@portaidentity/server 1.7.0

package/migrations/014_login_methods.sql

@@ -0,0 +1,34 @@
+-- Up Migration
+
+-- Configurable Login Methods (plans/client-login-methods)
+-- Adds organization-level default login methods + per-client override.
+-- Two-level inheritance model:
+--   1. organizations.default_login_methods — org-wide default (NOT NULL, defaults to {password, magic_link})
+--   2. clients.login_methods — per-client override (NULL = inherit from org)
+--
+-- Future-proof design: TEXT[] without a value CHECK so adding 'sso' or 'passkey' later
+-- is a pure TypeScript change with no migration required. All writes are funneled through
+-- the service layer, which validates against the LoginMethod TypeScript union.
+
+-- Organizations: default authentication methods for all clients in the org.
+ALTER TABLE organizations
+    ADD COLUMN default_login_methods TEXT[] NOT NULL
+        DEFAULT ARRAY['password', 'magic_link']::TEXT[];
+
+COMMENT ON COLUMN organizations.default_login_methods IS
+    'Default authentication methods available for all clients in this org. Clients may override via clients.login_methods. Values: password, magic_link (extensible — sso/passkey in future).';
+
+-- Clients: per-client override of org default. NULL = inherit from org.
+-- Empty array ({}) is invalid and rejected by the service layer (NULL is the canonical
+-- "inherit" sentinel). Non-null values must be a non-empty subset of LoginMethod.
+ALTER TABLE clients
+    ADD COLUMN login_methods TEXT[] DEFAULT NULL;
+
+COMMENT ON COLUMN clients.login_methods IS
+    'Authentication methods for this client. NULL = inherit from organizations.default_login_methods. Non-null must be non-empty.';
+
+-- Down Migration
+
+-- Drop in reverse order of creation (clients first since it's the leaf).
+ALTER TABLE clients DROP COLUMN IF EXISTS login_methods;
+ALTER TABLE organizations DROP COLUMN IF EXISTS default_login_methods;

package/migrations/015_signing_key_encryption.sql

@@ -0,0 +1,20 @@
+-- Up Migration
+
+-- Add encryption metadata columns to signing_keys table.
+-- These support AES-256-GCM envelope encryption of private keys at rest.
+-- Existing rows keep encrypted = false (plaintext) for backward compatibility.
+ALTER TABLE signing_keys
+  ADD COLUMN private_key_iv  VARCHAR(24),
+  ADD COLUMN private_key_tag VARCHAR(32),
+  ADD COLUMN encrypted       BOOLEAN NOT NULL DEFAULT false;
+
+COMMENT ON COLUMN signing_keys.private_key_iv IS 'AES-256-GCM initialization vector (hex) — NULL for unencrypted legacy keys';
+COMMENT ON COLUMN signing_keys.private_key_tag IS 'AES-256-GCM authentication tag (hex) — NULL for unencrypted legacy keys';
+COMMENT ON COLUMN signing_keys.encrypted IS 'Whether private_key is AES-256-GCM encrypted (false = plaintext legacy)';
+
+-- Down Migration
+
+ALTER TABLE signing_keys
+  DROP COLUMN IF EXISTS private_key_iv,
+  DROP COLUMN IF EXISTS private_key_tag,
+  DROP COLUMN IF EXISTS encrypted;

package/migrations/016_failed_login_count.sql

@@ -0,0 +1,27 @@
+-- Up Migration
+
+-- Add failed login tracking columns for account lockout.
+-- Tracks consecutive failed password attempts per user and enables
+-- automatic account lockout after exceeding the configured threshold
+-- (system_config: max_failed_logins, lockout_duration_seconds).
+--
+-- The counter resets to 0 on successful login. Auto-locked accounts
+-- (locked_reason = 'auto_lockout') auto-unlock after the cooldown.
+
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS failed_login_count INTEGER NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS last_failed_login_at TIMESTAMPTZ;
+
+-- Partial index for efficient auto-unlock queries: find locked users
+-- whose cooldown has elapsed. Only indexes auto-locked rows.
+CREATE INDEX IF NOT EXISTS idx_users_locked_auto
+  ON users (locked_at)
+  WHERE status = 'locked' AND locked_reason = 'auto_lockout';
+
+-- Down Migration
+
+DROP INDEX IF EXISTS idx_users_locked_auto;
+
+ALTER TABLE users
+  DROP COLUMN IF EXISTS last_failed_login_at,
+  DROP COLUMN IF EXISTS failed_login_count;

