@openora/core 0.4.1-canary.18 → 0.4.1-canary.181

package/dist/pam/identity/service/two-factor-delivery.service.d.ts

@@ -0,0 +1,67 @@
+import { DrizzleService } from '@openora/core/server';
+import type { MailDispatchPort, SmsAdapter, TwoFactorDeliveryMethod, User } from '@openora/core/contracts';
+/**
+ * Masks a registered address down to what is safe to show an unauthenticated (or
+ * merely half-authenticated) caller: enough to recognise which of your own addresses
+ * a code went to, not enough to learn the address from the screen.
+ */
+export declare function maskEmail(email: string): string;
+export declare function maskPhone(phone: string): string;
+export type TwoFactorDeliveryDeps = {
+    drizzle: DrizzleService;
+    mailDispatch?: MailDispatchPort;
+    sms: SmsAdapter;
+};
+type TwoFactorDestination = {
+    method: TwoFactorDeliveryMethod;
+    masked: string;
+};
+/**
+ * Delivers a one-time second-factor code over whichever transport the account's
+ * enrolled method names. better-auth generates and verifies the code itself; this
+ * only decides where it goes, which is the one thing the plugin cannot know - it
+ * sees a single enrolment and no notion of `app` vs `email` vs `sms`.
+ */
+export declare class TwoFactorDeliveryService {
+    private readonly drizzle;
+    private readonly mailDispatch?;
+    private readonly sms;
+    private readonly lastFailure;
+    constructor({ drizzle, mailDispatch, sms }: TwoFactorDeliveryDeps);
+    /**
+     * The transport error from this account's most recent `deliver`, cleared as it is
+     * read. better-auth's send-otp endpoint wraps the hook in `.catch(logger.error)` and
+     * answers 200 regardless, so without this the API would promise a code that is
+     * never coming. The hook runs inline (no `backgroundTasks.handler` is configured),
+     * so a failure is already recorded by the time the endpoint returns.
+     *
+     * What this actually catches differs by transport: `sms` calls the vendor
+     * synchronously, so a real rejection lands here. `email` only enqueues a mail job
+     * (`MailDispatchPort.toUser`) - this catches the queue being unreachable, not a
+     * later SMTP-level bounce, the same fire-and-forget contract every other email in
+     * this codebase runs under (registration, password reset). A player recovers from
+     * either case the same way: `sendTwoFactorOtp` re-reads the persisted method and
+     * tries again.
+     */
+    takeFailure(userId: User['id']): unknown;
+    /**
+     * Where a code for this account would go, masked. Returns undefined for an account
+     * on the `app` method (nothing is delivered) or one that is not enrolled at all.
+     */
+    describeDestination(userId: User['id']): Promise<TwoFactorDestination | undefined>;
+    /**
+     * Fans a generated code out to the account's chosen transport. Bound as better-auth's
+     * `sendOTP` hook, so it runs for every OTP the plugin issues - enrolment, resend and
+     * the send leg of a login challenge alike.
+     */
+    deliver(args: {
+        userId: User['id'];
+        email: string;
+        phoneNumber: string | null;
+        code: string;
+    }): Promise<void>;
+    private dispatch;
+    private findAccount;
+}
+export {};
+//# sourceMappingURL=two-factor-delivery.service.d.ts.map

package/dist/pam/identity/service/two-factor-delivery.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-delivery.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/two-factor-delivery.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EACV,gBAAgB,EAChB,UAAU,EACV,uBAAuB,EACvB,IAAI,EACL,MAAM,yBAAyB,CAAC;AAGjC;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/C;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,MAAM,EAAE,uBAAuB,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;gBAElD,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,qBAAqB;IAMjE;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO;IAMxC;;;OAGG;IACG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAexF;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,IAAI,CAAC;YAaH,QAAQ;YAgCR,WAAW;CAa1B"}

