@proteinjs/user-server 1.22.1 → 1.22.3

package/dist/src/authentication/PasswordHasher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordHasher.d.ts","sourceRoot":"","sources":["../../../src/authentication/PasswordHasher.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAKpC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAgB;IAEjD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,gBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ/E;;;OAGG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYvF;;;OAGG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,gBAA0B,GAAG,OAAO;IAQ1E,uGAAuG;IACvG,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,iBAAiB;CAK1B"}
+{"version":3,"file":"PasswordHasher.d.ts","sourceRoot":"","sources":["../../../src/authentication/PasswordHasher.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAKpC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAgB;IAEvD,iIAAiI;IACjI,OAAO,CAAC,MAAM,CAAC,OAAO,CAA8B;IAE9C,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,gBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ/E;;;OAGG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYvF;;;;;OAKG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAQ5D;;;OAGG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,gBAA0B,GAAG,OAAO;IAQ1E,uGAAuG;IACvG,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,iBAAiB;CAK1B"}

package/dist/src/authentication/PasswordHasher.js

@@ -113,6 +113,31 @@ var PasswordHasher = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Spends what verifying a human credential spends, and matches nothing: the refusal for an
+     * address with no account pays the same argon2 verification a wrong password pays, so how
+     * long a refusal takes says nothing about whether the address has an account. (The stand-in
+     * hash is minted on the first call; that one call also pays a hash.)
+     */
+    PasswordHasher.prototype.verifyAgainstNothing = function (password) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        if (!PasswordHasher.standIn) {
+                            PasswordHasher.standIn = argon2.hash((0, crypto_1.randomBytes)(32).toString('hex'), PasswordHasher.ARGON2_OPTIONS);
+                        }
+                        _b = (_a = argon2).verify;
+                        return [4 /*yield*/, PasswordHasher.standIn];
+                    case 1: return [4 /*yield*/, _b.apply(_a, [_c.sent(), password])];
+                    case 2:
+                        _c.sent();
+                        return [2 /*return*/, false];
+                }
+            });
+        });
+    };
     /**
      * True when a verified credential should be re-written in the current format: legacy sha256
      * under `human` mode. Machine rows never rehash — sha256 IS their current format.

package/dist/src/authentication/PasswordHasher.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordHasher.js","sourceRoot":"","sources":["../../../src/authentication/PasswordHasher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAqD;AACrD,6CAAiC;AAUjC;;;;;;;;;;;;GAYG;AACH;IAAA;IA8DA,CAAC;IA9CO,6BAAI,GAAV,UAAW,QAAgB,EAAE,IAAgC;QAAhC,qBAAA,EAAA,cAAgC;;;;;wBAC3D,IAAI,IAAI,KAAK,SAAS,EAAE;4BACtB,sBAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAC;yBACjC;wBAEM,qBAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,cAAc,CAAC,EAAA;4BAAjE,sBAAO,SAA0D,EAAC;;;;KACnE;IAED;;;OAGG;IACG,+BAAM,GAAZ,UAAa,UAAqC,EAAE,QAAgB;;;;;wBAClE,IAAI,CAAC,UAAU,EAAE;4BACf,sBAAO,KAAK,EAAC;yBACd;6BAEG,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,eAAe,CAAC,EAArD,wBAAqD;wBAChD,qBAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAA;4BAAhD,sBAAO,SAAyC,EAAC;4BAGnD,sBAAO,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAC;;;;KACrE;IAED;;;OAGG;IACH,oCAAW,GAAX,UAAY,UAAkB,EAAE,IAAgC;QAAhC,qBAAA,EAAA,cAAgC;QAC9D,IAAI,IAAI,KAAK,SAAS,EAAE;YACtB,OAAO,KAAK,CAAC;SACd;QAED,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,uGAAuG;IAC/F,kCAAS,GAAjB,UAAkB,KAAa;QAC7B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAEO,0CAAiB,GAAzB,UAA0B,MAAc,EAAE,SAAiB;QACzD,IAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACtG,CAAC;IA5DD;;;;;OAKG;IACqB,6BAAc,GAAuB;QAC3D,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,CAAC;KACf,CAAC;IAEsB,8BAAe,GAAG,YAAY,CAAC;IAgDzD,qBAAC;CAAA,AA9DD,IA8DC;AA9DY,wCAAc"}
+{"version":3,"file":"PasswordHasher.js","sourceRoot":"","sources":["../../../src/authentication/PasswordHasher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAkE;AAClE,6CAAiC;AAUjC;;;;;;;;;;;;GAYG;AACH;IAAA;IA+EA,CAAC;IA5DO,6BAAI,GAAV,UAAW,QAAgB,EAAE,IAAgC;QAAhC,qBAAA,EAAA,cAAgC;;;;;wBAC3D,IAAI,IAAI,KAAK,SAAS,EAAE;4BACtB,sBAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAC;yBACjC;wBAEM,qBAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,cAAc,CAAC,EAAA;4BAAjE,sBAAO,SAA0D,EAAC;;;;KACnE;IAED;;;OAGG;IACG,+BAAM,GAAZ,UAAa,UAAqC,EAAE,QAAgB;;;;;wBAClE,IAAI,CAAC,UAAU,EAAE;4BACf,sBAAO,KAAK,EAAC;yBACd;6BAEG,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,eAAe,CAAC,EAArD,wBAAqD;wBAChD,qBAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAA;4BAAhD,sBAAO,SAAyC,EAAC;4BAGnD,sBAAO,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAC;;;;KACrE;IAED;;;;;OAKG;IACG,6CAAoB,GAA1B,UAA2B,QAAgB;;;;;;wBACzC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;4BAC3B,cAAc,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC;yBACtG;wBACK,KAAA,CAAA,KAAA,MAAM,CAAA,CAAC,MAAM,CAAA;wBAAC,qBAAM,cAAc,CAAC,OAAO,EAAA;4BAAhD,qBAAM,cAAc,SAA4B,EAAE,QAAQ,EAAC,EAAA;;wBAA3D,SAA2D,CAAC;wBAC5D,sBAAO,KAAK,EAAC;;;;KACd;IAED;;;OAGG;IACH,oCAAW,GAAX,UAAY,UAAkB,EAAE,IAAgC;QAAhC,qBAAA,EAAA,cAAgC;QAC9D,IAAI,IAAI,KAAK,SAAS,EAAE;YACtB,OAAO,KAAK,CAAC;SACd;QAED,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,uGAAuG;IAC/F,kCAAS,GAAjB,UAAkB,KAAa;QAC7B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAEO,0CAAiB,GAAzB,UAA0B,MAAc,EAAE,SAAiB;QACzD,IAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACtG,CAAC;IA7ED;;;;;OAKG;IACqB,6BAAc,GAAuB;QAC3D,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,CAAC;KACf,CAAC;IAEsB,8BAAe,GAAG,YAAY,CAAC;IAiEzD,qBAAC;CAAA,AA/ED,IA+EC;AA/EY,wCAAc"}

