@plyaz/auth 1.0.0 → 1.0.1

package/dist/index.cjs

@@ -94,7 +94,9 @@ function maskSensitiveData(data, sensitiveFields = ["password", "token", "secret
   if (typeof data !== "object" || data === null) {
     return data;
   }
-  const masked = { ...data };
+  const masked = {
+    ...data
+  };
   const four = 4;
   for (const field of sensitiveFields) {
     if (field in masked) {
@@ -128,15 +130,26 @@ var JwtManager = class {
     return jsonwebtoken.sign(payload, this.config.privateKey, signOptions);
   }
   generateTokens(user, accessTokenExpiry = "1h", refreshTokenExpiry = "7d") {
-    const accessToken = this.generateToken({ sub: user.id, type: "access" }, accessTokenExpiry);
-    const refreshToken = this.generateToken({ sub: user.id, type: "refresh" }, refreshTokenExpiry);
+    const accessToken = this.generateToken(
+      { sub: user.id, type: "access" },
+      accessTokenExpiry
+    );
+    const refreshToken = this.generateToken(
+      { sub: user.id, type: "refresh" },
+      refreshTokenExpiry
+    );
     let expiresIn;
     if (typeof accessTokenExpiry === "string") {
       const match = accessTokenExpiry.match(/^(\d+)([smhd])$/);
       if (match) {
         const value = globalThis.parseInt(match[1], config$1.NUMERIX.TEN);
         const unit = match[2];
-        const multipliers = { s: 1, m: 60, h: 3600, d: 86400 };
+        const multipliers = {
+          s: 1,
+          m: 60,
+          h: 3600,
+          d: 86400
+        };
         expiresIn = value * multipliers[unit];
       } else {
         expiresIn = config$1.NUMERIX.THIRTY_SIX_HUNDERD;
@@ -172,10 +185,13 @@ var JwtManager = class {
       issuer: this.config.issuer,
       audience: this.config.audience
     });
-    if (typeof decoded === "string") throw new Error(`Invalid ${tokenType} token payload`);
+    if (typeof decoded === "string")
+      throw new Error(`Invalid ${tokenType} token payload`);
     const payload = decoded;
     if (payload.type !== tokenType) {
-      throw new Error(`Invalid token type. Expected ${tokenType}, got ${payload.type}`);
+      throw new Error(
+        `Invalid token type. Expected ${tokenType}, got ${payload.type}`
+      );
     }
     return payload;
   }
@@ -327,17 +343,44 @@ var PermissionChecker = class {
       }
     }
     const userPermissions = await this.getUserPermissions(userId);
-    const directResult = this.checkDirectPermission(userPermissions, resource, action, context);
+    const directResult = this.checkDirectPermission(
+      userPermissions,
+      resource,
+      action,
+      context
+    );
     if (directResult.granted) {
-      return this.cacheAndReturn(userId, resource, action, context, directResult);
+      return this.cacheAndReturn(
+        userId,
+        resource,
+        action,
+        context,
+        directResult
+      );
     }
-    const roleResult = await this.checkRoleBasedPermission(userId, resource, action, context);
+    const roleResult = await this.checkRoleBasedPermission(
+      userId,
+      resource,
+      action,
+      context
+    );
     if (roleResult.granted) {
       return this.cacheAndReturn(userId, resource, action, context, roleResult);
     }
-    const wildcardResult = this.checkWildcardPermission(userPermissions, resource, action, context);
+    const wildcardResult = this.checkWildcardPermission(
+      userPermissions,
+      resource,
+      action,
+      context
+    );
     if (wildcardResult.granted) {
-      return this.cacheAndReturn(userId, resource, action, context, wildcardResult);
+      return this.cacheAndReturn(
+        userId,
+        resource,
+        action,
+        context,
+        wildcardResult
+      );
     }
     const deniedResult = {
       granted: false,
@@ -441,7 +484,10 @@ var PermissionChecker = class {
     for (const permission of permissions) {
       if (permission.resource === resource && permission.action === action) {
         if (permission.conditions && Object.keys(permission.conditions).length > 0) {
-          const conditionsMet = this.evaluateConditions(permission.conditions, context);
+          const conditionsMet = this.evaluateConditions(
+            permission.conditions,
+            context
+          );
           if (conditionsMet) {
             return {
               granted: true,
@@ -480,7 +526,12 @@ var PermissionChecker = class {
     const userRoles = await this.getUserRoles(userId);
     for (const role of userRoles) {
       const rolePermissions = await this.getRolePermissions(role.id);
-      const result = this.checkDirectPermission(rolePermissions, resource, action, context);
+      const result = this.checkDirectPermission(
+        rolePermissions,
+        resource,
+        action,
+        context
+      );
       if (result.granted) {
         return {
           ...result,
@@ -508,7 +559,10 @@ var PermissionChecker = class {
       const actionMatch = permission.action === "*" || permission.action === action;
       if (resourceMatch && actionMatch) {
         if (permission.conditions && Object.keys(permission.conditions).length > 0) {
-          const conditionsMet = this.evaluateConditions(permission.conditions, context);
+          const conditionsMet = this.evaluateConditions(
+            permission.conditions,
+            context
+          );
           if (conditionsMet) {
             return {
               granted: true,
@@ -16479,7 +16533,11 @@ var DynamicRoles = class {
     for (const [conditionType, conditionValue] of Object.entries(conditions)) {
       const evaluator = this.conditionEvaluators.get(conditionType);
       if (evaluator) {
-        const result = await evaluator(userId, { [conditionType]: conditionValue }, context);
+        const result = await evaluator(
+          userId,
+          { [conditionType]: conditionValue },
+          context
+        );
