npm - @openora/core - Versions diffs - 0.4.1-canary.18 → 0.4.1-canary.20 - Mend

@openora/core 0.4.1-canary.18 → 0.4.1-canary.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (104) hide show

package/dist/contracts/schemas/identity.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/contracts/schemas/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAG1C,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACxB,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,UAAU;IACd,MAAM,EAAE,UAAU;IAClB,cAAc,EAAE,UAAU;IAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;~~IACxB~~,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;~~CAC/B~~,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE;IAC5D,OAAO,EAAE,sCAAsC;CAChD,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC"}
1	+ {"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/contracts/schemas/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AACjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAG1C,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,SAAS,EAAE,eAAe;IAC1B,WAAW,EAAE,eAAe;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACxB,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,UAAU;IACd,MAAM,EAAE,UAAU;IAClB,cAAc,EAAE,UAAU;IAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,yFAAyF;IACzF,uFAAuF;IACvF,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC,IAAI,CAAC;IAC7E,KAAK,EAAE,IAAI;IACX,GAAG,EAAE,IAAI;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE;IAC5D,OAAO,EAAE,sCAAsC;CAChD,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC"}

package/dist/iam/service/iam.service.d.ts CHANGED Viewed

@@ -171,9 +171,9 @@ export declare class IamService {
             status: "pending" | "accepted" | "revoked";
             id: string;
             createdAt: Date;
+            expiresAt: Date;
             token: string;
             roleId: string;
-            expiresAt: Date;
             acceptedAt: Date | null;
         }, "createdAt" | "expiresAt" | "acceptedAt">[];
         total: number;
@@ -189,9 +189,9 @@ export declare class IamService {
         status: "pending" | "accepted" | "revoked";
         id: string;
         createdAt: Date;
+        expiresAt: Date;
         token: string;
         roleId: string;
-        expiresAt: Date;
         acceptedAt: Date | null;
     }, "createdAt" | "expiresAt" | "acceptedAt">>;
     acceptInvitation(token: string): Promise<{

package/dist/pam/identity/__tests__/identity.rate-limit.test.js CHANGED Viewed

@@ -2,6 +2,12 @@ import { describe, it, expect, vi } from 'vitest';
 import { InProcessRateLimiter } from '@openora/core/server';
 import { mock, mockDb } from '../../../testing/mock.js';
 import { IdentityService } from '../service/identity.service.js';
+const testTemplateRenderer = {
+    render: () => ({ subject: 'subject', body: 'body' }),
+};
+function withTemplateRenderer(deps) {
+    return new IdentityService({ templateRenderer: testTemplateRenderer, ...deps });
+}
 // Keep the real @openora/core/server (so assertRateLimit + InProcessRateLimiter
 // are real); only stub createAuth so the constructor doesn't touch a real DB.
 vi.mock('@openora/core/server', async (importOriginal) => {
@@ -23,7 +29,7 @@ describe('IdentityService - rate limiting', () => {
         for (let i = 0; i < 5; i++) {
             await limiter.consume(`register:${email}`, { limit: 5, windowMs: 15 * 60 * 1000 });
         }
-        const svc = new IdentityService({ drizzle, events, limiter });
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
         await expect(svc.register({ email, password: 'password123', name: 'A' }, {}, new Headers())).rejects.toMatchObject({
             code: 'TOO_MANY_REQUESTS',
             data: { retryAfterMs: expect.any(Number) },
@@ -31,7 +37,7 @@ describe('IdentityService - rate limiting', () => {
         limiter.close();
     });
     it('allows register when no limiter is bound (test/no-auth edition)', async () => {
-        const svc = new IdentityService({ drizzle, events });
+        const svc = withTemplateRenderer({ drizzle, events });
         // signUpEmail is a bare vi.fn returning undefined; a throw here would be a 429, not the
         // downstream .json() failure we expect, so assert we got past the guard.