package/dist/src/authentication/SocketIOSessionWatcher.d.ts

@@ -3,6 +3,11 @@ import { Session } from '@proteinjs/user';
 /**
  * Handles Socket.IO session cleanup (such as disconnecting sockets)
  * when sessions are deleted.
+ *
+ * A deletion is not always made by a running server: a boot's source-record sync — and a
+ * migration Job, which never starts one — deactivates a withdrawn machine account and deletes its
+ * sessions before any socket server exists. Then no socket can be open, and there is nothing to
+ * close.
  */
 export declare class SocketIOSessionWatcher implements TableWatcher<Session> {
     name(): string;

package/dist/src/authentication/SocketIOSessionWatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SocketIOSessionWatcher.d.ts","sourceRoot":"","sources":["../../../src/authentication/SocketIOSessionWatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,OAAO,EAAgB,MAAM,iBAAiB,CAAC;AAGxD;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,YAAY,CAAC,OAAO,CAAC;IAClE,IAAI,IAAI,MAAM;IAId,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC;IAIjB,WAAW,CAAC,CAAC,SAAS,OAAO,EACjC,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,CAAC,EAAE,EACnB,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,EAC1B,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,IAAI,CAAC;CAIjB"}
+{"version":3,"file":"SocketIOSessionWatcher.d.ts","sourceRoot":"","sources":["../../../src/authentication/SocketIOSessionWatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,OAAO,EAAgB,MAAM,iBAAiB,CAAC;AAGxD;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,YAAW,YAAY,CAAC,OAAO,CAAC;IAClE,IAAI,IAAI,MAAM;IAId,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC;IAIjB,WAAW,CAAC,CAAC,SAAS,OAAO,EACjC,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,CAAC,EAAE,EACnB,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,EAC1B,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,IAAI,CAAC;CAWjB"}

package/dist/src/authentication/SocketIOSessionWatcher.js

@@ -42,6 +42,11 @@ var server_1 = require("@proteinjs/server");
 /**
  * Handles Socket.IO session cleanup (such as disconnecting sockets)
  * when sessions are deleted.
+ *
+ * A deletion is not always made by a running server: a boot's source-record sync — and a
+ * migration Job, which never starts one — deactivates a withdrawn machine account and deletes its
+ * sessions before any socket server exists. Then no socket can be open, and there is nothing to
+ * close.
  */
 var SocketIOSessionWatcher = /** @class */ (function () {
     function SocketIOSessionWatcher() {
@@ -54,10 +59,16 @@ var SocketIOSessionWatcher = /** @class */ (function () {
     };
     SocketIOSessionWatcher.prototype.afterDelete = function (recordDeleteCount, deletedRecords, initialQb, deleteQb) {
         return __awaiter(this, void 0, void 0, function () {
-            var deletedSessionIds;
+            var socketIOServer, deletedSessionIds;
             return __generator(this, function (_a) {
+                socketIOServer = server_1.SocketIOServerRepo.getSocketIOServerIfExists();
                 deletedSessionIds = deletedRecords.map(function (deletedRecord) { return deletedRecord.sessionId; });
-                server_1.SocketIOServerRepo.getSocketIOServer().in(deletedSessionIds).disconnectSockets(true);
+                // No rooms is never sent: socket.io applies an operation with an empty room list to EVERY
+                // socket on the namespace.
+                if (!socketIOServer || deletedSessionIds.length === 0) {
+                    return [2 /*return*/];
+                }
+                socketIOServer.in(deletedSessionIds).disconnectSockets(true);
                 return [2 /*return*/];
             });
         });

package/dist/src/authentication/SocketIOSessionWatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"SocketIOSessionWatcher.js","sourceRoot":"","sources":["../../../src/authentication/SocketIOSessionWatcher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAwD;AACxD,4CAAuD;AAEvD;;;GAGG;AACH;IAAA;IAkBA,CAAC;IAjBC,qCAAI,GAAJ;QACE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,sCAAK,GAAL;QACE,OAAO,IAAI,mBAAY,EAAE,CAAC;IAC5B,CAAC;IAEK,4CAAW,GAAjB,UACE,iBAAyB,EACzB,cAAmB,EACnB,SAA0B,EAC1B,QAAyB;;;;gBAEnB,iBAAiB,GAAG,cAAc,CAAC,GAAG,CAAC,UAAC,aAAa,IAAK,OAAA,aAAa,CAAC,SAAS,EAAvB,CAAuB,CAAC,CAAC;gBACzF,2BAAkB,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;;;;KACtF;IACH,6BAAC;AAAD,CAAC,AAlBD,IAkBC;AAlBY,wDAAsB"}
+{"version":3,"file":"SocketIOSessionWatcher.js","sourceRoot":"","sources":["../../../src/authentication/SocketIOSessionWatcher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAwD;AACxD,4CAAuD;AAEvD;;;;;;;;GAQG;AACH;IAAA;IAyBA,CAAC;IAxBC,qCAAI,GAAJ;QACE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,sCAAK,GAAL;QACE,OAAO,IAAI,mBAAY,EAAE,CAAC;IAC5B,CAAC;IAEK,4CAAW,GAAjB,UACE,iBAAyB,EACzB,cAAmB,EACnB,SAA0B,EAC1B,QAAyB;;;;gBAEnB,cAAc,GAAG,2BAAkB,CAAC,yBAAyB,EAAE,CAAC;gBAChE,iBAAiB,GAAG,cAAc,CAAC,GAAG,CAAC,UAAC,aAAa,IAAK,OAAA,aAAa,CAAC,SAAS,EAAvB,CAAuB,CAAC,CAAC;gBACzF,0FAA0F;gBAC1F,2BAA2B;gBAC3B,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE;oBACrD,sBAAO;iBACR;gBAED,cAAc,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;;;;KAC9D;IACH,6BAAC;AAAD,CAAC,AAzBD,IAyBC;AAzBY,wDAAsB"}

package/dist/src/authentication/UserStatusTableWatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserStatusTableWatcher.d.ts","sourceRoot":"","sources":["../../../src/authentication/UserStatusTableWatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,IAAI,EAAU,MAAM,iBAAiB,CAAC;AAG/C;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,YAAW,YAAY,CAAC,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA+C;IAE7D,IAAI,IAAI,MAAM;IAId,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;IAId,WAAW,CAAC,CAAC,SAAS,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CA8BrH"}
+{"version":3,"file":"UserStatusTableWatcher.d.ts","sourceRoot":"","sources":["../../../src/authentication/UserStatusTableWatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAiB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,IAAI,EAAU,MAAM,iBAAiB,CAAC;AAI/C;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,YAAW,YAAY,CAAC,IAAI,CAAC;IAC/D,OAAO,CAAC,MAAM,CAA+C;IAE7D,IAAI,IAAI,MAAM;IAId,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;IAId,WAAW,CAAC,CAAC,SAAS,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CA8BrH"}