         if (!result) {
           return false;
         }
@@ -16499,7 +16557,9 @@ var DynamicRoles = class {
   async enforceAssignmentLimits(userId) {
     const userAssignments = this.getUserAssignments(userId, false);
     if (userAssignments.length >= this.config.maxAssignmentsPerUser) {
-      throw new Error(`Maximum assignments per user exceeded: ${this.config.maxAssignmentsPerUser}`);
+      throw new Error(
+        `Maximum assignments per user exceeded: ${this.config.maxAssignmentsPerUser}`
+      );
     }
   }
   /**
@@ -16515,9 +16575,12 @@ var DynamicRoles = class {
    * @private
    */
   startCleanupTimer() {
-    this.cleanupTimer = globalThis.setInterval(async () => {
-      await this.cleanupExpiredAssignments();
-    }, config$1.NUMERIX.FIVE * config$1.NUMERIX.SIXTY * config$1.NUMERIX.THOUSAND);
+    this.cleanupTimer = globalThis.setInterval(
+      async () => {
+        await this.cleanupExpiredAssignments();
+      },
+      config$1.NUMERIX.FIVE * config$1.NUMERIX.SIXTY * config$1.NUMERIX.THOUSAND
+    );
   }
   /**
    * Emit role assigned event
@@ -16615,10 +16678,17 @@ exports.AuthService = class AuthService {
   }
   async signIn(email3, password, deviceInfo) {
     const user = await this.traditionalAuth.authenticate(email3, password);
-    const session = await this.sessionManager.createSession(user.id, deviceInfo);
+    const session = await this.sessionManager.createSession(
+      user.id,
+      deviceInfo
+    );
     const tokens = this.jwtManager.generateTokens(user);
     await this.userRepo.updateLastLogin(user.id);
-    return { user, tokens: { ...tokens, refreshToken: tokens.refreshToken ?? "" }, session };
+    return {
+      user,
+      tokens: { ...tokens, refreshToken: tokens.refreshToken ?? "" },
+      session
+    };
   }
   async signUp(userData, password) {
     const passwordHash = await this.traditionalAuth.hashPassword(password);
@@ -16650,11 +16720,22 @@ exports.AuthService = class AuthService {
     return this.userRepo.findById(userId);
   }
   async oauthSignIn(profile, accessToken, refreshToken, deviceInfo) {
-    const user = await this.oauthAuth.authenticate(profile, accessToken, refreshToken);
-    const session = await this.sessionManager.createSession(user.id, deviceInfo ?? {});
+    const user = await this.oauthAuth.authenticate(
+      profile,
+      accessToken,
+      refreshToken
+    );
+    const session = await this.sessionManager.createSession(
+      user.id,
+      deviceInfo ?? {}
+    );
     const tokens = this.jwtManager.generateTokens(user);
     await this.userRepo.updateLastLogin(user.id);
-    return { user, tokens: { ...tokens, refreshToken: tokens.refreshToken ?? "" }, session };
+    return {
+      user,
+      tokens: { ...tokens, refreshToken: tokens.refreshToken ?? "" },
+      session
+    };
   }
 };
 _init3 = __decoratorStart();
@@ -16679,8 +16760,13 @@ var _SessionService = class _SessionService {
   async createSession(userContext, sessionData = {}) {
     this.logger.debug(`Creating session for user: ${userContext.userId}`);
     try {
-      const session = await this.sessionManager.createSession(userContext, sessionData);
-      this.logger.log(`Session created: ${session.id} for user: ${userContext.userId}`);
+      const session = await this.sessionManager.createSession(
+        userContext,
+        sessionData
+      );
+      this.logger.log(
+        `Session created: ${session.id} for user: ${userContext.userId}`
+      );
       this.emitEvent(AUTH_EVENTS.SESSION_CREATED, {
         userId: userContext.userId,
         sessionId: session.id,
@@ -16688,7 +16774,10 @@ var _SessionService = class _SessionService {
       });
       return session;
     } catch (error48) {
-      this.logger.error(`Failed to create session for user: ${userContext.userId}`, error48);
+      this.logger.error(
+        `Failed to create session for user: ${userContext.userId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -16792,7 +16881,10 @@ var _SessionService = class _SessionService {
         timestamp: /* @__PURE__ */ new Date()
       });
     } catch (error48) {
-      this.logger.error(`Failed to invalidate all sessions for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to invalidate all sessions for user: ${userId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -16806,7 +16898,10 @@ var _SessionService = class _SessionService {
     try {
       return await this.sessionManager.detectConcurrentSessions(userId);
     } catch (error48) {
-      this.logger.error(`Failed to detect concurrent sessions for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to detect concurrent sessions for user: ${userId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -16820,7 +16915,10 @@ var _SessionService = class _SessionService {
     try {
       return await this.sessionManager.generateCsrfToken(sessionId);
     } catch (error48) {
-      this.logger.error(`Failed to generate CSRF token for session: ${sessionId}`, error48);
+      this.logger.error(
+        `Failed to generate CSRF token for session: ${sessionId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -16833,13 +16931,19 @@ var _SessionService = class _SessionService {
   async validateCsrfToken(sessionId, token) {
     this.logger.debug(`Validating CSRF token for session: ${sessionId}`);
     try {
-      const isValid = await this.sessionManager.validateCsrfToken(sessionId, token);
+      const isValid = await this.sessionManager.validateCsrfToken(
+        sessionId,
+        token
+      );
       if (!isValid) {
         this.logger.warn(`Invalid CSRF token for session: ${sessionId}`);
       }
       return isValid;
     } catch (error48) {
-      this.logger.error(`Failed to validate CSRF token for session: ${sessionId}`, error48);
+      this.logger.error(
+        `Failed to validate CSRF token for session: ${sessionId}`,