package/migrations/017_audit_retention.sql

@@ -0,0 +1,11 @@
+-- Up Migration
+
+-- Add audit_retention_days system config value.
+-- Controls how long audit log entries are kept before cleanup.
+-- Used by `porta audit cleanup` CLI command.
+INSERT INTO system_config (key, value, value_type, description, is_sensitive) VALUES
+    ('audit_retention_days', '90', 'number', 'Number of days to retain audit log entries (default: 90 days)', FALSE);
+
+-- Down Migration
+
+DELETE FROM system_config WHERE key = 'audit_retention_days';

package/migrations/018_admin_api_enhancements.sql

@@ -0,0 +1,78 @@
+-- Up Migration
+
+-- Admin API Enhancements (RD-21)
+-- Adds branding_assets table for organization logo/favicon image storage
+-- and admin_sessions table for OIDC session tracking and management.
+
+-- ============================================================================
+-- Branding Assets: Organization logo/favicon storage
+-- ============================================================================
+-- Images stored as PostgreSQL bytea (simple deployment, images are small).
+-- Unique constraint ensures one logo and one favicon per organization.
+
+CREATE TABLE IF NOT EXISTS branding_assets (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    organization_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    asset_type VARCHAR(20) NOT NULL,       -- 'logo', 'favicon'
+    content_type VARCHAR(50) NOT NULL,     -- 'image/png', 'image/svg+xml', etc.
+    data BYTEA NOT NULL,
+    file_size INTEGER NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT branding_assets_unique_org_type UNIQUE(organization_id, asset_type),
+    CONSTRAINT branding_assets_valid_type CHECK (asset_type IN ('logo', 'favicon')),
+    CONSTRAINT branding_assets_valid_size CHECK (file_size > 0 AND file_size <= 524288)
+);
+
+-- Index for looking up assets by organization
+CREATE INDEX IF NOT EXISTS idx_branding_assets_org_id
+    ON branding_assets(organization_id);
+
+-- ============================================================================
+-- Admin Sessions: OIDC session tracking for admin viewer/revocation
+-- ============================================================================
+-- PostgreSQL mirror of Redis OIDC sessions. Populated via adapter hooks
+-- (fire-and-forget) for listing, filtering, and admin revocation.
+-- Active sessions have revoked_at IS NULL.
+
+CREATE TABLE IF NOT EXISTS admin_sessions (
+    session_id VARCHAR(128) PRIMARY KEY,
+    user_id UUID REFERENCES users(id) ON DELETE CASCADE,
+    client_id UUID REFERENCES clients(id) ON DELETE SET NULL,
+    organization_id UUID REFERENCES organizations(id) ON DELETE CASCADE,
+    grant_id VARCHAR(128),
+    ip_address INET,
+    user_agent TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL,
+    last_activity_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    revoked_at TIMESTAMPTZ,
+    CONSTRAINT admin_sessions_not_expired CHECK (expires_at > created_at)
+);
+
+-- Partial indexes for efficient querying of active sessions
+CREATE INDEX IF NOT EXISTS idx_admin_sessions_user_active
+    ON admin_sessions(user_id)
+    WHERE revoked_at IS NULL;
+
+CREATE INDEX IF NOT EXISTS idx_admin_sessions_org_active
+    ON admin_sessions(organization_id)
+    WHERE revoked_at IS NULL;
+
+CREATE INDEX IF NOT EXISTS idx_admin_sessions_client_active
+    ON admin_sessions(client_id)
+    WHERE revoked_at IS NULL;
+
+CREATE INDEX IF NOT EXISTS idx_admin_sessions_expires
+    ON admin_sessions(expires_at)
+    WHERE revoked_at IS NULL;
+
+-- Index for grant-based session lookup (used during revocation cascade)
+CREATE INDEX IF NOT EXISTS idx_admin_sessions_grant_id
+    ON admin_sessions(grant_id)
+    WHERE grant_id IS NOT NULL;
+
+-- Down Migration
+
+DROP TABLE IF EXISTS admin_sessions;
+DROP TABLE IF EXISTS branding_assets;