package/dist/src/authentication/UserStatusTableWatcher.js

@@ -40,6 +40,7 @@ exports.UserStatusTableWatcher = void 0;
 var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 /**
  * The one owner of "deactivated ⇒ sessions die": any user-table update writing
  * `status: 'deactivated'` deletes the account's session rows (SocketIOSessionWatcher kicks the
@@ -95,7 +96,7 @@ var UserStatusTableWatcher = /** @class */ (function () {
                                             if (deletedSessions > 0) {
                                                 this.logger.info({
                                                     message: "Deactivation killed sessions",
-                                                    obj: { email: user.email, sessions: deletedSessions },
+                                                    obj: { account: new util_node_1.RequestDigests().account(user.email), sessions: deletedSessions },
                                                 });
                                             }
                                             return [2 /*return*/];

package/dist/src/authentication/UserStatusTableWatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserStatusTableWatcher.js","sourceRoot":"","sources":["../../../src/authentication/UserStatusTableWatcher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAiF;AACjF,wCAA+C;AAC/C,4CAA2C;AAE3C;;;;;;;;;GASG;AACH;IAAA;QACU,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAwC/D,CAAC;IAtCC,qCAAI,GAAJ;QACE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,sCAAK,GAAL;QACE,OAAO,aAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAEK,4CAAW,GAAjB,UAAkC,iBAAyB,EAAE,MAAkB,EAAE,EAAmB;;;;;;;wBAClG,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,iBAAiB,KAAK,CAAC,EAAE;4BAC9D,sBAAO;yBACR;wBAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;4BACd,yFAAyF;4BACzF,sFAAsF;4BACtF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gCAChB,OAAO,EAAE,kIAA6H;6BACvI,CAAC,CAAC;4BACH,sBAAO;yBACR;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBAC3B,qBAAM,EAAE,CAAC,cAAc,CAAC;;;;gDACT,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAA;;4CAAnD,IAAI,GAAG,SAA4C;4CACzD,IAAI,CAAC,IAAI,EAAE;gDACT,sBAAO,CAAC,mEAAmE;6CAC5E;4CAEuB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAA;;4CAA5E,eAAe,GAAG,SAA0D;4CAClF,IAAI,eAAe,GAAG,CAAC,EAAE;gDACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oDACf,OAAO,EAAE,8BAA8B;oDACvC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE;iDACtD,CAAC,CAAC;6CACJ;;;;iCACF,CAAC,EAAA;;wBAbF,SAaE,CAAC;;;;;KACJ;IACH,6BAAC;AAAD,CAAC,AAzCD,IAyCC;AAzCY,wDAAsB"}
+{"version":3,"file":"UserStatusTableWatcher.js","sourceRoot":"","sources":["../../../src/authentication/UserStatusTableWatcher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAiF;AACjF,wCAA+C;AAC/C,4CAA2C;AAC3C,kDAAsD;AAEtD;;;;;;;;;GASG;AACH;IAAA;QACU,WAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAwC/D,CAAC;IAtCC,qCAAI,GAAJ;QACE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,sCAAK,GAAL;QACE,OAAO,aAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAEK,4CAAW,GAAjB,UAAkC,iBAAyB,EAAE,MAAkB,EAAE,EAAmB;;;;;;;wBAClG,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,iBAAiB,KAAK,CAAC,EAAE;4BAC9D,sBAAO;yBACR;wBAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;4BACd,yFAAyF;4BACzF,sFAAsF;4BACtF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gCAChB,OAAO,EAAE,kIAA6H;6BACvI,CAAC,CAAC;4BACH,sBAAO;yBACR;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBAC3B,qBAAM,EAAE,CAAC,cAAc,CAAC;;;;gDACT,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAA;;4CAAnD,IAAI,GAAG,SAA4C;4CACzD,IAAI,CAAC,IAAI,EAAE;gDACT,sBAAO,CAAC,mEAAmE;6CAC5E;4CAEuB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAA;;4CAA5E,eAAe,GAAG,SAA0D;4CAClF,IAAI,eAAe,GAAG,CAAC,EAAE;gDACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oDACf,OAAO,EAAE,8BAA8B;oDACvC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,0BAAc,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE;iDACtF,CAAC,CAAC;6CACJ;;;;iCACF,CAAC,EAAA;;wBAbF,SAaE,CAAC;;;;;KACJ;IACH,6BAAC;AAAD,CAAC,AAzCD,IAyCC;AAzCY,wDAAsB"}

package/dist/src/authentication/authenticate.d.ts

@@ -1,6 +1,21 @@
+import { User } from '@proteinjs/user';
 export declare function createAuthentication(defaultAdminCredentials?: {
     username: string;
     password: string;
 }): typeof authenticate;
 export declare function authenticate(email: string, password: string): Promise<true | string>;
+/**
+ * Looks the account up and verifies the password — the cost every refusal pays, whether or not
+ * the address has an account: with none, the password is verified against a stand-in of the
+ * same cost (`PasswordHasher.verifyAgainstNothing`), so a refusal's timing says nothing about
+ * the address; a human row still in the legacy sha256 format (verified in microseconds) pays the
+ * stand-in too, so a refusal's timing says nothing about whether the account has signed in since
+ * the format changed either. The login door also runs it on a throttled try and discards the
+ * verdict, so a throttled answer takes as long as a refused password. No side effects (no
+ * rehash, no log).
+ */
+export declare function checkPassword(email: string, password: string): Promise<{
+    user?: User;
+    matches: boolean;
+}>;
 //# sourceMappingURL=authenticate.d.ts.map

package/dist/src/authentication/authenticate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../src/authentication/authenticate.ts"],"names":[],"mappings":"AAMA,wBAAgB,oBAAoB,CAAC,uBAAuB,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,uBAMpG;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CA8C1F"}
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../src/authentication/authenticate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAU,MAAM,iBAAiB,CAAC;AAM/C,wBAAgB,oBAAoB,CAAC,uBAAuB,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,uBAMpG;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CA8C1F;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,CAAC,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAc/G"}