         await expect(svc.register({ email: 'ok@x.dev', password: 'password123', name: 'A' }, {}, new Headers())).rejects.not.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
@@ -47,7 +53,7 @@ describe('IdentityService - verify2fa rate-limit key stability (ABC-208 finding
                 windowMs: 5 * 60 * 1000,
             });
         }
-        const svc = new IdentityService({ drizzle, events, limiter });
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
         // Same two_factor cookie + different junk pairs must still hit the one exhausted bucket.
         for (let i = 0; i < 3; i++) {
             await expect(svc.verifyTwoFactor({ code: '123456' }, { cookie: `better-auth.two_factor=${twoFactorIdentifier}; junk${i}=${i}` }, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
@@ -61,7 +67,7 @@ describe('IdentityService - rate limiting on secret-guessing routes (ABC-208 fin
         for (let i = 0; i < 5; i++) {
             await limiter.consume('change-password:anonymous', { limit: 5, windowMs: 15 * 60 * 1000 });
         }
-        const svc = new IdentityService({ drizzle, events, limiter });
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
         await expect(svc.changePassword({ currentPassword: 'currentpw1', newPassword: 'newpassword1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
         limiter.close();
     });
@@ -70,7 +76,7 @@ describe('IdentityService - rate limiting on secret-guessing routes (ABC-208 fin
         for (let i = 0; i < 5; i++) {
             await limiter.consume('verify-email:anonymous', { limit: 5, windowMs: 15 * 60 * 1000 });
         }
-        const svc = new IdentityService({ drizzle, events, limiter });
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
         await expect(svc.verifyEmail({ token: 'sometoken' }, {})).rejects.toMatchObject({
             code: 'TOO_MANY_REQUESTS',
         });
@@ -81,7 +87,7 @@ describe('IdentityService - rate limiting on secret-guessing routes (ABC-208 fin
         for (let i = 0; i < 5; i++) {
             await limiter.consume('enable2fa:anonymous', { limit: 5, windowMs: 5 * 60 * 1000 });
         }
-        const svc = new IdentityService({ drizzle, events, limiter });
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
         await expect(svc.enableTwoFactor({ password: 'currentpw1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
         limiter.close();
     });
@@ -90,7 +96,7 @@ describe('IdentityService - rate limiting on secret-guessing routes (ABC-208 fin
         for (let i = 0; i < 5; i++) {
             await limiter.consume('disable2fa:anonymous', { limit: 5, windowMs: 5 * 60 * 1000 });
         }
-        const svc = new IdentityService({ drizzle, events, limiter });
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
         await expect(svc.disableTwoFactor({ password: 'currentpw1' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
         limiter.close();
     });
@@ -105,13 +111,13 @@ describe('IdentityService - fail-closed limiter policy for credential-guessing k
     }
     it('passes onUnavailable: deny on the login: key', async () => {
         const { limiter, consume } = denyingLimiter();
-        const svc = new IdentityService({ drizzle, events, limiter });
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
         await expect(svc.login({ email: 'User@X.dev', password: 'password123' }, {}, new Headers())).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
         expect(consume).toHaveBeenCalledWith('login:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
     });
     it('passes onUnavailable: deny on the verify2fa: key', async () => {
         const { limiter, consume } = denyingLimiter();
-        const svc = new IdentityService({ drizzle, events, limiter });
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
         await expect(svc.verifyTwoFactor({ code: '123456' }, {}, new Headers())).rejects.toMatchObject({
             code: 'TOO_MANY_REQUESTS',
         });
@@ -119,9 +125,25 @@ describe('IdentityService - fail-closed limiter policy for credential-guessing k
     });
     it('passes onUnavailable: deny on the pwreset: key', async () => {
         const { limiter, consume } = denyingLimiter();
-        const svc = new IdentityService({ drizzle, events, limiter });
-        await expect(svc.resetPassword({ token: 'reset-tok', newPassword: 'newpassword1' })).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
-        expect(consume).toHaveBeenCalledWith('pwreset:reset-tok', expect.objectContaining({ onUnavailable: 'deny' }));
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.resetPassword({ email: 'user@x.dev', otp: '123456', newPassword: 'newpassword1' })).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('pwreset:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('passes onUnavailable: deny on the pwreset-verify: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        await expect(svc.verifyPasswordResetOtp({ email: 'user@x.dev', otp: '123456' })).rejects.toMatchObject({ code: 'TOO_MANY_REQUESTS' });
+        expect(consume).toHaveBeenCalledWith('pwreset-verify:user@x.dev', expect.objectContaining({ onUnavailable: 'deny' }));
+    });
+    it('throttles requestPasswordReset on the pwreset-req: key', async () => {
+        const { limiter, consume } = denyingLimiter();
+        const svc = withTemplateRenderer({ drizzle, events, limiter });
+        // The throttle is asserted before the anti-enumeration try/catch, so a denied
+        // request key surfaces as a 429 (only the better-auth call is swallowed).