+        error48
+      );
       return false;
     }
   }
@@ -16852,7 +16956,10 @@ var _SessionService = class _SessionService {
     try {
       return await this.sessionManager.shouldRefreshSession(sessionId);
     } catch (error48) {
-      this.logger.error(`Failed to check if session needs refresh: ${sessionId}`, error48);
+      this.logger.error(
+        `Failed to check if session needs refresh: ${sessionId}`,
+        error48
+      );
       return false;
     }
   }
@@ -16904,7 +17011,9 @@ var _TokenService = class _TokenService {
     try {
       const result = await this.tokenValidator.validateAccessToken(token);
       if (!result.valid) {
-        this.logger.warn(`Access token validation failed: ${result.error?.message}`);
+        this.logger.warn(
+          `Access token validation failed: ${result.error?.message}`
+        );
       }
       return result;
     } catch (error48) {
@@ -16928,7 +17037,9 @@ var _TokenService = class _TokenService {
     try {
       const result = await this.tokenValidator.validateRefreshToken(token);
       if (!result.valid) {
-        this.logger.warn(`Refresh token validation failed: ${result.error?.message}`);
+        this.logger.warn(
+          `Refresh token validation failed: ${result.error?.message}`
+        );
       }
       return result;
     } catch (error48) {
@@ -16962,7 +17073,10 @@ var _TokenService = class _TokenService {
       this.logger.log(`Token pair generated for user: ${userId}`);
       return tokenPair;
     } catch (error48) {
-      this.logger.error(`Failed to generate token pair for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to generate token pair for user: ${userId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -17012,7 +17126,10 @@ var _TokenService = class _TokenService {
       await this.refreshTokenManager.revokeAllUserTokens(userId);
       this.logger.log(`All tokens revoked for user: ${userId}`);
     } catch (error48) {
-      this.logger.error(`Failed to revoke all tokens for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to revoke all tokens for user: ${userId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -17026,7 +17143,10 @@ var _TokenService = class _TokenService {
       await this.refreshTokenManager.revokeSessionTokens(sessionId);
       this.logger.log(`Tokens revoked for session: ${sessionId}`);
     } catch (error48) {
-      this.logger.error(`Failed to revoke tokens for session: ${sessionId}`, error48);
+      this.logger.error(
+        `Failed to revoke tokens for session: ${sessionId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -17122,7 +17242,10 @@ var _AccountService = class _AccountService {
       });
       return connectedAccount;
     } catch (error48) {
-      this.logger.error(`Failed to link ${provider} account for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to link ${provider} account for user: ${userId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -17150,7 +17273,10 @@ var _AccountService = class _AccountService {
         timestamp: /* @__PURE__ */ new Date()
       });
     } catch (error48) {
-      this.logger.error(`Failed to unlink account ${accountId} for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to unlink account ${accountId} for user: ${userId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -17174,16 +17300,23 @@ var _AccountService = class _AccountService {
    * @param accountId - Account identifier to set as primary
    */
   async setPrimary(userId, accountId) {
-    this.logger.debug(`Setting primary account ${accountId} for user: ${userId}`);
+    this.logger.debug(
+      `Setting primary account ${accountId} for user: ${userId}`
+    );
     try {
       const account = await this.accountRepository.findById(accountId);
       if (account?.userId !== userId) {
         throw new Error("Account not found or does not belong to user");
       }
       await this.accountRepository.setPrimary(userId, accountId);
-      this.logger.log(`Primary account set to ${accountId} for user: ${userId}`);
+      this.logger.log(
+        `Primary account set to ${accountId} for user: ${userId}`
+      );
     } catch (error48) {
-      this.logger.error(`Failed to set primary account ${accountId} for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to set primary account ${accountId} for user: ${userId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -17197,7 +17330,10 @@ var _AccountService = class _AccountService {
     try {
       return await this.accountRepository.findPrimary(userId);
     } catch (error48) {
-      this.logger.error(`Failed to get primary account for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to get primary account for user: ${userId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -17208,11 +17344,19 @@ var _AccountService = class _AccountService {
    * @returns Connected account or null
    */
   async findByProvider(provider, providerAccountId) {
-    this.logger.debug(`Finding account by provider: ${provider}, ID: ${providerAccountId}`);
+    this.logger.debug(
+      `Finding account by provider: ${provider}, ID: ${providerAccountId}`
+    );
     try {
-      return await this.accountRepository.findByProvider(provider, providerAccountId);
+      return await this.accountRepository.findByProvider(
+        provider,
+        providerAccountId
+      );
     } catch (error48) {
-      this.logger.error(`Failed to find account by provider: ${provider}`, error48);
+      this.logger.error(
+        `Failed to find account by provider: ${provider}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -17225,10 +17369,17 @@ var _AccountService = class _AccountService {
   async updateTokens(accountId, accessToken, refreshToken) {
     this.logger.debug(`Updating tokens for account: ${accountId}`);
     try {