package/dist/src/authentication/authenticate.js

@@ -36,10 +36,11 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = exports.createAuthentication = void 0;
+exports.checkPassword = exports.authenticate = exports.createAuthentication = void 0;
 var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 var DefaultAdminCredentials_1 = require("./DefaultAdminCredentials");
 var PasswordHasher_1 = require("./PasswordHasher");
 function createAuthentication(defaultAdminCredentials) {
@@ -51,7 +52,7 @@ function createAuthentication(defaultAdminCredentials) {
 exports.createAuthentication = createAuthentication;
 function authenticate(email, password) {
     return __awaiter(this, void 0, void 0, function () {
-        var logger, defaultAdminCredentials, db, user, hasher, _a, mode, _b, _c, _d;
+        var logger, defaultAdminCredentials, _a, user, matches, db, hasher, mode, _b, _c, _d;
         var _e;
         return __generator(this, function (_f) {
             switch (_f.label) {
@@ -64,32 +65,25 @@ function authenticate(email, password) {
                         logger.info({ message: 'Authenitcated default admin user' });
                         return [2 /*return*/, true];
                     }
-                    db = (0, db_1.getDbAsSystem)();
-                    return [4 /*yield*/, db.get(user_1.tables.User, { email: email.toLowerCase() })];
+                    return [4 /*yield*/, checkPassword(email, password)];
                 case 1:
-                    user = _f.sent();
-                    hasher = new PasswordHasher_1.PasswordHasher();
-                    _a = !user;
-                    if (_a) return [3 /*break*/, 3];
-                    return [4 /*yield*/, hasher.verify(user.password, password)];
-                case 2:
-                    _a = !(_f.sent());
-                    _f.label = 3;
-                case 3:
-                    if (_a) {
+                    _a = _f.sent(), user = _a.user, matches = _a.matches;
+                    if (!user || !matches) {
                         return [2 /*return*/, 'User name or password incorrect'];
                     }
+                    db = (0, db_1.getDbAsSystem)();
+                    hasher = new PasswordHasher_1.PasswordHasher();
                     mode = user.isLoadedFromSource === true ? 'machine' : 'human';
-                    if (!hasher.needsRehash(user.password, mode)) return [3 /*break*/, 6];
+                    if (!hasher.needsRehash(user.password, mode)) return [3 /*break*/, 4];
                     _c = (_b = db).update;
                     _d = [user_1.tables.User];
                     _e = { id: user.id };
                     return [4 /*yield*/, hasher.hash(password)];
-                case 4: return [4 /*yield*/, _c.apply(_b, _d.concat([(_e.password = _f.sent(), _e)]))];
-                case 5:
+                case 2: return [4 /*yield*/, _c.apply(_b, _d.concat([(_e.password = _f.sent(), _e)]))];
+                case 3:
                     _f.sent();
-                    _f.label = 6;
-                case 6:
+                    _f.label = 4;
+                case 4:
                     // Deactivated accounts are refused a new session even with correct credentials; the session
                     // side of the same gate lives in userCache (deactivated sessions resolve as guest).
                     if (user.status === 'deactivated') {
@@ -100,7 +94,10 @@ function authenticate(email, password) {
                         if (user.deleteRequestedAt != null) {
                             return [2 /*return*/, true];
                         }
-                        logger.warn({ message: 'Refused login for deactivated account', obj: { email: email.toLowerCase() } });
+                        logger.warn({
+                            message: 'Refused login for deactivated account',
+                            obj: { account: new util_node_1.RequestDigests().account(email) },
+                        });
                         return [2 /*return*/, 'This account has been deactivated'];
                     }
                     return [2 /*return*/, true];
@@ -109,4 +106,42 @@ function authenticate(email, password) {
     });
 }
 exports.authenticate = authenticate;
+/**
+ * Looks the account up and verifies the password — the cost every refusal pays, whether or not
+ * the address has an account: with none, the password is verified against a stand-in of the
+ * same cost (`PasswordHasher.verifyAgainstNothing`), so a refusal's timing says nothing about
+ * the address; a human row still in the legacy sha256 format (verified in microseconds) pays the
+ * stand-in too, so a refusal's timing says nothing about whether the account has signed in since
+ * the format changed either. The login door also runs it on a throttled try and discards the
+ * verdict, so a throttled answer takes as long as a refused password. No side effects (no
+ * rehash, no log).
+ */
+function checkPassword(email, password) {
+    return __awaiter(this, void 0, void 0, function () {
+        var user, hasher, matches;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { email: email.toLowerCase() })];
+                case 1:
+                    user = _b.sent();
+                    hasher = new PasswordHasher_1.PasswordHasher();
+                    if (!!user) return [3 /*break*/, 3];
+                    _a = {};
+                    return [4 /*yield*/, hasher.verifyAgainstNothing(password)];
+                case 2: return [2 /*return*/, (_a.matches = _b.sent(), _a)];
+                case 3: return [4 /*yield*/, hasher.verify(user.password, password)];
+                case 4:
+                    matches = _b.sent();
+                    if (!hasher.needsRehash(user.password, user.isLoadedFromSource === true ? 'machine' : 'human')) return [3 /*break*/, 6];
+                    return [4 /*yield*/, hasher.verifyAgainstNothing(password)];
+                case 5:
+                    _b.sent();
+                    _b.label = 6;
+                case 6: return [2 /*return*/, { user: user, matches: matches }];
+            }
+        });
+    });
+}
+exports.checkPassword = checkPassword;
 //# sourceMappingURL=authenticate.js.map

