@proteinjs/user-server 1.22.0 → 1.22.1

package/dist/src/authentication/PasswordResetToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetToken.d.ts","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":"AAGA,OAAO,EAAU,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAEjD,IAAI,IAAI,MAAM;IAIR,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAkBnE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASjF,8GAA8G;IAC9G,WAAW,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS;IASnD,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,MAAM;CAQf"}
+{"version":3,"file":"PasswordResetToken.d.ts","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":"AACA,OAAe,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAU,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAoB;IACjD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAM;IAE9C;;;OAGG;IACG,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAUjC,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmBnE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASjF;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS;IAQxC;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS;IASnD,OAAO,CAAC,KAAK;IAIb,yEAAyE;IACzE,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,MAAM;CAQf"}

package/dist/src/authentication/PasswordResetToken.js

@@ -48,26 +48,55 @@ var user_1 = require("@proteinjs/user");
  * The password-reset token's one owner: its shape, its mint, the lookup that maps a presented
  * value back to the user it was issued to, and its single-use redemption.
  *
- * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters),
- * stored on the user row beside its expiry until it is redeemed or expires.
+ * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters). The
+ * token itself exists only in the link mailed to the account: the user row stores its SHA-256
+ * digest (hex) beside the expiry, never the token, so a read of the table yields nothing that
+ * can be presented. A digest is not a token — presenting one is hashed again and matches no row.
+ * A fast unsalted hash is enough here because the input is 256 bits of CSPRNG output, not a
+ * human-chosen secret.
  *
- * Resolution refuses anything that is not a value of that shape BEFORE any lookup. A query
- * filter built from a request value that is not a token does not compare the way a token does:
- * `null` renders as `IS NULL` and would match every account with no pending reset, an empty
- * string matches an emptied column, and other types reach the driver. The row the lookup
- * returns is then re-checked in code — its stored token must be a string equal to the presented
- * one (compared in constant time) and its expiry a real timestamp still in the future — so the
+ * Resolution refuses anything that is not a value of the token's shape BEFORE any lookup. A
+ * query filter built from a request value that is not a token does not compare the way a token
+ * does: `null` renders as `IS NULL` and would match every account with no pending reset, an
+ * empty string matches an emptied column, and other types reach the driver. The presented token
+ * is then hashed, the row is looked up by that digest, and the row the lookup returns is
+ * re-checked in code — its stored digest must be a string equal to the presented token's digest
+ * (compared in constant time) and its expiry a real timestamp still in the future — so the
  * outcome never rests on how the storage compares.
+ *
+ * No migration accompanies the move from a stored token to a stored digest: a row that still
+ * holds a token minted before it never equals the digest of anything presented, so that token
+ * fails validation for what remains of its hour and the person asks for a new link.
  */
 var PasswordResetToken = /** @class */ (function () {
     function PasswordResetToken() {
     }
-    PasswordResetToken.prototype.mint = function () {
-        return (0, crypto_1.randomBytes)(32).toString('hex');
+    /**
+     * Issue a token to `user`: store its digest and its expiry on the row, replacing any token
+     * outstanding, and return the token — the only time it exists outside the mailed link.
+     */
+    PasswordResetToken.prototype.mint = function (user) {
+        return __awaiter(this, void 0, void 0, function () {
+            var token;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        token = (0, crypto_1.randomBytes)(32).toString('hex');
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
+                                id: user.id,
+                                passwordResetToken: this.digest(token),
+                                passwordResetTokenExpiration: (0, moment_1.default)().add(PasswordResetToken.LIFETIME_MINUTES, 'minutes'),
+                            })];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/, token];
+                }
+            });
+        });
     };
     PasswordResetToken.prototype.resolve = function (presented) {
         return __awaiter(this, void 0, void 0, function () {
-            var token, user;
+            var token, digest, user;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -75,10 +104,11 @@ var PasswordResetToken = /** @class */ (function () {
                         if (token === undefined) {
                             return [2 /*return*/, { status: 'malformed' }];
                         }
-                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { passwordResetToken: token })];
+                        digest = this.digest(token);
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { passwordResetToken: digest })];
                     case 1:
                         user = _a.sent();
-                        if (!user || !this.matches(user.passwordResetToken, token)) {
+                        if (!user || !this.matches(user.passwordResetToken, digest)) {
                             return [2 /*return*/, { status: 'unknown' }];
                         }
                         if (!this.isLive(user.passwordResetTokenExpiration)) {
@@ -91,15 +121,15 @@ var PasswordResetToken = /** @class */ (function () {
     };
     /**
      * Write the new credential and clear the token in one conditional update: the row must still
-     * carry this token at write time, so two presentations of the same token cannot both succeed.
-     * Resolves false when the token was already redeemed.
+     * carry this token's digest at write time, so two presentations of the same token cannot both
+     * succeed. Resolves false when the token was already redeemed.
      */
     PasswordResetToken.prototype.redeem = function (user, token, hashedPassword) {
         return __awaiter(this, void 0, void 0, function () {
             var updated;
             return __generator(this, function (_a) {
                 switch (_a.label) {
-                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { password: hashedPassword, passwordResetToken: null, passwordResetTokenExpiration: null }, { id: user.id, passwordResetToken: token })];
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { password: hashedPassword, passwordResetToken: null, passwordResetTokenExpiration: null }, { id: user.id, passwordResetToken: this.digest(token) })];
                     case 1:
                         updated = _a.sent();
                         return [2 /*return*/, updated === 1];
@@ -107,22 +137,56 @@ var PasswordResetToken = /** @class */ (function () {
             });
         });
     };
-    /** A log-safe reference to a presented token: a short digest of a well-formed one, never the value itself. */
+    /**
+     * Withdraw a token that never reached its owner (the mail carrying it failed to send): the row
+     * is cleared only while it still carries this token's digest, so a newer token is left alone.
+     */
+    PasswordResetToken.prototype.revoke = function (user, token) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { passwordResetToken: null, passwordResetTokenExpiration: null }, { id: user.id, passwordResetToken: this.digest(token) })];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    /** When the token outstanding on `user` was minted, or undefined when the row carries none. */
+    PasswordResetToken.prototype.mintedAt = function (user) {
+        if (!user.passwordResetToken || !user.passwordResetTokenExpiration) {
+            return undefined;
+        }
+        return (0, moment_1.default)(user.passwordResetTokenExpiration).subtract(PasswordResetToken.LIFETIME_MINUTES, 'minutes');
+    };
+    /**
+     * A log-safe reference to a presented token: a short prefix of a well-formed one's digest,
+     * never the value itself and never a part of it. The routes log it only for a token that
+     * resolved `unknown` — one no row carries — so it never lines up with a digest a row holds.
+     * What it is for is telling refusals apart in the log: one stale link presented again reads
+     * the same each time, a run of different values reads differently. 48 bits of the SHA-256 of
+     * 256 random bits identify nothing and can be presented nowhere.
+     */
     PasswordResetToken.prototype.fingerprint = function (presented) {
         var token = this.parse(presented);
         if (token === undefined) {
             return undefined;
         }
-        return (0, crypto_1.createHash)('sha256').update(token).digest('hex').slice(0, 12);
+        return this.digest(token).slice(0, 12);
     };
     PasswordResetToken.prototype.parse = function (presented) {
         return typeof presented === 'string' && PasswordResetToken.SHAPE.test(presented) ? presented : undefined;
     };
-    PasswordResetToken.prototype.matches = function (stored, presented) {
-        if (typeof stored !== 'string' || stored.length !== presented.length) {
+    /** What the row stores in place of a token: its SHA-256, hex-encoded. */
+    PasswordResetToken.prototype.digest = function (token) {
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+    };
+    PasswordResetToken.prototype.matches = function (storedDigest, presentedDigest) {
+        if (typeof storedDigest !== 'string' || storedDigest.length !== presentedDigest.length) {
             return false;
         }
-        return (0, crypto_1.timingSafeEqual)(Buffer.from(stored), Buffer.from(presented));
+        return (0, crypto_1.timingSafeEqual)(Buffer.from(storedDigest), Buffer.from(presentedDigest));
     };
     PasswordResetToken.prototype.isLive = function (expiration) {
         if (!expiration) {
@@ -132,6 +196,7 @@ var PasswordResetToken = /** @class */ (function () {
         return expiresAt.isValid() && (0, moment_1.default)().isBefore(expiresAt);
     };
     PasswordResetToken.SHAPE = /^[0-9a-f]{64}$/;
+    PasswordResetToken.LIFETIME_MINUTES = 60;
     return PasswordResetToken;
 }());
 exports.PasswordResetToken = PasswordResetToken;