-      await this.accountRepository.updateTokens(accountId, accessToken, refreshToken);
+      await this.accountRepository.updateTokens(
+        accountId,
+        accessToken,
+        refreshToken
+      );
       this.logger.log(`Tokens updated for account: ${accountId}`);
     } catch (error48) {
-      this.logger.error(`Failed to update tokens for account: ${accountId}`, error48);
+      this.logger.error(
+        `Failed to update tokens for account: ${accountId}`,
+        error48
+      );
       throw error48;
     }
   }
@@ -17256,9 +17407,14 @@ var _AccountService = class _AccountService {
     this.logger.debug(`Checking if user ${userId} has ${provider} account`);
     try {
       const accounts = await this.accountRepository.findByUserId(userId);
-      return accounts.some((account) => account.provider === provider && account.isActive);
+      return accounts.some(
+        (account) => account.provider === provider && account.isActive
+      );
     } catch (error48) {
-      this.logger.error(`Failed to check provider account for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to check provider account for user: ${userId}`,
+        error48
+      );
       return false;
     }
   }
@@ -17273,7 +17429,10 @@ var _AccountService = class _AccountService {
       const accounts = await this.accountRepository.findByUserId(userId);
       return accounts.filter((account) => account.isActive).length;
     } catch (error48) {
-      this.logger.error(`Failed to get account count for user: ${userId}`, error48);
+      this.logger.error(
+        `Failed to get account count for user: ${userId}`,
+        error48
+      );
       return 0;
     }
   }
@@ -17310,7 +17469,10 @@ var _BruteForceService = class _BruteForceService {
   }
   static {
     // 30 min
-    this.USER_PROGRESSIVE_DELAYS = { 4: 5e3, 5: 5e3 };
+    this.USER_PROGRESSIVE_DELAYS = {
+      4: 5e3,
+      5: 5e3
+    };
   }
   static {
     this.IP_HARD_LIMIT = 10;
@@ -17411,7 +17573,12 @@ exports.RateLimiterService = class RateLimiterService {
     }
     if (requests > options.limit && options.blockMs) {
       const blockUntil = Date.now() + options.blockMs;
-      await this.redis.set(blockKey, blockUntil.toString(), "PX", options.blockMs);
+      await this.redis.set(
+        blockKey,
+        blockUntil.toString(),
+        "PX",
+        options.blockMs
+      );
       await this.redis.del(rateKey);
       return true;
     }
@@ -17695,7 +17862,9 @@ var CookieStore = class {
    */
   setCookie(sessionId, data, ttlSeconds) {
     const encryptedData = this.encrypt(JSON.stringify(data));
-    globalThis.console.log(`Setting cookie: ${this.config.cookieName}=${encryptedData}; Max-Age=${ttlSeconds}`);
+    globalThis.console.log(
+      `Setting cookie: ${this.config.cookieName}=${encryptedData}; Max-Age=${ttlSeconds}`
+    );
   }
   /**
    * Clear HTTP cookie (mock implementation)
@@ -17901,7 +18070,9 @@ var MemoryStore = class {
   async enforceSessionLimits(userId) {
     const userSessions = await this.getByUserId(userId);
     if (userSessions.length >= this.config.maxSessionsPerUser) {
-      userSessions.sort((a, b) => a.lastActivityAt.getTime() - b.lastActivityAt.getTime());
+      userSessions.sort(
+        (a, b) => a.lastActivityAt.getTime() - b.lastActivityAt.getTime()
+      );
       const sessionsToRemove = userSessions.length - this.config.maxSessionsPerUser + 1;
       for (let i = 0; i < sessionsToRemove; i++) {
         await this.delete(userSessions[i].id);
@@ -17958,7 +18129,11 @@ var RedisStore = class {
     const serializedData = this.serialize(data);
     await this.client.set(key, serializedData, ttlSeconds);
     const userSessionsTTL = Math.max(ttlSeconds, this.config.defaultTTL);
-    await this.client.set(`${userSessionsKey}${sessionId}`, "1", userSessionsTTL);
+    await this.client.set(
+      `${userSessionsKey}${sessionId}`,
+      "1",
+      userSessionsTTL
+    );
   }
   /**
    * Retrieve session data from Redis
@@ -18007,7 +18182,10 @@ var RedisStore = class {
     const userSessionKeys = await this.client.keys(userSessionsPattern);
     let deletedCount = 0;
     for (const userSessionKey of userSessionKeys) {
-      const sessionId = userSessionKey.replace(this.getUserSessionsKey(userId), "");
+      const sessionId = userSessionKey.replace(
+        this.getUserSessionsKey(userId),
+        ""
+      );
       const sessionKey = this.getSessionKey(sessionId);
       const sessionDeleted = await this.client.del(sessionKey);
       await this.client.del(userSessionKey);
@@ -18025,7 +18203,10 @@ var RedisStore = class {
     const data = await this.get(sessionId);
     if (data) {
       data.lastActivityAt = /* @__PURE__ */ new Date();
-      const remainingTTL = Math.max(0, Math.floor((data.expiresAt.getTime() - Date.now()) / config$1.NUMERIX.THOUSAND));
+      const remainingTTL = Math.max(
+        0,
+        Math.floor((data.expiresAt.getTime() - Date.now()) / config$1.NUMERIX.THOUSAND)
+      );
       if (remainingTTL > 0) {
         await this.set(sessionId, data, remainingTTL);
       }
@@ -18051,7 +18232,10 @@ var RedisStore = class {
     const userSessionKeys = await this.client.keys(userSessionsPattern);
     const sessions = [];
     for (const userSessionKey of userSessionKeys) {
-      const sessionId = userSessionKey.replace(this.getUserSessionsKey(userId), "");
+      const sessionId = userSessionKey.replace(
+        this.getUserSessionsKey(userId),
+        ""
+      );
       const sessionData = await this.get(sessionId);
       if (sessionData) {
         sessions.push(sessionData);
@@ -18146,7 +18330,9 @@ var RedisStore = class {
   async enforceSessionLimits(userId) {
     const userSessions = await this.getByUserId(userId);
     if (userSessions.length >= this.config.maxSessionsPerUser) {
-      userSessions.sort((a, b) => a.lastActivityAt.getTime() - b.lastActivityAt.getTime());