package/dist/src/authentication/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../../src/authentication/authenticate.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAyC;AACzC,4CAA2C;AAC3C,qEAAoE;AACpE,mDAAkD;AAElD,SAAgB,oBAAoB,CAAC,uBAAgE;IACnG,IAAI,uBAAuB,EAAE;QAC3B,iDAAuB,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;KACjE;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAND,oDAMC;AAED,SAAsB,YAAY,CAAC,KAAa,EAAE,QAAgB;;;;;;;oBAC1D,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC9C,uBAAuB,GAAG,iDAAuB,CAAC,cAAc,EAAE,CAAC;oBACzE,IACE,uBAAuB;wBACvB,uBAAuB,CAAC,QAAQ,IAAI,KAAK;wBACzC,uBAAuB,CAAC,QAAQ,IAAI,QAAQ,EAC5C;wBACA,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;wBAC7D,sBAAO,IAAI,EAAC;qBACb;oBAKK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAAhE,IAAI,GAAG,SAAyD;oBAChE,MAAM,GAAG,IAAI,+BAAc,EAAE,CAAC;oBAChC,KAAA,CAAC,IAAI,CAAA;4BAAL,wBAAK;oBAAM,qBAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAA;;oBAA9C,KAAA,CAAC,CAAC,SAA4C,CAAC,CAAA;;;oBAA5D,QAA8D;wBAC5D,sBAAO,iCAAiC,EAAC;qBAC1C;oBAKK,IAAI,GAAG,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;yBAChE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAvC,wBAAuC;oBACnC,KAAA,CAAA,KAAA,EAAE,CAAA,CAAC,MAAM,CAAA;0BAAC,aAAM,CAAC,IAAI;2BAAI,EAAE,EAAE,IAAI,CAAC,EAAE;oBAAY,qBAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAA;wBAAjF,qBAAM,yBAAsC,WAAQ,GAAE,SAA2B,QAAG,EAAA;;oBAApF,SAAoF,CAAC;;;oBAGvF,4FAA4F;oBAC5F,oFAAoF;oBACpF,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE;wBACjC,6FAA6F;wBAC7F,2FAA2F;wBAC3F,6FAA6F;wBAC7F,0FAA0F;wBAC1F,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,EAAE;4BAClC,sBAAO,IAAI,EAAC;yBACb;wBAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;wBACvG,sBAAO,mCAAmC,EAAC;qBAC5C;oBAED,sBAAO,IAAI,EAAC;;;;CACb;AA9CD,oCA8CC"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../../src/authentication/authenticate.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAA+C;AAC/C,4CAA2C;AAC3C,kDAAsD;AACtD,qEAAoE;AACpE,mDAAkD;AAElD,SAAgB,oBAAoB,CAAC,uBAAgE;IACnG,IAAI,uBAAuB,EAAE;QAC3B,iDAAuB,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;KACjE;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAND,oDAMC;AAED,SAAsB,YAAY,CAAC,KAAa,EAAE,QAAgB;;;;;;;oBAC1D,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC9C,uBAAuB,GAAG,iDAAuB,CAAC,cAAc,EAAE,CAAC;oBACzE,IACE,uBAAuB;wBACvB,uBAAuB,CAAC,QAAQ,IAAI,KAAK;wBACzC,uBAAuB,CAAC,QAAQ,IAAI,QAAQ,EAC5C;wBACA,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;wBAC7D,sBAAO,IAAI,EAAC;qBACb;oBAEyB,qBAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAA;;oBAAxD,KAAoB,SAAoC,EAAtD,IAAI,UAAA,EAAE,OAAO,aAAA;oBACrB,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE;wBACrB,sBAAO,iCAAiC,EAAC;qBAC1C;oBACK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBACrB,MAAM,GAAG,IAAI,+BAAc,EAAE,CAAC;oBAK9B,IAAI,GAAG,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;yBAChE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAvC,wBAAuC;oBACnC,KAAA,CAAA,KAAA,EAAE,CAAA,CAAC,MAAM,CAAA;0BAAC,aAAM,CAAC,IAAI;2BAAI,EAAE,EAAE,IAAI,CAAC,EAAE;oBAAY,qBAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAA;wBAAjF,qBAAM,yBAAsC,WAAQ,GAAE,SAA2B,QAAG,EAAA;;oBAApF,SAAoF,CAAC;;;oBAGvF,4FAA4F;oBAC5F,oFAAoF;oBACpF,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE;wBACjC,6FAA6F;wBAC7F,2FAA2F;wBAC3F,6FAA6F;wBAC7F,0FAA0F;wBAC1F,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,EAAE;4BAClC,sBAAO,IAAI,EAAC;yBACb;wBAED,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,uCAAuC;4BAChD,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,0BAAc,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;yBACtD,CAAC,CAAC;wBACH,sBAAO,mCAAmC,EAAC;qBAC5C;oBAED,sBAAO,IAAI,EAAC;;;;CACb;AA9CD,oCA8CC;AAED;;;;;;;;;GASG;AACH,SAAsB,aAAa,CAAC,KAAa,EAAE,QAAgB;;;;;;wBAIpD,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAA7E,IAAI,GAAG,SAAsE;oBAC7E,MAAM,GAAG,IAAI,+BAAc,EAAE,CAAC;yBAChC,CAAC,IAAI,EAAL,wBAAK;;oBACW,qBAAM,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAA;wBAA7D,uBAAS,UAAO,GAAE,SAA2C,OAAG;wBAElD,qBAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAA;;oBAAtD,OAAO,GAAG,SAA4C;yBACxD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAzF,wBAAyF;oBAC3F,qBAAM,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAA;;oBAA3C,SAA2C,CAAC;;wBAE9C,sBAAO,EAAE,IAAI,MAAA,EAAE,OAAO,SAAA,EAAE,EAAC;;;;CAC1B;AAdD,sCAcC"}

package/dist/src/authorization/userCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userCache.d.ts","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAAE,IAAI,EAA6C,MAAM,iBAAiB,CAAC;AAKlF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,EAAE,gBAAgB,CAAC,IAAI,CA8C5C,CAAC"}
+{"version":3,"file":"userCache.d.ts","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,EAAE,IAAI,EAA6C,MAAM,iBAAiB,CAAC;AAKlF;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,EAAE,gBAAgB,CAAC,IAAI,CA8C5C,CAAC"}

package/dist/src/authorization/userCache.js

@@ -43,6 +43,7 @@ exports.userCache = void 0;
 var moment_1 = __importDefault(require("moment"));
 var db_1 = require("@proteinjs/db");
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 var user_1 = require("@proteinjs/user");
 var DefaultAdminCredentials_1 = require("../authentication/DefaultAdminCredentials");
 var logger = new logger_1.Logger({ name: 'userCache' });
@@ -87,7 +88,7 @@ exports.userCache = {
                         // account is deactivated — every request runs as the unauthenticated guest.
                         logger.warn({
                             message: "Session references a deactivated account; resolving as unauthenticated",
-                            obj: { sessionId: sessionId, userEmail: userEmail },
+                            obj: { sessionId: sessionId, account: new util_node_1.RequestDigests().account(userEmail) },
                         });
                     }
                     else if (accountUser) {
@@ -101,7 +102,7 @@ exports.userCache = {
                         // build as an unhandled rejection and downs the process.
                         logger.warn({
                             message: "Session references an account that does not exist; resolving as unauthenticated",
-                            obj: { sessionId: sessionId, userEmail: userEmail },
+                            obj: { sessionId: sessionId, account: new util_node_1.RequestDigests().account(userEmail) },
                         });
                     }
                     _a.label = 3;