package/dist/src/authentication/PasswordResetToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetToken.js","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAkE;AAClE,kDAAwC;AACxC,oCAA8C;AAC9C,wCAA+C;AAQ/C;;;;;;;;;;;;;;GAcG;AACH;IAAA;IAqEA,CAAC;IAlEC,iCAAI,GAAJ;QACE,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEK,oCAAO,GAAb,UAAc,SAAkB;;;;;;wBACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;wBACpC,IAAI,KAAK,KAAK,SAAS,EAAE;4BACvB,sBAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAC;yBAChC;wBAEY,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;wBAA5E,IAAI,GAAG,SAAqE;wBAClF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE;4BAC1D,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAC;yBAC9B;wBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE;4BACnD,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,MAAA,EAAE,EAAC;yBACpC;wBAED,sBAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE,KAAK,OAAA,EAAE,EAAC;;;;KACxC;IAED;;;;OAIG;IACG,mCAAM,GAAZ,UAAa,IAAU,EAAE,KAAa,EAAE,cAAsB;;;;;4BAC5C,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAC1C,aAAM,CAAC,IAAI,EACX,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAC1F,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAC3C,EAAA;;wBAJK,OAAO,GAAG,SAIf;wBACD,sBAAO,OAAO,KAAK,CAAC,EAAC;;;;KACtB;IAED,8GAA8G;IAC9G,wCAAW,GAAX,UAAY,SAAkB;QAC5B,IAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE;YACvB,OAAO,SAAS,CAAC;SAClB;QAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAEO,kCAAK,GAAb,UAAc,SAAkB;QAC9B,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;IAEO,oCAAO,GAAf,UAAgB,MAAiC,EAAE,SAAiB;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE;YACpE,OAAO,KAAK,CAAC;SACd;QAED,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,mCAAM,GAAd,UAAe,UAAqC;QAClD,IAAI,CAAC,UAAU,EAAE;YACf,OAAO,KAAK,CAAC;SACd;QAED,IAAM,SAAS,GAAG,IAAA,gBAAM,EAAC,UAAU,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,IAAA,gBAAM,GAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAnEuB,wBAAK,GAAG,gBAAgB,CAAC;IAoEnD,yBAAC;CAAA,AArED,IAqEC;AArEY,gDAAkB"}
+{"version":3,"file":"PasswordResetToken.js","sourceRoot":"","sources":["../../../src/authentication/PasswordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAkE;AAClE,kDAAwC;AACxC,oCAA8C;AAC9C,wCAA+C;AAQ/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;IAAA;IAkHA,CAAC;IA9GC;;;OAGG;IACG,iCAAI,GAAV,UAAW,IAAU;;;;;;wBACb,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC9C,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;gCACxC,EAAE,EAAE,IAAI,CAAC,EAAE;gCACX,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gCACtC,4BAA4B,EAAE,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,CAAC;6BAC3F,CAAC,EAAA;;wBAJF,SAIE,CAAC;wBACH,sBAAO,KAAK,EAAC;;;;KACd;IAEK,oCAAO,GAAb,UAAc,SAAkB;;;;;;wBACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;wBACpC,IAAI,KAAK,KAAK,SAAS,EAAE;4BACvB,sBAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAC;yBAChC;wBAEK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBACrB,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAA7E,IAAI,GAAG,SAAsE;wBACnF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE;4BAC3D,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAC;yBAC9B;wBAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE;4BACnD,sBAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,MAAA,EAAE,EAAC;yBACpC;wBAED,sBAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE,KAAK,OAAA,EAAE,EAAC;;;;KACxC;IAED;;;;OAIG;IACG,mCAAM,GAAZ,UAAa,IAAU,EAAE,KAAa,EAAE,cAAsB;;;;;4BAC5C,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAC1C,aAAM,CAAC,IAAI,EACX,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAC1F,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxD,EAAA;;wBAJK,OAAO,GAAG,SAIf;wBACD,sBAAO,OAAO,KAAK,CAAC,EAAC;;;;KACtB;IAED;;;OAGG;IACG,mCAAM,GAAZ,UAAa,IAAU,EAAE,KAAa;;;;4BACpC,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAC1B,aAAM,CAAC,IAAI,EACX,EAAE,kBAAkB,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAChE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxD,EAAA;;wBAJD,SAIC,CAAC;;;;;KACH;IAED,+FAA+F;IAC/F,qCAAQ,GAAR,UAAS,IAAU;QACjB,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE;YAClE,OAAO,SAAS,CAAC;SAClB;QAED,OAAO,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAC5G,CAAC;IAED;;;;;;;OAOG;IACH,wCAAW,GAAX,UAAY,SAAkB;QAC5B,IAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE;YACvB,OAAO,SAAS,CAAC;SAClB;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAEO,kCAAK,GAAb,UAAc,SAAkB;QAC9B,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;IAED,yEAAyE;IACjE,mCAAM,GAAd,UAAe,KAAa;QAC1B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,oCAAO,GAAf,UAAgB,YAAuC,EAAE,eAAuB;QAC9E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE;YACtF,OAAO,KAAK,CAAC;SACd;QAED,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IAClF,CAAC;IAEO,mCAAM,GAAd,UAAe,UAAqC;QAClD,IAAI,CAAC,UAAU,EAAE;YACf,OAAO,KAAK,CAAC;SACd;QAED,IAAM,SAAS,GAAG,IAAA,gBAAM,EAAC,UAAU,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,IAAA,gBAAM,GAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAhHuB,wBAAK,GAAG,gBAAgB,CAAC;IACzB,mCAAgB,GAAG,EAAE,CAAC;IAgHhD,yBAAC;CAAA,AAlHD,IAkHC;AAlHY,gDAAkB"}

