@openora/core 0.4.1-canary.17 → 0.4.1-canary.170

package/dist/pam/identity/__tests__/phone-verification.service.int.test.js

@@ -0,0 +1,274 @@
+import { createHash } from 'node:crypto';
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { eq, sql } from 'drizzle-orm';
+import { createTestDb, seedUser as insertUser } from '@openora/core/testing';
+import { migrate as migrateIdentity } from '@openora/core/pam/migrate/identity';
+import { account, phoneVerificationSession, session, user } from '../schema/index.js';
+import { PhoneVerificationService } from '../service/phone-verification.service.js';
+import { makeEventBus, makeIdentityReader, mock, NO_CLIENT_META } from '../../../testing/mock.js';
+const PASSWORD = 'current-password';
+const PHONE = '+14155550100';
+let db;
+const allowLimiter = () => mock({
+    consume: vi.fn().mockResolvedValue({ allowed: true, retryAfterMs: 0 }),
+    reset: vi.fn(),
+});
+function build({ passwordMatches = true } = {}) {
+    const events = makeEventBus();
+    const sms = mock({ sendOtp: vi.fn().mockResolvedValue(undefined) });
+    const auth = mock({
+        $context: Promise.resolve({
+            password: { verify: vi.fn().mockResolvedValue(passwordMatches) },
+        }),
+        api: { verifyTOTP: vi.fn().mockResolvedValue(new Response(null, { status: 200 })) },
+    });
+    const svc = new PhoneVerificationService({
+        drizzle: db.drizzle,
+        events,
+        sms,
+        limiter: allowLimiter(),
+        auth,
+        identityReader: makeIdentityReader(),
+        trustedDeviceDays: 30,
+    });
+    return { svc, events, sms };
+}
+async function seedAuthenticatedUser(overrides = {}) {
+    const accountUser = await insertUser(db, {
+        name: 'A',
+        email: overrides.email ?? 'phone-verification@test.dev',
+        ...(overrides.role ? { role: overrides.role } : {}),
+    });
+    await db.drizzle.db.insert(account).values({
+        userId: accountUser.id,
+        accountId: accountUser.id,
+        providerId: 'credential',
+        password: 'stored-password-hash',
+    });
+    const [activeSession] = await db.drizzle.db
+        .insert(session)
+        .values({
+        userId: accountUser.id,
+        token: 'active-session-token',
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+    })
+        .returning({ id: session.id });
+    return { accountUser, sessionId: activeSession.id };
+}
+beforeAll(async () => {
+    db = await createTestDb([migrateIdentity]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    await db.drizzle.db.execute(sql `TRUNCATE ${user}, ${account}, ${session}, ${phoneVerificationSession} RESTART IDENTITY CASCADE`);
+});
+describe('PhoneVerificationService (real PG)', () => {
+    it('requires the current password before it creates an OTP challenge', async () => {
+        const { accountUser, sessionId } = await seedAuthenticatedUser();
+        const { svc, sms } = build({ passwordMatches: false });
+        await expect(svc.request({
+            userId: accountUser.id,
+            sessionId,
+            input: { phone: PHONE, currentPassword: PASSWORD },
+            reqHeaders: {},
+            meta: NO_CLIENT_META,
+        })).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        expect(sms.sendOtp).not.toHaveBeenCalled();
+        expect(await db.drizzle.db.select().from(phoneVerificationSession)).toEqual([]);
+    });
+    it('binds the OTP to the authenticated session, verifies the number atomically, and audits by event', async () => {
+        const { accountUser, sessionId } = await seedAuthenticatedUser();
+        const { svc, events, sms } = build();
+        await svc.request({
+            userId: accountUser.id,
+            sessionId,
+            input: { phone: PHONE, currentPassword: PASSWORD },
+            reqHeaders: {},
+            meta: NO_CLIENT_META,
+        });
+        const code = sms.sendOtp.mock.calls[0]?.[0]?.code;
+        expect(code).toMatch(/^\d{6}$/);
+        const [challenge] = await db.drizzle.db.select().from(phoneVerificationSession);