package/dist/src/authorization/userCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"userCache.js","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAE5B,oCAA8C;AAC9C,4CAA2C;AAC3C,wCAAkF;AAClF,qFAAoF;AAEpF,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAEjD;;;;;;;;GAQG;AACU,QAAA,SAAS,GAA2B;IAC/C,GAAG,EAAE,6BAAsB;IAC3B,MAAM,EAAE,UAAO,SAAiB,EAAE,SAAiB;;;;;oBAC7C,IAAI,GAAG,gBAAS,CAAC;yBACjB,SAAS,EAAT,wBAAS;oBACL,gBAAgB,GAAG,iDAAuB,CAAC,cAAc,EAAE,CAAC;yBAC9D,CAAA,gBAAgB,IAAI,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAA,EAA1D,wBAA0D;oBACtD,SAAS,GAAS;wBACtB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,gBAAgB,CAAC,QAAQ;wBAChC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;wBACnC,aAAa,EAAE,IAAI;wBACnB,KAAK,EAAE,CAAC,OAAO,CAAC;wBAChB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,EAAE,EAAE,OAAO;qBACZ,CAAC;oBACF,IAAI,GAAG,SAAS,CAAC;;wBAEG,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAAxF,WAAW,GAAG,SAA0E;oBAC9F,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,aAAa,EAAE;wBACvD,sFAAsF;wBACtF,iFAAiF;wBACjF,4EAA4E;wBAC5E,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,wEAAwE;4BACjF,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;yBAAM,IAAI,WAAW,EAAE;wBACtB,OAAQ,WAAmB,CAAC,UAAU,CAAC,CAAC;wBACxC,IAAI,GAAG,WAAW,CAAC;qBACpB;yBAAM;wBACL,0FAA0F;wBAC1F,+EAA+E;wBAC/E,sFAAsF;wBACtF,yDAAyD;wBACzD,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,iFAAiF;4BAC1F,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,SAAS,WAAA,EAAE;yBAC9B,CAAC,CAAC;qBACJ;;wBAIL,sBAAO,IAAI,EAAC;;;SACb;CACF,CAAC"}
+{"version":3,"file":"userCache.js","sourceRoot":"","sources":["../../../src/authorization/userCache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAE5B,oCAA8C;AAC9C,4CAA2C;AAC3C,kDAAsD;AACtD,wCAAkF;AAClF,qFAAoF;AAEpF,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAEjD;;;;;;;;GAQG;AACU,QAAA,SAAS,GAA2B;IAC/C,GAAG,EAAE,6BAAsB;IAC3B,MAAM,EAAE,UAAO,SAAiB,EAAE,SAAiB;;;;;oBAC7C,IAAI,GAAG,gBAAS,CAAC;yBACjB,SAAS,EAAT,wBAAS;oBACL,gBAAgB,GAAG,iDAAuB,CAAC,cAAc,EAAE,CAAC;yBAC9D,CAAA,gBAAgB,IAAI,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAA,EAA1D,wBAA0D;oBACtD,SAAS,GAAS;wBACtB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,gBAAgB,CAAC,QAAQ;wBAChC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;wBACnC,aAAa,EAAE,IAAI;wBACnB,KAAK,EAAE,CAAC,OAAO,CAAC;wBAChB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,OAAO,EAAE,IAAA,gBAAM,GAAE;wBACjB,EAAE,EAAE,OAAO;qBACZ,CAAC;oBACF,IAAI,GAAG,SAAS,CAAC;;wBAEG,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAAxF,WAAW,GAAG,SAA0E;oBAC9F,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,aAAa,EAAE;wBACvD,sFAAsF;wBACtF,iFAAiF;wBACjF,4EAA4E;wBAC5E,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,wEAAwE;4BACjF,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,OAAO,EAAE,IAAI,0BAAc,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;yBACrE,CAAC,CAAC;qBACJ;yBAAM,IAAI,WAAW,EAAE;wBACtB,OAAQ,WAAmB,CAAC,UAAU,CAAC,CAAC;wBACxC,IAAI,GAAG,WAAW,CAAC;qBACpB;yBAAM;wBACL,0FAA0F;wBAC1F,+EAA+E;wBAC/E,sFAAsF;wBACtF,yDAAyD;wBACzD,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,iFAAiF;4BAC1F,GAAG,EAAE,EAAE,SAAS,WAAA,EAAE,OAAO,EAAE,IAAI,0BAAc,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;yBACrE,CAAC,CAAC;qBACJ;;wBAIL,sBAAO,IAAI,EAAC;;;SACb;CACF,CAAC"}

package/dist/src/routes/devLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAc9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,QAAQ,EAAE,KA4DtB,CAAC"}
+{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAe9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,QAAQ,EAAE,KAuEtB,CAAC"}

package/dist/src/routes/devLogin.js

@@ -38,6 +38,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.devLogin = void 0;
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 var util_1 = require("@proteinjs/util");
 var establishSession_1 = require("../authentication/establishSession");
 var Roles_1 = require("../services/Roles");
@@ -97,7 +98,7 @@ exports.devLogin = {
     path: '/dev/login',
     method: 'get',
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var envEmail, email, emailParam, requested, creation, bootstrapEmail, outcome, bootstrapRoles, outcome;
+        var envEmail, email, emailParam, requested, digests, creation, error_1, bootstrapEmail, outcome, bootstrapRoles, outcome;
         var _a, _b, _c;
         return __generator(this, function (_d) {
             switch (_d.label) {
@@ -125,6 +126,10 @@ exports.devLogin = {
                         email = requested;
                     }
                     email = email.toLowerCase();
+                    digests = new util_node_1.RequestDigests();
+                    _d.label = 1;
+                case 1:
+                    _d.trys.push([1, 3, , 4]);
                     return [4 /*yield*/, new Signup_1.Signup().createAccount({
                             name: email.slice(0, email.indexOf('@')),
                             email: email,
@@ -132,35 +137,45 @@ exports.devLogin = {
                             emailVerified: false,
                             invitedBy: null,
                         })];
-                case 1:
+                case 2:
                     creation = _d.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_1 = _d.sent();
+                    // createAccount refuses in plain words (an address a machine-account declaration owns); the
+                    // dev door answers the way its other refusals do — the words, no session, no row.
+                    response
+                        .status(400)
+                        .send("/dev/login: ".concat(error_1 instanceof Error ? error_1.message : 'the account could not be created'));
+                    return [2 /*return*/];
+                case 4:
                     if (creation === 'created') {
-                        logger.info({ message: 'Dev auto-login created missing test account', obj: { email: email } });
+                        logger.info({ message: 'Dev auto-login created missing test account', obj: { account: digests.account(email) } });
                     }
                     bootstrapEmail = ((_c = process.env.DEV_BOOTSTRAP_ADMIN_EMAIL) !== null && _c !== void 0 ? _c : '').trim().toLowerCase();
-                    if (!(bootstrapEmail && email === bootstrapEmail)) return [3 /*break*/, 3];
+                    if (!(bootstrapEmail && email === bootstrapEmail)) return [3 /*break*/, 6];
                     return [4 /*yield*/, new Roles_1.Roles().bootstrapAdmin(email)];
-                case 2:
+                case 5:
                     outcome = _d.sent();
-                    logger.info({ message: "Dev bootstrap admin door: ".concat(outcome), obj: { email: email } });
-                    _d.label = 3;
-                case 3:
+                    logger.info({ message: "Dev bootstrap admin door: ".concat(outcome), obj: { account: digests.account(email) } });
+                    _d.label = 6;
+                case 6:
                     bootstrapRoles = DevBootstrapRoles_1.DevBootstrapRoles.rolesFor(email);
-                    if (!(bootstrapRoles.length > 0)) return [3 /*break*/, 5];
+                    if (!(bootstrapRoles.length > 0)) return [3 /*break*/, 8];
                     return [4 /*yield*/, new Roles_1.Roles().bootstrapRoles(email, bootstrapRoles)];
-                case 4:
+                case 7:
                     outcome = _d.sent();
                     logger.info({ message: DevBootstrapRoles_1.DevBootstrapRoles.markerLine(email, outcome) });
-                    _d.label = 5;
-                case 5: 
+                    _d.label = 8;
+                case 8: 
                 // establishSession commits the session row before the redirect — the redirected GET / must
                 // never read the store ahead of the write (observed: first /dev/login load landed on /login).
                 return [4 /*yield*/, (0, establishSession_1.establishSession)(request, email)];
-                case 6:
+                case 9:
                     // establishSession commits the session row before the redirect — the redirected GET / must
                     // never read the store ahead of the write (observed: first /dev/login load landed on /login).
                     _d.sent();
-                    logger.info({ message: 'Dev auto-login session established', obj: { email: email } });
+                    logger.info({ message: 'Dev auto-login session established', obj: { account: digests.account(email) } });
                     response.redirect('/');
                     return [2 /*return*/];
             }