package/dist/src/routes/devLogin.d.ts

@@ -32,7 +32,7 @@ import { Route } from '@proteinjs/server-api';
  * call is unchanged; the variable absent = nothing changes; the gates closed = 404 regardless.
  * Test and prod never set it — the omission is the safety, the same idiom as the gates. The
  * outcome is logged as ONE marker line, `Dev bootstrap admin door: <granted|admin-exists>`,
- * which the n3xa compose-estate boot proof reads from the server log to PROVE the grant landed.
+ * which a consumer's boot proof can read from the server log to PROVE the grant landed.
  *
  * Role-bootstrap door (`DEV_BOOTSTRAP_ROLES='email:role[,role];email:role…'`, the grammar in
  * DevBootstrapRoles.ts): the first-admin door leaves every OTHER account role-less, and a

package/dist/src/routes/devLogin.js

@@ -80,7 +80,7 @@ var emailDomain = function (address) { return address.slice(address.lastIndexOf(
  * call is unchanged; the variable absent = nothing changes; the gates closed = 404 regardless.
  * Test and prod never set it — the omission is the safety, the same idiom as the gates. The
  * outcome is logged as ONE marker line, `Dev bootstrap admin door: <granted|admin-exists>`,
- * which the n3xa compose-estate boot proof reads from the server log to PROVE the grant landed.
+ * which a consumer's boot proof can read from the server log to PROVE the grant landed.
  *
  * Role-bootstrap door (`DEV_BOOTSTRAP_ROLES='email:role[,role];email:role…'`, the grammar in
  * DevBootstrapRoles.ts): the first-admin door leaves every OTHER account role-less, and a

package/dist/src/routes/executePasswordReset.d.ts

@@ -5,7 +5,8 @@ import { Route } from '@proteinjs/server-api';
  * Resolves the presented token through `PasswordResetToken` — which refuses anything but a
  * well-formed token before any lookup — checks its expiry, and redeems it: the new password is
  * written and the token cleared in one conditional update, so a token resets a password once.
- * The token itself never reaches the log.
+ * The token itself never reaches the log. A request that carries no body at all is refused like
+ * one that carries a blank password.
  *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.

package/dist/src/routes/executePasswordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAuClC,CAAC"}
+{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAuClC,CAAC"}

package/dist/src/routes/executePasswordReset.js

@@ -47,7 +47,8 @@ var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
  * Resolves the presented token through `PasswordResetToken` — which refuses anything but a
  * well-formed token before any lookup — checks its expiry, and redeems it: the new password is
  * written and the token cleared in one conditional update, so a token resets a password once.
- * The token itself never reaches the log.
+ * The token itself never reaches the log. A request that carries no body at all is refused like
+ * one that carries a blank password.
  *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
@@ -57,11 +58,12 @@ exports.executePasswordReset = {
     method: user_1.routes.executePasswordReset.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
         var logger, _a, token, newPassword, resetToken, resolution, user, hashedPassword;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
+        var _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
                 case 0:
                     logger = new logger_1.Logger({ name: 'executePasswordReset' });
-                    _a = request.body, token = _a.token, newPassword = _a.newPassword;
+                    _a = (_b = request.body) !== null && _b !== void 0 ? _b : {}, token = _a.token, newPassword = _a.newPassword;
                     if (typeof newPassword !== 'string' || newPassword.length === 0) {
                         response.status(400).send({ error: 'New password cannot be blank' });
                         return [2 /*return*/];
@@ -69,7 +71,7 @@ exports.executePasswordReset = {
                     resetToken = new PasswordResetToken_1.PasswordResetToken();
                     return [4 /*yield*/, resetToken.resolve(token)];
                 case 1:
-                    resolution = _b.sent();
+                    resolution = _c.sent();
                     if (resolution.status === 'malformed' || resolution.status === 'unknown') {
                         logger.info({
                             message: "Invalid reset token used",
@@ -86,10 +88,10 @@ exports.executePasswordReset = {
                     user = resolution.user;
                     return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().hash(newPassword)];
                 case 2:
-                    hashedPassword = _b.sent();
+                    hashedPassword = _c.sent();
                     return [4 /*yield*/, resetToken.redeem(user, resolution.token, hashedPassword)];
                 case 3:
-                    if (!(_b.sent())) {
+                    if (!(_c.sent())) {
                         logger.info({ message: "Reset token already redeemed", obj: { email: user.email } });
                         response.status(400).send({ error: 'Invalid or expired reset token' });
                         return [2 /*return*/];

