@openora/core 0.4.1-canary.18 → 0.4.1-canary.181

package/dist/pam/identity/service/phone-verification.service.js

@@ -0,0 +1,223 @@
+import { ORPCError } from '@orpc/server';
+import { DatabaseError } from 'pg';
+import { and, eq, gt, sql } from 'drizzle-orm';
+import { assertRateLimit, } from '@openora/core/server';
+import { phoneVerificationSession, user } from '../schema/index.js';
+import { getSecurityControls } from './security-controls.service.js';
+import { assertFreshReauthentication } from './fresh-reauthentication.service.js';
+import { nodeHeadersToHeaders } from '../../shared/headers-mapper.js';
+import { hashCode, generateCode } from '../../shared/otp.js';
+const MINUTE_MS = 60 * 1000;
+const OTP_TTL_MS = 5 * MINUTE_MS;
+const RESEND_COOLDOWN_MS = MINUTE_MS;
+const MAX_VERIFY_ATTEMPTS = 5;
+const REAUTH_TTL_MS = 5 * MINUTE_MS;
+const REQUEST_RATE_LIMIT = { limit: 3, windowMs: 15 * MINUTE_MS, onUnavailable: 'deny' };
+const VERIFY_RATE_LIMIT = { limit: 10, windowMs: 5 * MINUTE_MS, onUnavailable: 'deny' };
+function phoneVerificationCooldownError(retryAfterMs) {
+    return new ORPCError('TOO_MANY_REQUESTS', {
+        message: 'A code was already sent. Please wait before requesting another.',
+        data: { retryAfterMs },
+    });
+}
+function phoneVerificationInvalidError() {
+    return new ORPCError('UNPROCESSABLE_CONTENT', { message: 'The code is invalid or expired.' });
+}
+function isPhoneNumberCollision(error) {
+    const cause = error instanceof DatabaseError ? error : error?.cause;
+    return (cause instanceof DatabaseError &&
+        cause.code === '23505' &&
+        cause.constraint === 'user_phoneNumber_unique');
+}
+export class PhoneVerificationService {
+    drizzle;
+    events;
+    sms;
+    limiter;
+    auth;
+    identityReader;
+    twoFactorLockout;
+    trustedDeviceDays;
+    constructor({ drizzle, events, sms, limiter, auth, identityReader, twoFactorLockout, trustedDeviceDays, }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.sms = sms;
+        this.limiter = limiter;
+        this.auth = auth;
+        this.identityReader = identityReader;
+        this.twoFactorLockout = twoFactorLockout;
+        this.trustedDeviceDays = trustedDeviceDays;
+    }
+    async request({ userId, sessionId, input, reqHeaders, meta, }) {
+        await assertRateLimit(this.limiter, `phone-verification-request:${userId}`, REQUEST_RATE_LIMIT);
+        const [caller] = await this.drizzle.db
+            .select({ role: user.role, twoFactorEnabled: user.twoFactorEnabled })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (!caller) {
+            throw new ORPCError('UNAUTHORIZED', { message: 'Not signed in.' });
+        }
+        // A verified number is also a login credential: PhoneLoginService mints a session
+        // from an SMS code alone. Binding one therefore stays a player-only control, so a
+        // backoffice account cannot trade its password login for a single SMS factor.
+        if (caller.role !== 'player') {
+            throw new ORPCError('FORBIDDEN', {
+                message: 'Only players can verify a phone number.',
+            });
+        }
+        await assertFreshReauthentication({
+            drizzle: this.drizzle,
+            auth: this.auth,
+            twoFactorLockout: this.twoFactorLockout,
+            userId,
+            headers: nodeHeadersToHeaders(reqHeaders),
+            currentPassword: input.currentPassword,
+            totpCode: input.totpCode,
+            twoFactorEnabled: caller.twoFactorEnabled ?? false,
+            meta,
+        });
+        const now = new Date();
+        const [phoneOwner] = await this.drizzle.db
+            .select({ id: user.id })
+            .from(user)
+            .where(eq(user.phoneNumber, input.phone))
+            .limit(1);
+        // Anti-enumeration, the same trade PhoneLoginService makes for this identifier: a
+        // number owned by someone else answers with the ordinary success shape and no SMS,
+        // rather than a CONFLICT that would confirm to any signed-in player that a given
+        // number belongs to an account here. No challenge is written, so `confirm` then fails
+        // as invalid-or-expired, which is indistinguishable from a wrong code.
+        if (phoneOwner && phoneOwner.id !== userId) {
+            return {
+                expiresAt: new Date(now.getTime() + OTP_TTL_MS).toISOString(),
+                resendAfter: new Date(now.getTime() + RESEND_COOLDOWN_MS).toISOString(),
+            };
+        }
+        const [existing] = await this.drizzle.db
+            .select({ createdAt: phoneVerificationSession.createdAt })
+            .from(phoneVerificationSession)
+            .where(and(eq(phoneVerificationSession.userId, userId), gt(phoneVerificationSession.expiresAt, now)))
+            .limit(1);
+        const elapsedMs = existing ? now.getTime() - existing.createdAt.getTime() : RESEND_COOLDOWN_MS;
+        if (elapsedMs < RESEND_COOLDOWN_MS) {
+            throw phoneVerificationCooldownError(RESEND_COOLDOWN_MS - elapsedMs);
+        }
+        const code = generateCode();
+        const expiresAt = new Date(now.getTime() + OTP_TTL_MS);
+        await this.drizzle.db
+            .insert(phoneVerificationSession)