+        await expect(svc.requestPasswordReset({ email: 'User@X.dev' })).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+        });
+        expect(consume).toHaveBeenCalledWith('pwreset-req:user@x.dev', expect.any(Object));
     });
 });
 //# sourceMappingURL=identity.rate-limit.test.js.map

package/dist/pam/identity/__tests__/identity.rate-limit.test.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"identity.rate-limit.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAiB,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,~~EAAE~~,MAAM,gCAAgC,CAAC;~~AAEjE~~,gFAAgF;AAChF,8EAA8E;AAC9E,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAyC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3B,MAAM,MAAM,GAAG,IAAI,CAAW,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAE9D,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,aAAa,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,wFAAwF;QACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;~~QAE9D~~,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SAC3C,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;~~QACrD~~,wFAAwF;QACxF,yEAAyE;QACzE,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC3F,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,mBAAmB,EAAE,EAAE;gBACxD,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;~~QAE9D~~,yFAAyF;QACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,EAAE,MAAM,EAAE,0BAA0B,mBAAmB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAC1E,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;~~QAE9D~~,MAAM,MAAM,CACV,GAAG,CAAC,cAAc,CAChB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,EAC9D,EAAE,EACF,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;~~QAE9D~~,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC9E,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;~~QAE9D~~,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;~~QAE9D~~,MAAM,MAAM,CACV,GAAG,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,gFAAgF;IAChF,iFAAiF;IACjF,gDAAgD;IAChD,SAAS,cAAc;QACrB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;~~QAE9D~~,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,kBAAkB,EAClB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;~~QAE9D~~,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7F,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EACpC,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,~~IAAI~~,~~eAAe,~~CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;~~QAE9D~~,MAAM,MAAM,CACV,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,~~WAAW~~,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,~~CACvE~~,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,mBAAmB,~~EACnB~~,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"identity.rate-limit.test.js","sourceRoot":"","sources":["../../../../src/pam/identity/__tests__/identity.rate-limit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAiB,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,eAAe,EAA4B,MAAM,gCAAgC,CAAC;AAE3F,MAAM,oBAAoB,GAA0B;IAClD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;CACrD,CAAC;AAEF,SAAS,oBAAoB,CAAC,IAAmD;IAC/E,OAAO,IAAI,eAAe,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAyC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SAC3E,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3B,MAAM,MAAM,GAAG,IAAI,CAAW,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAE9D,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,aAAa,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,wFAAwF;QACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;SAC3C,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,wFAAwF;QACxF,yEAAyE;QACzE,MAAM,MAAM,CACV,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC3F,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,mBAAmB,EAAE,EAAE;gBACxD,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,yFAAyF;QACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CACjB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,EAAE,MAAM,EAAE,0BAA0B,mBAAmB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAC1E,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