        const { svc } = build();
+        await expect(svc.set(accountUser.id, { pin: PIN, confirmPin: PIN, currentPassword: PASSWORD }, {}, NO_CLIENT_META)).rejects.toMatchObject({ code: 'UNPROCESSABLE_CONTENT' });
+    });
+    it('removes an existing PIN with no reauthentication and audits by event', async () => {
+        const accountUser = await seedAuthenticatedUser();
+        const { svc, events } = build();
+        await svc.set(accountUser.id, { pin: PIN, confirmPin: PIN, currentPassword: PASSWORD }, {}, NO_CLIENT_META);
+        const controls = await svc.remove(accountUser.id, NO_CLIENT_META);
+        expect(controls.withdrawalPinSet).toBe(false);
+        const row = await readUser(accountUser.id);
+        expect(row?.withdrawalPinHash).toBeNull();
+        expect(row?.withdrawalPinSetAt).toBeNull();
+        expect(events.emit).toHaveBeenCalledWith('identity.security.withdrawal_pin.removed', expect.objectContaining({ userId: accountUser.id }));
+    });
+    it('no-ops removing an already-unset PIN, without emitting an event', async () => {
+        const accountUser = await seedAuthenticatedUser();
+        const { svc, events } = build();
+        const controls = await svc.remove(accountUser.id, NO_CLIENT_META);
+        expect(controls.withdrawalPinSet).toBe(false);
+        expect(events.emit).not.toHaveBeenCalledWith('identity.security.withdrawal_pin.removed', expect.anything());
+    });
+});
+describe('WithdrawalPinService - input validation (unit)', () => {
+    it('rejects a mismatched pin/confirmPin', () => {
+        const result = SetWithdrawalPinInputSchema.safeParse({
+            pin: '1234',
+            confirmPin: '4321',
+            currentPassword: 'password123',
+        });
+        expect(result.success).toBe(false);
+    });
+});
+describe('WithdrawalPinService - rate limiting (real Redis + real PG)', () => {
+    let redis;
+    beforeAll(async () => {
+        redis = await createTestRedis();
+    });
+    afterAll(async () => {
+        await redis.quit();
+    });
+    beforeEach(async () => {
+        await redis.flush();
+    });
+    it('rejects the 6th set() within the window with a 429', async () => {
+        const accountUser = await seedAuthenticatedUser();
+        const { svc } = build({ limiter: new RedisRateLimiter(redis.client) });
+        for (let i = 0; i < 5; i++) {
+            await svc.set(accountUser.id, { pin: PIN, confirmPin: PIN, currentPassword: PASSWORD }, {}, NO_CLIENT_META);
+        }
+        await expect(svc.set(accountUser.id, { pin: PIN, confirmPin: PIN, currentPassword: PASSWORD }, {}, NO_CLIENT_META)).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+    });
+    it('rejects the 6th remove() within the same per-user budget', async () => {
+        const accountUser = await seedAuthenticatedUser();
+        const { svc } = build({ limiter: new RedisRateLimiter(redis.client) });
+        for (let i = 0; i < 5; i++) {
+            await svc.remove(accountUser.id, NO_CLIENT_META);
+        }
+        await expect(svc.remove(accountUser.id, NO_CLIENT_META)).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+    });
+});
+//# sourceMappingURL=withdrawal-pin.service.int.test.js.map