+            .values({
+            userId,
+            sessionId,
+            phone: input.phone,
+            codeHash: hashCode(code),
+            reauthenticatedAt: now,
+            expiresAt,
+        })
+            .onConflictDoUpdate({
+            target: phoneVerificationSession.userId,
+            set: {
+                sessionId,
+                phone: input.phone,
+                codeHash: hashCode(code),
+                reauthenticatedAt: now,
+                expiresAt,
+                failedAttempts: 0,
+                createdAt: now,
+            },
+        });
+        await this.sms.sendOtp({ to: input.phone, code });
+        return {
+            expiresAt: expiresAt.toISOString(),
+            resendAfter: new Date(now.getTime() + RESEND_COOLDOWN_MS).toISOString(),
+        };
+    }
+    async confirm({ userId, sessionId, input, meta, }) {
+        await assertRateLimit(this.limiter, `phone-verification-confirm:${userId}`, VERIFY_RATE_LIMIT);
+        const now = new Date();
+        const [otp] = await this.drizzle.db
+            .select({
+            id: phoneVerificationSession.id,
+            sessionId: phoneVerificationSession.sessionId,
+            phone: phoneVerificationSession.phone,
+            codeHash: phoneVerificationSession.codeHash,
+            reauthenticatedAt: phoneVerificationSession.reauthenticatedAt,
+            failedAttempts: phoneVerificationSession.failedAttempts,
+        })
+            .from(phoneVerificationSession)
+            .where(and(eq(phoneVerificationSession.userId, userId), gt(phoneVerificationSession.expiresAt, now)))
+            .limit(1);
+        if (!otp ||
+            otp.sessionId !== sessionId ||
+            now.getTime() - otp.reauthenticatedAt.getTime() > REAUTH_TTL_MS) {
+            throw phoneVerificationInvalidError();
+        }
+        if (hashCode(input.code) !== otp.codeHash) {
+            // Outside any transaction on purpose: a rejected attempt has to survive the throw
+            // that rejects it, and the increment is atomic so concurrent guesses cannot each
+            // read a stale count and slip past the cap (same shape as PhoneLoginService).
+            const [attempt] = await this.drizzle.db
+                .update(phoneVerificationSession)
+                .set({ failedAttempts: sql `${phoneVerificationSession.failedAttempts} + 1` })
+                .where(eq(phoneVerificationSession.id, otp.id))
+                .returning({ failedAttempts: phoneVerificationSession.failedAttempts });
+            if (attempt !== undefined && attempt.failedAttempts >= MAX_VERIFY_ATTEMPTS) {
+                await this.drizzle.db
+                    .delete(phoneVerificationSession)
+                    .where(eq(phoneVerificationSession.id, otp.id));
+            }
+            throw phoneVerificationInvalidError();
+        }
+        let previousPhoneVerified = false;
+        try {
+            await this.drizzle.db.transaction(async (tx) => {
+                // Consuming the challenge and binding the number commit together, and the
+                // conditional delete is what makes a concurrent second confirm lose the race:
+                // only the transaction whose DELETE returns a row proceeds to the update.
+                const [consumed] = await tx
+                    .delete(phoneVerificationSession)
+                    .where(eq(phoneVerificationSession.id, otp.id))
+                    .returning({ id: phoneVerificationSession.id });
+                if (!consumed) {
+                    throw phoneVerificationInvalidError();
+                }
+                // Read before the write: RETURNING yields the new row, and the audit record needs
+                // the state this verification replaced.
+                const [before] = await tx
+                    .select({ phoneVerified: user.phoneVerified })
+                    .from(user)
+                    .where(eq(user.id, userId))
+                    .limit(1);
+                const [updated] = await tx
+                    .update(user)
+                    .set({ phoneNumber: otp.phone, phoneVerified: true, phoneVerifiedAt: new Date() })
+                    .where(eq(user.id, userId))
+                    .returning({ id: user.id });
+                if (!updated) {
+                    throw new ORPCError('UNAUTHORIZED', { message: 'Not signed in.' });
+                }
+                previousPhoneVerified = before?.phoneVerified ?? false;
+            });
+        }
+        catch (error) {
+            if (isPhoneNumberCollision(error)) {
+                throw new ORPCError('CONFLICT', { message: 'Phone number is unavailable.' });
+            }
+            throw error;
+        }
+        const controls = await getSecurityControls(this.drizzle, userId, this.trustedDeviceDays);
+        if (!controls) {
+            throw new ORPCError('UNAUTHORIZED', { message: 'Not signed in.' });
+        }
+        this.events.emit('identity.phone.verified', {
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            previousPhoneVerified,
+            ip: meta.ip,
+            userAgent: meta.userAgent,
+        });
+        return controls;
+    }
+}
+//# sourceMappingURL=phone-verification.service.js.map