;IAC9F,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,cAAc,CAChB,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,EAC9D,EAAE,EACF,IAAI,OAAO,EAAE,CACd,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC9E,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACzF,gFAAgF;IAChF,iFAAiF;IACjF,gDAAgD;IAChD,SAAS,cAAc;QACrB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAC/E,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,kBAAkB,EAClB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7F,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,EACpC,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CACvF,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,oBAAoB,EACpB,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,CACV,GAAG,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAClC,2BAA2B,EAC3B,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE/D,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACpF,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pam/identity/__tests__/identity.service.test.js CHANGED Viewed

@@ -1,28 +1,41 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { IdentityService, SESSION_DURATION_IN_SECONDS } from '../service/identity.service.js';
+import { IdentityService, SESSION_DURATION_IN_SECONDS, } from '../service/identity.service.js';
 import { UnsupportedLanguageError } from '../../shared/language.js';
 import { ORPCError } from '@orpc/server';
-const { signInEmailMock, getSessionMock, updateUserMock } = vi.hoisted(() => ({
+import { mock } from '../../../testing/mock.js';
+const { signInEmailMock, getSessionMock, updateUserMock, requestPasswordResetEmailOTPMock, checkVerificationOTPMock, resetPasswordEmailOTPMock, capturedAuthOptions, } = vi.hoisted(() => ({
     signInEmailMock: vi.fn(),
     getSessionMock: vi.fn().mockResolvedValue(null),
     updateUserMock: vi.fn(),
+    requestPasswordResetEmailOTPMock: vi.fn(),
+    checkVerificationOTPMock: vi.fn(),
+    resetPasswordEmailOTPMock: vi.fn(),
+    capturedAuthOptions: {
+        current: undefined,
+    },
 }));
 vi.mock('@openora/core/server', async (importOriginal) => ({
     ...(await importOriginal()),
-    createAuth: vi.fn(() => ({
-        options: {
-            session: {
-                expiresIn: SESSION_DURATION_IN_SECONDS,
+    createAuth: vi.fn((options) => {
+        capturedAuthOptions.current = options;
+        return {
+            options: {
+                session: {
+                    expiresIn: SESSION_DURATION_IN_SECONDS,
+                },
+            },
+            api: {
+                getSession: getSessionMock,
+                signUpEmail: vi.fn(),
+                signInEmail: signInEmailMock,
+                signOut: vi.fn(),
+                updateUser: updateUserMock,
+                requestPasswordResetEmailOTP: requestPasswordResetEmailOTPMock,
+                checkVerificationOTP: checkVerificationOTPMock,
+                resetPasswordEmailOTP: resetPasswordEmailOTPMock,
             },
-        },
-        api: {
-            getSession: getSessionMock,
-            signUpEmail: vi.fn(),
-            signInEmail: signInEmailMock,
-            signOut: vi.fn(),
-            updateUser: updateUserMock,
-        },
-    })),
+        };
+    }),
 }));
 function makeDrizzle({ selectRows = [], updateReturning = [] } = {}) {
     const selectQueue = [...selectRows];
@@ -37,10 +50,22 @@ function makeDrizzle({ selectRows = [], updateReturning = [] } = {}) {
     const select = vi.fn(() => ({
         from: () => ({ where: () => ({ limit: () => Promise.resolve(selectQueue.shift() ?? []) }) }),
     }));
-    return { db: { select, update }, update, select };
+    return mock({
+        db: { select, update },
+        update,
+        select,
+    });
 }
 function makeEvents() {
-    return { emit: vi.fn(), on: vi.fn() };
+    return mock({ emit: vi.fn(), on: vi.fn() });
+}
+// createAuth() is mocked below, so the renderer is never actually invoked - this fake only
+// satisfies IdentityService's required `templateRenderer` dependency at construction time.
