@prenta/core 0.118.0

package/dist/auth/session.js

@@ -0,0 +1,106 @@
+import * as jose from 'jose';
+/**
+ * Thrown when a JWT verifies cryptographically but its decoded payload
+ * doesn't match the expected `SessionPayload` shape. We map this to a 401
+ * (not 500) because it represents a forged-but-correctly-signed-by-the-CMS
+ * token rather than a server bug.
+ */
+export class InvalidSessionPayloadError extends Error {
+    constructor(reason) {
+        super(`Session payload is malformed: ${reason}`);
+        this.name = 'InvalidSessionPayloadError';
+    }
+}
+/**
+ * Narrow an arbitrary JWT payload to a `SessionPayload`. Required because
+ * `jose.jwtVerify()` returns `JWTPayload`, which is `Record<string, unknown>`
+ * — without an explicit shape check, downstream code reading `payload.role`
+ * would happily evaluate `undefined` against the `WRITE_ROLES`/`ADMIN_ROLES`
+ * sets and grant `false` (deny), which is safe — but reading `payload.userId`
+ * to look up the user would crash deep in the request, after side effects.
+ *
+ * Centralizing the check keeps the failure mode crisp: the request returns
+ * 401 and the audit log shows "malformed session" instead of a 500.
+ */
+function assertSessionPayload(payload) {
+    if (typeof payload !== 'object' || payload === null) {
+        throw new InvalidSessionPayloadError('payload is not an object');
+    }
+    const p = payload;
+    if (typeof p.userId !== 'string' || p.userId.length === 0) {
+        throw new InvalidSessionPayloadError('missing or invalid `userId`');
+    }
+    if (typeof p.role !== 'string' || p.role.length === 0) {
+        throw new InvalidSessionPayloadError('missing or invalid `role`');
+    }
+    if (typeof p.sessionId !== 'string' || p.sessionId.length === 0) {
+        throw new InvalidSessionPayloadError('missing or invalid `sessionId`');
+    }
+    if (p.fingerprint !== undefined && typeof p.fingerprint !== 'string') {
+        throw new InvalidSessionPayloadError('`fingerprint`, when present, must be a string');
+    }
+}
+const DEFAULT_MAX_AGE = 60 * 60 * 24 * 7; // 7 days
+/** Create a signed JWT session token. */
+export async function createSession(payload, options) {
+    const secret = new TextEncoder().encode(options.secret);
+    return new jose.SignJWT({ ...payload })
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt()
+        .setExpirationTime(`${options.maxAge ?? DEFAULT_MAX_AGE}s`)
+        .setIssuer(options.issuer ?? 'prenta-cms')
+        .setAudience(options.audience ?? 'prenta-cms')
+        .sign(secret);
+}
+/** Verify and decode a JWT session token. */
+export async function verifySession(token, options) {
+    const secret = new TextEncoder().encode(options.secret);
+    const { payload } = await jose.jwtVerify(token, secret, {
+        issuer: options.issuer ?? 'prenta-cms',
+        audience: options.audience ?? 'prenta-cms',
+    });
+    assertSessionPayload(payload);
+    // Strip standard JWT claims (iat/exp/iss/aud/etc) so the returned object
+    // is ONLY the SessionPayload fields we explicitly validated. This prevents
+    // callers (e.g. `refreshSession`) from accidentally re-signing arbitrary
+    // attacker-supplied claims.
+    const safe = {
+        userId: payload.userId,
+        role: payload.role,
+        sessionId: payload.sessionId,
+    };
+    if (payload.fingerprint !== undefined)
+        safe.fingerprint = payload.fingerprint;
+    return safe;
+}
+/** Revoke a session by marking it in the database. */
+export async function revokeSession(sessionId, db) {
+    await db.session.update({
+        where: { id: sessionId },
+        data: { revokedAt: new Date() },
+    });
+}
+/**
+ * Refresh a session token, issuing a new JWT with an extended expiry.