package/dist/pam/identity/service/phone-verification.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-verification.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/phone-verification.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAKL,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAY9B,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAgB,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5B,MAAM,UAAU,GAAG,CAAC,GAAG,SAAS,CAAC;AACjC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,aAAa,GAAG,CAAC,GAAG,SAAS,CAAC;AAEpC,MAAM,kBAAkB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAW,CAAC;AAClG,MAAM,iBAAiB,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAW,CAAC;AAEjG,SAAS,8BAA8B,CAAC,YAAoB;IAC1D,OAAO,IAAI,SAAS,CAAC,mBAAmB,EAAE;QACxC,OAAO,EAAE,iEAAiE;QAC1E,IAAI,EAAE,EAAE,YAAY,EAAE;KACvB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,6BAA6B;IACpC,OAAO,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,KAAK,GAAG,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAe,EAAE,KAAK,CAAC;IAC/E,OAAO,CACL,KAAK,YAAY,aAAa;QAC9B,KAAK,CAAC,IAAI,KAAK,OAAO;QACtB,KAAK,CAAC,UAAU,KAAK,yBAAyB,CAC/C,CAAC;AACJ,CAAC;AAaD,MAAM,OAAO,wBAAwB;IAClB,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,GAAG,CAAa;IAChB,OAAO,CAAqB;IAC5B,IAAI,CAAO;IACX,cAAc,CAAiB;IAC/B,gBAAgB,CAA2B;IAC3C,iBAAiB,CAAS;IAE3C,YAAY,EACV,OAAO,EACP,MAAM,EACN,GAAG,EACH,OAAO,EACP,IAAI,EACJ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,GACY;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EACZ,MAAM,EACN,SAAS,EACT,KAAK,EACL,UAAU,EACV,IAAI,GAOL;QACC,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACnC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;aACpE,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,kFAAkF;QAClF,kFAAkF;QAClF,8EAA8E;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;gBAC/B,OAAO,EAAE,yCAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,2BAA2B,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,MAAM;YACN,OAAO,EAAE,oBAAoB,CAAC,UAAU,CAAC;YACzC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK;YAClD,IAAI;SACL,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACvC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACvB,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;aACxC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,kFAAkF;QAClF,mFAAmF;QACnF,iFAAiF;QACjF,sFAAsF;QACtF,uEAAuE;QACvE,IAAI,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YAC3C,OAAO;gBACL,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;gBAC7D,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE;aACxE,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACrC,MAAM,CAAC,EAAE,SAAS,EAAE,wBAAwB,CAAC,SAAS,EAAE,CAAC;aACzD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3C,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAC5C,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC/F,IAAI,SAAS,GAAG,kBAAkB,EAAE,CAAC;YACnC,MAAM,8BAA8B,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,wBAAwB,CAAC;aAChC,MAAM,CAAC;YACN,MAAM;YACN,SAAS;YACT,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;YACxB,iBAAiB,EAAE,GAAG;YACtB,SAAS;SACV,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,wBAAwB,CAAC,MAAM;YACvC,GAAG,EAAE;gBACH,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACxB,iBAAiB,EAAE,GAAG;gBACtB,SAAS;gBACT,cAAc,EAAE,CAAC;gBACjB,SAAS,EAAE,GAAG;aACf;SACF,CAAC,CAAC;QACL,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,OAAO;YACL,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE;SACxE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EACZ,MAAM,EACN,SAAS,EACT,KAAK,EACL,IAAI,GAML;QACC,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,EAAE,EAAE,wBAAwB,CAAC,EAAE;YAC/B,SAAS,EAAE,wBAAwB,CAAC,SAAS;YAC7C,KAAK,EAAE,wBAAwB,CAAC,KAAK;YACrC,QAAQ,EAAE,wBAAwB,CAAC,QAAQ;YAC3C,iBAAiB,EAAE,wBAAwB,CAAC,iBAAiB;YAC7D,cAAc,EAAE,wBAAwB,CAAC,cAAc;SACxD,CAAC;aACD,IAAI,CAAC,wBAAwB,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3C,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAC5C,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IACE,CAAC,GAAG;YACJ,GAAG,CAAC,SAAS,KAAK,SAAS;YAC3B,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,aAAa,EAC/D,CAAC;YACD,MAAM,6BAA6B,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1C,kFAAkF;YAClF,iFAAiF;YACjF,8EAA8E;YAC9E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;iBACpC,MAAM,CAAC,wBAAwB,CAAC;iBAChC,GAAG,CAAC,EAAE,cAAc,EAAE,GAAG,CAAA,GAAG,wBAAwB,CAAC,cAAc,MAAM,EAAE,CAAC;iBAC5E,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;iBAC9C,SAAS,CAAC,EAAE,cAAc,EAAE,wBAAwB,CAAC,cAAc,EAAE,CAAC,CAAC;YAC1E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,cAAc,IAAI,mBAAmB,EAAE,CAAC;gBAC3E,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;qBAClB,MAAM,CAAC,wBAAwB,CAAC;qBAChC,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,6BAA6B,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,qBAAqB,GAAG,KAAK,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC7C,0EAA0E;gBAC1E,8EAA8E;gBAC9E,0EAA0E;gBAC1E,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;qBACxB,MAAM,CAAC,wBAAwB,CAAC;qBAChC,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;qBAC9C,SAAS,CAAC,EAAE,EAAE,EAAE,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,6BAA6B,EAAE,CAAC;gBACxC,CAAC;gBACD,kFAAkF;gBAClF,wCAAwC;gBACxC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;qBACtB,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;qBAC7C,IAAI,CAAC,IAAI,CAAC;qBACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;qBAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;gBACZ,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;qBACvB,MAAM,CAAC,IAAI,CAAC;qBACZ,GAAG,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACjF,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;qBAC1B,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACrE,CAAC;gBACD,qBAAqB,GAAG,MAAM,EAAE,aAAa,IAAI,KAAK,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC1C,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,qBAAqB;YACrB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/pam/identity/service/play-eligibility.service.d.ts