package/dist/src/routes/executePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,mEAAkE;AAClE,2EAA0E;AAE1E;;;;;;;;;;GAUG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,OAAO,CAAC,IAAI,EAAnC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAkB;oBAC5C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;wBACrE,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAEO,IAAI,GAAK,UAAU,KAAf,CAAgB;oBACL,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAC7D,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAArE,IAAI,CAAC,CAAC,SAA+D,CAAC,EAAE;wBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACrF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}
+{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,mEAAkE;AAClE,2EAA0E;AAE1E;;;;;;;;;;;GAWG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,EAAzC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAwB;oBAClD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;wBACrE,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAEO,IAAI,GAAK,UAAU,KAAf,CAAgB;oBACL,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAC7D,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAArE,IAAI,CAAC,CAAC,SAA+D,CAAC,EAAE;wBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACrF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}

package/dist/src/routes/initiatePasswordReset.d.ts

@@ -2,8 +2,9 @@ import { Route } from '@proteinjs/server-api';
 /**
  * Route for initiating a password reset process.
  *
- * This route handles the process of generating a password reset token,
- * sending a reset email to the user, and storing the token and expiration of the token in the database.
+ * Mints a reset token through `PasswordResetToken` — which stores only the token's digest and
+ * its expiry on the user row — and mails the token to the account as a reset link. The token is
+ * withdrawn again when the mail fails to send.
  *
  * Requires an implementation of `DefaultPasswordResetEmailConfigFactory` to build the password reset email with.
  *

package/dist/src/routes/initiatePasswordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initiatePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAW9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAgEnC,CAAC"}
+{"version":3,"file":"initiatePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAW9C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAkEnC,CAAC"}