+const testTemplateRenderer = {
+    render: () => ({ subject: 'subject', body: 'body' }),
+};
+function withTemplateRenderer(deps) {
+    return new IdentityService({ templateRenderer: testTemplateRenderer, ...deps });
 }
 function jsonResponse(body, status) {
     return new Response(JSON.stringify(body), {
@@ -62,7 +87,7 @@ beforeEach(() => {
 });
 describe('IdentityService - SendEmailPort seam', () => {
     it('constructs without a SendEmailPort (email delivery silently skipped)', () => {
-        const svc = new IdentityService({
+        const svc = withTemplateRenderer({
             drizzle: makeDrizzle(),
             events: makeEvents(),
         });
@@ -70,7 +95,7 @@ describe('IdentityService - SendEmailPort seam', () => {
     });
     it('constructs with a stub SendEmailPort and exposes it for use', () => {
         const stub = { send: vi.fn().mockResolvedValue(undefined) };
-        const svc = new IdentityService({
+        const svc = withTemplateRenderer({
             drizzle: makeDrizzle(),
             events: makeEvents(),
             email: stub,
@@ -78,7 +103,7 @@ describe('IdentityService - SendEmailPort seam', () => {
         expect(svc).toBeInstanceOf(IdentityService);
     });
     it('me returns null when no session exists', async () => {
-        const svc = new IdentityService({
+        const svc = withTemplateRenderer({
             drizzle: makeDrizzle(),
             events: makeEvents(),
         });
@@ -94,7 +119,7 @@ describe('IdentityService - login lockout', () => {
         });
         const events = makeEvents();
         signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
-        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        const svc = withTemplateRenderer({ drizzle: drizzle, events: events });
         await expect(svc.login({ email: 'A@B.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
         expect(events.emit).toHaveBeenCalledWith('identity.user.lockout.triggered', expect.objectContaining({ userId: 'u1', email: 'a@b.dev' }));
     });
@@ -105,7 +130,7 @@ describe('IdentityService - login lockout', () => {
         });
         const events = makeEvents();
         signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
-        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        const svc = withTemplateRenderer({ drizzle: drizzle, events: events });
         await expect(svc.login({ email: 'a@b.dev', password: 'wrongpass1' }, {}, new Headers())).rejects.toThrow();
         expect(events.emit).toHaveBeenCalledWith('identity.user.login.failed', expect.objectContaining({ email: 'a@b.dev', reason: 'invalid_credentials' }));
         expect(events.emit).not.toHaveBeenCalledWith('identity.user.lockout.triggered', expect.anything());
@@ -115,7 +140,7 @@ describe('IdentityService - login lockout', () => {
         const drizzle = makeDrizzle({
             selectRows: [[{ id: 'u1', failedLoginAttempts: 5, lockoutUntil: future }]],
         });
-        const svc = new IdentityService({ drizzle: drizzle, events: makeEvents() });
+        const svc = withTemplateRenderer({ drizzle: drizzle, events: makeEvents() });
         const promise = svc.login({ email: 'a@b.dev', password: 'whatever1' }, {}, new Headers());
         await expect(promise).rejects.toThrow(ORPCError);
         await expect(promise).rejects.toMatchObject({
@@ -134,7 +159,7 @@ describe('IdentityService - login lockout', () => {
         });
         const events = makeEvents();
         signInEmailMock.mockResolvedValue(jsonResponse({ user: betterAuthUser, token: 'tok', session: { expiresAt: '2020-02-01T00:00:00.000Z' } }, 200));
-        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        const svc = withTemplateRenderer({ drizzle: drizzle, events: events });
         const result = await svc.login({ email: 'a@b.dev', password: 'rightpass1' }, {}, new Headers());
         expect(result).toMatchObject({ session: { token: 'tok' } });
         expect(events.emit).toHaveBeenCalledWith('identity.user.login', expect.objectContaining({ userId: 'u1' }));