package/dist/pam/identity/service/two-factor-delivery.service.js

@@ -0,0 +1,135 @@
+import { randomUUID } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { user } from '../schema/index.js';
+/**
+ * Masks a registered address down to what is safe to show an unauthenticated (or
+ * merely half-authenticated) caller: enough to recognise which of your own addresses
+ * a code went to, not enough to learn the address from the screen.
+ */
+export function maskEmail(email) {
+    const [local = '', domain = ''] = email.split('@');
+    // A one-character local part has nothing to keep and nothing to hide; showing it
+    // whole would leak the entire address, so it masks to a bare marker.
+    const head = local.length > 1 ? local.slice(0, 1) : '';
+    return `${head}***@${domain}`;
+}
+export function maskPhone(phone) {
+    const tail = phone.slice(-2);
+    return `+** *** *** ${tail}`;
+}
+/**
+ * Delivers a one-time second-factor code over whichever transport the account's
+ * enrolled method names. better-auth generates and verifies the code itself; this
+ * only decides where it goes, which is the one thing the plugin cannot know - it
+ * sees a single enrolment and no notion of `app` vs `email` vs `sms`.
+ */
+export class TwoFactorDeliveryService {
+    drizzle;
+    mailDispatch;
+    sms;
+    lastFailure = new Map();
+    constructor({ drizzle, mailDispatch, sms }) {
+        this.drizzle = drizzle;
+        this.mailDispatch = mailDispatch;
+        this.sms = sms;
+    }
+    /**
+     * The transport error from this account's most recent `deliver`, cleared as it is
+     * read. better-auth's send-otp endpoint wraps the hook in `.catch(logger.error)` and
+     * answers 200 regardless, so without this the API would promise a code that is
+     * never coming. The hook runs inline (no `backgroundTasks.handler` is configured),
+     * so a failure is already recorded by the time the endpoint returns.
+     *
+     * What this actually catches differs by transport: `sms` calls the vendor
+     * synchronously, so a real rejection lands here. `email` only enqueues a mail job
+     * (`MailDispatchPort.toUser`) - this catches the queue being unreachable, not a
+     * later SMTP-level bounce, the same fire-and-forget contract every other email in
+     * this codebase runs under (registration, password reset). A player recovers from
+     * either case the same way: `sendTwoFactorOtp` re-reads the persisted method and
+     * tries again.
+     */
+    takeFailure(userId) {
+        const failure = this.lastFailure.get(userId);
+        this.lastFailure.delete(userId);
+        return failure;
+    }
+    /**
+     * Where a code for this account would go, masked. Returns undefined for an account
+     * on the `app` method (nothing is delivered) or one that is not enrolled at all.
+     */
+    async describeDestination(userId) {
+        const row = await this.findAccount(userId);
+        if (!row?.twoFactorMethod || row.twoFactorMethod === 'app') {
+            return undefined;
+        }
+        if (row.twoFactorMethod === 'email') {
+            return { method: 'email', masked: maskEmail(row.email) };
+        }
+        return row.phoneVerified && row.phoneNumber
+            ? { method: 'sms', masked: maskPhone(row.phoneNumber) }
+            : // An `sms` enrolment whose phone has since been cleared or unverified has
+                // nowhere to send to - and must report that the same way `deliver` decides it.
+                undefined;
+    }
+    /**
+     * Fans a generated code out to the account's chosen transport. Bound as better-auth's
+     * `sendOTP` hook, so it runs for every OTP the plugin issues - enrolment, resend and
+     * the send leg of a login challenge alike.
+     */
+    async deliver(args) {
+        this.lastFailure.delete(args.userId);
+        try {
+            await this.dispatch(args);
+        }
+        catch (error) {
+            // Recorded rather than only thrown: better-auth swallows whatever this hook
+            // throws and still answers 200, so the caller learns of a dead transport only
+            // by reading it back through `takeFailure`.
+            this.lastFailure.set(args.userId, error);
+            throw error;
+        }
+    }
+    async dispatch(args) {
+        const row = await this.findAccount(args.userId);
+        const method = row?.twoFactorMethod;
+        // `app` reads the code off the shared secret and an unenrolled account has no
+        // method yet, so neither has anywhere to deliver to. Staying silent is correct:
+        // better-auth calls this hook unconditionally.
+        if (method !== 'email' && method !== 'sms') {
+            return;
+        }
+        if (method === 'sms') {
+            // Only a verified number. Enrolment checks this too, but a second factor must
+            // never be routed to a number the account has not proven it holds, however the
+            // column came to have it.
+            const phone = row.phoneVerified ? row.phoneNumber : null;
+            if (!phone) {
+                return;
+            }
+            await this.sms.sendOtp({ to: phone, code: args.code });
+            return;
+        }
+        // Routed through the dispatch port rather than a raw sender so the code inherits
+        // the platform's per-user locale, rendering and delivery log like every other mail.
+        // The key is fresh per send: a resent code is a new mail, not a retry of the old one.
+        await this.mailDispatch?.toUser({
+            userId: args.userId,
+            template: { key: 'twoFactorOtp', data: { otp: args.code } },
+            idempotencyKey: `otp:twoFactorOtp:${randomUUID()}`,
+        });
+    }
+    async findAccount(userId) {
+        const [row] = await this.drizzle.db
+            .select({
+            email: user.email,
+            phoneNumber: user.phoneNumber,
+            phoneVerified: user.phoneVerified,
+            twoFactorMethod: user.twoFactorMethod,
+        })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        return row;
+    }
+}
+//# sourceMappingURL=two-factor-delivery.service.js.map