package/dist/src/routes/initiatePasswordReset.js

@@ -60,8 +60,9 @@ var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
 /**
  * Route for initiating a password reset process.
  *
- * This route handles the process of generating a password reset token,
- * sending a reset email to the user, and storing the token and expiration of the token in the database.
+ * Mints a reset token through `PasswordResetToken` — which stores only the token's digest and
+ * its expiry on the user row — and mails the token to the account as a reset link. The token is
+ * withdrawn again when the mail fails to send.
  *
  * Requires an implementation of `DefaultPasswordResetEmailConfigFactory` to build the password reset email with.
  *
@@ -74,13 +75,18 @@ exports.initiatePasswordReset = {
     path: user_1.routes.initiatePasswordReset.path,
     method: user_1.routes.initiatePasswordReset.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var logger, email, db, genericResponse, user, currentTime, tokenCreationTime, timeDifference, emailSender, defaultConfigFactory, passwordResetToken, passwordResetTokenExpiration, config, _a, text, html, error_1;
+        var logger, requestedEmail, email, db, genericResponse, user, resetToken, mintedAt, emailSender, defaultConfigFactory, passwordResetToken, config, _a, text, html, error_1;
         var _b, _c;
         return __generator(this, function (_d) {
             switch (_d.label) {
                 case 0:
                     logger = new logger_1.Logger({ name: 'initiatePasswordReset' });
-                    email = (_b = request.body.email) === null || _b === void 0 ? void 0 : _b.toLowerCase();
+                    requestedEmail = ((_b = request.body) !== null && _b !== void 0 ? _b : {}).email;
+                    if (typeof requestedEmail !== 'string' || requestedEmail.length === 0) {
+                        response.status(400).send({ error: 'Email cannot be blank' });
+                        return [2 /*return*/];
+                    }
+                    email = requestedEmail.toLowerCase();
                     db = (0, db_1.getDbAsSystem)();
                     genericResponse = { message: 'If an account with that email exists, we have sent a password reset link.' };
                     return [4 /*yield*/, db.get(user_1.tables.User, { email: email })];
@@ -92,47 +98,44 @@ exports.initiatePasswordReset = {
                         response.send(genericResponse);
                         return [2 /*return*/];
                     }
-                    // Check if there's an existing token and it's less than 5 minutes old
-                    if (user.passwordResetToken && user.passwordResetTokenExpiration) {
-                        currentTime = (0, moment_1.default)();
-                        tokenCreationTime = (0, moment_1.default)(user.passwordResetTokenExpiration).subtract(1, 'hour');
-                        timeDifference = currentTime.diff(tokenCreationTime, 'minutes');
-                        if (timeDifference < 5) {
-                            logger.info({ message: "Password reset requested too soon for user", obj: { email: email } });
-                            response.send(genericResponse);
-                            return [2 /*return*/];
-                        }
+                    resetToken = new PasswordResetToken_1.PasswordResetToken();
+                    mintedAt = resetToken.mintedAt(user);
+                    if (mintedAt && (0, moment_1.default)().diff(mintedAt, 'minutes') < 5) {
+                        logger.info({ message: "Password reset requested too soon for user", obj: { email: email } });
+                        response.send(genericResponse);
+                        return [2 /*return*/];
                     }
                     emailSender = new email_server_1.EmailSender();
                     defaultConfigFactory = (0, email_server_1.getDefaultPasswordResetEmailConfigFactory)();
                     if (!defaultConfigFactory) {
                         throw new Error("Unable to find a @proteinjs/email-server/DefaultPasswordResetEmailConfigFactory implementation when initiating password reset.");
                     }
-                    passwordResetToken = new PasswordResetToken_1.PasswordResetToken().mint();
-                    passwordResetTokenExpiration = (0, moment_1.default)().add(1, 'hour');
-                    _d.label = 2;
+                    return [4 /*yield*/, resetToken.mint(user)];
                 case 2:
-                    _d.trys.push([2, 5, , 6]);
+                    passwordResetToken = _d.sent();
+                    _d.label = 3;
+                case 3:
+                    _d.trys.push([3, 5, , 7]);
                     config = defaultConfigFactory.getConfig();
                     _a = config.getEmailContent("".concat(user_1.uiRoutes.auth.passwordReset, "?token=").concat(passwordResetToken)), text = _a.text, html = _a.html;
                     // Send email containing a reset link
                     return [4 /*yield*/, emailSender.sendEmail(__assign({ to: user.email, subject: ((_c = config.options) === null || _c === void 0 ? void 0 : _c.subject) || 'Reset Password', text: text, html: html }, config.options))];
-                case 3:
-                    // Send email containing a reset link
-                    _d.sent();
-                    // If email is sent successfully, save reset token to user record
-                    return [4 /*yield*/, db.update(user_1.tables.User, { id: user.id, passwordResetToken: passwordResetToken, passwordResetTokenExpiration: passwordResetTokenExpiration })];
                 case 4:
-                    // If email is sent successfully, save reset token to user record
+                    // Send email containing a reset link
                     _d.sent();
                     response.send(genericResponse);
-                    return [3 /*break*/, 6];
+                    return [3 /*break*/, 7];
                 case 5:
                     error_1 = _d.sent();
                     logger.error({ message: "Failed to send password reset email", obj: { email: email }, error: error_1 });
+                    // The link never reached the account: withdraw the token so asking again is not throttled
+                    return [4 /*yield*/, resetToken.revoke(user, passwordResetToken)];
+                case 6:
+                    // The link never reached the account: withdraw the token so asking again is not throttled
+                    _d.sent();
                     response.status(500).send({ error: 'Failed to send password reset email. Please try again later.' });
-                    return [3 /*break*/, 6];
-                case 6: return [2 /*return*/];
+                    return [3 /*break*/, 7];
+                case 7: return [2 /*return*/];
             }
         });
     }); },

package/dist/src/routes/initiatePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAA4B;AAC5B,wDAGiC;AACjC,2EAA0E;AAE1E;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBACvD,KAAK,GAAG,MAAA,OAAO,CAAC,IAAI,CAAC,KAAK,0CAAE,WAAW,EAAE,CAAC;oBAC1C,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAErB,eAAe,GAAG,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;oBAEpG,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBAC3F,2CAA2C;wBAC3C,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAED,sEAAsE;oBACtE,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,4BAA4B,EAAE;wBAC1D,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;wBACvB,iBAAiB,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAClF,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;wBACtE,IAAI,cAAc,GAAG,CAAC,EAAE;4BACtB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;4BACvF,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;4BAC/B,sBAAO;yBACR;qBACF;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAGK,kBAAkB,GAAG,IAAI,uCAAkB,EAAE,CAAC,IAAI,EAAE,CAAC;oBACrD,4BAA4B,GAAG,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;;;;oBAGrD,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,iEAAiE;oBACjE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,kBAAkB,oBAAA,EAAE,4BAA4B,8BAAA,EAAE,CAAC,EAAA;;oBAD/F,iEAAiE;oBACjE,SAA+F,CAAC;oBAChG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;;;;oBAE/B,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACxF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;;;;;SAExG;CACF,CAAC"}
+{"version":3,"file":"initiatePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAA2D;AAC3D,4CAA2C;AAC3C,kDAA4B;AAC5B,wDAGiC;AACjC,2EAA0E;AAE1E;;;;;;;;;;;;;GAaG;AACU,QAAA,qBAAqB,GAAU;IAC1C,IAAI,EAAE,aAAM,CAAC,qBAAqB,CAAC,IAAI;IACvC,MAAM,EAAE,aAAM,CAAC,qBAAqB,CAAC,MAAM;IAC3C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBAC9C,cAAc,GAAK,CAAA,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAA,MAAvB,CAAwB;oBACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;wBAC9D,sBAAO;qBACR;oBAEK,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;oBACrC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAErB,eAAe,GAAG,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;oBAEpG,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBAC3F,2CAA2C;wBAC3C,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAGK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACtC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,QAAQ,IAAI,IAAA,gBAAM,GAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;wBACtD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACvF,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;wBAC/B,sBAAO;qBACR;oBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;oBAEhC,oBAAoB,GAAG,IAAA,wDAAuB,GAAE,CAAC;oBACvD,IAAI,CAAC,oBAAoB,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAC;qBACH;oBAG0B,qBAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAA;;oBAAhD,kBAAkB,GAAG,SAA2B;;;;oBAG9C,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;oBAC1C,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,aAAa,oBAAU,kBAAkB,CAAE,CAAC,EAAnG,IAAI,UAAA,EAAE,IAAI,UAAA,CAA0F;oBAE5G,qCAAqC;oBACrC,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,IAAI,CAAC,KAAK,EACd,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;oBAPF,qCAAqC;oBACrC,SAME,CAAC;oBAEH,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;;;;oBAE/B,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBACxF,0FAA0F;oBAC1F,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAA;;oBADjD,0FAA0F;oBAC1F,SAAiD,CAAC;oBAClD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;;;;;SAExG;CACF,CAAC"}

