@proteinjs/user-server 1.21.1 → 1.22.1

package/dist/src/authentication/PasswordResetToken.d.ts

@@ -1,3 +1,4 @@
+import { Moment } from 'moment';
 import { User } from '@proteinjs/user';
 export type PasswordResetResolution = {
     status: 'malformed';
@@ -15,30 +16,60 @@ export type PasswordResetResolution = {
  * The password-reset token's one owner: its shape, its mint, the lookup that maps a presented
  * value back to the user it was issued to, and its single-use redemption.
  *
- * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters),
- * stored on the user row beside its expiry until it is redeemed or expires.
+ * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters). The
+ * token itself exists only in the link mailed to the account: the user row stores its SHA-256
+ * digest (hex) beside the expiry, never the token, so a read of the table yields nothing that
+ * can be presented. A digest is not a token — presenting one is hashed again and matches no row.
+ * A fast unsalted hash is enough here because the input is 256 bits of CSPRNG output, not a
+ * human-chosen secret.
  *
- * Resolution refuses anything that is not a value of that shape BEFORE any lookup. A query
- * filter built from a request value that is not a token does not compare the way a token does:
- * `null` renders as `IS NULL` and would match every account with no pending reset, an empty
- * string matches an emptied column, and other types reach the driver. The row the lookup
- * returns is then re-checked in code — its stored token must be a string equal to the presented
- * one (compared in constant time) and its expiry a real timestamp still in the future — so the
+ * Resolution refuses anything that is not a value of the token's shape BEFORE any lookup. A
+ * query filter built from a request value that is not a token does not compare the way a token
+ * does: `null` renders as `IS NULL` and would match every account with no pending reset, an
+ * empty string matches an emptied column, and other types reach the driver. The presented token
+ * is then hashed, the row is looked up by that digest, and the row the lookup returns is
+ * re-checked in code — its stored digest must be a string equal to the presented token's digest
+ * (compared in constant time) and its expiry a real timestamp still in the future — so the
  * outcome never rests on how the storage compares.
+ *
+ * No migration accompanies the move from a stored token to a stored digest: a row that still
+ * holds a token minted before it never equals the digest of anything presented, so that token
+ * fails validation for what remains of its hour and the person asks for a new link.
  */
 export declare class PasswordResetToken {
     private static readonly SHAPE;
-    mint(): string;
+    private static readonly LIFETIME_MINUTES;
+    /**
+     * Issue a token to `user`: store its digest and its expiry on the row, replacing any token
+     * outstanding, and return the token — the only time it exists outside the mailed link.
+     */
+    mint(user: User): Promise<string>;
     resolve(presented: unknown): Promise<PasswordResetResolution>;
     /**
      * Write the new credential and clear the token in one conditional update: the row must still
-     * carry this token at write time, so two presentations of the same token cannot both succeed.
-     * Resolves false when the token was already redeemed.
+     * carry this token's digest at write time, so two presentations of the same token cannot both
+     * succeed. Resolves false when the token was already redeemed.
      */
     redeem(user: User, token: string, hashedPassword: string): Promise<boolean>;
-    /** A log-safe reference to a presented token: a short digest of a well-formed one, never the value itself. */
+    /**
+     * Withdraw a token that never reached its owner (the mail carrying it failed to send): the row
+     * is cleared only while it still carries this token's digest, so a newer token is left alone.
+     */
+    revoke(user: User, token: string): Promise<void>;
+    /** When the token outstanding on `user` was minted, or undefined when the row carries none. */
+    mintedAt(user: User): Moment | undefined;
+    /**
+     * A log-safe reference to a presented token: a short prefix of a well-formed one's digest,
+     * never the value itself and never a part of it. The routes log it only for a token that
+     * resolved `unknown` — one no row carries — so it never lines up with a digest a row holds.
+     * What it is for is telling refusals apart in the log: one stale link presented again reads
+     * the same each time, a run of different values reads differently. 48 bits of the SHA-256 of
+     * 256 random bits identify nothing and can be presented nowhere.
+     */
     fingerprint(presented: unknown): string | undefined;
     private parse;
+    /** What the row stores in place of a token: its SHA-256, hex-encoded. */
+    private digest;
     private matches;
     private isLive;
 }