package/dist/pam/identity/service/two-factor-delivery.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-delivery.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/two-factor-delivery.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAOjC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,iFAAiF;IACjF,qEAAqE;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,OAAO,GAAG,IAAI,OAAO,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,eAAe,IAAI,EAAE,CAAC;AAC/B,CAAC;AAaD;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IAClB,OAAO,CAAiB;IACxB,YAAY,CAAoB;IAChC,GAAG,CAAa;IAChB,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9D,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAyB;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,MAAkB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAAkB;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,WAAW;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;YACvD,CAAC,CAAC,0EAA0E;gBAC1E,+EAA+E;gBAC/E,SAAS,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,IAKb;QACC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4EAA4E;YAC5E,8EAA8E;YAC9E,4CAA4C;YAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAA0C;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,GAAG,EAAE,eAAe,CAAC;QACpC,8EAA8E;QAC9E,gFAAgF;QAChF,+CAA+C;QAC/C,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,8EAA8E;YAC9E,+EAA+E;YAC/E,0BAA0B;YAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACzD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,oFAAoF;QACpF,sFAAsF;QACtF,MAAM,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE;YAC3D,cAAc,EAAE,oBAAoB,UAAU,EAAE,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAkB;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/pam/identity/service/two-factor-lockout.service.d.ts

@@ -0,0 +1,25 @@
+import { type EventBus, DrizzleService } from '@openora/core/server';
+import type { AdminSecurityConfig, ClientMeta, IdentityReader, User } from '@openora/core/contracts';
+export type TwoFactorLockoutServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    identityReader: IdentityReader;
+    config: AdminSecurityConfig['twoFactorLockout'];
+};
+/**
+ * Consecutive-failure lockout for the second factor, counted per account and kept in
+ * columns of its own: a second-factor lockout must not consume the password-login
+ * budget, and the two thresholds are configured independently.
+ */
+export declare class TwoFactorLockoutService {
+    private readonly drizzle;
+    private readonly events;
+    private readonly identityReader;
+    private readonly config;
+    constructor({ drizzle, events, identityReader, config }: TwoFactorLockoutServiceDeps);
+    resolvePendingUserId(cookieValue: string | undefined): Promise<User['id'] | undefined>;
+    assertNotLocked(userId: User['id']): Promise<void>;
+    recordFailure(userId: User['id'], meta: ClientMeta): Promise<void>;
+    reset(userId: User['id']): Promise<void>;
+}
+//# sourceMappingURL=two-factor-lockout.service.d.ts.map

package/dist/pam/identity/service/two-factor-lockout.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-lockout.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/two-factor-lockout.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,KAAK,EACV,mBAAmB,EACnB,UAAU,EACV,cAAc,EACd,IAAI,EACL,MAAM,yBAAyB,CAAC;AAuBjC,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;CACjD,CAAC;AAEF;;;;GAIG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAErD,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,2BAA2B;IAO9E,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAatF,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAYlD,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DlE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}