package/migrations/019_invitation_details.sql

@@ -0,0 +1,27 @@
+-- Up Migration
+
+-- Migration 019: Add details JSONB column to invitation_tokens
+--
+-- Stores pre-assignment metadata (roles, claims, personal message, inviter)
+-- in the invitation token so they can be applied when the invitation is accepted.
+--
+-- The details column is nullable — existing tokens without details continue
+-- to work exactly as before (backward compatible).
+
+ALTER TABLE invitation_tokens
+  ADD COLUMN details JSONB;
+
+-- Add invited_by column to track which admin user created the invitation
+ALTER TABLE invitation_tokens
+  ADD COLUMN invited_by UUID REFERENCES users(id) ON DELETE SET NULL;
+
+COMMENT ON COLUMN invitation_tokens.details IS
+  'Optional JSONB storing pre-assignment metadata: roles, claims, personalMessage, inviterName';
+
+COMMENT ON COLUMN invitation_tokens.invited_by IS
+  'User ID of the admin who created this invitation';
+
+-- Down Migration
+
+ALTER TABLE invitation_tokens DROP COLUMN IF EXISTS invited_by;
+ALTER TABLE invitation_tokens DROP COLUMN IF EXISTS details;

package/migrations/020_two_factor_admin_permission.sql

@@ -0,0 +1,108 @@
+-- Up Migration
+
+-- Migration 020: Add admin:user:2fa permission for 2FA admin API management
+--
+-- This migration adds the admin:user:2fa permission to the porta-admin
+-- application and assigns it to the porta-super-admin, porta-user-admin,
+-- and porta-admin (legacy) roles.
+--
+-- The permission governs state-changing 2FA admin operations:
+--   - POST .../two-factor/disable
+--   - POST .../two-factor/reset
+--   - POST .../two-factor/recovery-codes/regenerate
+--
+-- Read-only status inspection uses the existing admin:user:read permission.
+--
+-- Idempotent: uses INSERT ... ON CONFLICT DO NOTHING throughout.
+
+DO $$
+DECLARE
+  v_app_id UUID;
+  v_perm_id UUID;
+  v_super_admin_role_id UUID;
+  v_user_admin_role_id UUID;
+  v_legacy_admin_role_id UUID;
+BEGIN
+  -- Find the porta-admin application
+  SELECT id INTO v_app_id
+  FROM applications
+  WHERE slug = 'porta-admin'
+  LIMIT 1;
+
+  -- If porta-admin app doesn't exist, skip (pre-init state)
+  IF v_app_id IS NULL THEN
+    RAISE NOTICE 'porta-admin application not found — skipping 2FA permission seed';
+    RETURN;
+  END IF;
+
+  -- Insert the permission
+  INSERT INTO permissions (application_id, slug, name, description, status)
+  VALUES (
+    v_app_id,
+    'admin:user:2fa',
+    'Manage User 2FA',
+    'Disable, reset, or regenerate recovery codes for user two-factor authentication',
+    'active'
+  )
+  ON CONFLICT (application_id, slug) DO NOTHING
+  RETURNING id INTO v_perm_id;
+
+  -- If permission already existed, look it up
+  IF v_perm_id IS NULL THEN
+    SELECT id INTO v_perm_id
+    FROM permissions
+    WHERE application_id = v_app_id AND slug = 'admin:user:2fa';
+  END IF;
+
+  -- Find role IDs
+  SELECT id INTO v_super_admin_role_id
+  FROM roles
+  WHERE application_id = v_app_id AND slug = 'porta-super-admin';
+
+  SELECT id INTO v_user_admin_role_id
+  FROM roles
+  WHERE application_id = v_app_id AND slug = 'porta-user-admin';
+
+  SELECT id INTO v_legacy_admin_role_id
+  FROM roles
+  WHERE application_id = v_app_id AND slug = 'porta-admin';
+
+  -- Assign permission to roles
+  IF v_super_admin_role_id IS NOT NULL AND v_perm_id IS NOT NULL THEN
+    INSERT INTO role_permissions (role_id, permission_id)
+    VALUES (v_super_admin_role_id, v_perm_id)
+    ON CONFLICT DO NOTHING;
+  END IF;
+
+  IF v_user_admin_role_id IS NOT NULL AND v_perm_id IS NOT NULL THEN
+    INSERT INTO role_permissions (role_id, permission_id)
+    VALUES (v_user_admin_role_id, v_perm_id)
+    ON CONFLICT DO NOTHING;
+  END IF;
+
+  IF v_legacy_admin_role_id IS NOT NULL AND v_perm_id IS NOT NULL THEN
+    INSERT INTO role_permissions (role_id, permission_id)
+    VALUES (v_legacy_admin_role_id, v_perm_id)
+    ON CONFLICT DO NOTHING;
+  END IF;
+
+  RAISE NOTICE 'admin:user:2fa permission seeded successfully';
+END $$;
+
+-- Down Migration
+
+-- Remove the admin:user:2fa permission (CASCADE removes role_permissions mappings)
+DO $$
+DECLARE
+  v_app_id UUID;
+BEGIN
+  SELECT id INTO v_app_id
+  FROM applications
+  WHERE slug = 'porta-admin'
+  LIMIT 1;
+
+  IF v_app_id IS NOT NULL THEN
+    DELETE FROM permissions
+    WHERE application_id = v_app_id AND slug = 'admin:user:2fa';
+  END IF;
+END $$;