package/dist/src/authentication/PasswordResetToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetToken.d.ts","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":"AAGA,OAAO,EAAU,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAEjD,IAAI,IAAI,MAAM;IAIR,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkBnE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASjF,8GAA8G;IAC9G,WAAW,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS;IASnD,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,MAAM;CAQf"}
+{"version":3,"file":"PasswordResetToken.d.ts","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":"AACA,OAAe,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAU,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAoB;IACjD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAM;IAE9C;;;OAGG;IACG,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAUjC,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmBnE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASjF;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS;IAQxC;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS;IASnD,OAAO,CAAC,KAAK;IAIb,yEAAyE;IACzE,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,MAAM;CAQf"}

package/dist/src/authentication/PasswordResetToken.js

@@ -48,26 +48,55 @@ var user_1 = require("@proteinjs/user");
  * The password-reset token's one owner: its shape, its mint, the lookup that maps a presented
  * value back to the user it was issued to, and its single-use redemption.
  *
- * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters),
- * stored on the user row beside its expiry until it is redeemed or expires.
+ * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters). The
+ * token itself exists only in the link mailed to the account: the user row stores its SHA-256
+ * digest (hex) beside the expiry, never the token, so a read of the table yields nothing that
+ * can be presented. A digest is not a token — presenting one is hashed again and matches no row.
+ * A fast unsalted hash is enough here because the input is 256 bits of CSPRNG output, not a
+ * human-chosen secret.
  *
- * Resolution refuses anything that is not a value of that shape BEFORE any lookup. A query
- * filter built from a request value that is not a token does not compare the way a token does:
- * `null` renders as `IS NULL` and would match every account with no pending reset, an empty
- * string matches an emptied column, and other types reach the driver. The row the lookup
- * returns is then re-checked in code — its stored token must be a string equal to the presented
- * one (compared in constant time) and its expiry a real timestamp still in the future — so the
+ * Resolution refuses anything that is not a value of the token's shape BEFORE any lookup. A
+ * query filter built from a request value that is not a token does not compare the way a token
+ * does: `null` renders as `IS NULL` and would match every account with no pending reset, an
+ * empty string matches an emptied column, and other types reach the driver. The presented token
+ * is then hashed, the row is looked up by that digest, and the row the lookup returns is
+ * re-checked in code — its stored digest must be a string equal to the presented token's digest
+ * (compared in constant time) and its expiry a real timestamp still in the future — so the
  * outcome never rests on how the storage compares.
+ *
+ * No migration accompanies the move from a stored token to a stored digest: a row that still
+ * holds a token minted before it never equals the digest of anything presented, so that token
+ * fails validation for what remains of its hour and the person asks for a new link.
  */
 var PasswordResetToken = /** @class */ (function () {
     function PasswordResetToken() {
     }
-    PasswordResetToken.prototype.mint = function () {
-        return (0, crypto_1.randomBytes)(32).toString('hex');
+    /**
+     * Issue a token to `user`: store its digest and its expiry on the row, replacing any token
+     * outstanding, and return the token — the only time it exists outside the mailed link.
+     */
+    PasswordResetToken.prototype.mint = function (user) {
+        return __awaiter(this, void 0, void 0, function () {
+            var token;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        token = (0, crypto_1.randomBytes)(32).toString('hex');
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
+                                id: user.id,
+                                passwordResetToken: this.digest(token),
+                                passwordResetTokenExpiration: (0, moment_1.default)().add(PasswordResetToken.LIFETIME_MINUTES, 'minutes'),
+                            })];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/, token];
+                }
+            });
+        });
     };
     PasswordResetToken.prototype.resolve = function (presented) {
         return __awaiter(this, void 0, void 0, function () {
-            var token, user;
+            var token, digest, user;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -75,10 +104,11 @@ var PasswordResetToken = /** @class */ (function () {
                         if (token === undefined) {
                             return [2 /*return*/, { status: 'malformed' }];
                         }