package/dist/pam/identity/service/two-factor-lockout.service.js

@@ -0,0 +1,121 @@
+import { eq, sql } from 'drizzle-orm';
+import { user, verification } from '../schema/index.js';
+import { computeLockoutTier, createAccountLockedError, isActiveLockout, } from './lockout-policy.service.js';
+// better-auth withholds the session until the second factor clears, so a failing
+// attempt has no session to identify. It does store the pending user id in a
+// verification row keyed by the identifier it puts in the signed two-factor cookie
+// (`2fa-<random>`), which is what lets the lockout follow the account rather than
+// only the browser. Cookie value is `<identifier>.<signature>`.
+const PENDING_2FA_IDENTIFIER_PREFIX = '2fa-';
+function pendingIdentifier(cookieValue) {
+    if (!cookieValue) {
+        return undefined;
+    }
+    const [identifier = ''] = cookieValue.split('.');
+    return identifier.startsWith(PENDING_2FA_IDENTIFIER_PREFIX) ? identifier : undefined;
+}
+/**
+ * Consecutive-failure lockout for the second factor, counted per account and kept in
+ * columns of its own: a second-factor lockout must not consume the password-login
+ * budget, and the two thresholds are configured independently.
+ */
+export class TwoFactorLockoutService {
+    drizzle;
+    events;
+    identityReader;
+    config;
+    constructor({ drizzle, events, identityReader, config }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.identityReader = identityReader;
+        this.config = config;
+    }
+    async resolvePendingUserId(cookieValue) {
+        const identifier = pendingIdentifier(cookieValue);
+        if (!identifier) {
+            return undefined;
+        }
+        const [row] = await this.drizzle.db
+            .select({ value: verification.value })
+            .from(verification)
+            .where(eq(verification.identifier, identifier))
+            .limit(1);
+        return row?.value;
+    }
+    async assertNotLocked(userId) {
+        const [row] = await this.drizzle.db
+            .select({ lockoutUntil: user.twoFactorLockoutUntil })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (isActiveLockout(row?.lockoutUntil)) {
+            throw createAccountLockedError(row?.lockoutUntil ?? new Date());
+        }
+    }
+    async recordFailure(userId, meta) {
+        const [row] = await this.drizzle.db
+            .select({
+            failedAttempts: user.failedTwoFactorAttempts,
+            lockoutCount: user.twoFactorLockoutCount,
+            lastFailedAt: user.lastFailedTwoFactorAt,
+        })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (!row) {
+            return;
+        }
+        const attempts = row.failedAttempts + 1;
+        const isLocking = attempts >= this.config.maxAttempts;
+        const { durationMs } = computeLockoutTier({
+            lockoutCount: row.lockoutCount,
+            lastFailedLoginAt: row.lastFailedAt,
+            nowMs: Date.now(),
+            fallbackDurationMs: this.config.durationMs,
+        });
+        const lockoutUntil = isLocking ? new Date(Date.now() + durationMs) : null;
+        await this.drizzle.db
+            .update(user)
+            .set({
+            failedTwoFactorAttempts: isLocking ? 0 : attempts,
+            lastFailedTwoFactorAt: sql `now()`,
+            ...(isLocking
+                ? {
+                    twoFactorLockoutUntil: lockoutUntil,
+                    twoFactorLockoutCount: row.lockoutCount + 1,
+                }
+                : {}),
+        })
+            .where(eq(user.id, userId));
+        const playerId = await this.identityReader.getPlayerIdByUserIdSafe(userId);
+        this.events.emit('identity.2fa.failed', {
+            userId,
+            playerId,
+            method: 'totp',
+            attemptsRemaining: isLocking ? 0 : Math.max(this.config.maxAttempts - attempts, 0),
+            ip: meta.ip ?? null,
+            userAgent: meta.userAgent ?? null,
+        });
+        if (lockoutUntil) {
+            this.events.emit('identity.2fa.lockout.triggered', {
+                userId,
+                playerId,
+                lockoutUntil: lockoutUntil.toISOString(),
+                ip: meta.ip ?? null,
+                userAgent: meta.userAgent ?? null,
+            });
+            throw createAccountLockedError(lockoutUntil);
+        }
+    }
+    async reset(userId) {
+        await this.drizzle.db
+            .update(user)
+            .set({
+            failedTwoFactorAttempts: 0,
+            twoFactorLockoutUntil: null,
+            lastFailedTwoFactorAt: null,
+        })
+            .where(eq(user.id, userId));
+    }
+}
+//# sourceMappingURL=two-factor-lockout.service.js.map