+      userSessions.sort(
+        (a, b) => a.lastActivityAt.getTime() - b.lastActivityAt.getTime()
+      );
       const sessionsToRemove = userSessions.length - this.config.maxSessionsPerUser + 1;
       for (let i = 0; i < sessionsToRemove; i++) {
         await this.delete(userSessions[i].id);
@@ -18238,7 +18424,9 @@ var EnhancedSessionManager = class {
     const sessionId = this.generateSessionId();
     await this.enforceSessionLimits(userContext.userId);
     const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + this.config.sessionTTL * config$1.NUMERIX.THOUSAND);
+    const expiresAt = new Date(
+      now.getTime() + this.config.sessionTTL * config$1.NUMERIX.THOUSAND
+    );
     const session = {
       id: sessionId,
       userId: userContext.userId,
@@ -18303,7 +18491,12 @@ var EnhancedSessionManager = class {
       ...updates,
       lastActivityAt: /* @__PURE__ */ new Date()
     };
-    const remainingTTL = Math.max(0, Math.floor((updatedSession.expiresAt.getTime() - Date.now()) / config$1.NUMERIX.THOUSAND));
+    const remainingTTL = Math.max(
+      0,
+      Math.floor(
+        (updatedSession.expiresAt.getTime() - Date.now()) / config$1.NUMERIX.THOUSAND
+      )
+    );
     if (remainingTTL <= 0) {
       throw new Error("Session has expired");
     }
@@ -18331,7 +18524,9 @@ var EnhancedSessionManager = class {
       throw new Error("Session not found");
     }
     const now = /* @__PURE__ */ new Date();
-    const newExpiresAt = new Date(now.getTime() + this.config.sessionTTL * config$1.NUMERIX.THOUSAND);
+    const newExpiresAt = new Date(
+      now.getTime() + this.config.sessionTTL * config$1.NUMERIX.THOUSAND
+    );
     const refreshedSession = {
       ...sessionData,
       expiresAt: newExpiresAt,
@@ -18371,7 +18566,9 @@ var EnhancedSessionManager = class {
    */
   async detectConcurrentSessions(userId) {
     const sessionDataArray = await this.store.getByUserId(userId);
-    return sessionDataArray.map((sessionData) => this.mapSessionDataToSession(sessionData));
+    return sessionDataArray.map(
+      (sessionData) => this.mapSessionDataToSession(sessionData)
+    );
   }
   /**
    * Apply maximum session policy for a user
@@ -18380,7 +18577,9 @@ var EnhancedSessionManager = class {
   async enforceSessionLimits(userId) {
     const userSessions = await this.store.getByUserId(userId);
     if (userSessions.length >= this.config.maxConcurrentSessions) {
-      userSessions.sort((a, b) => a.lastActivityAt.getTime() - b.lastActivityAt.getTime());
+      userSessions.sort(
+        (a, b) => a.lastActivityAt.getTime() - b.lastActivityAt.getTime()
+      );
       const sessionsToRemove = userSessions.length - this.config.maxConcurrentSessions + 1;
       for (let i = 0; i < sessionsToRemove; i++) {
         await this.deleteSession(userSessions[i].id);
@@ -18495,7 +18694,8 @@ async function createUser(email3, authProvider, data, password) {
     roles: data?.roles ?? [],
     password_hash: passwordHash
   }).select("*").single();
-  if (error48 || !user) throw new Error(error48?.message ?? "Failed to create user");
+  if (error48 || !user)
+    throw new Error(error48?.message ?? "Failed to create user");
   return user;
 }
 __name(createUser, "createUser");
@@ -18513,7 +18713,9 @@ async function createUserSession(userId, deviceInfo) {
   const thirtyTwo = 32;
   const accessToken = crypto.randomBytes(thirtyTwo).toString("hex");
   const tokenHash = await bcrypt__default.default.hash(accessToken, config$1.NUMERIX.TEN);
-  const expiresAt = new Date(Date.now() + config$1.NUMERIX.THOUSAND * config$1.NUMERIX.SIXTY * config$1.NUMERIX.SIXTY * config$1.NUMERIX.TWENTY_FOUR);
+  const expiresAt = new Date(
+    Date.now() + config$1.NUMERIX.THOUSAND * config$1.NUMERIX.SIXTY * config$1.NUMERIX.SIXTY * config$1.NUMERIX.TWENTY_FOUR
+  );
   const { data, error: error48 } = await supabase.from("sessions").insert({
     user_id: userId,
     token_hash: tokenHash,
@@ -18521,7 +18723,8 @@ async function createUserSession(userId, deviceInfo) {
     expires_at: expiresAt,
     last_active_at: /* @__PURE__ */ new Date()
   }).select("*").single();
-  if (error48 || !data) throw new Error(error48?.message ?? "Failed to create session");
+  if (error48 || !data)
+    throw new Error(error48?.message ?? "Failed to create session");
   return {
     id: data.id,
     userId: data.user_id,
@@ -18559,13 +18762,16 @@ async function refreshSessionDB(sessionId) {
   const thirtyTwo = 32;
   const accessToken = crypto.randomBytes(thirtyTwo).toString("hex");
   const tokenHash = await bcrypt__default.default.hash(accessToken, config$1.NUMERIX.TEN);
-  const expiresAt = new Date(Date.now() + config$1.NUMERIX.THOUSAND * config$1.NUMERIX.SIXTY * config$1.NUMERIX.SIXTY * config$1.NUMERIX.TWENTY_FOUR);
+  const expiresAt = new Date(
+    Date.now() + config$1.NUMERIX.THOUSAND * config$1.NUMERIX.SIXTY * config$1.NUMERIX.SIXTY * config$1.NUMERIX.TWENTY_FOUR
+  );
   const { data, error: error48 } = await supabase.from("sessions").update({
     token_hash: tokenHash,
     expires_at: expiresAt,
     last_active_at: /* @__PURE__ */ new Date()
   }).eq("id", sessionId).select("*").single();
-  if (error48 || !data) throw new Error(error48?.message ?? "Failed to refresh session");
+  if (error48 || !data)
+    throw new Error(error48?.message ?? "Failed to refresh session");
   return {
     id: data.id,
     userId: data.user_id,
@@ -18655,12 +18861,7 @@ var ClerkAdapter = class extends BaseAuthProviderAdapter {
    * @param deviceInfo - Optional device metadata
    */
   async signUp(provider, credentials, data) {
-    await createUser(
-      credentials.email,
-      provider,
-      data,
-      credentials.password
-    );
+    await createUser(credentials.email, provider, data, credentials.password);
   }
   /**
    * Sign out a user.