-                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { passwordResetToken: token })];
+                        digest = this.digest(token);
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { passwordResetToken: digest })];
                     case 1:
                         user = _a.sent();
-                        if (!user || !this.matches(user.passwordResetToken, token)) {
+                        if (!user || !this.matches(user.passwordResetToken, digest)) {
                             return [2 /*return*/, { status: 'unknown' }];
                         }
                         if (!this.isLive(user.passwordResetTokenExpiration)) {
@@ -91,15 +121,15 @@ var PasswordResetToken = /** @class */ (function () {
     };
     /**
      * Write the new credential and clear the token in one conditional update: the row must still
-     * carry this token at write time, so two presentations of the same token cannot both succeed.
-     * Resolves false when the token was already redeemed.
+     * carry this token's digest at write time, so two presentations of the same token cannot both
+     * succeed. Resolves false when the token was already redeemed.
      */
     PasswordResetToken.prototype.redeem = function (user, token, hashedPassword) {
         return __awaiter(this, void 0, void 0, function () {
             var updated;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { password: hashedPassword, passwordResetToken: null, passwordResetTokenExpiration: null }, { id: user.id, passwordResetToken: token })];
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { password: hashedPassword, passwordResetToken: null, passwordResetTokenExpiration: null }, { id: user.id, passwordResetToken: this.digest(token) })];
                     case 1:
                         updated = _a.sent();
                         return [2 /*return*/, updated === 1];
@@ -107,22 +137,56 @@ var PasswordResetToken = /** @class */ (function () {
             });
         });
     };
-    /** A log-safe reference to a presented token: a short digest of a well-formed one, never the value itself. */
+    /**
+     * Withdraw a token that never reached its owner (the mail carrying it failed to send): the row
+     * is cleared only while it still carries this token's digest, so a newer token is left alone.
+     */
+    PasswordResetToken.prototype.revoke = function (user, token) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { passwordResetToken: null, passwordResetTokenExpiration: null }, { id: user.id, passwordResetToken: this.digest(token) })];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /** When the token outstanding on `user` was minted, or undefined when the row carries none. */
+    PasswordResetToken.prototype.mintedAt = function (user) {
+        if (!user.passwordResetToken || !user.passwordResetTokenExpiration) {
+            return undefined;
+        }
+        return (0, moment_1.default)(user.passwordResetTokenExpiration).subtract(PasswordResetToken.LIFETIME_MINUTES, 'minutes');
+    };
+    /**
+     * A log-safe reference to a presented token: a short prefix of a well-formed one's digest,
+     * never the value itself and never a part of it. The routes log it only for a token that
+     * resolved `unknown` — one no row carries — so it never lines up with a digest a row holds.
+     * What it is for is telling refusals apart in the log: one stale link presented again reads
+     * the same each time, a run of different values reads differently. 48 bits of the SHA-256 of
+     * 256 random bits identify nothing and can be presented nowhere.
+     */
     PasswordResetToken.prototype.fingerprint = function (presented) {
         var token = this.parse(presented);
         if (token === undefined) {
             return undefined;
         }
-        return (0, crypto_1.createHash)('sha256').update(token).digest('hex').slice(0, 12);
+        return this.digest(token).slice(0, 12);
     };
     PasswordResetToken.prototype.parse = function (presented) {
         return typeof presented === 'string' && PasswordResetToken.SHAPE.test(presented) ? presented : undefined;
     };
-    PasswordResetToken.prototype.matches = function (stored, presented) {
-        if (typeof stored !== 'string' || stored.length !== presented.length) {
+    /** What the row stores in place of a token: its SHA-256, hex-encoded. */
+    PasswordResetToken.prototype.digest = function (token) {
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+    };
+    PasswordResetToken.prototype.matches = function (storedDigest, presentedDigest) {
+        if (typeof storedDigest !== 'string' || storedDigest.length !== presentedDigest.length) {
             return false;
         }
-        return (0, crypto_1.timingSafeEqual)(Buffer.from(stored), Buffer.from(presented));
+        return (0, crypto_1.timingSafeEqual)(Buffer.from(storedDigest), Buffer.from(presentedDigest));
     };
     PasswordResetToken.prototype.isLive = function (expiration) {
         if (!expiration) {
@@ -132,6 +196,7 @@ var PasswordResetToken = /** @class */ (function () {
         return expiresAt.isValid() && (0, moment_1.default)().isBefore(expiresAt);
     };
     PasswordResetToken.SHAPE = /^[0-9a-f]{64}$/;
+    PasswordResetToken.LIFETIME_MINUTES = 60;
     return PasswordResetToken;
 }());
 exports.PasswordResetToken = PasswordResetToken;