+        expect(challenge).toMatchObject({
+            userId: accountUser.id,
+            sessionId,
+            phone: PHONE,
+            codeHash: createHash('sha256').update(code).digest('hex'),
+        });
+        const controls = await svc.confirm({
+            userId: accountUser.id,
+            sessionId,
+            input: { code },
+            meta: NO_CLIENT_META,
+        });
+        expect(controls).toMatchObject({ phoneNumber: PHONE, phoneVerified: true });
+        const [updatedUser] = await db.drizzle.db
+            .select({ phoneNumber: user.phoneNumber, phoneVerified: user.phoneVerified })
+            .from(user)
+            .where(eq(user.id, accountUser.id));
+        expect(updatedUser).toEqual({ phoneNumber: PHONE, phoneVerified: true });
+        expect(await db.drizzle.db.select().from(phoneVerificationSession)).toEqual([]);
+        expect(events.emit).toHaveBeenCalledWith('identity.phone.verified', {
+            userId: accountUser.id,
+            playerId: null,
+            previousPhoneVerified: false,
+            ip: null,
+            userAgent: null,
+        });
+        expect(events.emit).not.toHaveBeenCalledWith('identity.authentication.succeeded', expect.anything());
+    });
+    it('does not allow a challenge created in another session to confirm the phone number', async () => {
+        const { accountUser, sessionId } = await seedAuthenticatedUser();
+        const [otherSession] = await db.drizzle.db
+            .insert(session)
+            .values({
+            userId: accountUser.id,
+            token: 'other-active-session-token',
+            expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+        })
+            .returning({ id: session.id });
+        const { svc, sms } = build();
+        await svc.request({
+            userId: accountUser.id,
+            sessionId,
+            input: { phone: PHONE, currentPassword: PASSWORD },
+            reqHeaders: {},
+            meta: NO_CLIENT_META,
+        });
+        const code = sms.sendOtp.mock.calls[0]?.[0]?.code;
+        await expect(svc.confirm({
+            userId: accountUser.id,
+            sessionId: otherSession.id,
+            input: { code },
+            meta: NO_CLIENT_META,
+        })).rejects.toMatchObject({ code: 'UNPROCESSABLE_CONTENT' });
+        const [unchanged] = await db.drizzle.db
+            .select({ phoneVerified: user.phoneVerified })
+            .from(user)
+            .where(eq(user.id, accountUser.id));
+        expect(unchanged?.phoneVerified).toBe(false);
+    });
+    it('rejects the second confirm with CONFLICT when two accounts race to claim the same number', async () => {
+        // Neither account owns PHONE yet, so `request()`'s uniqueness check (which only looks
+        // at already-bound `user.phoneNumber`) lets both create a pending session for it.
+        const first = await seedAuthenticatedUser();
+        const second = await insertUser(db, { name: 'B', email: 'phone-verification-2@test.dev' });
+        await db.drizzle.db.insert(account).values({
+            userId: second.id,
+            accountId: second.id,
+            providerId: 'credential',
+            password: 'stored-password-hash',
+        });
+        const [secondSession] = await db.drizzle.db
+            .insert(session)
+            .values({
+            userId: second.id,
+            token: 'second-active-session-token',
+            expiresAt: new Date(Date.now() + 60 * 60 * 1000),
+        })
+            .returning({ id: session.id });
+        const { svc, sms } = build();
+        await svc.request({
+            userId: first.accountUser.id,
+            sessionId: first.sessionId,
+            input: { phone: PHONE, currentPassword: PASSWORD },
+            reqHeaders: {},
+            meta: NO_CLIENT_META,
+        });
+        const firstCode = sms.sendOtp.mock.calls[0]?.[0]?.code;
+        await svc.request({
+            userId: second.id,