@@ -0,0 +1,8 @@
+import { DrizzleService } from '@openora/core/server';
+import type { PlayEligibilityPort, User } from '@openora/core/contracts';
+export declare class PlayEligibilityService implements PlayEligibilityPort {
+    private readonly drizzle;
+    constructor(drizzle: DrizzleService);
+    isRestricted(userId: User['id']): Promise<boolean>;
+}
+//# sourceMappingURL=play-eligibility.service.d.ts.map

package/dist/pam/identity/service/play-eligibility.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"play-eligibility.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/play-eligibility.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAIzE,qBAAa,sBAAuB,YAAW,mBAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAE9C,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAWzD"}

package/dist/pam/identity/service/play-eligibility.service.js

@@ -0,0 +1,21 @@
+import { eq } from 'drizzle-orm';
+import { user } from '../schema/index.js';
+import { isRgBlocked } from './rg-guard.service.js';
+export class PlayEligibilityService {
+    drizzle;
+    constructor(drizzle) {
+        this.drizzle = drizzle;
+    }
+    async isRestricted(userId) {
+        const [row] = await this.drizzle.db
+            .select({ rgBlocked: user.rgBlocked, rgBlockedUntil: user.rgBlockedUntil })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (!row) {
+            return true;
+        }
+        return isRgBlocked(row);
+    }
+}
+//# sourceMappingURL=play-eligibility.service.js.map

package/dist/pam/identity/service/play-eligibility.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"play-eligibility.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/play-eligibility.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAExD,KAAK,CAAC,YAAY,CAAC,MAAkB;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;aAC1E,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/pam/identity/service/rg-guard.service.d.ts

@@ -0,0 +1,37 @@
+import type { DrizzleService, EventBus } from '@openora/core/server';
+import type { ClientMeta, User } from '@openora/core/contracts';
+export declare function isRgBlocked(u: {
+    rgBlocked: boolean;
+    rgBlockedUntil: Date | null;
+}): boolean;
+type BlockedAccount = {
+    id: User['id'];
+    rgBlocked: boolean;
+    rgBlockedUntil: Date | null;
+};
+type AccountBlockGateOptions = {
+    /**
+     * Expire every session on the account before throwing. Needed wherever the caller has
+     * already let better-auth mint one (password login, email-code verification); the phone
+     * path checks the gate before minting, so it has nothing to revoke and passes false.
+     */
+    revokeSessions: boolean;
+    /** `ORPCError.data` for each block, so each surface keeps its own error vocabulary. */
+    errorData: {
+        rgBlocked: Record<string, string>;
+        suspended: Record<string, string>;
+    };
+};
+/**
+ * The RG and backoffice (suspended/closed) gates for an account that has just proven a
+ * credential - never before, so a probe can't tell a restricted account apart from a
+ * wrong secret. Shared by every surface that hands out a session, so the three of them
+ * cannot drift: a gate that only some login paths enforce is not a gate.
+ * Returns the resolved playerId so callers can attach it to their own success event.
+ */
+export declare function assertAccountNotBlocked({ drizzle, events }: {
+    drizzle: DrizzleService;
+    events: EventBus;