+ *
+ * When `db` is supplied, the existing `Session` row is verified to be active
+ * and its `expiresAt` is extended in lockstep with the new JWT. Without that
+ * check, a revoked session that was still in a user's cookie could be
+ * "un-revoked" simply by refreshing it.
+ */
+export async function refreshSession(token, options, db) {
+    const payload = await verifySession(token, options);
+    if (db) {
+        const session = await db.session.findUnique({ where: { id: payload.sessionId } });
+        if (!session || session.revokedAt || session.expiresAt < new Date()) {
+            throw new Error('Session is no longer active');
+        }
+        const maxAge = options.maxAge ?? DEFAULT_MAX_AGE;
+        await db.session.update({
+            where: { id: payload.sessionId },
+            data: { expiresAt: new Date(Date.now() + maxAge * 1000) },
+        });
+    }
+    return createSession(payload, options);
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAU5B;;;;;GAKG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,MAAc;QACxB,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAA;IAC5C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,0BAA0B,CAAC,6BAA6B,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,0BAA0B,CAAC,2BAA2B,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,0BAA0B,CAAC,gCAAgC,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,0BAA0B,CAAC,+CAA+C,CAAC,CAAA;IACvF,CAAC;AACH,CAAC;AASD,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,SAAS;AAElD,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAuB,EACvB,OAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACvD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;SACpC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,GAAG,CAAC;SAC1D,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;SACzC,WAAW,CAAC,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC;SAC7C,IAAI,CAAC,MAAM,CAAC,CAAA;AACjB,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,OAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACvD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;QACtD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,YAAY;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY;KAC3C,CAAC,CAAA;IACF,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAC7B,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,IAAI,GAAmB;QAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAA;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;IAC7E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,EAAY;IACjE,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;QACxB,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,OAAuB,EACvB,EAAa;IAEb,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAEnD,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAA;QAChD,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE;YAChC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE;SAC1D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AACxC,CAAC"}

package/dist/auth/team.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Team / access-control read models for the Users admin tab.
+ *
+ * Pure data shaping over the Prisma client (no config or request coupling) so it
+ * unit-tests cleanly. The API layer derives `workspaceDomain` / `seatLimit` from
+ * config and passes them in.
+ *
+ *   - `listTeamMembers`  — active/suspended/locked members, de-duplicated against
+ *                          pending invites (a placeholder user for a pending
+ *                          invite is shown only as the invite row).
+ *   - `getUserStats`     — the four summary cards (members, pending, admins, seats).
+ *   - `computeAccessReview` — risk recommendations from real signals.
+ */
+import { type DisplayRole, type UserRoleEnum } from './roles.js';
+import type { PrentaDB } from '../db/client-types.js';
+export type MemberStatus = 'active' | 'suspended' | 'locked' | 'deactivated';
+export interface TeamMember {
+    id: string;
+    name: string;
+    email: string;
+    initials: string;
+    role: UserRoleEnum;
+    roleName: DisplayRole;
+    status: MemberStatus;
+    mfaEnabled: boolean;
+    mfaRequired: boolean;
+    externalDomain: boolean;
+    authProvider: string | null;
+    lastLoginAt: string | null;
+    lastActiveAt: string | null;
+    acceptedInviteAt: string | null;
+    createdAt: string;
+    isCurrentUser: boolean;
+}
+export interface TeamOptions {
+    /** Registrable workspace domain, e.g. "prentamedia.com". */
+    workspaceDomain?: string | null;
+    /** Seat cap; null/undefined = unlimited. */
+    seatLimit?: number | null;