package/migrations/021_auth_recovery_jobs.sql

@@ -0,0 +1,74 @@
+-- Up Migration
+
+-- Durable recovery work keeps public authentication requests independent from account existence.
+-- Protected addresses are encrypted before insertion; this table never stores plaintext addresses
+-- or authentication artifacts.
+CREATE TABLE auth_recovery_jobs (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    job_type VARCHAR(32) NOT NULL,
+    organization_id UUID NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    address_ciphertext TEXT NOT NULL,
+    address_iv TEXT NOT NULL,
+    address_tag TEXT NOT NULL,
+    address_key_id VARCHAR(64) NOT NULL,
+    interaction_uid VARCHAR(128),
+    idempotency_digest CHAR(64) NOT NULL,
+    status VARCHAR(24) NOT NULL DEFAULT 'available',
+    available_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    claimed_at TIMESTAMPTZ,
+    claimed_by UUID,
+    attempt_count SMALLINT NOT NULL DEFAULT 0,
+    last_failure_reason VARCHAR(64),
+    completed_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT auth_recovery_jobs_type
+        CHECK (job_type IN ('magic_link', 'password_reset')),
+    CONSTRAINT auth_recovery_jobs_status
+        CHECK (status IN ('available', 'claimed', 'completed', 'terminal_failure')),
+    CONSTRAINT auth_recovery_jobs_attempt_count
+        CHECK (attempt_count BETWEEN 0 AND 5),
+    CONSTRAINT auth_recovery_jobs_idempotency_digest
+        CHECK (idempotency_digest ~ '^[0-9a-f]{64}$'),
+    CONSTRAINT auth_recovery_jobs_protected_address
+        CHECK (
+            address_ciphertext ~ '^[A-Za-z0-9_-]+$'
+            AND address_iv ~ '^[A-Za-z0-9_-]+$'
+            AND address_tag ~ '^[A-Za-z0-9_-]+$'
+            AND address_key_id ~ '^[A-Za-z0-9_-]{8,64}$'
+        ),
+    CONSTRAINT auth_recovery_jobs_interaction_uid
+        CHECK (
+            (job_type = 'magic_link' AND char_length(interaction_uid) BETWEEN 1 AND 128)
+            OR (job_type = 'password_reset' AND interaction_uid IS NULL)
+        ),
+    CONSTRAINT auth_recovery_jobs_failure_reason
+        CHECK (
+            last_failure_reason IS NULL
+            OR last_failure_reason ~ '^[a-z][a-z0-9_]{0,63}$'
+        ),
+    CONSTRAINT auth_recovery_jobs_claim_state
+        CHECK (
+            (status = 'claimed' AND claimed_at IS NOT NULL AND claimed_by IS NOT NULL)
+            OR (status <> 'claimed' AND claimed_at IS NULL AND claimed_by IS NULL)
+        ),
+    CONSTRAINT auth_recovery_jobs_completion_state
+        CHECK (
+            (status IN ('completed', 'terminal_failure') AND completed_at IS NOT NULL)
+            OR (status NOT IN ('completed', 'terminal_failure') AND completed_at IS NULL)
+        ),
+    CONSTRAINT auth_recovery_jobs_idempotency
+        UNIQUE (organization_id, job_type, idempotency_digest)
+);
+
+CREATE INDEX auth_recovery_jobs_available
+    ON auth_recovery_jobs (available_at, created_at, id)
+    WHERE status = 'available' AND attempt_count < 5;
+
+CREATE INDEX auth_recovery_jobs_expired_claims
+    ON auth_recovery_jobs (claimed_at, created_at, id)
+    WHERE status = 'claimed' AND attempt_count < 5;
+
+-- Down Migration
+
+DROP TABLE IF EXISTS auth_recovery_jobs;