+}, account: BlockedAccount, { ip, userAgent }: ClientMeta, { revokeSessions, errorData }: AccountBlockGateOptions): Promise<string | null>;
+export {};
+//# sourceMappingURL=rg-guard.service.d.ts.map

package/dist/pam/identity/service/rg-guard.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rg-guard.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/rg-guard.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAIhE,wBAAgB,WAAW,CAAC,CAAC,EAAE;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAE3F;AAED,KAAK,cAAc,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,CAAC;AAE1F,KAAK,uBAAuB,GAAG;IAC7B;;;;OAIG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,uFAAuF;IACvF,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACrF,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,EAClE,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,UAAU,EAC7B,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,uBAAuB,GACrD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgDxB"}

package/dist/pam/identity/service/rg-guard.service.js

@@ -0,0 +1,60 @@
+import { ORPCError } from '@orpc/server';
+import { eq } from 'drizzle-orm';
+import { player } from '@openora/core/pam/schema/profile';
+import { session } from '../schema/index.js';
+export function isRgBlocked(u) {
+    return u.rgBlocked && (u.rgBlockedUntil === null || u.rgBlockedUntil > new Date());
+}
+/**
+ * The RG and backoffice (suspended/closed) gates for an account that has just proven a
+ * credential - never before, so a probe can't tell a restricted account apart from a
+ * wrong secret. Shared by every surface that hands out a session, so the three of them
+ * cannot drift: a gate that only some login paths enforce is not a gate.
+ * Returns the resolved playerId so callers can attach it to their own success event.
+ */
+export async function assertAccountNotBlocked({ drizzle, events }, account, { ip, userAgent }, { revokeSessions, errorData }) {
+    const [playerRow] = await drizzle.db
+        .select({ id: player.id, status: player.status })
+        .from(player)
+        .where(eq(player.userId, account.id))
+        .limit(1);
+    const revoke = async () => {
+        if (revokeSessions) {
+            await drizzle.db
+                .update(session)
+                .set({ expiresAt: new Date() })
+                .where(eq(session.userId, account.id));
+        }
+    };
+    if (isRgBlocked(account)) {
+        await revoke();
+        events.emit('rg.exclusion.login_blocked', {
+            userId: account.id,
+            playerId: playerRow?.id ?? null,
+            ip,
+            userAgent,
+        });
+        throw new ORPCError('FORBIDDEN', {
+            message: 'Account access is currently restricted (responsible gambling).',
+            data: errorData.rgBlocked,
+        });
+    }
+    // Distinct mechanism from RG (self_excluded is out of scope here) - a suspended or
+    // closed player can never log back in.
+    if (playerRow && (playerRow.status === 'suspended' || playerRow.status === 'closed')) {
+        await revoke();
+        events.emit('player.login_blocked', {
+            userId: account.id,
+            playerId: playerRow.id,
+            status: playerRow.status,
+            ip,
+            userAgent,
+        });
+        throw new ORPCError('FORBIDDEN', {
+            message: 'This account has been suspended and can no longer be used.',
+            data: errorData.suspended,
+        });
+    }
+    return playerRow?.id ?? null;
+}
+//# sourceMappingURL=rg-guard.service.js.map