+    /** Used to mark the current row + protect self-actions. */
+    currentUserId?: string;
+    /** Access-review recommendation ids the workspace has dismissed. */
+    dismissedIds?: string[];
+}
+export interface MemberFilter {
+    search?: string;
+    /** Display-role filter ("Owner"/"Admin"/"Editor"/"Viewer"/"all"). */
+    role?: string;
+    status?: string;
+}
+export interface MemberListPage {
+    page: number;
+    pageSize: number;
+}
+export interface MemberListResult {
+    members: TeamMember[];
+    total: number;
+    page: number;
+    pageSize: number;
+    totalPages: number;
+}
+export declare function listTeamMembers(db: PrentaDB, filter?: MemberFilter, opts?: TeamOptions): Promise<TeamMember[]>;
+export declare function listTeamMembersPaginated(db: PrentaDB, filter?: MemberFilter, opts?: TeamOptions, pageOpts?: MemberListPage): Promise<MemberListResult>;
+export interface UserStats {
+    members: number;
+    pendingInvites: number;
+    admins: number;
+    seatsUsed: number;
+    seatLimit: number | null;
+    seatsAvailable: number | null;
+}
+export declare function getUserStats(db: PrentaDB, opts?: TeamOptions): Promise<UserStats>;
+export type Severity = 'low' | 'medium' | 'high' | 'critical';
+export type RecommendationType = 'inactive_user' | 'external_domain' | 'admin_without_mfa' | 'owner_without_mfa' | 'stale_invite' | 'never_signed_in';
+export interface AccessReviewRecommendation {
+    id: string;
+    userId: string | null;
+    inviteId?: string | null;
+    severity: Severity;
+    type: RecommendationType;
+    title: string;
+    description: string;
+    recommendedAction: string;
+    status: 'open';
+}
+/**
+ * Build one primary recommendation per member (highest-risk signal), plus a
+ * recommendation per stale pending invite. Dismissed ids are filtered out and
+ * the result is sorted highest-severity first.
+ */
+export declare function buildRecommendations(members: TeamMember[], pendingInvites: Array<{
+    id: string;
+    email: string;
+    createdAt: string;
+}>, dismissed: Set<string>): AccessReviewRecommendation[];
+export declare function computeAccessReview(db: PrentaDB, opts?: TeamOptions): Promise<AccessReviewRecommendation[]>;
+/** Derive the registrable workspace domain from a site URL, if any. */
+export declare function workspaceDomainFromUrl(siteUrl?: string | null): string | null;
+//# sourceMappingURL=team.d.ts.map

package/dist/auth/team.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../src/auth/team.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAA;AACpG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAOrD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAA;AAE5E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,WAAW,CAAA;IACrB,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,OAAO,CAAA;IACpB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AA0BD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,UAAU,EAAE,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB;AAiGD,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,GAAE,YAAiB,EACzB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,UAAU,EAAE,CAAC,CAGvB;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,QAAQ,EACZ,MAAM,GAAE,YAAiB,EACzB,IAAI,GAAE,WAAgB,EACtB,QAAQ,GAAE,cAAqE,GAC9E,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CA0B3F;AAED,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,cAAc,GACd,iBAAiB,CAAA;AAErB,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,kBAAkB,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf;AASD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,UAAU,EAAE,EACrB,cAAc,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EACvE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GACrB,0BAA0B,EAAE,CAuG9B;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAevC;AAED,uEAAuE;AACvE,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQ7E"}

package/dist/auth/team.js

@@ -0,0 +1,327 @@
+/**
+ * Team / access-control read models for the Users admin tab.
+ *
+ * Pure data shaping over the Prisma client (no config or request coupling) so it
+ * unit-tests cleanly. The API layer derives `workspaceDomain` / `seatLimit` from
+ * config and passes them in.
+ *
+ *   - `listTeamMembers`  — active/suspended/locked members, de-duplicated against
+ *                          pending invites (a placeholder user for a pending
+ *                          invite is shown only as the invite row).
+ *   - `getUserStats`     — the four summary cards (members, pending, admins, seats).
+ *   - `computeAccessReview` — risk recommendations from real signals.