package/dist/pam/identity/service/two-factor-lockout.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-lockout.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/two-factor-lockout.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAOtC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,6BAA6B,CAAC;AAErC,iFAAiF;AACjF,6EAA6E;AAC7E,mFAAmF;AACnF,kFAAkF;AAClF,gEAAgE;AAChE,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAE7C,SAAS,iBAAiB,CAAC,WAA+B;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AASD;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IACjB,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,cAAc,CAAiB;IAC/B,MAAM,CAA0C;IAEjE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAA+B;QAClF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAA+B;QACxD,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;aACrC,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAkB;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;aACpD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACvC,MAAM,wBAAwB,CAAC,GAAG,EAAE,YAAY,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,IAAgB;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAChC,MAAM,CAAC;YACN,cAAc,EAAE,IAAI,CAAC,uBAAuB;YAC5C,YAAY,EAAE,IAAI,CAAC,qBAAqB;YACxC,YAAY,EAAE,IAAI,CAAC,qBAAqB;SACzC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACtD,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC;YACxC,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,iBAAiB,EAAE,GAAG,CAAC,YAAY;YACnC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YACjB,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;SAC3C,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1E,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC;YACH,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;YACjD,qBAAqB,EAAE,GAAG,CAAA,OAAO;YACjC,GAAG,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,qBAAqB,EAAE,YAAY;oBACnC,qBAAqB,EAAE,GAAG,CAAC,YAAY,GAAG,CAAC;iBAC5C;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAE9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACtC,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,MAAM;YACd,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,QAAQ,EAAE,CAAC,CAAC;YAClF,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;SAClC,CAAC,CAAC;QAEH,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACjD,MAAM;gBACN,QAAQ;gBACR,YAAY,EAAE,YAAY,CAAC,WAAW,EAAE;gBACxC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;aAClC,CAAC,CAAC;YACH,MAAM,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAkB;QAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC;YACH,uBAAuB,EAAE,CAAC;YAC1B,qBAAqB,EAAE,IAAI;YAC3B,qBAAqB,EAAE,IAAI;SAC5B,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/pam/identity/service/user-commands.service.d.ts

@@ -0,0 +1,11 @@
+import type { DrizzleService } from '@openora/core/server';
+import type { User, UserCommands } from '@openora/core/contracts';
+/** Identity owns the `user` table, so sibling modules mutate it through this port. */
+export declare class DrizzleUserCommands implements UserCommands {
+    private readonly drizzle;
+    constructor(drizzle: DrizzleService);
+    setUsername(userId: User['id'], username: string): Promise<{
+        success: boolean;
+    }>;
+}
+//# sourceMappingURL=user-commands.service.d.ts.map

package/dist/pam/identity/service/user-commands.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-commands.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/user-commands.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAYlE,sFAAsF;AACtF,qBAAa,mBAAoB,YAAW,YAAY;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAE9C,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM;;;CAavD"}

package/dist/pam/identity/service/user-commands.service.js

@@ -0,0 +1,32 @@
+import { eq } from 'drizzle-orm';
+import { DatabaseError } from 'pg';
+import { ORPCError } from '@orpc/server';
+import { user } from '../schema/index.js';
+function isUsernameCollision(error) {
+    const cause = error instanceof DatabaseError ? error : error?.cause;
+    return (cause instanceof DatabaseError &&
+        cause.code === '23505' &&
+        cause.constraint === 'user_username_unique');
+}
+/** Identity owns the `user` table, so sibling modules mutate it through this port. */
+export class DrizzleUserCommands {
+    drizzle;
+    constructor(drizzle) {
+        this.drizzle = drizzle;
+    }
+    async setUsername(userId, username) {
+        try {
+            await this.drizzle.db.update(user).set({ username }).where(eq(user.id, userId));
+        }
+        catch (error) {
+            if (isUsernameCollision(error)) {
+                // Thrown as the transport error rather than a domain class: consumers live in
+                // sibling modules and cannot import identity's internals to map it.
+                throw new ORPCError('CONFLICT', { message: 'Username is already in use' });
+            }
+            throw error;
+        }
+        return { success: true };
+    }
+}
+//# sourceMappingURL=user-commands.service.js.map

package/dist/pam/identity/service/user-commands.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-commands.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/user-commands.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,KAAK,GAAG,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAe,EAAE,KAAK,CAAC;IAC/E,OAAO,CACL,KAAK,YAAY,aAAa;QAC9B,KAAK,CAAC,IAAI,KAAK,OAAO;QACtB,KAAK,CAAC,UAAU,KAAK,sBAAsB,CAC5C,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAExD,KAAK,CAAC,WAAW,CAAC,MAAkB,EAAE,QAAgB;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,8EAA8E;gBAC9E,oEAAoE;gBACpE,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/pam/identity/service/withdrawal-pin-hash.service.d.ts