package/dist/pam/identity/service/rg-guard.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rg-guard.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/rg-guard.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,UAAU,WAAW,CAAC,CAAsD;IAChF,OAAO,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;AACrF,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAE,OAAO,EAAE,MAAM,EAAiD,EAClE,OAAuB,EACvB,EAAE,EAAE,EAAE,SAAS,EAAc,EAC7B,EAAE,cAAc,EAAE,SAAS,EAA2B;IAEtD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;SACjC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;SAChD,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;SACpC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,OAAO,CAAC,EAAE;iBACb,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC9B,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;YACxC,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,IAAI;YAC/B,EAAE;YACF,SAAS;SACV,CAAC,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;YAC/B,OAAO,EAAE,gEAAgE;YACzE,IAAI,EAAE,SAAS,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,uCAAuC;IACvC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,WAAW,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;QACrF,MAAM,MAAM,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAClC,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,QAAQ,EAAE,SAAS,CAAC,EAAE;YACtB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,EAAE;YACF,SAAS;SACV,CAAC,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;YAC/B,OAAO,EAAE,4DAA4D;YACrE,IAAI,EAAE,SAAS,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,EAAE,EAAE,IAAI,IAAI,CAAC;AAC/B,CAAC"}

package/dist/pam/identity/service/security-controls.service.d.ts

@@ -0,0 +1,4 @@
+import type { DrizzleService } from '@openora/core/server';
+import { type SecurityControls, type User } from '@openora/core/contracts';
+export declare function getSecurityControls(drizzle: DrizzleService, userId: User['id'], trustedDeviceDays: number): Promise<SecurityControls | null>;
+//# sourceMappingURL=security-controls.service.d.ts.map

package/dist/pam/identity/service/security-controls.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-controls.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/security-controls.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAmB,KAAK,gBAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAO5F,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8BlC"}

package/dist/pam/identity/service/security-controls.service.js

@@ -0,0 +1,38 @@
+import { E164PhoneSchema } from '@openora/core/contracts';
+import { eq } from 'drizzle-orm';
+import { user } from '../schema/index.js';
+// `trustedDeviceDays` is platform config, not a row on `user` - every caller passes in
+// its own copy (each already has one, for the same reason `TrustedDeviceService` does)
+// rather than this function reaching for config on its own.
+export async function getSecurityControls(drizzle, userId, trustedDeviceDays) {
+    const [row] = await drizzle.db
+        .select({
+        passwordMeetsPolicy: user.passwordMeetsPolicy,
+        emailVerified: user.emailVerified,
+        phoneNumber: user.phoneNumber,
+        phoneVerified: user.phoneVerified,
+        twoFactorEnabled: user.twoFactorEnabled,
+        loginWithdrawalAlertsEnabled: user.loginWithdrawalAlertsEnabled,
+        autoLogoutDuration: user.autoLogoutDuration,
+        requireTwoFactorOnLogin: user.requireTwoFactorOnLogin,
+        withdrawalPinHash: user.withdrawalPinHash,
+        antiPhishingCode: user.antiPhishingCode,
+    })
+        .from(user)
+        .where(eq(user.id, userId))
+        .limit(1);
+    if (!row) {
+        return null;
+    }
+    const phone = E164PhoneSchema.safeParse(row.phoneNumber);
+    const { withdrawalPinHash, ...rest } = row;
+    return {
+        ...rest,
+        phoneNumber: phone.success ? phone.data : null,
+        phoneVerified: phone.success && row.phoneVerified,
+        twoFactorEnabled: row.twoFactorEnabled ?? false,
+        withdrawalPinSet: withdrawalPinHash !== null,
+        trustedDeviceDays,
+    };
+}
+//# sourceMappingURL=security-controls.service.js.map