@@ -18905,7 +19106,10 @@ var CustomAdapter = class extends BaseAuthProviderAdapter {
     return { user, session, tokens: { accessToken: session.accessToken } };
   }
   async signUp(provider, credentials, data, deviceInfo) {
-    const userFindByEmail = await findUserByEmailProvider(data?.email ?? "", provider);
+    const userFindByEmail = await findUserByEmailProvider(
+      data?.email ?? "",
+      provider
+    );
     if (userFindByEmail) {
       throw new errors.DatabasePackageError("User already register");
     }
@@ -18986,14 +19190,26 @@ var TraditionalAuthStrategy = class {
     const SALT_LENGTH = 32;
     const HASH_LENGTH = 64;
     const salt = crypto.randomBytes(SALT_LENGTH).toString("hex");
-    const hash2 = crypto.pbkdf2Sync(password, salt, config$1.NUMERIX.THOUSAND, HASH_LENGTH, "sha512").toString("hex");
+    const hash2 = crypto.pbkdf2Sync(
+      password,
+      salt,
+      config$1.NUMERIX.THOUSAND,
+      HASH_LENGTH,
+      "sha512"
+    ).toString("hex");
     return `pbkdf2$${salt}$${hash2}`;
   }
   async verifyPassword(password, hash2) {
     const HASH_LENGTH = 64;
     if (hash2.startsWith("pbkdf2$")) {
       const [, salt, storedHash] = hash2.split("$");
-      const computedHash = crypto.pbkdf2Sync(password, salt, config$1.NUMERIX.THOUSAND, HASH_LENGTH, "sha512").toString("hex");
+      const computedHash = crypto.pbkdf2Sync(
+        password,
+        salt,
+        config$1.NUMERIX.THOUSAND,
+        HASH_LENGTH,
+        "sha512"
+      ).toString("hex");
       return computedHash === storedHash;
     }
     return false;
@@ -19144,22 +19360,29 @@ var FacebookProvider = class extends BaseAuthProvider {
     __name(this, "FacebookProvider");
   }
   async authenticate(credentials) {
-    const tokenResponse = await this.exchangeCodeForTokens(credentials.code);
+    const tokenResponse = await this.exchangeCodeForTokens(
+      credentials.code
+    );
     const userProfile = await this.getUserProfile(tokenResponse.access_token);
     const tokens = {
       accessToken: tokenResponse.access_token,
       refreshToken: tokenResponse.refresh_token,
-      expiresAt: new Date(Date.now() + tokenResponse.expires_in * config$1.NUMERIX.THOUSAND),
+      expiresAt: new Date(
+        Date.now() + tokenResponse.expires_in * config$1.NUMERIX.THOUSAND
+      ),
       expiresIn: 0,
       tokenType: ""
     };
     return { user: userProfile, tokens };
   }
   async refreshToken(refreshToken) {
-    const response = await globalThis.fetch("https://graph.facebook.com/v18.0/oauth/access_token", {
-      method: "GET",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" }
-    });
+    const response = await globalThis.fetch(
+      "https://graph.facebook.com/v18.0/oauth/access_token",
+      {
+        method: "GET",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" }
+      }
+    );
     const data = await response.json();
     return {
       accessToken: data.access_token,
@@ -19170,12 +19393,17 @@ var FacebookProvider = class extends BaseAuthProvider {
     };
   }
   async revokeToken(token) {
-    await globalThis.fetch(`https://graph.facebook.com/v18.0/me/permissions?access_token=${token}`, {
-      method: "DELETE"
-    });
+    await globalThis.fetch(
+      `https://graph.facebook.com/v18.0/me/permissions?access_token=${token}`,
+      {
+        method: "DELETE"
+      }
+    );
   }
   async getUserProfile(accessToken) {
-    const response = await globalThis.fetch(`https://graph.facebook.com/v18.0/me?fields=id,name,email,picture&access_token=${accessToken}`);
+    const response = await globalThis.fetch(
+      `https://graph.facebook.com/v18.0/me?fields=id,name,email,picture&access_token=${accessToken}`
+    );
     const profile = await response.json();
     return {
       id: profile.id,
@@ -19204,10 +19432,13 @@ var FacebookProvider = class extends BaseAuthProvider {
     return `https://www.facebook.com/v18.0/dialog/oauth?${params.toString()}`;
   }
   async exchangeCodeForTokens(code) {
-    const response = await globalThis.fetch("https://graph.facebook.com/v18.0/oauth/access_token", {
-      method: "GET",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" }
-    });
+    const response = await globalThis.fetch(
+      "https://graph.facebook.com/v18.0/oauth/access_token",
+      {
+        method: "GET",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" }
+      }
+    );
     globalThis.console.log(code);
     return await response.json();
   }
@@ -19258,7 +19489,9 @@ var GitHubProvider = class extends BaseAuthProvider {
     return {
       accessToken: data.access_token,
       refreshToken: data.refresh_token ?? refreshToken,
-      expiresAt: new Date(Date.now() + (data.expires_in ?? config$1.NUMERIX.THIRTY_SIX_HUNDERD) * config$1.NUMERIX.THOUSAND),
+      expiresAt: new Date(
+        Date.now() + (data.expires_in ?? config$1.NUMERIX.THIRTY_SIX_HUNDERD) * config$1.NUMERIX.THOUSAND
+      ),
       expiresIn: 0,