+ */
+import { toDisplayRole, enumRolesForDisplay } from './roles.js';
+import { findInBatches } from '../db/find-in-batches.js';
+const INACTIVE_DAYS = 90;
+const STALE_INVITE_DAYS = 7;
+const DAY_MS = 24 * 60 * 60 * 1000;
+function initialsFor(name, email) {
+    const source = name?.trim() || email;
+    const parts = source.split(/\s+/).filter(Boolean);
+    if (parts.length >= 2)
+        return (parts[0][0] + parts[1][0]).toUpperCase();
+    const single = parts[0] ?? email;
+    return single.slice(0, 2).toUpperCase();
+}
+function emailDomain(email) {
+    return email.split('@')[1]?.toLowerCase() ?? '';
+}
+function iso(d) {
+    if (!d)
+        return null;
+    return d instanceof Date ? d.toISOString() : d;
+}
+function memberStatus(user) {
+    if (!user.isActive)
+        return 'deactivated';
+    if (user.lockedAt)
+        return 'locked';
+    if (user.suspendedAt)
+        return 'suspended';
+    return 'active';
+}
+const MEMBER_LIST_DEFAULT_PAGE_SIZE = 50;
+const MEMBER_LIST_MAX_PAGE_SIZE = 200;
+function buildUserWhere(filter) {
+    const where = {};
+    if (filter.search) {
+        const q = filter.search.trim();
+        if (q) {
+            where.OR = [
+                { name: { contains: q, mode: 'insensitive' } },
+                { email: { contains: q, mode: 'insensitive' } },
+            ];
+        }
+    }
+    const roleEnums = enumRolesForDisplay(filter.role);
+    if (roleEnums) {
+        where.role = { in: roleEnums };
+    }
+    const status = filter.status?.toLowerCase();
+    if (status && status !== 'all') {
+        if (status === 'deactivated') {
+            where.isActive = false;
+        }
+        else if (status === 'locked') {
+            where.isActive = true;
+            where.lockedAt = { not: null };
+        }
+        else if (status === 'suspended') {
+            where.isActive = true;
+            where.suspendedAt = { not: null };
+            where.lockedAt = null;
+        }
+        else if (status === 'active') {
+            where.isActive = true;
+            where.suspendedAt = null;
+            where.lockedAt = null;
+        }
+    }
+    return where;
+}
+function membersFromUsers(users, pending, opts) {
+    return users
+        .filter((u) => !pending.has(u.email.toLowerCase()))
+        .map((u) => toMember(u, opts));
+}
+function toMember(user, opts) {
+    const domain = emailDomain(user.email);
+    return {
+        id: user.id,
+        name: user.name,
+        email: user.email,
+        initials: initialsFor(user.name, user.email),
+        role: user.role,
+        roleName: toDisplayRole(user.role),
+        status: memberStatus(user),
+        mfaEnabled: !!user.totpEnabled,
+        mfaRequired: !!user.mfaRequired,
+        externalDomain: !!opts.workspaceDomain && !!domain && domain !== opts.workspaceDomain,
+        authProvider: user.authProvider ?? null,
+        lastLoginAt: iso(user.lastLoginAt),
+        lastActiveAt: iso(user.lastActiveAt ?? user.lastLoginAt),
+        acceptedInviteAt: iso(user.acceptedInviteAt),
+        createdAt: iso(user.createdAt) ?? new Date().toISOString(),
+        isCurrentUser: !!opts.currentUserId && user.id === opts.currentUserId,
+    };