@@ -146,7 +171,7 @@ describe('IdentityService - login lockout', () => {
         });
         const events = makeEvents();
         signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
-        const svc = new IdentityService({
+        const svc = withTemplateRenderer({
             drizzle: drizzle,
             events: events,
             options: {
@@ -171,7 +196,7 @@ describe('IdentityService - login lockout', () => {
         });
         const events = makeEvents();
         signInEmailMock.mockResolvedValue(jsonResponse({ message: 'Invalid' }, 401));
-        const svc = new IdentityService({
+        const svc = withTemplateRenderer({
             drizzle: drizzle,
             events: events,
             options: {
@@ -188,6 +213,29 @@ describe('IdentityService - login lockout', () => {
         expect(events.emit).toHaveBeenCalledWith('identity.user.lockout.triggered', expect.objectContaining({ userId: 'u1', email: 'support@b.dev' }));
     });
 });
+describe('IdentityService - login banned-user 403 (not the RG block)', () => {
+    it('surfaces a banned-user 403 from signInEmail as FORBIDDEN and still emits login.failed', async () => {
+        const drizzle = makeDrizzle({
+            selectRows: [
+                [
+                    {
+                        id: 'u1',
+                        failedLoginAttempts: 0,
+                        lockoutUntil: null,
+                        rgBlocked: false,
+                        rgBlockedUntil: null,
+                    },
+                ],
+            ],
+        });
+        const events = makeEvents();
+        signInEmailMock.mockResolvedValue(jsonResponse({ message: 'BANNED_USER' }, 403));
+        const svc = withTemplateRenderer({ drizzle: drizzle, events: events });
+        await expect(svc.login({ email: 'a@b.dev', password: 'whatever1' }, {}, new Headers())).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect(events.emit).toHaveBeenCalledWith('identity.user.login.failed', expect.objectContaining({ email: 'a@b.dev', reason: 'error' }));
+        expect(events.emit).not.toHaveBeenCalledWith('rg.exclusion.login_blocked', expect.anything());
+    });
+});
 describe('IdentityService - RG login gate', () => {
     it('blocks a self-excluded login AFTER credentials verify and emits rg.exclusion.login_blocked', async () => {
         const drizzle = makeDrizzle({
@@ -206,7 +254,7 @@ describe('IdentityService - RG login gate', () => {
         const events = makeEvents();
         // Valid credentials (200) - the gate must still block.
         signInEmailMock.mockResolvedValue(jsonResponse({ user: betterAuthUser, token: 'tok', session: {} }, 200));
-        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        const svc = withTemplateRenderer({ drizzle: drizzle, events: events });
         await expect(svc.login({ email: 'a@b.dev', password: 'rightpass1' }, {}, new Headers())).rejects.toMatchObject({ code: 'FORBIDDEN' });
         expect(signInEmailMock).toHaveBeenCalled();
         expect(events.emit).toHaveBeenCalledWith('rg.exclusion.login_blocked', expect.objectContaining({ userId: 'u1' }));
@@ -232,7 +280,7 @@ describe('IdentityService - RG login gate', () => {
         });
         const events = makeEvents();
         signInEmailMock.mockResolvedValue(jsonResponse({ user: betterAuthUser, token: 'tok', session: {} }, 200));
-        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        const svc = withTemplateRenderer({ drizzle: drizzle, events: events });
         const result = await svc.login({ email: 'a@b.dev', password: 'rightpass1' }, {}, new Headers());
         expect(result).toMatchObject({ session: { token: 'tok' } });
         expect(events.emit).toHaveBeenCalledWith('identity.user.login', expect.objectContaining({ userId: 'u1' }));
@@ -254,7 +302,7 @@ describe('IdentityService - unlockUser', () => {
             ],
         });
         const events = makeEvents();