+            sessionId: secondSession.id,
+            input: { phone: PHONE, currentPassword: PASSWORD },
+            reqHeaders: {},
+            meta: NO_CLIENT_META,
+        });
+        const secondCode = sms.sendOtp.mock.calls[1]?.[0]?.code;
+        await svc.confirm({
+            userId: first.accountUser.id,
+            sessionId: first.sessionId,
+            input: { code: firstCode },
+            meta: NO_CLIENT_META,
+        });
+        await expect(svc.confirm({
+            userId: second.id,
+            sessionId: secondSession.id,
+            input: { code: secondCode },
+            meta: NO_CLIENT_META,
+        })).rejects.toMatchObject({ code: 'CONFLICT' });
+        const [unchanged] = await db.drizzle.db
+            .select({ phoneNumber: user.phoneNumber, phoneVerified: user.phoneVerified })
+            .from(user)
+            .where(eq(user.id, second.id));
+        expect(unchanged).toEqual({ phoneNumber: null, phoneVerified: false });
+    });
+    it('keeps counting wrong codes and burns the challenge on the last one', async () => {
+        const { accountUser, sessionId } = await seedAuthenticatedUser();
+        const { svc } = build();
+        await svc.request({
+            userId: accountUser.id,
+            sessionId,
+            input: { phone: PHONE, currentPassword: PASSWORD },
+            reqHeaders: {},
+            meta: NO_CLIENT_META,
+        });
+        for (let attempt = 1; attempt < 5; attempt++) {
+            await expect(svc.confirm({
+                userId: accountUser.id,
+                sessionId,
+                input: { code: '000000' },
+                meta: NO_CLIENT_META,
+            })).rejects.toMatchObject({ code: 'UNPROCESSABLE_CONTENT' });
+            const [row] = await db.drizzle.db.select().from(phoneVerificationSession);
+            expect(row?.failedAttempts).toBe(attempt);
+        }
+        await expect(svc.confirm({
+            userId: accountUser.id,
+            sessionId,
+            input: { code: '000000' },
+            meta: NO_CLIENT_META,
+        })).rejects.toMatchObject({ code: 'UNPROCESSABLE_CONTENT' });
+        expect(await db.drizzle.db.select().from(phoneVerificationSession)).toEqual([]);
+    });
+    it('refuses to bind a number to a non-player account', async () => {
+        const { accountUser, sessionId } = await seedAuthenticatedUser({
+            role: 'admin',
+            email: 'phone-verification-admin@test.dev',
+        });
+        const { svc, sms } = build();
+        await expect(svc.request({
+            userId: accountUser.id,
+            sessionId,
+            input: { phone: PHONE, currentPassword: PASSWORD },
+            reqHeaders: {},
+            meta: NO_CLIENT_META,
+        })).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect(sms.sendOtp).not.toHaveBeenCalled();
+        expect(await db.drizzle.db.select().from(phoneVerificationSession)).toEqual([]);
+    });
+    it('answers a number owned by another account without an SMS or a challenge', async () => {
+        const { accountUser, sessionId } = await seedAuthenticatedUser();
+        const owner = await insertUser(db, { name: 'B', email: 'phone-verification-owner@test.dev' });
+        await db.drizzle.db
+            .update(user)
+            .set({ phoneNumber: PHONE, phoneVerified: true })
+            .where(eq(user.id, owner.id));
+        const { svc, sms } = build();
+        const result = await svc.request({
+            userId: accountUser.id,
+            sessionId,
+            input: { phone: PHONE, currentPassword: PASSWORD },
+            reqHeaders: {},
+            meta: NO_CLIENT_META,
+        });
+        expect(result).toMatchObject({
+            expiresAt: expect.any(String),
+            resendAfter: expect.any(String),
+        });
+        expect(sms.sendOtp).not.toHaveBeenCalled();
+        expect(await db.drizzle.db.select().from(phoneVerificationSession)).toEqual([]);
+    });
+});
+//# sourceMappingURL=phone-verification.service.int.test.js.map