@@ -0,0 +1,3 @@
+export declare const MIN_WITHDRAWAL_PIN_SECRET_LENGTH = 32;
+export declare function hashWithdrawalPin(pin: string, secret: string): string;
+//# sourceMappingURL=withdrawal-pin-hash.service.d.ts.map

package/dist/pam/identity/service/withdrawal-pin-hash.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withdrawal-pin-hash.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/withdrawal-pin-hash.service.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAErE"}

package/dist/pam/identity/service/withdrawal-pin-hash.service.js

@@ -0,0 +1,10 @@
+import { createHmac } from 'node:crypto';
+// A 4-digit PIN is long-lived and low-entropy (10,000 possibilities); the plain-sha256
+// pattern in pam/shared/otp.ts is only safe there because those OTPs expire in minutes.
+// HMAC-SHA256 with a dedicated, never-reused secret closes that gap without inventing a
+// new primitive family (same shape as server/auth/sign-session-cookie.ts).
+export const MIN_WITHDRAWAL_PIN_SECRET_LENGTH = 32;
+export function hashWithdrawalPin(pin, secret) {
+    return createHmac('sha256', secret).update(pin).digest('hex');
+}
+//# sourceMappingURL=withdrawal-pin-hash.service.js.map

package/dist/pam/identity/service/withdrawal-pin-hash.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"withdrawal-pin-hash.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/withdrawal-pin-hash.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAAc;IAC3D,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/pam/identity/service/withdrawal-pin.service.d.ts

@@ -0,0 +1,36 @@
+import { type Auth, type EventBus, type DrizzleService, type NodeHeaders } from '@openora/core/server';
+import { type ClientMeta, type IdentityReader, type RateLimiterAdapter, type SecurityControls, type SetWithdrawalPinInput, type User } from '@openora/core/contracts';
+import type { TwoFactorLockoutService } from './two-factor-lockout.service.js';
+export type WithdrawalPinServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+    limiter: RateLimiterAdapter;
+    auth: Auth;
+    identityReader: IdentityReader;
+    twoFactorLockout?: TwoFactorLockoutService;
+    hmacSecret: string;
+    trustedDeviceDays: number;
+};
+/**
+ * Withdrawal PIN as a security control, independent of the login credential and of
+ * wallet withdrawal itself (verifying the PIN at withdrawal time is a separate,
+ * not-yet-built seam). Set and Change share the one upsert route below; Remove is
+ * immediate and un-gated by design (AC), so it deliberately skips fresh reauth.
+ */
+export declare class WithdrawalPinService {
+    private readonly drizzle;
+    private readonly events;
+    private readonly limiter;
+    private readonly auth;
+    private readonly identityReader;
+    private readonly twoFactorLockout?;
+    private readonly hmacSecret;
+    private readonly trustedDeviceDays;
+    constructor({ drizzle, events, limiter, auth, identityReader, twoFactorLockout, hmacSecret, trustedDeviceDays, }: WithdrawalPinServiceDeps);
+    private securityControlsFor;
+    private loadCaller;
+    private assertPlayer;
+    set(userId: User['id'], input: SetWithdrawalPinInput, reqHeaders: NodeHeaders, meta: ClientMeta): Promise<SecurityControls>;
+    remove(userId: User['id'], meta: ClientMeta): Promise<SecurityControls>;
+}
+//# sourceMappingURL=withdrawal-pin.service.d.ts.map