-        const svc = new IdentityService({ drizzle: drizzle, events: events });
+        const svc = withTemplateRenderer({ drizzle: drizzle, events: events });
         const res = await svc.unlockUser('u1', 'admin1');
         expect(res).toEqual({ success: true });
         expect(drizzle.update).toHaveBeenCalled();
@@ -267,7 +315,7 @@ describe('IdentityService - unlockUser', () => {
     });
     it('throws when the user does not exist', async () => {
         const drizzle = makeDrizzle({ selectRows: [[]] });
-        const svc = new IdentityService({ drizzle: drizzle, events: makeEvents() });
+        const svc = withTemplateRenderer({ drizzle: drizzle, events: makeEvents() });
         await expect(svc.unlockUser('missing', 'admin1')).rejects.toThrow();
     });
     it('resets the login rate-limit window for the unlocked user', async () => {
@@ -288,7 +336,7 @@ describe('IdentityService - unlockUser', () => {
             consume: vi.fn(),
             reset: resetMock,
         };
-        const svc = new IdentityService({
+        const svc = withTemplateRenderer({
             drizzle: drizzle,
             events: makeEvents(),
             limiter,
@@ -297,12 +345,117 @@ describe('IdentityService - unlockUser', () => {
         expect(resetMock).toHaveBeenCalledWith('login:a@b.dev');
     });
 });
+describe('IdentityService.requestPasswordReset', () => {
+    it('calls the non-deprecated requestPasswordResetEmailOTP endpoint and returns SUCCESS', async () => {
+        requestPasswordResetEmailOTPMock.mockResolvedValue(jsonResponse({ success: true }, 200));
+        const svc = withTemplateRenderer({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        const result = await svc.requestPasswordReset({ email: 'a@b.dev' });
+        expect(result).toEqual({ success: true });
+        expect(requestPasswordResetEmailOTPMock).toHaveBeenCalledWith(expect.objectContaining({ body: { email: 'a@b.dev' } }));
+    });
+    it('swallows a failure and still returns SUCCESS (anti-enumeration)', async () => {
+        requestPasswordResetEmailOTPMock.mockRejectedValue(new Error('boom'));
+        const svc = withTemplateRenderer({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        await expect(svc.requestPasswordReset({ email: 'unregistered@x.dev' })).resolves.toEqual({
+            success: true,
+        });
+    });
+});
+describe('IdentityService.verifyPasswordResetOtp', () => {
+    it('calls checkVerificationOTP with type forget-password and returns SUCCESS', async () => {
+        checkVerificationOTPMock.mockResolvedValue(jsonResponse({ success: true }, 200));
+        const svc = withTemplateRenderer({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        const result = await svc.verifyPasswordResetOtp({ email: 'a@b.dev', otp: '123456' });
+        expect(result).toEqual({ success: true });
+        expect(checkVerificationOTPMock).toHaveBeenCalledWith(expect.objectContaining({
+            body: { email: 'a@b.dev', type: 'forget-password', otp: '123456' },
+        }));
+    });
+    it('surfaces an invalid OTP (400) response as ORPCError BAD_REQUEST with a generic message', async () => {
+        checkVerificationOTPMock.mockResolvedValue(jsonResponse({ message: 'INVALID_OTP' }, 400));
+        const svc = withTemplateRenderer({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        await expect(svc.verifyPasswordResetOtp({ email: 'a@b.dev', otp: '000000' })).rejects.toMatchObject({
+            code: 'BAD_REQUEST',
+            message: 'Invalid or expired verification code',
+        });
+    });
+    it('does not leak better-auth USER_NOT_FOUND message - forces the same generic message as a wrong OTP (anti-enumeration)', async () => {
+        // better-auth's checkVerificationOTP checks findUserByEmail BEFORE the OTP row, so an
+        // unregistered email produces a distinct raw message ("User not found") that must never
+        // reach the caller - it would let an unauthenticated caller learn whether an email exists.