package/dist/pam/identity/__tests__/phone-verification.service.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-verification.service.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/phone-verification.service.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,QAAQ,IAAI,UAAU,EAAe,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAGhF,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAElG,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,MAAM,KAAK,GAAG,cAAc,CAAC;AAE7B,IAAI,EAAU,CAAC;AAEf,MAAM,YAAY,GAAG,GAAuB,EAAE,CAC5C,IAAI,CAAqB;IACvB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACtE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;CACf,CAAC,CAAC;AAEL,SAAS,KAAK,CAAC,EAAE,eAAe,GAAG,IAAI,KAAoC,EAAE;IAC3E,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAa,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,CAAO;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;YACxB,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE;SACjE,CAAC;QACF,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE;KACpF,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC;QACvC,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,MAAM;QACN,GAAG;QACH,OAAO,EAAE,YAAY,EAAE;QACvB,IAAI;QACJ,cAAc,EAAE,kBAAkB,EAAE;QACpC,iBAAiB,EAAE,EAAE;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,YAA+C,EAAE;IACpF,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE;QACvC,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,6BAA6B;QACvD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,EAAE,WAAW,CAAC,EAAE;QACtB,SAAS,EAAE,WAAW,CAAC,EAAE;QACzB,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,sBAAsB;KACjC,CAAC,CAAC;IACH,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;SACxC,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC;QACN,MAAM,EAAE,WAAW,CAAC,EAAE;QACtB,KAAK,EAAE,sBAAsB;QAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;KACjD,CAAC;SACD,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAc,CAAC,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CACzB,GAAG,CAAA,YAAY,IAAI,KAAK,OAAO,KAAK,OAAO,KAAK,wBAAwB,2BAA2B,CACpG,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACjE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,CACV,GAAG,CAAC,OAAO,CAAC;YACV,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS;YACT,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,cAAc;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAElD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACjE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAErC,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS;YACT,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAI,GAAG,CAAC,OAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAChF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC;YAC9B,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS;YACT,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC1D,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;YACjC,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS;YACT,KAAK,EAAE,EAAE,IAAI,EAAE;YACf,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aACtC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;aAC5E,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,yBAAyB,EAAE;YAClE,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,QAAQ,EAAE,IAAI;YACd,qBAAqB,EAAE,KAAK;YAC5B,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAC1C,mCAAmC,EACnC,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACjE,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aACvC,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC;YACN,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,KAAK,EAAE,4BAA4B;YACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;SACjD,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAE7B,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS;YACT,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,GAAI,GAAG,CAAC,OAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QAEhF,MAAM,MAAM,CACV,GAAG,CAAC,OAAO,CAAC;YACV,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS,EAAE,YAAa,CAAC,EAAE;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE;YACf,IAAI,EAAE,cAAc;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aACpC,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;aAC7C,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,sFAAsF;QACtF,kFAAkF;QAClF,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3F,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YACzC,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,UAAU,EAAE,YAAY;YACxB,QAAQ,EAAE,sBAAsB;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aACxC,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC;YACN,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,KAAK,EAAE,6BAA6B;YACpC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;SACjD,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAE7B,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,SAAS,GAAI,GAAG,CAAC,OAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QACrF,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,SAAS,EAAE,aAAc,CAAC,EAAE;YAC5B,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,UAAU,GAAI,GAAG,CAAC,OAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QAEtF,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,GAAG,CAAC,OAAO,CAAC;YACV,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,SAAS,EAAE,aAAc,CAAC,EAAE;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;YAC3B,IAAI,EAAE,cAAc;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAE9C,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aACpC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;aAC5E,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACjE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAExB,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS;YACT,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QAEH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,MAAM,MAAM,CACV,GAAG,CAAC,OAAO,CAAC;gBACV,MAAM,EAAE,WAAW,CAAC,EAAE;gBACtB,SAAS;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,IAAI,EAAE,cAAc;aACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC1E,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,CACV,GAAG,CAAC,OAAO,CAAC;YACV,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,IAAI,EAAE,cAAc;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,CAAC;YAC7D,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,mCAAmC;SAC3C,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAE7B,MAAM,MAAM,CACV,GAAG,CAAC,OAAO,CAAC;YACV,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS;YACT,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,cAAc;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aAChB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAChD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;YAC/B,MAAM,EAAE,WAAW,CAAC,EAAE;YACtB,SAAS;YACT,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE;YAClD,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC3B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAC7B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/play-eligibility.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=play-eligibility.test.d.ts.map