package/dist/pam/identity/service/withdrawal-pin.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withdrawal-pin.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/withdrawal-pin.service.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,IAAI,EACT,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,WAAW,EAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,IAAI,EACV,MAAM,yBAAyB,CAAC;AAKjC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAU/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,cAAc,EAAE,cAAc,CAAC;IAC/B,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,EACV,OAAO,EACP,MAAM,EACN,OAAO,EACP,IAAI,EACJ,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,iBAAiB,GAClB,EAAE,wBAAwB;YAWb,mBAAmB;YAQnB,UAAU;YAgBV,YAAY;IAuBpB,GAAG,CACP,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAClB,KAAK,EAAE,qBAAqB,EAC5B,UAAU,EAAE,WAAW,EACvB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,gBAAgB,CAAC;IAsCtB,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAwB9E"}

package/dist/pam/identity/service/withdrawal-pin.service.js

@@ -0,0 +1,132 @@
+import { ORPCError } from '@orpc/server';
+import { eq } from 'drizzle-orm';
+import { assertRateLimit, } from '@openora/core/server';
+import { RATE_LIMIT_KEYS, makeRateLimitKey, } from '@openora/core/contracts';
+import { user } from '../schema/index.js';
+import { getSecurityControls } from './security-controls.service.js';
+import { assertFreshReauthentication } from './fresh-reauthentication.service.js';
+import { hashWithdrawalPin } from './withdrawal-pin-hash.service.js';
+import { nodeHeadersToHeaders } from '../../shared/headers-mapper.js';
+const MINUTE_MS = 60 * 1000;
+const WITHDRAWAL_PIN_RATE_LIMIT = {
+    limit: 5,
+    windowMs: 5 * MINUTE_MS,
+    onUnavailable: 'deny',
+};
+/**
+ * Withdrawal PIN as a security control, independent of the login credential and of
+ * wallet withdrawal itself (verifying the PIN at withdrawal time is a separate,
+ * not-yet-built seam). Set and Change share the one upsert route below; Remove is
+ * immediate and un-gated by design (AC), so it deliberately skips fresh reauth.
+ */
+export class WithdrawalPinService {
+    drizzle;
+    events;
+    limiter;
+    auth;
+    identityReader;
+    twoFactorLockout;
+    hmacSecret;
+    trustedDeviceDays;
+    constructor({ drizzle, events, limiter, auth, identityReader, twoFactorLockout, hmacSecret, trustedDeviceDays, }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.limiter = limiter;
+        this.auth = auth;
+        this.identityReader = identityReader;
+        this.twoFactorLockout = twoFactorLockout;
+        this.hmacSecret = hmacSecret;
+        this.trustedDeviceDays = trustedDeviceDays;
+    }
+    async securityControlsFor(userId) {
+        const controls = await getSecurityControls(this.drizzle, userId, this.trustedDeviceDays);
+        if (!controls) {
+            throw new ORPCError('UNAUTHORIZED', { message: 'Not signed in.' });
+        }
+        return controls;
+    }
+    async loadCaller(userId) {
+        const [caller] = await this.drizzle.db
+            .select({
+            role: user.role,
+            twoFactorEnabled: user.twoFactorEnabled,
+            withdrawalPinHash: user.withdrawalPinHash,
+        })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (!caller) {
+            throw new ORPCError('UNAUTHORIZED', { message: 'Not signed in.' });
+        }
+        return caller;
+    }
+    async assertPlayer(userId, role, action, meta) {
+        if (role === 'player') {
+            return;
+        }
+        // A service-level denial still owes the audit log the same signal AdminGuard emits,
+        // since this check rejects before any shared guard runs (docs/standards/audit.md).
+        this.events.emit('identity.user.unauthorized_access', {
+            userId,
+            playerId: null,
+            resource: 'identity.security.withdrawal_pin',
+            action,
+            role,
+            ip: meta.ip,
+            userAgent: meta.userAgent,
+        });
+        throw new ORPCError('FORBIDDEN', { message: 'Only players can manage a withdrawal PIN.' });
+    }
+    async set(userId, input, reqHeaders, meta) {
+        await assertRateLimit(this.limiter, makeRateLimitKey(RATE_LIMIT_KEYS.WITHDRAWAL_PIN_MUTATION, userId), WITHDRAWAL_PIN_RATE_LIMIT);
+        const caller = await this.loadCaller(userId);
+        await this.assertPlayer(userId, caller.role, 'set', meta);
+        await assertFreshReauthentication({
+            drizzle: this.drizzle,
+            auth: this.auth,
+            twoFactorLockout: this.twoFactorLockout,
+            userId,
+            headers: nodeHeadersToHeaders(reqHeaders),
+            currentPassword: input.currentPassword,
+            totpCode: input.totpCode,
+            twoFactorEnabled: caller.twoFactorEnabled ?? false,
+            meta,
+        });
+        const wasAlreadySet = caller.withdrawalPinHash !== null;
+        await this.drizzle.db
+            .update(user)
+            .set({
+            withdrawalPinHash: hashWithdrawalPin(input.pin, this.hmacSecret),
+            withdrawalPinSetAt: new Date(),
+        })
+            .where(eq(user.id, userId));
+        this.events.emit('identity.security.withdrawal_pin.set', {
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            wasAlreadySet,
+            ip: meta.ip,
+            userAgent: meta.userAgent,
+        });
+        return this.securityControlsFor(userId);
+    }
+    async remove(userId, meta) {
+        await assertRateLimit(this.limiter, makeRateLimitKey(RATE_LIMIT_KEYS.WITHDRAWAL_PIN_MUTATION, userId), WITHDRAWAL_PIN_RATE_LIMIT);
+        const caller = await this.loadCaller(userId);
+        await this.assertPlayer(userId, caller.role, 'remove', meta);
+        if (caller.withdrawalPinHash === null) {
+            return this.securityControlsFor(userId);
+        }
+        await this.drizzle.db
+            .update(user)
+            .set({ withdrawalPinHash: null, withdrawalPinSetAt: null })
+            .where(eq(user.id, userId));
+        this.events.emit('identity.security.withdrawal_pin.removed', {
+            userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            ip: meta.ip,
+            userAgent: meta.userAgent,
+        });
+        return this.securityControlsFor(userId);
+    }
+}
+//# sourceMappingURL=withdrawal-pin.service.js.map

