@proteinjs/user-server 1.7.0 → 1.9.0

package/dist/src/emails/AccountDeletionEmailConfigs.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDefaultAccountDeletedEmailConfigFactory = exports.getDefaultAccountDeletionRequestedEmailConfigFactory = void 0;
+var reflection_1 = require("@proteinjs/reflection");
+var getDefaultAccountDeletionRequestedEmailConfigFactory = function () {
+    var defaultFactory = {
+        getConfig: function () { return ({
+            options: { subject: 'Your account is scheduled for deletion' },
+            getEmailContent: function (purgeAfter) { return ({
+                text: "Your account is scheduled for deletion. Your content is no longer visible to you or to " +
+                    "anyone you shared it with. You can change your mind until ".concat(purgeAfter.format('MMMM D, YYYY'), " ") +
+                    "by simply logging back in \u2014 that restores everything, including shares. After that date, your " +
+                    "account and everything in it are permanently removed from our systems, and we'll email you to " +
+                    "confirm when it's done. If you didn't request this, log back in now to cancel.",
+            }); },
+        }); },
+    };
+    var retrievedFactory = reflection_1.SourceRepository.get().object('@proteinjs/user-server/DefaultAccountDeletionRequestedEmailConfigFactory');
+    return retrievedFactory || defaultFactory;
+};
+exports.getDefaultAccountDeletionRequestedEmailConfigFactory = getDefaultAccountDeletionRequestedEmailConfigFactory;
+var getDefaultAccountDeletedEmailConfigFactory = function () {
+    var defaultFactory = {
+        getConfig: function () { return ({
+            options: { subject: 'Your account has been deleted' },
+            getEmailContent: function () { return ({
+                text: "Your account and everything in it have been permanently removed from our systems. " +
+                    "This is the confirmation you were promised when you requested deletion. Goodbye, and thank you.",
+            }); },
+        }); },
+    };
+    var retrievedFactory = reflection_1.SourceRepository.get().object('@proteinjs/user-server/DefaultAccountDeletedEmailConfigFactory');
+    return retrievedFactory || defaultFactory;
+};
+exports.getDefaultAccountDeletedEmailConfigFactory = getDefaultAccountDeletedEmailConfigFactory;
+//# sourceMappingURL=AccountDeletionEmailConfigs.js.map

package/dist/src/emails/AccountDeletionEmailConfigs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountDeletionEmailConfigs.js","sourceRoot":"","sources":["../../../src/emails/AccountDeletionEmailConfigs.ts"],"names":[],"mappings":";;;AAAA,oDAAmE;AAyB5D,IAAM,oDAAoD,GAC/D;IACE,IAAM,cAAc,GAAsD;QACxE,SAAS,EAAE,cAAM,OAAA,CAAC;YAChB,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE;YAC9D,eAAe,EAAE,UAAC,UAAkB,IAAK,OAAA,CAAC;gBACxC,IAAI,EACF,yFAAyF;oBACzF,oEAA6D,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,MAAG;oBACjG,qGAAgG;oBAChG,gGAAgG;oBAChG,gFAAgF;aACnF,CAAC,EAPuC,CAOvC;SACH,CAAC,EAVe,CAUf;KACH,CAAC;IAEF,IAAM,gBAAgB,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CACpD,0EAA0E,CAC3E,CAAC;IAEF,OAAO,gBAAgB,IAAI,cAAc,CAAC;AAC5C,CAAC,CAAC;AArBS,QAAA,oDAAoD,wDAqB7D;AAeG,IAAM,0CAA0C,GAAG;IACxD,IAAM,cAAc,GAA4C;QAC9D,SAAS,EAAE,cAAM,OAAA,CAAC;YAChB,OAAO,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE;YACrD,eAAe,EAAE,cAAM,OAAA,CAAC;gBACtB,IAAI,EACF,oFAAoF;oBACpF,iGAAiG;aACpG,CAAC,EAJqB,CAIrB;SACH,CAAC,EAPe,CAOf;KACH,CAAC;IAEF,IAAM,gBAAgB,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CACpD,gEAAgE,CACjE,CAAC;IAEF,OAAO,gBAAgB,IAAI,cAAc,CAAC;AAC5C,CAAC,CAAC;AAjBW,QAAA,0CAA0C,8CAiBrD"}

package/dist/src/emails/AccountDeletionEmails.d.ts

@@ -0,0 +1,13 @@
+import { Moment } from 'moment';
+/**
+ * Thin sender for the two account-deletion emails: deletion-requested (at deactivation — the
+ * only cancel channel an account-takeover victim has) and the store-required completion
+ * confirmation (sent by the purge walker after the user row is gone). Content comes from the
+ * config factories beside this class; transport is the app's DefaultEmailConfigFactory SMTP
+ * config via EmailSender.
+ */
+export declare class AccountDeletionEmails {
+    sendDeletionRequested(to: string, purgeAfter: Moment): Promise<void>;
+    sendAccountDeleted(to: string): Promise<void>;
+}
+//# sourceMappingURL=AccountDeletionEmails.d.ts.map