package/dist/src/authentication/PasswordResetToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetToken.js","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAkE;AAClE,kDAAwC;AACxC,oCAA8C;AAC9C,wCAA+C;AAQ/C;;;;;;;;;;;;;;GAcG;AACH;IAAA;IAqEA,CAAC;IAlEC,iCAAI,GAAJ;QACE,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEK,oCAAO,GAAb,UAAc,SAAkB;;;;;;wBACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;wBACpC,IAAI,KAAK,KAAK,SAAS,EAAE;4BACvB,sBAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAC;yBAChC;wBAEY,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;wBAA5E,IAAI,GAAG,SAAqE;wBAClF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE;4BAC1D,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAC;yBAC9B;wBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE;4BACnD,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,MAAA,EAAE,EAAC;yBACpC;wBAED,sBAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE,KAAK,OAAA,EAAE,EAAC;;;;KACxC;IAED;;;;OAIG;IACG,mCAAM,GAAZ,UAAa,IAAU,EAAE,KAAa,EAAE,cAAsB;;;;;4BAC5C,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAC1C,aAAM,CAAC,IAAI,EACX,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAC1F,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAC3C,EAAA;;wBAJK,OAAO,GAAG,SAIf;wBACD,sBAAO,OAAO,KAAK,CAAC,EAAC;;;;KACtB;IAED,8GAA8G;IAC9G,wCAAW,GAAX,UAAY,SAAkB;QAC5B,IAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE;YACvB,OAAO,SAAS,CAAC;SAClB;QAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,kCAAK,GAAb,UAAc,SAAkB;QAC9B,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;IAEO,oCAAO,GAAf,UAAgB,MAAiC,EAAE,SAAiB;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE;YACpE,OAAO,KAAK,CAAC;SACd;QAED,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,mCAAM,GAAd,UAAe,UAAqC;QAClD,IAAI,CAAC,UAAU,EAAE;YACf,OAAO,KAAK,CAAC;SACd;QAED,IAAM,SAAS,GAAG,IAAA,gBAAM,EAAC,UAAU,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,IAAA,gBAAM,GAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAnEuB,wBAAK,GAAG,gBAAgB,CAAC;IAoEnD,yBAAC;CAAA,AArED,IAqEC;AArEY,gDAAkB"}
+{"version":3,"file":"PasswordResetToken.js","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAkE;AAClE,kDAAwC;AACxC,oCAA8C;AAC9C,wCAA+C;AAQ/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;IAAA;IAkHA,CAAC;IA9GC;;;OAGG;IACG,iCAAI,GAAV,UAAW,IAAU;;;;;;wBACb,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC9C,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;gCACxC,EAAE,EAAE,IAAI,CAAC,EAAE;gCACX,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gCACtC,4BAA4B,EAAE,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,CAAC;6BAC3F,CAAC,EAAA;;wBAJF,SAIE,CAAC;wBACH,sBAAO,KAAK,EAAC;;;;KACd;IAEK,oCAAO,GAAb,UAAc,SAAkB;;;;;;wBACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;wBACpC,IAAI,KAAK,KAAK,SAAS,EAAE;4BACvB,sBAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAC;yBAChC;wBAEK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBACrB,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAA7E,IAAI,GAAG,SAAsE;wBACnF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE;4BAC3D,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAC;yBAC9B;wBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE;4BACnD,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,MAAA,EAAE,EAAC;yBACpC;wBAED,sBAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE,KAAK,OAAA,EAAE,EAAC;;;;KACxC;IAED;;;;OAIG;IACG,mCAAM,GAAZ,UAAa,IAAU,EAAE,KAAa,EAAE,cAAsB;;;;;4BAC5C,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAC1C,aAAM,CAAC,IAAI,EACX,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAC1F,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxD,EAAA;;wBAJK,OAAO,GAAG,SAIf;wBACD,sBAAO,OAAO,KAAK,CAAC,EAAC;;;;KACtB;IAED;;;OAGG;IACG,mCAAM,GAAZ,UAAa,IAAU,EAAE,KAAa;;;;4BACpC,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAC1B,aAAM,CAAC,IAAI,EACX,EAAE,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAChE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxD,EAAA;;wBAJD,SAIC,CAAC;;;;;KACH;IAED,+FAA+F;IAC/F,qCAAQ,GAAR,UAAS,IAAU;QACjB,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE;YAClE,OAAO,SAAS,CAAC;SAClB;QAED,OAAO,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAC5G,CAAC;IAED;;;;;;;OAOG;IACH,wCAAW,GAAX,UAAY,SAAkB;QAC5B,IAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE;YACvB,OAAO,SAAS,CAAC;SAClB;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAEO,kCAAK,GAAb,UAAc,SAAkB;QAC9B,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;IAED,yEAAyE;IACjE,mCAAM,GAAd,UAAe,KAAa;QAC1B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,oCAAO,GAAf,UAAgB,YAAuC,EAAE,eAAuB;QAC9E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE;YACtF,OAAO,KAAK,CAAC;SACd;QAED,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IAClF,CAAC;IAEO,mCAAM,GAAd,UAAe,UAAqC;QAClD,IAAI,CAAC,UAAU,EAAE;YACf,OAAO,KAAK,CAAC;SACd;QAED,IAAM,SAAS,GAAG,IAAA,gBAAM,EAAC,UAAU,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,IAAA,gBAAM,GAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAhHuB,wBAAK,GAAG,gBAAgB,CAAC;IACzB,mCAAgB,GAAG,EAAE,CAAC;IAgHhD,yBAAC;CAAA,AAlHD,IAkHC;AAlHY,gDAAkB"}