package/migrations/022_recovery_artifact_ownership.sql

@@ -0,0 +1,25 @@
+-- Up Migration
+
+-- A durable recovery job may create at most one token artifact. The plaintext token is derived
+-- deterministically from the protected job identity, so a retry can safely reuse the same link.
+ALTER TABLE magic_link_tokens
+    ADD COLUMN recovery_job_id UUID REFERENCES auth_recovery_jobs(id) ON DELETE SET NULL;
+
+ALTER TABLE password_reset_tokens
+    ADD COLUMN recovery_job_id UUID REFERENCES auth_recovery_jobs(id) ON DELETE SET NULL;
+
+CREATE UNIQUE INDEX magic_link_tokens_recovery_job
+    ON magic_link_tokens (recovery_job_id)
+    WHERE recovery_job_id IS NOT NULL;
+
+CREATE UNIQUE INDEX password_reset_tokens_recovery_job
+    ON password_reset_tokens (recovery_job_id)
+    WHERE recovery_job_id IS NOT NULL;
+
+-- Down Migration
+
+DROP INDEX IF EXISTS password_reset_tokens_recovery_job;
+DROP INDEX IF EXISTS magic_link_tokens_recovery_job;
+
+ALTER TABLE password_reset_tokens DROP COLUMN IF EXISTS recovery_job_id;
+ALTER TABLE magic_link_tokens DROP COLUMN IF EXISTS recovery_job_id;

package/migrations/023_magic_link_authority.sql

@@ -0,0 +1,39 @@
+-- Up Migration
+
+-- Magic-link authority is persisted when a new artifact is created. Existing rows receive their
+-- durable user organization only so the column can become mandatory, but remain explicitly
+-- unbound because their original interaction authority cannot be reconstructed safely.
+ALTER TABLE magic_link_tokens
+    ADD COLUMN organization_id UUID REFERENCES organizations(id) ON DELETE CASCADE,
+    ADD COLUMN interaction_uid VARCHAR(128),
+    ADD COLUMN authority_bound BOOLEAN;
+
+UPDATE magic_link_tokens AS token
+SET organization_id = account.organization_id,
+    authority_bound = FALSE
+FROM users AS account
+WHERE account.id = token.user_id;
+
+ALTER TABLE magic_link_tokens
+    ALTER COLUMN organization_id SET NOT NULL,
+    ALTER COLUMN authority_bound SET DEFAULT TRUE,
+    ALTER COLUMN authority_bound SET NOT NULL,
+    ADD CONSTRAINT magic_link_tokens_interaction_uid
+        CHECK (interaction_uid IS NULL OR char_length(interaction_uid) BETWEEN 1 AND 128),
+    ADD CONSTRAINT magic_link_tokens_recovery_authority
+        CHECK (recovery_job_id IS NULL OR authority_bound);
+
+CREATE INDEX magic_link_tokens_authority_lookup
+    ON magic_link_tokens (token_hash, organization_id)
+    WHERE used_at IS NULL AND authority_bound;
+
+-- Down Migration
+
+DROP INDEX IF EXISTS magic_link_tokens_authority_lookup;
+
+ALTER TABLE magic_link_tokens
+    DROP CONSTRAINT IF EXISTS magic_link_tokens_recovery_authority,
+    DROP CONSTRAINT IF EXISTS magic_link_tokens_interaction_uid,
+    DROP COLUMN IF EXISTS authority_bound,
+    DROP COLUMN IF EXISTS interaction_uid,
+    DROP COLUMN IF EXISTS organization_id;