+}
+/** Emails with a still-PENDING invite — excluded from the member list. */
+async function pendingInviteEmails(db) {
+    if (!db.invite?.findMany)
+        return new Set();
+    const rows = await db.invite.findMany({
+        where: { status: 'PENDING' },
+        select: { email: true },
+    });
+    return new Set(rows.map((r) => r.email.toLowerCase()));
+}
+async function loadAllUsers(db) {
+    return findInBatches(({ take, cursor }) => db.user.findMany({
+        take,
+        ...(cursor ? { skip: 1, cursor: { id: cursor } } : {}),
+        orderBy: { id: 'asc' },
+    }));
+}
+async function loadAllTeamMembers(db, opts) {
+    const [users, pending] = await Promise.all([loadAllUsers(db), pendingInviteEmails(db)]);
+    return membersFromUsers(users, pending, opts);
+}
+export async function listTeamMembers(db, filter = {}, opts = {}) {
+    const result = await listTeamMembersPaginated(db, filter, opts);
+    return result.members;
+}
+export async function listTeamMembersPaginated(db, filter = {}, opts = {}, pageOpts = { page: 1, pageSize: MEMBER_LIST_DEFAULT_PAGE_SIZE }) {
+    const page = Math.max(1, pageOpts.page);
+    const pageSize = Math.min(MEMBER_LIST_MAX_PAGE_SIZE, Math.max(1, pageOpts.pageSize || MEMBER_LIST_DEFAULT_PAGE_SIZE));
+    const where = buildUserWhere(filter);
+    const [users, pending, totalUsers] = await Promise.all([
+        db.user.findMany({
+            where,
+            orderBy: { createdAt: 'asc' },
+            skip: (page - 1) * pageSize,
+            take: pageSize,
+        }),
+        pendingInviteEmails(db),
+        db.user.count({ where }),
+    ]);
+    const members = membersFromUsers(users, pending, opts);
+    return {
+        members,
+        total: totalUsers,
+        page,
+        pageSize,
+        totalPages: Math.max(1, Math.ceil(totalUsers / pageSize)),
+    };
+}
+export async function getUserStats(db, opts = {}) {
+    const members = await loadAllTeamMembers(db, opts);
+    const active = members.filter((m) => m.status === 'active');
+    const admins = active.filter((m) => m.roleName === 'Owner' || m.roleName === 'Admin').length;
+    let pendingInvites = 0;
+    if (db.invite?.count) {
+        pendingInvites = await db.invite.count({
+            where: { status: 'PENDING', expiresAt: { gt: new Date() } },
+        });
+    }
+    // Active members + pending invites reserve seats. Suspended/locked/deactivated
+    // do not count.
+    const seatsUsed = active.length + pendingInvites;
+    const seatLimit = opts.seatLimit ?? null;
+    const seatsAvailable = seatLimit == null ? null : Math.max(0, seatLimit - seatsUsed);
+    return {
+        members: active.length,
+        pendingInvites,
+        admins,
+        seatsUsed,
+        seatLimit,
+        seatsAvailable,
+    };
+}
+const SEVERITY_RANK = { critical: 4, high: 3, medium: 2, low: 1 };
+function daysSince(d) {
+    if (!d)
+        return null;
+    return Math.floor((Date.now() - new Date(d).getTime()) / DAY_MS);
+}
+/**
+ * Build one primary recommendation per member (highest-risk signal), plus a
+ * recommendation per stale pending invite. Dismissed ids are filtered out and
+ * the result is sorted highest-severity first.