package/dist/pam/identity/__tests__/withdrawal-pin.service.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"withdrawal-pin.service.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/withdrawal-pin.service.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,QAAQ,IAAI,UAAU,GAGvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAa,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAA2B,MAAM,yBAAyB,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAElG,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACnC,MAAM,GAAG,GAAG,MAAM,CAAC;AAEnB,IAAI,EAAU,CAAC;AAEf,MAAM,YAAY,GAAG,GAAuB,EAAE,CAC5C,IAAI,CAAqB;IACvB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACtE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;CACf,CAAC,CAAC;AAEL,SAAS,KAAK,CAAC,EACb,eAAe,GAAG,IAAI,EACtB,OAAO,MACwD,EAAE;IACjE,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAO;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;YACxB,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE;SACjE,CAAC;QACF,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;KACpF,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,oBAAoB,CAAC;QACnC,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,MAAM;QACN,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE;QAClC,IAAI;QACJ,cAAc,EAAE,kBAAkB,EAAE;QACpC,UAAU,EAAE,WAAW;QACvB,iBAAiB,EAAE,EAAE;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,YAA2E,EAAE;IAE7E,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE;QACvC,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,kBAAkB,UAAU,EAAE,WAAW;QACnE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,gBAAgB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,EAAE,WAAW,CAAC,EAAE;QACtB,SAAS,EAAE,WAAW,CAAC,EAAE;QACzB,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,sBAAsB;KACjC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc;IACpC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,YAAY,IAAI,KAAK,OAAO,2BAA2B,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAEhC,MAAM,MAAM,CACV,GAAG,CAAC,GAAG,CACL,WAAW,CAAC,EAAE,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,EACxD,EAAE,EACF,cAAc,CACf,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/C,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,mCAAmC,EACnC,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,QAAQ,EAAE,kCAAkC;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,CAC5B,WAAW,CAAC,EAAE,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,EACxD,EAAE,EACF,cAAc,CACf,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,sCAAsC,EACtC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAChC,MAAM,GAAG,CAAC,GAAG,CACX,WAAW,CAAC,EAAE,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,EACxD,EAAE,EACF,cAAc,CACf,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,CAAC;QAEtE,MAAM,GAAG,CAAC,GAAG,CACX,WAAW,CAAC,EAAE,EACd,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,EAC9D,EAAE,EACF,cAAc,CACf,CAAC;QAEF,MAAM,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,CAAC;QACvE,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,sCAAsC,EACtC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QAE1D,MAAM,MAAM,CACV,GAAG,CAAC,GAAG,CACL,WAAW,CAAC,EAAE,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,gBAAgB,EAAE,EAChE,EAAE,EACF,cAAc,CACf,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAElD,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAC1C,sCAAsC,EACtC,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAExB,MAAM,MAAM,CACV,GAAG,CAAC,GAAG,CACL,WAAW,CAAC,EAAE,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,EACxD,EAAE,EACF,cAAc,CACf,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAChC,MAAM,GAAG,CAAC,GAAG,CACX,WAAW,CAAC,EAAE,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,EACxD,EAAE,EACF,cAAc,CACf,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAElE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,0CAA0C,EAC1C,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CACpD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAElE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAC1C,0CAA0C,EAC1C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC;YACnD,GAAG,EAAE,MAAM;YACX,UAAU,EAAE,MAAM;YAClB,eAAe,EAAE,aAAa;SAC/B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6DAA6D,EAAE,GAAG,EAAE;IAC3E,IAAI,KAAgB,CAAC;IAErB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,GAAG,CACX,WAAW,CAAC,EAAE,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,EACxD,EAAE,EACF,cAAc,CACf,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,CACV,GAAG,CAAC,GAAG,CACL,WAAW,CAAC,EAAE,EACd,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,EACxD,EAAE,EACF,cAAc,CACf,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7E,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/adapters/identity-reader.service.d.ts

@@ -1,10 +1,15 @@
 import { DrizzleService } from '@openora/core/server';
-import { Player, type IdentityReader } from '@openora/core/contracts';
+import type { IdentityReader, KycStatus, Player, User } from '@openora/core/contracts';
 export declare class IdentityReaderService implements IdentityReader {
     private readonly drizzle;
     constructor(drizzle: DrizzleService);
-    getLastLoginAt(userId: Player['id']): Promise<Date | null>;
-    getPlayerIdsInactiveSince(sinceDate: Date): Promise<string[]>;
-    getPlayerIdByUserId(userId: string): Promise<string | null>;
+    getLastLoginAt(userId: User['id']): Promise<Date | null>;
+    getPlayerIdsInactiveSince(sinceDate: Date): Promise<User['id'][]>;
+    getPlayerIdByUserId(userId: User['id']): Promise<Player['id'] | null>;
+    getPlayerIdByUserIdSafe(userId: User['id']): Promise<Player['id'] | null>;
+    getPlayerIdsByUserIdsSafe(userIds: User['id'][]): Promise<Map<User['id'], Player['id'] | null>>;
+    getPlayerKycStatusByUserId(userId: User['id']): Promise<KycStatus | null>;
+    getPlayerUserIdsSharingLoginIp(userId: User['id'], ipAddress: string): Promise<User['id'][]>;
+    canReceiveLoginWithdrawalAlerts(userId: User['id']): Promise<boolean>;
 }
 //# sourceMappingURL=identity-reader.service.d.ts.map

package/dist/pam/identity/adapters/identity-reader.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-reader.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/adapters/identity-reader.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAKtE,qBAAa,qBAAsB,YAAW,cAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAE9C,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ1D,yBAAyB,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAyB7D,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAQlE"}
+{"version":3,"file":"identity-reader.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/adapters/identity-reader.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAOvF,qBAAa,qBAAsB,YAAW,cAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAE9C,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQxD,yBAAyB,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IA4BjE,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IASrE,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IASzE,yBAAyB,CAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAmB1C,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IASzE,8BAA8B,CAClC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAWlB,+BAA+B,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAQ5E"}