package/package.json

@@ -0,0 +1,106 @@
+{
+  "name": "@portaidentity/server",
+  "version": "1.7.0",
+  "description": "Multi-tenant OIDC provider built on node-oidc-provider, Koa, and TypeScript",
+  "type": "module",
+  "license": "MIT",
+  "bin": {
+    "porta-server": "dist/cli/index.js"
+  },
+  "files": [
+    "dist",
+    "locales",
+    "migrations",
+    "templates",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "../../node_modules/@typescript/native/bin/tsc",
+    "start": "node dist/index.js",
+    "dev": "tsx watch src/index.ts",
+    "test": "vitest run --project unit --project integration",
+    "test:all": "yarn test:unit && yarn test:integration && yarn test:e2e && yarn test:pentest",
+    "test:watch": "vitest",
+    "test:unit": "vitest run --project unit",
+    "test:integration": "vitest run --project integration",
+    "test:e2e": "vitest run --project e2e",
+    "test:pentest": "vitest run --project pentest",
+    "test:ui": "playwright test --config tests/ui/playwright.config.ts",
+    "test:ui:debug": "playwright test --config tests/ui/playwright.config.ts --headed --workers=1",
+    "test:coverage": "vitest run --coverage",
+    "lint": "eslint 'src/**/*.ts' 'tests/**/*.ts'",
+    "lint:fix": "eslint 'src/**/*.ts' 'tests/**/*.ts' --fix",
+    "typecheck": "../../node_modules/@typescript/native/bin/tsc --noEmit",
+    "format": "prettier --write 'src/**/*.ts' 'tests/**/*.ts'",
+    "format:check": "prettier --check 'src/**/*.ts' 'tests/**/*.ts'",
+    "verify": "yarn lint && yarn typecheck && yarn test:all && yarn build",
+    "migrate": "node-pg-migrate up --migrations-dir migrations --migration-file-language sql",
+    "migrate:rollback": "node-pg-migrate down --migrations-dir migrations --migration-file-language sql --count 1",
+    "migrate:status": "node-pg-migrate status --migrations-dir migrations --migration-file-language sql",
+    "migrate:create": "node-pg-migrate create --migrations-dir migrations --migration-file-language sql",
+    "porta": "tsx src/cli/index.ts",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@koa/router": "15.7.0",
+    "argon2": "0.45.1",
+    "chalk": "6.0.0",
+    "cli-table3": "0.6.5",
+    "dotenv": "17.4.2",
+    "handlebars": "4.7.9",
+    "i18next": "26.3.6",
+    "i18next-fs-backend": "2.6.7",
+    "ioredis": "6.0.0",
+    "jose": "6.2.8",
+    "koa": "3.2.1",
+    "koa-bodyparser": "4.4.1",
+    "node-pg-migrate": "9.0.0",
+    "nodemailer": "9.0.5",
+    "oidc-provider": "9.11.2",
+    "open": "11.0.0",
+    "otpauth": "9.5.1",
+    "pg": "8.23.0",
+    "pino": "10.3.1",
+    "pino-pretty": "13.1.3",
+    "prom-client": "^15",
+    "qrcode": "1.5.4",
+    "yaml": "2.9.0",
+    "yargs": "18.1.0",
+    "zod": "4.4.3"
+  },
+  "devDependencies": {
+    "@eslint/js": "10.0.1",
+    "@playwright/test": "1.62.1",
+    "@types/koa": "3.0.3",
+    "@types/koa-bodyparser": "4.3.13",
+    "@types/koa__router": "12.0.5",
+    "@types/node": "26.2.0",
+    "@types/nodemailer": "8.0.1",
+    "@types/oidc-provider": "9.11.1",
+    "@types/pg": "8.21.0",
+    "@types/qrcode": "1.5.6",
+    "@types/yargs": "17.0.35",
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "@vitest/coverage-v8": "4.1.10",
+    "eslint": "10.8.1",
+    "eslint-config-prettier": "10.1.8",
+    "prettier": "3.9.6",
+    "tsx": "4.23.11",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "typescript-eslint": "8.66.0",
+    "vitest": "4.1.10"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/blendsdk/porta-identity.git",
+    "directory": "packages/server"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  }
+}