package/dist/pam/identity/service/security-controls.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-controls.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/security-controls.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAoC,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,uFAAuF;AACvF,uFAAuF;AACvF,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAuB,EACvB,MAAkB,EAClB,iBAAyB;IAEzB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;SAC3B,MAAM,CAAC;QACN,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,4BAA4B,EAAE,IAAI,CAAC,4BAA4B;QAC/D,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAC3C,OAAO;QACL,GAAG,IAAI;QACP,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC9C,aAAa,EAAE,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa;QACjD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,KAAK;QAC/C,gBAAgB,EAAE,iBAAiB,KAAK,IAAI;QAC5C,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/pam/identity/service/session-idle.service.d.ts

@@ -0,0 +1,22 @@
+import { type EventBus, DrizzleService } from '@openora/core/server';
+import { type IdentityReader, type SessionIdlePolicy, type User } from '@openora/core/contracts';
+import { type Session } from '../schema/index.js';
+export type SessionIdleServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    identityReader: IdentityReader;
+};
+/**
+ * Enforces the player's "Auto-logout when inactive" choice. Runs on every authenticated
+ * request, so it does the cheapest thing that works: one joined read, and a write only
+ * when the throttle has lapsed or the session has to go.
+ */
+export declare class SessionIdleService implements SessionIdlePolicy {
+    private readonly drizzle;
+    private readonly events;
+    private readonly identityReader;
+    constructor({ drizzle, events, identityReader }: SessionIdleServiceDeps);
+    touch(userId: User['id'], sessionId: Session['id']): Promise<'active' | 'expired'>;
+    private expire;
+}
+//# sourceMappingURL=session-idle.service.d.ts.map

package/dist/pam/identity/service/session-idle.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-idle.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/session-idle.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AAEnF,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,IAAI,EACV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AASjE,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;CAChC,CAAC;AAEF;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;gBAEpC,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,sBAAsB;IAMjE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;YA4D1E,MAAM;CAyBrB"}