package/dist/test/DbTraffic.d.ts

@@ -0,0 +1,29 @@
+import { DbDriver } from '@proteinjs/db';
+/**
+ * What reached the database while a run executed — the outcome a "refused before any lookup"
+ * claim rests on. A response code cannot prove it: a value that is wrongly let through still
+ * matches no row and still answers 400, so the proof is that nothing was built and nothing ran.
+ * - `lookups`: the filter of every read built through the package's `Db` — every `query`, which
+ *   is also what a `get` is (the first row of one);
+ * - `writes`: how many writes were built through it (`insert`, `update`, `delete`);
+ * - `statements`: how many statements the driver ran, whoever built them.
+ */
+export declare class DbTraffic {
+    readonly lookups: unknown[];
+    readonly writes: number;
+    readonly statements: number;
+    private constructor();
+    /** The traffic of a run that never touched the database: `expect(traffic).toEqual(DbTraffic.NONE)`. */
+    static readonly NONE: {
+        lookups: never[];
+        writes: number;
+        statements: number;
+    };
+    /** Runs `run` and answers what it resolved to beside the database traffic it caused. */
+    static during<T>(driver: DbDriver, run: () => Promise<T>): Promise<{
+        result: T;
+        traffic: DbTraffic;
+    }>;
+    private static callCount;
+}
+//# sourceMappingURL=DbTraffic.d.ts.map

package/dist/test/DbTraffic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DbTraffic.d.ts","sourceRoot":"","sources":["../../test/DbTraffic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAM,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,SAAS;IAElB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM;IAH7B,OAAO;IAMP,uGAAuG;IACvG,MAAM,CAAC,QAAQ,CAAC,IAAI;;;;MAA6C;IAEjE,wFAAwF;WAC3E,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,SAAS,CAAA;KAAE,CAAC;IAiB3G,OAAO,CAAC,MAAM,CAAC,SAAS;CAGzB"}