package/dist/pam/identity/service/withdrawal-pin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"withdrawal-pin.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/withdrawal-pin.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAKL,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,gBAAgB,GAOjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5B,MAAM,yBAAyB,GAAG;IAChC,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC,GAAG,SAAS;IACvB,aAAa,EAAE,MAAM;CACb,CAAC;AAaX;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,OAAO,CAAqB;IAC5B,IAAI,CAAO;IACX,cAAc,CAAiB;IAC/B,gBAAgB,CAA2B;IAC3C,UAAU,CAAS;IACnB,iBAAiB,CAAS;IAE3C,YAAY,EACV,OAAO,EACP,MAAM,EACN,OAAO,EACP,IAAI,EACJ,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,iBAAiB,GACQ;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,MAAkB;QAClD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAkB;QACzC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACnC,MAAM,CAAC;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,MAAkB,EAClB,IAAY,EACZ,MAAwB,EACxB,IAAgB;QAEhB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,oFAAoF;QACpF,mFAAmF;QACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YACpD,MAAM;YACN,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,kCAAkC;YAC5C,MAAM;YACN,IAAI;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,GAAG,CACP,MAAkB,EAClB,KAA4B,EAC5B,UAAuB,EACvB,IAAgB;QAEhB,MAAM,eAAe,CACnB,IAAI,CAAC,OAAO,EACZ,gBAAgB,CAAC,eAAe,CAAC,uBAAuB,EAAE,MAAM,CAAC,EACjE,yBAAyB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,2BAA2B,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,MAAM;YACN,OAAO,EAAE,oBAAoB,CAAC,UAAU,CAAC;YACzC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK;YAClD,IAAI;SACL,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC;YACH,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;YAChE,kBAAkB,EAAE,IAAI,IAAI,EAAE;SAC/B,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;YACvD,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,aAAa;YACb,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAkB,EAAE,IAAgB;QAC/C,MAAM,eAAe,CACnB,IAAI,CAAC,OAAO,EACZ,gBAAgB,CAAC,eAAe,CAAC,uBAAuB,EAAE,MAAM,CAAC,EACjE,yBAAyB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE7D,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;aAC1D,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;YAC3D,MAAM;YACN,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,MAAM,CAAC;YACnE,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/pam/player-management/__tests__/kyc-status-writer.int.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=kyc-status-writer.int.test.d.ts.map