package/dist/src/routes/devLogin.d.ts

@@ -32,7 +32,7 @@ import { Route } from '@proteinjs/server-api';
  * call is unchanged; the variable absent = nothing changes; the gates closed = 404 regardless.
  * Test and prod never set it — the omission is the safety, the same idiom as the gates. The
  * outcome is logged as ONE marker line, `Dev bootstrap admin door: <granted|admin-exists>`,
- * which the n3xa compose-estate boot proof reads from the server log to PROVE the grant landed.
+ * which a consumer's boot proof can read from the server log to PROVE the grant landed.
  *
  * Role-bootstrap door (`DEV_BOOTSTRAP_ROLES='email:role[,role];email:role…'`, the grammar in
  * DevBootstrapRoles.ts): the first-admin door leaves every OTHER account role-less, and a

package/dist/src/routes/devLogin.js

@@ -80,7 +80,7 @@ var emailDomain = function (address) { return address.slice(address.lastIndexOf(
  * call is unchanged; the variable absent = nothing changes; the gates closed = 404 regardless.
  * Test and prod never set it — the omission is the safety, the same idiom as the gates. The
  * outcome is logged as ONE marker line, `Dev bootstrap admin door: <granted|admin-exists>`,
- * which the n3xa compose-estate boot proof reads from the server log to PROVE the grant landed.
+ * which a consumer's boot proof can read from the server log to PROVE the grant landed.
  *
  * Role-bootstrap door (`DEV_BOOTSTRAP_ROLES='email:role[,role];email:role…'`, the grammar in
  * DevBootstrapRoles.ts): the first-admin door leaves every OTHER account role-less, and a

package/dist/src/routes/devMail.d.ts

@@ -0,0 +1,4 @@
+import { Route } from '@proteinjs/server-api';
+export declare const devMail: Route;
+export declare const devMailMessage: Route;
+//# sourceMappingURL=devMail.d.ts.map

package/dist/src/routes/devMail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devMail.d.ts","sourceRoot":"","sources":["../../../src/routes/devMail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAuB9C,eAAO,MAAM,OAAO,EAAE,KAwBrB,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,KAsB5B,CAAC"}

package/dist/src/routes/devMail.js

@@ -0,0 +1,119 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.devMailMessage = exports.devMail = void 0;
+var email_server_1 = require("@proteinjs/email-server");
+/**
+ * DEV-ONLY mail door: reads the process's mail sink (`@proteinjs/email-server` MailSink — the
+ * messages a development sender recorded instead of transporting), so automated dev-loop testing
+ * reads an invite or reset link from the sink instead of needing a real inbox, and nothing a dev
+ * server composes ever has to reach a real address to be verified.
+ *
+ *   GET /dev/mail[?n=<count>]  the last n messages (default 20, at most MailSink.CAPACITY), newest
+ *                              first: id, at, from, to, subject, the body's first link, refused, url
+ *   GET /dev/mail/<id>         the rendered message — its html part, or its text part as text/plain