+        checkVerificationOTPMock.mockResolvedValue(jsonResponse({ message: 'User not found' }, 400));
+        const svc = withTemplateRenderer({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        await expect(svc.verifyPasswordResetOtp({ email: 'unregistered@x.dev', otp: '000000' })).rejects.toMatchObject({
+            code: 'BAD_REQUEST',
+            message: 'Invalid or expired verification code',
+        });
+    });
+    it('surfaces a TOO_MANY_ATTEMPTS (403) response as ORPCError BAD_REQUEST (masked)', async () => {
+        checkVerificationOTPMock.mockResolvedValue(jsonResponse({ message: 'TOO_MANY_ATTEMPTS' }, 403));
+        const svc = withTemplateRenderer({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        await expect(svc.verifyPasswordResetOtp({ email: 'a@b.dev', otp: '000000' })).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+    });
+});
+describe('IdentityService.resetPassword', () => {
+    it('calls resetPasswordEmailOTP with the right body and returns SUCCESS', async () => {
+        resetPasswordEmailOTPMock.mockResolvedValue(jsonResponse({ success: true }, 200));
+        const svc = withTemplateRenderer({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        const result = await svc.resetPassword({
+            email: 'a@b.dev',
+            otp: '123456',
+            newPassword: 'newpassword1',
+        });
+        expect(result).toEqual({ success: true });
+        expect(resetPasswordEmailOTPMock).toHaveBeenCalledWith(expect.objectContaining({
+            body: { email: 'a@b.dev', otp: '123456', password: 'newpassword1' },
+        }));
+    });
+    it('surfaces a TOO_MANY_ATTEMPTS (403) response as ORPCError BAD_REQUEST (masked)', async () => {
+        resetPasswordEmailOTPMock.mockResolvedValue(jsonResponse({ message: 'TOO_MANY_ATTEMPTS' }, 403));
+        const svc = withTemplateRenderer({
+            drizzle: makeDrizzle(),
+            events: makeEvents(),
+        });
+        await expect(svc.resetPassword({ email: 'a@b.dev', otp: '000000', newPassword: 'newpassword1' })).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+    });
+});
+describe('IdentityService onPasswordReset hook (wired via createAuth)', () => {
+    it('clears the lockout and emits identity.password.reset when better-auth invokes the hook', async () => {
+        const drizzle = makeDrizzle();
+        const events = makeEvents();
+        withTemplateRenderer({ drizzle: drizzle, events: events });
+        await capturedAuthOptions.current?.onPasswordReset?.({ id: 'u1', email: 'a@b.dev' });
+        expect(events.emit).toHaveBeenCalledWith('identity.password.reset', expect.objectContaining({ userId: 'u1' }));
+        expect(drizzle.update).toHaveBeenCalled();
+    });
+});
 describe('IdentityService.updateProfile language validation', () => {
     it('rejects an unsupported language before calling updateUser', async () => {
-        const svc = new IdentityService({
+        const svc = withTemplateRenderer({
             drizzle: makeDrizzle(),
             events: makeEvents(),
-            platformConfig: { supportedLanguages: ['en', 'fr'] },
+            platformConfig: mock({ supportedLanguages: ['en', 'fr'] }),
         });
         await expect(svc.updateProfile({ language: 'de' }, {}, new Headers())).rejects.toThrow(UnsupportedLanguageError);
         expect(updateUserMock).not.toHaveBeenCalled();
@@ -310,10 +463,10 @@ describe('IdentityService.updateProfile language validation', () => {
     it('accepts a supported language and forwards it to updateUser', async () => {
         updateUserMock.mockResolvedValue(jsonResponse({ status: true }, 200));
         getSessionMock.mockResolvedValueOnce({ user: { ...betterAuthUser, language: 'fr' } });
-        const svc = new IdentityService({
+        const svc = withTemplateRenderer({
             drizzle: makeDrizzle(),
             events: makeEvents(),
-            platformConfig: { supportedLanguages: ['en', 'fr'] },
+            platformConfig: mock({ supportedLanguages: ['en', 'fr'] }),
         });
         const result = await svc.updateProfile({ language: 'fr' }, {}, new Headers());
         expect(updateUserMock).toHaveBeenCalledWith(expect.objectContaining({ body: expect.objectContaining({ language: 'fr' }) }));