       tokenType: ""
     };
@@ -19344,23 +19577,28 @@ var GoogleProvider = class extends BaseAuthProvider {
     const tokens = {
       accessToken: tokenResponse.access_token,
       refreshToken: tokenResponse.refresh_token,
-      expiresAt: new Date(Date.now() + tokenResponse.expires_in * config$1.NUMERIX.THOUSAND),
+      expiresAt: new Date(
+        Date.now() + tokenResponse.expires_in * config$1.NUMERIX.THOUSAND
+      ),
       expiresIn: 0,
       tokenType: ""
     };
     return { user: userProfile, tokens };
   }
   async refreshToken(refreshToken) {
-    const response = await globalThis.fetch("https://oauth2.googleapis.com/token", {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        client_id: this.config.clientId,
-        client_secret: this.config.clientSecret,
-        refresh_token: refreshToken,
-        grant_type: "refresh_token"
-      })
-    });
+    const response = await globalThis.fetch(
+      "https://oauth2.googleapis.com/token",
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret,
+          refresh_token: refreshToken,
+          grant_type: "refresh_token"
+        })
+      }
+    );
     const data = await response.json();
     return {
       accessToken: data.access_token,
@@ -19371,9 +19609,12 @@ var GoogleProvider = class extends BaseAuthProvider {
     };
   }
   async revokeToken(token) {
-    await globalThis.fetch(`https://oauth2.googleapis.com/revoke?token=${token}`, {
-      method: "POST"
-    });
+    await globalThis.fetch(
+      `https://oauth2.googleapis.com/revoke?token=${token}`,
+      {
+        method: "POST"
+      }
+    );
   }
   async getUserProfile(accessToken) {
     const response = await globalThis.fetch(
@@ -19398,17 +19639,20 @@ var GoogleProvider = class extends BaseAuthProvider {
     };
   }
   async exchangeCodeForTokens(code) {
-    const response = await globalThis.fetch("https://oauth2.googleapis.com/token", {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        client_id: this.config.clientId,
-        client_secret: this.config.clientSecret,
-        code,
-        grant_type: "authorization_code",
-        redirect_uri: this.config.redirectUri
-      })
-    });
+    const response = await globalThis.fetch(
+      "https://oauth2.googleapis.com/token",
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret,
+          code,
+          grant_type: "authorization_code",
+          redirect_uri: this.config.redirectUri
+        })
+      }
+    );
     return await response.json();
   }
   getAuthUrl() {
@@ -19435,7 +19679,10 @@ var SignInFlow = class {
     __name(this, "SignInFlow");
   }
   async execute(credentials) {
-    const isValid = await this.validateCredentials(credentials.email, credentials.password);
+    const isValid = await this.validateCredentials(
+      credentials.email,
+      credentials.password
+    );
     if (!isValid) {
       throw new Error("Invalid credentials");
     }
@@ -19448,7 +19695,9 @@ var SignInFlow = class {
       const thirty2 = 30;
       await this.sessionManager.createSession({
         userId: user.id,
-        expiresAt: new Date(Date.now() + thirty2 * config$1.NUMERIX.TWENTY_FOUR * config$1.NUMERIX.SIXTY * config$1.NUMERIX.SIXTY * config$1.NUMERIX.THOUSAND),
+        expiresAt: new Date(
+          Date.now() + thirty2 * config$1.NUMERIX.TWENTY_FOUR * config$1.NUMERIX.SIXTY * config$1.NUMERIX.SIXTY * config$1.NUMERIX.THOUSAND
+        ),
         // 30 days
         metadata: { rememberMe: true }
       });
@@ -19531,7 +19780,10 @@ var SignUpFlow = class {
   }
   async verifyEmail(token) {
     const payload = await this.jwtManager.verifyToken(token);
-    const user = await this.userRepository.updateEmailVerification(payload.userId, true);
+    const user = await this.userRepository.updateEmailVerification(
+      payload.userId,
+      true
+    );
     if (!user) {
       throw new Error("User not found");
     }
@@ -19551,7 +19803,10 @@ exports.AuthGuard = class AuthGuard {
   }
   // Explicit return type for canActivate
   async canActivate(context) {
-    const isPublic = this.reflector.get("isPublic", context.getHandler());
+    const isPublic = this.reflector.get(
+      "isPublic",
+      context.getHandler()
+    );
     if (isPublic) return true;
     const request = context.switchToHttp().getRequest();
     const token = this.extractToken(request);
@@ -19595,7 +19850,10 @@ exports.RolesGuard = class RolesGuard {
     __name(this, "RolesGuard");
   }
   async canActivate(context) {
-    const requiredRoles = this.reflector.get("roles", context.getHandler());
+    const requiredRoles = this.reflector.get(
+      "roles",
+      context.getHandler()
+    );
     if (!requiredRoles) return true;
     const request = context.switchToHttp().getRequest();
     const user = request.user;
@@ -19626,11 +19884,12 @@ exports.PermissionsGuard = class PermissionsGuard {
     if (!permissionMetadata) return true;