+ *
+ * Double-gated exactly like `/dev/login` (devLogin.ts), acting only when BOTH hold; otherwise the
+ * paths answer 404 as if unregistered:
+ * 1. `process.env.DEVELOPMENT` — the dev-server switch, never set in prod images.
+ * 2. `DEV_AUTO_LOGIN_EMAIL` — the explicit per-launch dev opt-in.
+ */
+var DEFAULT_COUNT = 20;
+var gatesOpen = function () { var _a; return !!process.env.DEVELOPMENT && ((_a = process.env.DEV_AUTO_LOGIN_EMAIL) !== null && _a !== void 0 ? _a : '').trim().length > 0; };
+exports.devMail = {
+    path: '/dev/mail',
+    method: 'get',
+    onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
+        var requested, count, messages;
+        var _a;
+        return __generator(this, function (_b) {
+            if (!gatesOpen()) {
+                response.status(404).send();
+                return [2 /*return*/];
+            }
+            requested = Number((_a = request.query) === null || _a === void 0 ? void 0 : _a.n);
+            count = Number.isInteger(requested) && requested > 0 ? Math.min(requested, email_server_1.MailSink.CAPACITY) : DEFAULT_COUNT;
+            messages = email_server_1.MailSink.get()
+                .list(count)
+                .map(function (_a) {
+                var id = _a.id, at = _a.at, from = _a.from, to = _a.to, subject = _a.subject, link = _a.link, refused = _a.refused;
+                return ({
+                    id: id,
+                    at: at,
+                    from: from,
+                    to: to,
+                    subject: subject,
+                    link: link,
+                    refused: refused,
+                    url: "/dev/mail/".concat(id),
+                });
+            });
+            response.status(200).json({ messages: messages });
+            return [2 /*return*/];
+        });
+    }); },
+};
+exports.devMailMessage = {
+    path: '/dev/mail/:id',
+    method: 'get',
+    onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
+        var record;
+        var _a, _b, _c;
+        return __generator(this, function (_d) {
+            if (!gatesOpen()) {
+                response.status(404).send();
+                return [2 /*return*/];
+            }
+            record = email_server_1.MailSink.get().get(String((_b = (_a = request.params) === null || _a === void 0 ? void 0 : _a.id) !== null && _b !== void 0 ? _b : ''));
+            if (!record) {
+                response.status(404).send();
+                return [2 /*return*/];
+            }
+            if (record.html !== undefined) {
+                response.status(200).type('html').send(record.html);
+                return [2 /*return*/];
+            }
+            response
+                .status(200)
+                .type('text')
+                .send((_c = record.text) !== null && _c !== void 0 ? _c : '');
+            return [2 /*return*/];
+        });
+    }); },
+};
+//# sourceMappingURL=devMail.js.map