package/dist/pam/identity/__tests__/play-eligibility.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"play-eligibility.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/play-eligibility.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/play-eligibility.test.js

@@ -0,0 +1,30 @@
+import { describe, it, expect } from 'vitest';
+import { makeDrizzle } from '../../../testing/mock.js';
+import { PlayEligibilityService } from '../service/play-eligibility.service.js';
+const HOUR_MS = 60 * 60 * 1000;
+function serviceFor(rows) {
+    return new PlayEligibilityService(makeDrizzle({ select: [rows] }));
+}
+describe('PlayEligibilityService', () => {
+    it('reports an indefinitely blocked player as restricted', async () => {
+        const svc = serviceFor([{ rgBlocked: true, rgBlockedUntil: null }]);
+        await expect(svc.isRestricted('user-1')).resolves.toBe(true);
+    });
+    it('reports a cooling-off still in its window as restricted', async () => {
+        const svc = serviceFor([{ rgBlocked: true, rgBlockedUntil: new Date(Date.now() + HOUR_MS) }]);
+        await expect(svc.isRestricted('user-1')).resolves.toBe(true);
+    });
+    it('reports an elapsed cooling-off as unrestricted before the expiry sweep runs', async () => {
+        const svc = serviceFor([{ rgBlocked: true, rgBlockedUntil: new Date(Date.now() - HOUR_MS) }]);
+        await expect(svc.isRestricted('user-1')).resolves.toBe(false);
+    });
+    it('reports an unblocked player as unrestricted', async () => {
+        const svc = serviceFor([{ rgBlocked: false, rgBlockedUntil: null }]);
+        await expect(svc.isRestricted('user-1')).resolves.toBe(false);
+    });
+    it('fails closed for an unknown user', async () => {
+        const svc = serviceFor([]);
+        await expect(svc.isRestricted('ghost')).resolves.toBe(true);
+    });
+});
+//# sourceMappingURL=play-eligibility.test.js.map

package/dist/pam/identity/__tests__/play-eligibility.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"play-eligibility.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/play-eligibility.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,SAAS,UAAU,CAAC,IAA+B;IACjD,OAAO,IAAI,sBAAsB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEpE,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9F,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9F,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAErE,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3B,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/rg-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rg-guard.test.d.ts.map

package/dist/pam/identity/__tests__/rg-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rg-guard.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/rg-guard.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/rg-guard.test.js

@@ -0,0 +1,21 @@
+import { describe, it, expect } from 'vitest';
+import { isRgBlocked } from '../service/rg-guard.service.js';
+const HOUR = 3600_000;
+describe('isRgBlocked', () => {
+    it('lets an unblocked player through', () => {
+        expect(isRgBlocked({ rgBlocked: false, rgBlockedUntil: null })).toBe(false);
+    });
+    it('blocks indefinitely when no expiry is set', () => {
+        expect(isRgBlocked({ rgBlocked: true, rgBlockedUntil: null })).toBe(true);
+    });
+    it('blocks while the exclusion is still running', () => {
+        expect(isRgBlocked({ rgBlocked: true, rgBlockedUntil: new Date(Date.now() + HOUR) })).toBe(true);
+    });
+    it('releases the player once the exclusion has expired', () => {
+        expect(isRgBlocked({ rgBlocked: true, rgBlockedUntil: new Date(Date.now() - HOUR) })).toBe(false);
+    });
+    it('ignores a stale expiry when the flag itself is off', () => {
+        expect(isRgBlocked({ rgBlocked: false, rgBlockedUntil: new Date(Date.now() + HOUR) })).toBe(false);
+    });
+});
+//# sourceMappingURL=rg-guard.test.js.map

package/dist/pam/identity/__tests__/rg-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rg-guard.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/rg-guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAE7D,MAAM,IAAI,GAAG,QAAQ,CAAC;AAEtB,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CACxF,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CACxF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CACzF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/session-idle.service.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-idle.service.int.test.d.ts.map

package/dist/pam/identity/__tests__/session-idle.service.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-idle.service.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/session-idle.service.int.test.ts"],"names":[],"mappings":""}