package/dist/src/routes/devLogin.js.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.js","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,wCAA6C;AAC7C,uEAAsE;AACtE,2CAA0C;AAC1C,6CAA4C;AAC5C,yDAAwD;AAExD,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEhD;kFACkF;AAClF,IAAM,WAAW,GAAG,UAAC,OAAe,IAAK,OAAA,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAzD,CAAyD,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACU,QAAA,QAAQ,GAAU;IAC7B,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,QAAQ,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;wBACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,sBAAO;qBACR;oBAEG,KAAK,GAAG,QAAQ,CAAC;oBACf,UAAU,GAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,CAAC;oBACxC,IAAI,UAAU,KAAK,SAAS,EAAE;wBACtB,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,EAAE;4BACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAA4C,WAAW,CAAC,QAAQ,CAAC,YAAS,CAAC,CAAC;4BACtG,sBAAO;yBACR;wBACD,IAAI,CAAC,iBAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;4BAC/B,QAAQ;iCACL,MAAM,CAAC,GAAG,CAAC;iCACX,IAAI,CACH,wBAAgB,SAAS,4EAAiE;gCACxF,uEAAgE,WAAW,CAAC,QAAQ,CAAC,MAAG,CAC3F,CAAC;4BACJ,sBAAO;yBACR;wBACD,KAAK,GAAG,SAAS,CAAC;qBACnB;oBACD,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBAEX,qBAAM,IAAI,eAAM,EAAE,CAAC,aAAa,CAAC;4BAChD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,KAAK,OAAA;4BACL,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI;yBAChB,CAAC,EAAA;;oBANI,QAAQ,GAAG,SAMf;oBACF,IAAI,QAAQ,KAAK,SAAS,EAAE;wBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;qBACzF;oBAEK,cAAc,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,yBAAyB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;yBACtF,CAAA,cAAc,IAAI,KAAK,KAAK,cAAc,CAAA,EAA1C,wBAA0C;oBAC5B,qBAAM,IAAI,aAAK,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAA;;oBAAjD,OAAO,GAAG,SAAuC;oBACvD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAA6B,OAAO,CAAE,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;;;oBAG7E,cAAc,GAAG,qCAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;yBACrD,CAAA,cAAc,CAAC,MAAM,GAAG,CAAC,CAAA,EAAzB,wBAAyB;oBACX,qBAAM,IAAI,aAAK,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAAjE,OAAO,GAAG,SAAuD;oBACvE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qCAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;;;gBAGzE,2FAA2F;gBAC3F,8FAA8F;gBAC9F,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,EAAA;;oBAFtC,2FAA2F;oBAC3F,8FAA8F;oBAC9F,SAAsC,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;oBAC/E,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;;;;SACxB;CACF,CAAC"}
+{"version":3,"file":"devLogin.js","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,kDAAsD;AACtD,wCAA6C;AAC7C,uEAAsE;AACtE,2CAA0C;AAC1C,6CAA4C;AAC5C,yDAAwD;AAExD,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEhD;kFACkF;AAClF,IAAM,WAAW,GAAG,UAAC,OAAe,IAAK,OAAA,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAzD,CAAyD,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACU,QAAA,QAAQ,GAAU;IAC7B,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,QAAQ,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;wBACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,sBAAO;qBACR;oBAEG,KAAK,GAAG,QAAQ,CAAC;oBACf,UAAU,GAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,CAAC;oBACxC,IAAI,UAAU,KAAK,SAAS,EAAE;wBACtB,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,EAAE;4BACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAA4C,WAAW,CAAC,QAAQ,CAAC,YAAS,CAAC,CAAC;4BACtG,sBAAO;yBACR;wBACD,IAAI,CAAC,iBAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;4BAC/B,QAAQ;iCACL,MAAM,CAAC,GAAG,CAAC;iCACX,IAAI,CACH,wBAAgB,SAAS,4EAAiE;gCACxF,uEAAgE,WAAW,CAAC,QAAQ,CAAC,MAAG,CAC3F,CAAC;4BACJ,sBAAO;yBACR;wBACD,KAAK,GAAG,SAAS,CAAC;qBACnB;oBACD,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBACtB,OAAO,GAAG,IAAI,0BAAc,EAAE,CAAC;;;;oBAIxB,qBAAM,IAAI,eAAM,EAAE,CAAC,aAAa,CAAC;4BAC1C,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,KAAK,OAAA;4BACL,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI;yBAChB,CAAC,EAAA;;oBANF,QAAQ,GAAG,SAMT,CAAC;;;;oBAEH,4FAA4F;oBAC5F,kFAAkF;oBAClF,QAAQ;yBACL,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC,sBAAe,OAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,CAAE,CAAC,CAAC;oBACtG,sBAAO;;oBAET,IAAI,QAAQ,KAAK,SAAS,EAAE;wBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;qBACnH;oBAEK,cAAc,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,yBAAyB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;yBACtF,CAAA,cAAc,IAAI,KAAK,KAAK,cAAc,CAAA,EAA1C,wBAA0C;oBAC5B,qBAAM,IAAI,aAAK,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAA;;oBAAjD,OAAO,GAAG,SAAuC;oBACvD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAA6B,OAAO,CAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;;;oBAGvG,cAAc,GAAG,qCAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;yBACrD,CAAA,cAAc,CAAC,MAAM,GAAG,CAAC,CAAA,EAAzB,wBAAyB;oBACX,qBAAM,IAAI,aAAK,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAAjE,OAAO,GAAG,SAAuD;oBACvE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qCAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;;;gBAGzE,2FAA2F;gBAC3F,8FAA8F;gBAC9F,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,EAAA;;oBAFtC,2FAA2F;oBAC3F,8FAA8F;oBAC9F,SAAsC,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;;;;SACxB;CACF,CAAC"}