package/dist/src/routes/devMail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devMail.js","sourceRoot":"","sources":["../../../src/routes/devMail.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wDAAmD;AAEnD;;;;;;;;;;;;;;GAcG;AACH,IAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,IAAM,SAAS,GAAG,sBAChB,OAAA,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA,EAAA,CAAC;AAE7E,QAAA,OAAO,GAAU;IAC5B,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;YACjC,IAAI,CAAC,SAAS,EAAE,EAAE;gBAChB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5B,sBAAO;aACR;YACK,SAAS,GAAG,MAAM,CAAC,MAAA,OAAO,CAAC,KAAK,0CAAE,CAAC,CAAC,CAAC;YACrC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,uBAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9G,QAAQ,GAAG,uBAAQ,CAAC,GAAG,EAAE;iBAC5B,IAAI,CAAC,KAAK,CAAC;iBACX,GAAG,CAAC,UAAC,EAA4C;oBAA1C,EAAE,QAAA,EAAE,EAAE,QAAA,EAAE,IAAI,UAAA,EAAE,EAAE,QAAA,EAAE,OAAO,aAAA,EAAE,IAAI,UAAA,EAAE,OAAO,aAAA;gBAAO,OAAA,CAAC;oBACtD,EAAE,IAAA;oBACF,EAAE,IAAA;oBACF,IAAI,MAAA;oBACJ,EAAE,IAAA;oBACF,OAAO,SAAA;oBACP,IAAI,MAAA;oBACJ,OAAO,SAAA;oBACP,GAAG,EAAE,oBAAa,EAAE,CAAE;iBACvB,CAAC;YATqD,CASrD,CAAC,CAAC;YACN,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,UAAA,EAAE,CAAC,CAAC;;;SACzC;CACF,CAAC;AAEW,QAAA,cAAc,GAAU;IACnC,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;YACjC,IAAI,CAAC,SAAS,EAAE,EAAE;gBAChB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5B,sBAAO;aACR;YACK,MAAM,GAAG,uBAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,EAAE,mCAAI,EAAE,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,EAAE;gBACX,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5B,sBAAO;aACR;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE;gBAC7B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACpD,sBAAO;aACR;YACD,QAAQ;iBACL,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,MAAA,MAAM,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC;;;SAC5B;CACF,CAAC"}

package/dist/src/routes/executePasswordReset.d.ts

@@ -5,7 +5,8 @@ import { Route } from '@proteinjs/server-api';
  * Resolves the presented token through `PasswordResetToken` — which refuses anything but a
  * well-formed token before any lookup — checks its expiry, and redeems it: the new password is
  * written and the token cleared in one conditional update, so a token resets a password once.
- * The token itself never reaches the log.
+ * The token itself never reaches the log. A request that carries no body at all is refused like
+ * one that carries a blank password.
  *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.