package/dist/pam/identity/__tests__/session-idle.service.int.test.js

@@ -0,0 +1,137 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach, vi } from 'vitest';
+import { eq, sql } from 'drizzle-orm';
+import { createTestDb, seedUser } from '@openora/core/testing';
+import { user, session } from '@openora/core/pam/schema/identity';
+import { makeEventBus, makeIdentityReader } from '../../../testing/mock.js';
+import { migrate } from '../migrate.js';
+import { SessionIdleService } from '../service/session-idle.service.js';
+let db;
+const service = (events = makeEventBus()) => new SessionIdleService({
+    drizzle: db.drizzle,
+    events,
+    identityReader: makeIdentityReader(),
+});
+const seedSession = (userId, lastSeenAt) => db.drizzle.db
+    .insert(session)
+    .values({
+    userId,
+    token: crypto.randomUUID(),
+    expiresAt: new Date(Date.now() + 86_400_000),
+    updatedAt: new Date(),
+    lastSeenAt,
+})
+    .returning()
+    .then(([row]) => row);
+const setWindow = (userId, autoLogoutDuration) => db.drizzle.db.update(user).set({ autoLogoutDuration }).where(eq(user.id, userId));
+const readSession = (id) => db.drizzle.db
+    .select()
+    .from(session)
+    .where(eq(session.id, id))
+    .then(([row]) => row);
+const minutesAgo = (n) => new Date(Date.now() - n * 60_000);
+beforeAll(async () => {
+    db = await createTestDb([migrate]);
+});
+afterAll(async () => {
+    await db.drop();
+});
+beforeEach(async () => {
+    vi.clearAllMocks();
+    await db.drizzle.db.execute(sql `TRUNCATE ${user} RESTART IDENTITY CASCADE`);
+});
+describe('SessionIdleService', () => {
+    it('applies the seven-day default to an account that never chose a window', async () => {
+        const account = await seedUser(db);
+        const target = await seedSession(account.id, minutesAgo(60 * 24 * 8));
+        expect(await service().touch(account.id, target.id)).toBe('expired');
+    });
+    it('leaves a session inside the default window alone', async () => {
+        const account = await seedUser(db);
+        const target = await seedSession(account.id, minutesAgo(60 * 24 * 6));
+        expect(await service().touch(account.id, target.id)).toBe('active');
+        expect((await readSession(target.id)).expiresAt.getTime()).toBeGreaterThan(Date.now());
+    });
+    it('expires a session idle past the chosen window', async () => {
+        const account = await seedUser(db);
+        await setWindow(account.id, '15m');
+        const target = await seedSession(account.id, minutesAgo(16));
+        expect(await service().touch(account.id, target.id)).toBe('expired');
+        const { rows } = await db.drizzle.db.execute(sql `select now() as now`);
+        const row = await readSession(target.id);
+        expect(row.expiresAt.getTime()).toBeLessThanOrEqual(new Date(rows[0].now).getTime());
+    });
+    it('keeps a session that has been idle for less than the window', async () => {
+        const account = await seedUser(db);
+        await setWindow(account.id, '1h');
+        const target = await seedSession(account.id, minutesAgo(30));
+        expect(await service().touch(account.id, target.id)).toBe('active');
+        expect((await readSession(target.id)).expiresAt.getTime()).toBeGreaterThan(Date.now());
+    });
+    it('leaves the last-used timestamp alone when it expires a session', async () => {
+        const account = await seedUser(db);
+        await setWindow(account.id, '15m');
+        const lastUsed = minutesAgo(90);
+        const target = await seedSession(account.id, minutesAgo(20));
+        await db.drizzle.db
+            .update(session)
+            .set({ updatedAt: lastUsed })
+            .where(eq(session.id, target.id));
+        await service().touch(account.id, target.id);
+        expect((await readSession(target.id)).updatedAt.getTime()).toBe(lastUsed.getTime());
+    });
+    it('starts the clock on a session that has never recorded activity', async () => {
+        const account = await seedUser(db);
+        await setWindow(account.id, '15m');
+        const target = await seedSession(account.id, null);
+        expect(await service().touch(account.id, target.id)).toBe('active');
+        expect((await readSession(target.id)).lastSeenAt).not.toBeNull();
+    });
+    it('records the expiry as a revocation nobody performed', async () => {
+        const account = await seedUser(db);
+        await setWindow(account.id, '15m');
+        const target = await seedSession(account.id, minutesAgo(20));
+        const events = makeEventBus();
+        await service(events).touch(account.id, target.id);
+        expect(events.emit).toHaveBeenCalledWith('identity.session.revoked', expect.objectContaining({ userId: account.id, sessionId: target.id }));
+        // No actor at all, rather than one naming the player: nobody revoked this.
+        expect(events.emit).toHaveBeenCalledWith('identity.session.revoked', expect.not.objectContaining({ actorId: expect.anything() }));
+    });
+    it('does not rewrite the activity stamp on every request', async () => {
+        const account = await seedUser(db);
+        const justNow = new Date(Date.now() - 5_000);
+        const target = await seedSession(account.id, justNow);
+        await service().touch(account.id, target.id);
+        expect((await readSession(target.id)).lastSeenAt?.getTime()).toBe(justNow.getTime());
+    });
+    it('never idles out an admin session, even one that has sat far past the default window', async () => {
+        const admin = await seedUser(db, { role: 'admin' });
+        const staleLastSeen = minutesAgo(60 * 24 * 30);
+        const target = await seedSession(admin.id, staleLastSeen);
+        expect(await service().touch(admin.id, target.id)).toBe('active');
+        // Admins have their own idle tracking through AdminGuard; this service must not
+        // touch their `lastSeenAt` at all, or the two mechanisms would fight over it.
+        expect((await readSession(target.id)).lastSeenAt?.getTime()).toBe(staleLastSeen.getTime());
+    });
+    it('fails closed when the session cannot be found', async () => {
+        const account = await seedUser(db);
+        expect(await service().touch(account.id, crypto.randomUUID())).toBe('expired');
+    });
+    it('expires an idle session exactly once under concurrent requests', async () => {
+        const account = await seedUser(db);
+        await setWindow(account.id, '15m');
+        const target = await seedSession(account.id, minutesAgo(20));
+        const events = makeEventBus();
+        const svc = service(events);
+        const results = await Promise.all([
+            svc.touch(account.id, target.id),
+            svc.touch(account.id, target.id),
+            svc.touch(account.id, target.id),
+        ]);
+        expect(results).toEqual(['expired', 'expired', 'expired']);
+        // Each concurrent call reads the same stale `lastSeenAt` and passes the idle test, but
+        // only the write that actually flips `expiresAt` may announce a revocation - otherwise
+        // one logout writes several rows into the append-only audit chain.
+        expect(events.emit).toHaveBeenCalledTimes(1);
+    });
+});
+//# sourceMappingURL=session-idle.service.int.test.js.map