+ */
+export function buildRecommendations(members, pendingInvites, dismissed) {
+    const recs = [];
+    for (const m of members) {
+        if (m.status !== 'active')
+            continue;
+        const inactiveDays = daysSince(m.lastLoginAt);
+        const inactive = inactiveDays != null && inactiveDays >= INACTIVE_DAYS;
+        const neverSignedIn = m.lastLoginAt == null && m.acceptedInviteAt != null;
+        const isOwner = m.roleName === 'Owner';
+        const isAdmin = m.roleName === 'Admin';
+        let rec = null;
+        if (isOwner && !m.mfaEnabled) {
+            rec = {
+                id: `owner_without_mfa:${m.id}`,
+                userId: m.id,
+                severity: 'critical',
+                type: 'owner_without_mfa',
+                title: 'Owner without MFA',
+                description: `${m.name} (${m.email}) is an Owner but has not enabled multi-factor authentication.`,
+                recommendedAction: 'Require MFA',
+                status: 'open',
+            };
+        }
+        else if (isAdmin && !m.mfaEnabled) {
+            rec = {
+                id: `admin_without_mfa:${m.id}`,
+                userId: m.id,
+                severity: 'high',
+                type: 'admin_without_mfa',
+                title: 'Admin without MFA',
+                description: `${m.name} (${m.email}) has admin access but has not enabled multi-factor authentication.`,
+                recommendedAction: 'Require MFA',
+                status: 'open',
+            };
+        }
+        else if (inactive && m.externalDomain) {
+            rec = {
+                id: `inactive_user:${m.id}`,
+                userId: m.id,
+                severity: 'high',
+                type: 'inactive_user',
+                title: 'Access review',
+                description: `${m.name} (${m.email}) hasn't signed in for ${inactiveDays} days and holds an external address. Consider revoking access to reduce risk.`,
+                recommendedAction: 'Revoke access',
+                status: 'open',
+            };
+        }
+        else if (inactive) {
+            rec = {
+                id: `inactive_user:${m.id}`,
+                userId: m.id,
+                severity: 'medium',
+                type: 'inactive_user',
+                title: 'Inactive user',
+                description: `${m.name} (${m.email}) hasn't signed in for ${inactiveDays} days.`,
+                recommendedAction: 'Revoke access',
+                status: 'open',
+            };
+        }
+        else if (m.externalDomain) {
+            rec = {
+                id: `external_domain:${m.id}`,
+                userId: m.id,
+                severity: m.roleName === 'Viewer' ? 'low' : 'medium',
+                type: 'external_domain',
+                title: 'External domain',
+                description: `${m.name} (${m.email}) signs in with an external email domain.`,
+                recommendedAction: 'Review access',
+                status: 'open',
+            };
+        }
+        else if (neverSignedIn) {
+            rec = {
+                id: `never_signed_in:${m.id}`,
+                userId: m.id,
+                severity: 'medium',
+                type: 'never_signed_in',
+                title: 'Never signed in',
+                description: `${m.name} (${m.email}) has an account but has never signed in.`,
+                recommendedAction: 'Send reminder',
+                status: 'open',
+            };
+        }
+        if (rec && !dismissed.has(rec.id))
+            recs.push(rec);
+    }
+    for (const inv of pendingInvites) {
+        const age = daysSince(inv.createdAt);
+        if (age != null && age >= STALE_INVITE_DAYS) {
+            const id = `stale_invite:${inv.id}`;
+            if (!dismissed.has(id)) {
+                recs.push({
+                    id,
+                    userId: null,
+                    inviteId: inv.id,
+                    severity: 'medium',
+                    type: 'stale_invite',
+                    title: 'Stale invitation',
+                    description: `The invitation to ${inv.email} has been pending for ${age} days.`,
+                    recommendedAction: 'Resend or cancel',
+                    status: 'open',
+                });
+            }
+        }
+    }
+    return recs.sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]);
+}
+export async function computeAccessReview(db, opts = {}) {
+    const members = await loadAllTeamMembers(db, opts);
+    let pending = [];
+    if (db.invite?.findMany) {
+        const rows = await db.invite.findMany({
+            where: { status: 'PENDING' },
+            select: { id: true, email: true, createdAt: true },
+        });
+        pending = rows.map((r) => ({
+            id: r.id,
+            email: r.email,
+            createdAt: iso(r.createdAt) ?? new Date().toISOString(),
+        }));
+    }
+    return buildRecommendations(members, pending, new Set(opts.dismissedIds ?? []));
+}
+/** Derive the registrable workspace domain from a site URL, if any. */
+export function workspaceDomainFromUrl(siteUrl) {
+    if (!siteUrl)
+        return null;
+    try {
+        const host = new URL(siteUrl).hostname.toLowerCase();
+        return host.replace(/^www\./, '');
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=team.js.map