package/templates/default/emails/invitation.hbs

@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style>
+    body { font-family: system-ui, sans-serif; margin: 0; padding: 0; background: #f5f5f5; }
+    .wrapper { max-width: 560px; margin: 0 auto; padding: 40px 20px; }
+    .card { background: white; border-radius: 8px; padding: 32px; box-shadow: 0 1px 3px rgba(0,0,0,0.1); }
+    .btn { display: inline-block; background: {{branding.primaryColor}}; color: white; text-decoration: none; padding: 12px 32px; border-radius: 4px; font-size: 16px; font-weight: 500; }
+    .footer { text-align: center; padding: 16px; color: #6b7280; font-size: 12px; }
+    .personal-message { background: #f9fafb; border-left: 3px solid {{branding.primaryColor}}; padding: 12px 16px; margin: 16px 0; border-radius: 0 4px 4px 0; color: #374151; font-style: italic; }
+  </style>
+</head>
+<body>
+  <div class="wrapper">
+    <div class="card">
+      {{#if branding.logoUrl}}<img src="{{branding.logoUrl}}" alt="{{branding.companyName}}" style="max-height: 40px; margin-bottom: 16px;">{{/if}}
+      <h1 style="font-size: 20px; margin: 0 0 12px 0;">You've been invited!</h1>
+      <p>Hi {{userName}},</p>
+      {{#if inviterName}}
+      <p><strong>{{inviterName}}</strong> has invited you to join <strong>{{orgName}}</strong>. Click the button below to set up your account. This invitation expires in {{expiresDays}} days.</p>
+      {{else}}
+      <p>You've been invited to join <strong>{{orgName}}</strong>. Click the button below to set up your account. This invitation expires in {{expiresDays}} days.</p>
+      {{/if}}
+      {{#if personalMessage}}
+      <div class="personal-message">
+        {{personalMessage}}
+      </div>
+      {{/if}}
+      <p style="text-align: center; margin: 24px 0;">
+        <a href="{{{inviteUrl}}}" class="btn">Accept Invitation</a>
+      </p>
+      <p style="color: #6b7280; font-size: 13px;">Or copy this link: {{{inviteUrl}}}</p>
+    </div>
+    <div class="footer">&copy; {{year}} {{branding.companyName}}</div>
+  </div>
+</body>
+</html>

package/templates/default/emails/invitation.txt.hbs

@@ -0,0 +1,18 @@
+You've been invited!
+
+Hi {{userName}},
+
+{{#if inviterName}}
+{{inviterName}} has invited you to join {{orgName}}. Click the link below to set up your account. This invitation expires in {{expiresDays}} days.
+{{else}}
+You've been invited to join {{orgName}}. Click the link below to set up your account. This invitation expires in {{expiresDays}} days.
+{{/if}}
+{{#if personalMessage}}
+
+Message from {{#if inviterName}}{{inviterName}}{{else}}your admin{{/if}}:
+"{{personalMessage}}"
+
+{{/if}}
+{{{inviteUrl}}}
+
+© {{year}} {{branding.companyName}}

package/templates/default/emails/magic-link.hbs

@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <style>
+    body { font-family: system-ui, sans-serif; margin: 0; padding: 0; background: #f5f5f5; }
+    .wrapper { max-width: 560px; margin: 0 auto; padding: 40px 20px; }
+    .card { background: white; border-radius: 8px; padding: 32px; box-shadow: 0 1px 3px rgba(0,0,0,0.1); }
+    .btn { display: inline-block; background: {{branding.primaryColor}}; color: white; text-decoration: none; padding: 12px 32px; border-radius: 4px; font-size: 16px; font-weight: 500; }
+    .footer { text-align: center; padding: 16px; color: #6b7280; font-size: 12px; }
+  </style>
+</head>
+<body>
+  <div class="wrapper">
+    <div class="card">
+      {{#if branding.logoUrl}}<img src="{{branding.logoUrl}}" alt="{{branding.companyName}}" style="max-height: 40px; margin-bottom: 16px;">{{/if}}
+      <h1 style="font-size: 20px; margin: 0 0 12px 0;">Sign in to your account</h1>
+      <p>Hi {{userName}},</p>
+      <p>Click the button below to sign in. This link expires in {{expiresMinutes}} minutes.</p>
+      <p style="text-align: center; margin: 24px 0;">
+        <a href="{{{magicLinkUrl}}}" class="btn">Sign In</a>
+      </p>
+      <p style="color: #6b7280; font-size: 13px;">If you didn't request this, you can safely ignore this email.</p>
+      <p style="color: #6b7280; font-size: 13px;">Or copy this link: {{{magicLinkUrl}}}</p>
+    </div>
+    <div class="footer">&copy; {{year}} {{branding.companyName}}</div>
+  </div>
+</body>
+</html>

package/templates/default/emails/magic-link.txt.hbs

@@ -0,0 +1,11 @@
+Sign in to your account
+
+Hi {{userName}},
+
+Click the link below to sign in. This link expires in {{expiresMinutes}} minutes.
+
+{{{magicLinkUrl}}}
+
+If you didn't request this, you can safely ignore this email.
+
+© {{year}} {{branding.companyName}}