     const user = request.user;
     if (!user) {
-      throw new errors.AuthenticationError(
-        "AUTH_INVALID_CREDENTIALS"
-      );
+      throw new errors.AuthenticationError("AUTH_INVALID_CREDENTIALS");
     }
-    const permissionContext = this.buildPermissionContext(request, permissionMetadata);
+    const permissionContext = this.buildPermissionContext(
+      request,
+      permissionMetadata
+    );
     const result = await this.permissionChecker.checkPermission(
       user.sub ?? user.userId ?? "",
       permissionMetadata.resource,
@@ -19638,18 +19897,13 @@ exports.PermissionsGuard = class PermissionsGuard {
       permissionContext
     );
     if (!result.granted) {
-      throw new errors.AuthenticationError(
-        "AUTH_INSUFFICIENT_PERMISSIONS"
-      );
+      throw new errors.AuthenticationError("AUTH_INSUFFICIENT_PERMISSIONS");
     }
     request.permissionResult = result;
     return true;
   }
   getPermissionMetadata(context) {
-    const permissionData = this.reflector.get(
-      "permission",
-      context.getHandler()
-    );
+    const permissionData = this.reflector.get("permission", context.getHandler());
     if (!permissionData) return null;
     if (Array.isArray(permissionData)) {
       return { resource: permissionData[0], action: permissionData[1] };
@@ -19669,7 +19923,12 @@ exports.PermissionsGuard = class PermissionsGuard {
       }
     }
     if (request.body) {
-      const relevantBodyFields = ["ownerId", "organizationId", "teamId", "projectId"];
+      const relevantBodyFields = [
+        "ownerId",
+        "organizationId",
+        "teamId",
+        "projectId"
+      ];
       for (const field of relevantBodyFields) {
         if (request.body[field]) context[field] = request.body[field];
       }
@@ -19682,9 +19941,7 @@ _init12 = __decoratorStart();
 exports.PermissionsGuard = __decorateElement(_init12, 0, "PermissionsGuard", _PermissionsGuard_decorators, exports.PermissionsGuard);
 __runInitializers(_init12, 1, exports.PermissionsGuard);
 var IS_PUBLIC_KEY = "isPublic";
-var Auth = /* @__PURE__ */ __name(() => common.applyDecorators(
-  common.UseGuards(exports.AuthGuard)
-), "Auth");
+var Auth = /* @__PURE__ */ __name(() => common.applyDecorators(common.UseGuards(exports.AuthGuard)), "Auth");
 var Public = /* @__PURE__ */ __name(() => common.SetMetadata(IS_PUBLIC_KEY, true), "Public");
 var Roles = /* @__PURE__ */ __name((...roles) => common.SetMetadata("roles", roles), "Roles");
 var Permissions = /* @__PURE__ */ __name((...permissions) => common.SetMetadata("permissions", permissions), "Permissions");
@@ -20202,7 +20459,9 @@ function useAuth() {
       });
     }, "linkAccount"),
     unlinkAccount: /* @__PURE__ */ __name(async (accountId) => {
-      return handleAuthAction(async () => store.removeConnectedAccount(accountId));
+      return handleAuthAction(
+        async () => store.removeConnectedAccount(accountId)
+      );
     }, "unlinkAccount")
   };
 }
@@ -20265,9 +20524,12 @@ var useConnectedAccounts = /* @__PURE__ */ __name(() => {
   const unlinkAccount = /* @__PURE__ */ __name(async (accountId) => {
     setIsLoading(true);
     try {
-      const response = await globalThis.fetch(`/api/auth/accounts/${accountId}/unlink`, {
-        method: "DELETE"
-      });
+      const response = await globalThis.fetch(
+        `/api/auth/accounts/${accountId}/unlink`,
+        {
+          method: "DELETE"
+        }
+      );
       if (!response.ok) throw new Error("Failed to unlink account");
       setAccounts((prev) => prev.filter((acc) => acc.id !== accountId));
     } finally {
@@ -20277,14 +20539,19 @@ var useConnectedAccounts = /* @__PURE__ */ __name(() => {
   const setPrimaryAccount = /* @__PURE__ */ __name(async (accountId) => {
     setIsLoading(true);
     try {
-      const response = await globalThis.fetch(`/api/auth/accounts/${accountId}/primary`, {
-        method: "PUT"
-      });
+      const response = await globalThis.fetch(
+        `/api/auth/accounts/${accountId}/primary`,
+        {
+          method: "PUT"
+        }
+      );
       if (!response.ok) throw new Error("Failed to set primary account");
-      setAccounts((prev) => prev.map((acc) => ({
-        ...acc,
-        isPrimary: acc.id === accountId
-      })));
+      setAccounts(
+        (prev) => prev.map((acc) => ({
+          ...acc,
+          isPrimary: acc.id === accountId
+        }))
+      );
     } finally {
       setIsLoading(false);
     }
@@ -20346,7 +20613,9 @@ var ProtectedRoute = /* @__PURE__ */ __name(({
   }
   if (requiredRoles.length > 0 && user) {
     const userRoles = user.roles ?? [];
-    const hasRequiredRole = requiredRoles.some((role) => userRoles.includes(role));
+    const hasRequiredRole = requiredRoles.some(
+      (role) => userRoles.includes(role)
+    );
     if (!hasRequiredRole) {
       return /* @__PURE__ */ jsxRuntime.jsxs("div", { children: [
         "Access denied. Required roles: ",