package/dist/auth/team.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.js","sourceRoot":"","sources":["../../src/auth/team.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAuC,MAAM,YAAY,CAAA;AAEpG,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAExD,MAAM,aAAa,GAAG,EAAE,CAAA;AACxB,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAC3B,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAyClC,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,MAAM,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;AACjD,CAAC;AAED,SAAS,GAAG,CAAC,CAAmC;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,IAAS;IAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,aAAa,CAAA;IACxC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAClC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,WAAW,CAAA;IACxC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAeD,MAAM,6BAA6B,GAAG,EAAE,CAAA;AACxC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAErC,SAAS,cAAc,CAAC,MAAoB;IAC1C,MAAM,KAAK,GAA4B,EAAE,CAAA;IAEzC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC9B,IAAI,CAAC,EAAE,CAAC;YACN,KAAK,CAAC,EAAE,GAAG;gBACT,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC9C,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;aAChD,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClD,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAA;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAA;IAC3C,IAAI,MAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC/B,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAA;QACxB,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACrB,KAAK,CAAC,QAAQ,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;QAChC,CAAC;aAAM,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACrB,KAAK,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;YACjC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;QACvB,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;YACxB,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;QACvB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAY,EAAE,OAAoB,EAAE,IAAiB;IAC7E,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAS,EAAE,IAAiB;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;QAC5C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;QAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;QAC9B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;QAC/B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC,eAAe;QACrF,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;QACvC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;QAClC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,CAAC;QACxD,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC5C,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC1D,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,aAAa;KACtE,CAAA;AACH,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,mBAAmB,CAAC,EAAY;IAC7C,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ;QAAE,OAAO,IAAI,GAAG,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACpC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAC5B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;KACxB,CAAC,CAAA;IACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAY;IACtC,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CACxC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QACf,IAAI;QACJ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;KACvB,CAAC,CACH,CAAA;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,EAAY,EAAE,IAAiB;IAC/D,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACvF,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAY,EACZ,SAAuB,EAAE,EACzB,OAAoB,EAAE;IAEtB,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAC/D,OAAO,MAAM,CAAC,OAAO,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAY,EACZ,SAAuB,EAAE,EACzB,OAAoB,EAAE,EACtB,WAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,6BAA6B,EAAE;IAE/E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,yBAAyB,EACzB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,IAAI,6BAA6B,CAAC,CAChE,CAAA;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IAEpC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YACf,KAAK;YACL,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YAC7B,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ;YAC3B,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,mBAAmB,CAAC,EAAE,CAAC;QACvB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;KACzB,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IACtD,OAAO;QACL,OAAO;QACP,KAAK,EAAE,UAAU;QACjB,IAAI;QACJ,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,CAAC;KAC1D,CAAA;AACH,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,OAAoB,EAAE;IACrE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAA;IAE5F,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,cAAc,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;YACrC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE;SAC5D,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,cAAc,CAAA;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IACxC,MAAM,cAAc,GAAG,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC,CAAA;IAEpF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,cAAc;QACd,MAAM;QACN,SAAS;QACT,SAAS;QACT,cAAc;KACf,CAAA;AACH,CAAC;AAwBD,MAAM,aAAa,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAA;AAE3F,SAAS,SAAS,CAAC,CAAgB;