package/dist/test/DbTraffic.js

@@ -0,0 +1,106 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbTraffic = void 0;
+var db_1 = require("@proteinjs/db");
+/**
+ * What reached the database while a run executed — the outcome a "refused before any lookup"
+ * claim rests on. A response code cannot prove it: a value that is wrongly let through still
+ * matches no row and still answers 400, so the proof is that nothing was built and nothing ran.
+ * - `lookups`: the filter of every read built through the package's `Db` — every `query`, which
+ *   is also what a `get` is (the first row of one);
+ * - `writes`: how many writes were built through it (`insert`, `update`, `delete`);
+ * - `statements`: how many statements the driver ran, whoever built them.
+ */
+var DbTraffic = /** @class */ (function () {
+    function DbTraffic(lookups, writes, statements) {
+        this.lookups = lookups;
+        this.writes = writes;
+        this.statements = statements;
+    }
+    /** Runs `run` and answers what it resolved to beside the database traffic it caused. */
+    DbTraffic.during = function (driver, run) {
+        return __awaiter(this, void 0, void 0, function () {
+            var reads, writes, statements, result, lookups;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        reads = jest.spyOn(db_1.Db.prototype, 'query');
+                        writes = [
+                            jest.spyOn(db_1.Db.prototype, 'insert'),
+                            jest.spyOn(db_1.Db.prototype, 'update'),
+                            jest.spyOn(db_1.Db.prototype, 'delete'),
+                        ];
+                        statements = [jest.spyOn(driver, 'runQuery'), jest.spyOn(driver, 'runDml')];
+                        _a.label = 1;
+                    case 1:
+                        _a.trys.push([1, , 3, 4]);
+                        return [4 /*yield*/, run()];
+                    case 2:
+                        result = _a.sent();
+                        lookups = reads.mock.calls.map(function (_a) {
+                            var _table = _a[0], filter = _a[1];
+                            return filter;
+                        });
+                        return [2 /*return*/, { result: result, traffic: new DbTraffic(lookups, DbTraffic.callCount(writes), DbTraffic.callCount(statements)) }];
+                    case 3:
+                        __spreadArray(__spreadArray([reads], writes, true), statements, true).forEach(function (spy) { return spy.mockRestore(); });
+                        return [7 /*endfinally*/];
+                    case 4: return [2 /*return*/];
+                }
+            });
+        });
+    };
+    DbTraffic.callCount = function (spies) {
+        return spies.reduce(function (count, spy) { return count + spy.mock.calls.length; }, 0);
+    };
+    /** The traffic of a run that never touched the database: `expect(traffic).toEqual(DbTraffic.NONE)`. */
+    DbTraffic.NONE = { lookups: [], writes: 0, statements: 0 };
+    return DbTraffic;
+}());
+exports.DbTraffic = DbTraffic;
+//# sourceMappingURL=DbTraffic.js.map

package/dist/test/DbTraffic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DbTraffic.js","sourceRoot":"","sources":["../../test/DbTraffic.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA6C;AAE7C;;;;;;;;GAQG;AACH;IACE,mBACW,OAAkB,EAClB,MAAc,EACd,UAAkB;QAFlB,YAAO,GAAP,OAAO,CAAW;QAClB,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;IAC1B,CAAC;IAKJ,wFAAwF;IAC3E,gBAAM,GAAnB,UAAuB,MAAgB,EAAE,GAAqB;;;;;;wBACtD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;wBAC1C,MAAM,GAAG;4BACb,IAAI,CAAC,KAAK,CAAC,OAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;4BAClC,IAAI,CAAC,KAAK,CAAC,OAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;4BAClC,IAAI,CAAC,KAAK,CAAC,OAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;yBACnC,CAAC;wBACI,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;;;;wBAEjE,qBAAM,GAAG,EAAE,EAAA;;wBAApB,MAAM,GAAG,SAAW;wBACpB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAC,EAAgB;gCAAf,MAAM,QAAA,EAAE,MAAM,QAAA;4BAAM,OAAA,MAAM;wBAAN,CAAM,CAAC,CAAC;wBACnE,sBAAO,EAAE,MAAM,QAAA,EAAE,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,EAAC;;wBAEjH,6BAAC,KAAK,GAAK,MAAM,SAAK,UAAU,QAAE,OAAO,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,WAAW,EAAE,EAAjB,CAAiB,CAAC,CAAC;;;;;;KAEzE;IAEc,mBAAS,GAAxB,UAAyB,KAAuC;QAC9D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAC,KAAK,EAAE,GAAG,IAAK,OAAA,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAA7B,CAA6B,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAvBD,uGAAuG;IACvF,cAAI,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAuBnE,gBAAC;CAAA,AA/BD,IA+BC;AA/BY,8BAAS"}

package/dist/test/DevLoginBootstrapAdmin.test.js

@@ -42,10 +42,9 @@ var devLoginHarness_1 = require("./devLoginHarness");
 var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
 var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
 /**
- * `DEV_BOOTSTRAP_ADMIN_EMAIL` — the first-admin door INSIDE `/dev/login` (n3xa plans/DEV_ESTATES.md
- * D3, founder-ruled 2026-09-04). A dev estate on a fresh real database has no privileged account
- * to grant from, and the no-raw-DB rule forbids the emulator-era seed scripts there — so the ONE
- * sanctioned account door mints break-glass, once:
+ * `DEV_BOOTSTRAP_ADMIN_EMAIL` — the first-admin door INSIDE `/dev/login`. A development server on
+ * a fresh real database has no privileged account to grant from, and a no-raw-database-write rule
+ * forbids seed scripts there — so the ONE sanctioned account door mints break-glass, once:
  *  - behind the door's existing two gates (DEVELOPMENT AND DEV_AUTO_LOGIN_EMAIL): closed = 404 as
  *    before, and the variable changes nothing;
  *  - only while NO account carries 'admin' (the same membership test the app's admin checks make);