package/dist/src/routes/executePasswordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAuClC,CAAC"}
+{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAuClC,CAAC"}

package/dist/src/routes/executePasswordReset.js

@@ -47,7 +47,8 @@ var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
  * Resolves the presented token through `PasswordResetToken` — which refuses anything but a
  * well-formed token before any lookup — checks its expiry, and redeems it: the new password is
  * written and the token cleared in one conditional update, so a token resets a password once.
- * The token itself never reaches the log.
+ * The token itself never reaches the log. A request that carries no body at all is refused like
+ * one that carries a blank password.
  *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
@@ -57,11 +58,12 @@ exports.executePasswordReset = {
     method: user_1.routes.executePasswordReset.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
         var logger, _a, token, newPassword, resetToken, resolution, user, hashedPassword;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
+        var _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
                 case 0:
                     logger = new logger_1.Logger({ name: 'executePasswordReset' });
-                    _a = request.body, token = _a.token, newPassword = _a.newPassword;
+                    _a = (_b = request.body) !== null && _b !== void 0 ? _b : {}, token = _a.token, newPassword = _a.newPassword;
                     if (typeof newPassword !== 'string' || newPassword.length === 0) {
                         response.status(400).send({ error: 'New password cannot be blank' });
                         return [2 /*return*/];
@@ -69,7 +71,7 @@ exports.executePasswordReset = {
                     resetToken = new PasswordResetToken_1.PasswordResetToken();
                     return [4 /*yield*/, resetToken.resolve(token)];
                 case 1:
-                    resolution = _b.sent();
+                    resolution = _c.sent();
                     if (resolution.status === 'malformed' || resolution.status === 'unknown') {
                         logger.info({
                             message: "Invalid reset token used",
@@ -86,10 +88,10 @@ exports.executePasswordReset = {
                     user = resolution.user;
                     return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().hash(newPassword)];
                 case 2:
-                    hashedPassword = _b.sent();
+                    hashedPassword = _c.sent();
                     return [4 /*yield*/, resetToken.redeem(user, resolution.token, hashedPassword)];
                 case 3:
-                    if (!(_b.sent())) {
+                    if (!(_c.sent())) {
                         logger.info({ message: "Reset token already redeemed", obj: { email: user.email } });
                         response.status(400).send({ error: 'Invalid or expired reset token' });
                         return [2 /*return*/];

package/dist/src/routes/executePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,mEAAkE;AAClE,2EAA0E;AAE1E;;;;;;;;;;GAUG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,OAAO,CAAC,IAAI,EAAnC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAkB;oBAC5C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;wBACrE,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAEO,IAAI,GAAK,UAAU,KAAf,CAAgB;oBACL,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAC7D,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAArE,IAAI,CAAC,CAAC,SAA+D,CAAC,EAAE;wBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACrF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}
+{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,mEAAkE;AAClE,2EAA0E;AAE1E;;;;;;;;;;;GAWG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,EAAzC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAwB;oBAClD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;wBACrE,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAEO,IAAI,GAAK,UAAU,KAAf,CAAgB;oBACL,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAC7D,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAArE,IAAI,CAAC,CAAC,SAA+D,CAAC,EAAE;wBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACrF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}

package/dist/src/routes/initiatePasswordReset.d.ts

@@ -2,8 +2,9 @@ import { Route } from '@proteinjs/server-api';
 /**
  * Route for initiating a password reset process.
  *
- * This route handles the process of generating a password reset token,
- * sending a reset email to the user, and storing the token and expiration of the token in the database.
+ * Mints a reset token through `PasswordResetToken` — which stores only the token's digest and
+ * its expiry on the user row — and mails the token to the account as a reset link. The token is
+ * withdrawn again when the mail fails to send.
  *
  * Requires an implementation of `DefaultPasswordResetEmailConfigFactory` to build the password reset email with.
  *

package/dist/src/routes/initiatePasswordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initiatePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAW9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAgEnC,CAAC"}
+{"version":3,"file":"initiatePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAW9C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAkEnC,CAAC"}