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,CAAA;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,cAAuE,EACvE,SAAsB;IAEtB,MAAM,IAAI,GAAiC,EAAE,CAAA;IAE7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAQ;QACnC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAG,YAAY,IAAI,IAAI,IAAI,YAAY,IAAI,aAAa,CAAA;QACtE,MAAM,aAAa,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAA;QACzE,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAA;QACtC,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAA;QAEtC,IAAI,GAAG,GAAsC,IAAI,CAAA;QACjD,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7B,GAAG,GAAG;gBACJ,EAAE,EAAE,qBAAqB,CAAC,CAAC,EAAE,EAAE;gBAC/B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,mBAAmB;gBAC1B,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,gEAAgE;gBAClG,iBAAiB,EAAE,aAAa;gBAChC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACpC,GAAG,GAAG;gBACJ,EAAE,EAAE,qBAAqB,CAAC,CAAC,EAAE,EAAE;gBAC/B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,mBAAmB;gBAC1B,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,qEAAqE;gBACvG,iBAAiB,EAAE,aAAa;gBAChC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,QAAQ,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;YACxC,GAAG,GAAG;gBACJ,EAAE,EAAE,iBAAiB,CAAC,CAAC,EAAE,EAAE;gBAC3B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,0BAA0B,YAAY,+EAA+E;gBACvJ,iBAAiB,EAAE,eAAe;gBAClC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,GAAG,GAAG;gBACJ,EAAE,EAAE,iBAAiB,CAAC,CAAC,EAAE,EAAE;gBAC3B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,0BAA0B,YAAY,QAAQ;gBAChF,iBAAiB,EAAE,eAAe;gBAClC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;YAC5B,GAAG,GAAG;gBACJ,EAAE,EAAE,mBAAmB,CAAC,CAAC,EAAE,EAAE;gBAC7B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACpD,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,2CAA2C;gBAC7E,iBAAiB,EAAE,eAAe;gBAClC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YACzB,GAAG,GAAG;gBACJ,EAAE,EAAE,mBAAmB,CAAC,CAAC,EAAE,EAAE;gBAC7B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,2CAA2C;gBAC7E,iBAAiB,EAAE,eAAe;gBAClC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,iBAAiB,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,gBAAgB,GAAG,CAAC,EAAE,EAAE,CAAA;YACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC;oBACR,EAAE;oBACF,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,GAAG,CAAC,EAAE;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,cAAc;oBACpB,KAAK,EAAE,kBAAkB;oBACzB,WAAW,EAAE,qBAAqB,GAAG,CAAC,KAAK,yBAAyB,GAAG,QAAQ;oBAC/E,iBAAiB,EAAE,kBAAkB;oBACrC,MAAM,EAAE,MAAM;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAY,EACZ,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAClD,IAAI,OAAO,GAA4D,EAAE,CAAA;IACzE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YACpC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;YAC5B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SACnD,CAAC,CAAA;QACF,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxD,CAAC,CAAC,CAAA;IACL,CAAC;IACD,OAAO,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAA;AACjF,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CAAC,OAAuB;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/auth/totp.d.ts

@@ -0,0 +1,31 @@
+export declare function generateTOTPSecret(): string;
+export declare function generateTOTPUri(secret: string, email: string, issuer?: string): string;
+/**
+ * Verify a TOTP code and return the matched time-step counter, or null if no
+ * code in the ±`window` span matches. The counter enables single-use
+ * enforcement: the caller persists it and rejects any code whose step was
+ * already consumed, so a captured-but-still-valid code can't be replayed within
+ * its window (#565).
+ */
+export declare function verifyTOTPStep(token: string, secret: string, window?: number): number | null;
+export declare function verifyTOTP(token: string, secret: string, window?: number): boolean;
+/**
+ * Generate the current TOTP code for a secret — the counterpart to
+ * {@link verifyTOTP}, for tooling and tests (an authenticator app is the normal
+ * source of codes).
+ */
+export declare function generateTOTP(secret: string): string;
+/**
+ * Normalize a user-entered backup code: strip whitespace/dashes and lowercase
+ * so "ABCD-1234" and "abcd 1234" both match the stored "abcd1234".
+ */
+export declare function normalizeBackupCode(input: string): string;
+/**
+ * Find the index of the stored backup code matching the submitted value, or -1.
+ * Compares against every stored code in constant time so timing can't reveal
+ * which/whether a code matched. Callers must treat a match as single-use and
+ * remove the code from storage.
+ */
+export declare function findBackupCodeMatch(codes: string[], submitted: string): number;
+export declare function generateBackupCodes(count?: number): string[];
+//# sourceMappingURL=totp.d.ts.map

package/dist/auth/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/auth/totp.ts"],"names":[],"mappings":"AAKA,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,SAAe,GAAG,MAAM,CAE5F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,MAAM,GAAG,IAAI,CAQvF;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAE7E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAkED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQ9E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,SAAI,GAAG,MAAM,EAAE,CAavD"}