package/dist/src/routes/executePasswordReset.d.ts

@@ -8,6 +8,10 @@ import { Route } from '@proteinjs/server-api';
  * The token itself never reaches the log. A request that carries no body at all is refused like
  * one that carries a blank password.
  *
+ * A redeemed link also opens the account's sign-in window again (`SignInThrottle`): the person
+ * just proved the mailbox, so a reset made while wrong guesses held the door shut lets the new
+ * password in at once instead of waiting the window out.
+ *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
  */

package/dist/src/routes/executePasswordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAuClC,CAAC"}
+{"version":3,"file":"executePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQ9C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAyClC,CAAC"}

package/dist/src/routes/executePasswordReset.js

@@ -39,8 +39,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.executePasswordReset = void 0;
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
+var util_node_1 = require("@proteinjs/util-node");
 var PasswordHasher_1 = require("../authentication/PasswordHasher");
 var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
+var SignInThrottle_1 = require("../throttle/SignInThrottle");
 /**
  * Route handler for executing a password reset.
  *
@@ -50,6 +52,10 @@ var PasswordResetToken_1 = require("../authentication/PasswordResetToken");
  * The token itself never reaches the log. A request that carries no body at all is refused like
  * one that carries a blank password.
  *
+ * A redeemed link also opens the account's sign-in window again (`SignInThrottle`): the person
+ * just proved the mailbox, so a reset made while wrong guesses held the door shut lets the new
+ * password in at once instead of waiting the window out.
+ *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
  */
@@ -57,12 +63,13 @@ exports.executePasswordReset = {
     path: user_1.routes.executePasswordReset.path,
     method: user_1.routes.executePasswordReset.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var logger, _a, token, newPassword, resetToken, resolution, user, hashedPassword;
+        var logger, digests, _a, token, newPassword, resetToken, resolution, user, hashedPassword;
         var _b;
         return __generator(this, function (_c) {
             switch (_c.label) {
                 case 0:
                     logger = new logger_1.Logger({ name: 'executePasswordReset' });
+                    digests = new util_node_1.RequestDigests();
                     _a = (_b = request.body) !== null && _b !== void 0 ? _b : {}, token = _a.token, newPassword = _a.newPassword;
                     if (typeof newPassword !== 'string' || newPassword.length === 0) {
                         response.status(400).send({ error: 'New password cannot be blank' });
@@ -81,7 +88,7 @@ exports.executePasswordReset = {
                         return [2 /*return*/];
                     }
                     if (resolution.status === 'expired') {
-                        logger.info({ message: "Expired reset token used", obj: { email: resolution.user.email } });
+                        logger.info({ message: "Expired reset token used", obj: { account: digests.account(resolution.user.email) } });
                         response.status(400).send({ error: 'Reset token has expired' });
                         return [2 /*return*/];
                     }
@@ -92,11 +99,12 @@ exports.executePasswordReset = {
                     return [4 /*yield*/, resetToken.redeem(user, resolution.token, hashedPassword)];
                 case 3:
                     if (!(_c.sent())) {
-                        logger.info({ message: "Reset token already redeemed", obj: { email: user.email } });
+                        logger.info({ message: "Reset token already redeemed", obj: { account: digests.account(user.email) } });
                         response.status(400).send({ error: 'Invalid or expired reset token' });
                         return [2 /*return*/];
                     }
-                    logger.info({ message: "Password successfully reset", obj: { email: user.email } });
+                    SignInThrottle_1.signInThrottle.recordSuccess(digests.account(user.email));
+                    logger.info({ message: "Password successfully reset", obj: { account: digests.account(user.email) } });
                     response.send({ message: 'Password has been successfully reset' });
                     return [2 /*return*/];
             }

package/dist/src/routes/executePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,mEAAkE;AAClE,2EAA0E;AAE1E;;;;;;;;;;;GAWG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,EAAzC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAwB;oBAClD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;wBACrE,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC5F,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAEO,IAAI,GAAK,UAAU,KAAf,CAAgB;oBACL,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAC7D,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAArE,IAAI,CAAC,CAAC,SAA+D,CAAC,EAAE;wBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACrF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}
+{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,4CAA2C;AAC3C,kDAAsD;AACtD,mEAAkE;AAClE,2EAA0E;AAC1E,6DAA4D;AAE5D;;;;;;;;;;;;;;;GAeG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,OAAO,GAAG,IAAI,0BAAc,EAAE,CAAC;oBAC/B,KAAyB,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,EAAzC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAwB;oBAClD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;wBAC/D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;wBACrE,sBAAO;qBACR;oBAEK,UAAU,GAAG,IAAI,uCAAkB,EAAE,CAAC;oBACzB,qBAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAA;;oBAA5C,UAAU,GAAG,SAA+B;oBAClD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACxE,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,0BAA0B;4BACnC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;yBACzE,CAAC,CAAC;wBACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE;wBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC/G,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAEO,IAAI,GAAK,UAAU,KAAf,CAAgB;oBACL,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBAC7D,qBAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,cAAc,CAAC,EAAA;;oBAArE,IAAI,CAAC,CAAC,SAA+D,CAAC,EAAE;wBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;wBACxG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAED,+BAAc,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;oBACvG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}

package/dist/src/routes/initiatePasswordReset.d.ts

@@ -6,6 +6,13 @@ import { Route } from '@proteinjs/server-api';
  * its expiry on the user row — and mails the token to the account as a reset link. The token is
  * withdrawn again when the mail fails to send.
  *
+ * ONE ANSWER: every request with an address is answered `ONE_ANSWER` — BEFORE the address is
+ * looked up — whether it has an account, is throttled (`PasswordResetThrottle`: per client and
+ * per address), is inside the account's five-minute gap, or its mail fails; so neither the
+ * words, the status nor the timing say whether an address has an account. The work runs after
+ * the answer. Every request is one outcome line carrying the account digest and the coarse IP
+ * hash (`RequestDigests`) — never the address.
+ *
  * Requires an implementation of `DefaultPasswordResetEmailConfigFactory` to build the password reset email with.
  *
  * @bodyParam {string} email - The email address of the user requesting a password reset.

package/dist/src/routes/initiatePasswordReset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initiatePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAW9C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAkEnC,CAAC"}
+{"version":3,"file":"initiatePasswordReset.d.ts","sourceRoot":"","sources":["../../../src/routes/initiatePasswordReset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAoB9C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAoEnC,CAAC"}