package/dist/pam/identity/service/session-idle.service.js

@@ -0,0 +1,101 @@
+import { createLogger } from '@openora/core/server';
+import { and, eq, gt, sql } from 'drizzle-orm';
+import { AUTO_LOGOUT_MINUTES, } from '@openora/core/contracts';
+import { session, user } from '../schema/index.js';
+const logger = createLogger('session-idle');
+// Tighter than the admin guard's 5 minutes: `lastSeenAt` is the input to the idle
+// comparison here, not just a display value, and a 5-minute lag would stretch the
+// shortest window (15 minutes) by a third before it bites.
+const LAST_SEEN_THROTTLE_MS = 60 * 1000;
+/**
+ * Enforces the player's "Auto-logout when inactive" choice. Runs on every authenticated
+ * request, so it does the cheapest thing that works: one joined read, and a write only
+ * when the throttle has lapsed or the session has to go.
+ */
+export class SessionIdleService {
+    drizzle;
+    events;
+    identityReader;
+    constructor({ drizzle, events, identityReader }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.identityReader = identityReader;
+    }
+    async touch(userId, sessionId) {
+        const [row] = await this.drizzle.db
+            .select({
+            lastSeenAt: session.lastSeenAt,
+            autoLogoutDuration: user.autoLogoutDuration,
+            role: user.role,
+        })
+            .from(session)
+            .innerJoin(user, eq(user.id, session.userId))
+            .where(and(eq(session.id, sessionId), eq(session.userId, userId)))
+            .limit(1);
+        // No row: the session was revoked (or never existed) between better-auth resolving it
+        // and this query running. Reporting 'active' here would publish a session onto the
+        // context that this very read could not find - fail closed instead, the same as an
+        // over-idle window.
+        if (!row) {
+            return 'expired';
+        }
+        // The setting is player-only - `assertPlayerPreferenceCaller` never lets an admin set
+        // it, so every admin row is stuck at the column default. Admin sessions already have
+        // their own idle tracking through `AdminGuard`/`AdminSecurityService.touchLastSeen`;
+        // enforcing a second, un-configurable mechanism here would idle out backoffice staff
+        // on a window they have no way to see or change.
+        if (row.role !== 'player') {
+            return 'active';
+        }
+        const windowMinutes = AUTO_LOGOUT_MINUTES[row.autoLogoutDuration];
+        if (windowMinutes === undefined) {
+            // Only reachable if the enum and this map ever disagree (a bad migration or a
+            // partial deploy). Failing open on a security control has no visible symptom, so
+            // this must not silently return 'active' the way a missing map entry otherwise would.
+            logger.error({ userId, sessionId, duration: row.autoLogoutDuration }, 'unknown auto-logout duration');
+            await this.expire(userId, sessionId);
+            return 'expired';
+        }
+        const windowMs = windowMinutes * 60_000;
+        const idleForMs = row.lastSeenAt ? Date.now() - row.lastSeenAt.getTime() : null;
+        // `idleForMs === null` means the session predates this column and has no activity on
+        // record yet. It falls through to the stamp below on purpose: reading that null as
+        // "idle since the beginning of time" would cut every standing session on deploy.
+        if (idleForMs !== null && idleForMs > windowMs) {
+            await this.expire(userId, sessionId);
+            return 'expired';
+        }
+        if (idleForMs === null || idleForMs >= LAST_SEEN_THROTTLE_MS) {
+            await this.drizzle.db
+                .update(session)
+                .set({ lastSeenAt: sql `now()` })
+                .where(eq(session.id, sessionId));
+        }
+        return 'active';
+    }
+    async expire(userId, sessionId) {
+        // Conditional on `expiresAt > now()` plus a `.returning()` check, exactly like
+        // `revokeSession` (session.service.ts) - without it, concurrent requests past the
+        // same stale `lastSeenAt` each pass the idle test, each write, and each emit
+        // `identity.session.revoked` into the append-only audit chain for one logout.
+        const updated = await this.drizzle.db
+            .update(session)
+            // Same shape as an explicit revoke: expire in place and leave `updatedAt` alone, so
+            // the device list still shows when the session was last actually used.
+            .set({ expiresAt: sql `now()`, updatedAt: session.updatedAt })
+            .where(and(eq(session.id, sessionId), gt(session.expiresAt, sql `now()`)))
+            .returning({ id: session.id });
+        if (updated.length === 0) {
+            return;
+        }
+        // No `actorId`: nobody revoked this, the player's own inactivity window did.
+        this.events.emit('identity.session.revoked', {
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            sessionId,
+            ip: null,
+            userAgent: null,
+        });
+    }
+}
+//# sourceMappingURL=session-idle.service.js.map

package/dist/pam/identity/service/session-idle.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-idle.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/session-idle.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,mBAAmB,GAIpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAgB,MAAM,oBAAoB,CAAC;AAEjE,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAE5C,kFAAkF;AAClF,kFAAkF;AAClF,2DAA2D;AAC3D,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAQxC;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,cAAc,CAAiB;IAEhD,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAA0B;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAkB,EAAE,SAAwB;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;aACD,IAAI,CAAC,OAAO,CAAC;aACb,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;aAC5C,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACjE,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,sFAAsF;QACtF,mFAAmF;QACnF,mFAAmF;QACnF,oBAAoB;QACpB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,sFAAsF;QACtF,qFAAqF;QACrF,qFAAqF;QACrF,qFAAqF;QACrF,iDAAiD;QACjD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAClE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,8EAA8E;YAC9E,iFAAiF;YACjF,sFAAsF;YACtF,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,kBAAkB,EAAE,EACvD,8BAA8B,CAC/B,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;QACxC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEhF,qFAAqF;QACrF,mFAAmF;QACnF,iFAAiF;QACjF,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,IAAI,qBAAqB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;iBAClB,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;iBAC/B,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAkB,EAAE,SAAwB;QAC/D,+EAA+E;QAC/E,kFAAkF;QAClF,6EAA6E;QAC7E,8EAA8E;QAC9E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClC,MAAM,CAAC,OAAO,CAAC;YAChB,oFAAoF;YACpF,uEAAuE;aACtE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC;aACxE,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,SAAS;YACT,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;CACF"}