package/dist/pam/identity/__tests__/session-idle.service.int.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-idle.service.int.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/session-idle.service.int.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,IAAI,EAAU,CAAC;AAEf,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,YAAY,EAAE,EAAE,EAAE,CAC1C,IAAI,kBAAkB,CAAC;IACrB,OAAO,EAAE,EAAE,CAAC,OAAO;IACnB,MAAM;IACN,cAAc,EAAE,kBAAkB,EAAE;CACrC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,UAAuB,EAAE,EAAE,CAC9D,EAAE,CAAC,OAAO,CAAC,EAAE;KACV,MAAM,CAAC,OAAO,CAAC;KACf,MAAM,CAAC;IACN,MAAM;IACN,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;IAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;IAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,UAAU;CACX,CAAC;KACD,SAAS,EAAE;KACX,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAI,CAAC,CAAC;AAE3B,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,kBAAsC,EAAE,EAAE,CAC3E,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,EAAE,CACjC,EAAE,CAAC,OAAO,CAAC,EAAE;KACV,MAAM,EAAE;KACR,IAAI,CAAC,OAAO,CAAC;KACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;KACzB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAI,CAAC,CAAC;AAE3B,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAEpE,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,YAAY,IAAI,2BAA2B,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAEtE,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAEtE,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAErE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAkB,GAAG,CAAA,qBAAqB,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;aAChB,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpC,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE7C,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAEnD,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAE9B,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAEnD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,0BAA0B,EAC1B,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CACtE,CAAC;QACF,2EAA2E;QAC3E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,0BAA0B,EAC1B,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAEtD,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAE7C,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClE,gFAAgF;QAChF,8EAA8E;QAC9E,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnC,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAE5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;SACjC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3D,uFAAuF;QACvF,uFAAuF;QACvF,mEAAmE;QACnE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/session.service.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session.service.int.test.d.ts.map

package/dist/pam/identity/__tests__/session.service.int.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.service.int.test.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/session.service.int.test.ts"],"names":[],"mappings":""}