package/dist/src/emails/AccountDeletionEmails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountDeletionEmails.d.ts","sourceRoot":"","sources":["../../../src/emails/AccountDeletionEmails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAOhC;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAC1B,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpE,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAWpD"}

package/dist/src/emails/AccountDeletionEmails.js

@@ -0,0 +1,98 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountDeletionEmails = void 0;
+var email_server_1 = require("@proteinjs/email-server");
+var AccountDeletionEmailConfigs_1 = require("./AccountDeletionEmailConfigs");
+/**
+ * Thin sender for the two account-deletion emails: deletion-requested (at deactivation — the
+ * only cancel channel an account-takeover victim has) and the store-required completion
+ * confirmation (sent by the purge walker after the user row is gone). Content comes from the
+ * config factories beside this class; transport is the app's DefaultEmailConfigFactory SMTP
+ * config via EmailSender.
+ */
+var AccountDeletionEmails = /** @class */ (function () {
+    function AccountDeletionEmails() {
+    }
+    AccountDeletionEmails.prototype.sendDeletionRequested = function (to, purgeAfter) {
+        return __awaiter(this, void 0, void 0, function () {
+            var config, _a, text, html;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        config = (0, AccountDeletionEmailConfigs_1.getDefaultAccountDeletionRequestedEmailConfigFactory)().getConfig();
+                        _a = config.getEmailContent(purgeAfter), text = _a.text, html = _a.html;
+                        return [4 /*yield*/, new email_server_1.EmailSender().sendEmail(__assign({ to: to, subject: 'Your account is scheduled for deletion', text: text, html: html }, config.options))];
+                    case 1:
+                        _b.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    AccountDeletionEmails.prototype.sendAccountDeleted = function (to) {
+        return __awaiter(this, void 0, void 0, function () {
+            var config, _a, text, html;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        config = (0, AccountDeletionEmailConfigs_1.getDefaultAccountDeletedEmailConfigFactory)().getConfig();
+                        _a = config.getEmailContent(), text = _a.text, html = _a.html;
+                        return [4 /*yield*/, new email_server_1.EmailSender().sendEmail(__assign({ to: to, subject: 'Your account has been deleted', text: text, html: html }, config.options))];
+                    case 1:
+                        _b.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+    return AccountDeletionEmails;
+}());
+exports.AccountDeletionEmails = AccountDeletionEmails;
+//# sourceMappingURL=AccountDeletionEmails.js.map

package/dist/src/emails/AccountDeletionEmails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountDeletionEmails.js","sourceRoot":"","sources":["../../../src/emails/AccountDeletionEmails.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wDAAsD;AACtD,6EAGuC;AAEvC;;;;;;GAMG;AACH;IAAA;IAwBA,CAAC;IAvBO,qDAAqB,GAA3B,UAA4B,EAAU,EAAE,UAAkB;;;;;;wBAClD,MAAM,GAAG,IAAA,kFAAoD,GAAE,CAAC,SAAS,EAAE,CAAC;wBAC5E,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,EAAjD,IAAI,UAAA,EAAE,IAAI,UAAA,CAAwC;wBAC1D,qBAAM,IAAI,0BAAW,EAAE,CAAC,SAAS,YAC/B,EAAE,IAAA,EACF,OAAO,EAAE,wCAAwC,EACjD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;;;;;KACJ;IAEK,kDAAkB,GAAxB,UAAyB,EAAU;;;;;;wBAC3B,MAAM,GAAG,IAAA,wEAA0C,GAAE,CAAC,SAAS,EAAE,CAAC;wBAClE,KAAiB,MAAM,CAAC,eAAe,EAAE,EAAvC,IAAI,UAAA,EAAE,IAAI,UAAA,CAA8B;wBAChD,qBAAM,IAAI,0BAAW,EAAE,CAAC,SAAS,YAC/B,EAAE,IAAA,EACF,OAAO,EAAE,+BAA+B,EACxC,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;;;;;KACJ;IACH,4BAAC;AAAD,CAAC,AAxBD,IAwBC;AAxBY,sDAAqB"}

package/dist/src/routes/devLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAU9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,EAAE,KA0CtB,CAAC"}
+{"version":3,"file":"devLogin.d.ts","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAW9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,EAAE,KAuCtB,CAAC"}

package/dist/src/routes/devLogin.js

@@ -38,6 +38,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.devLogin = void 0;
 var logger_1 = require("@proteinjs/logger");
+var establishSession_1 = require("../authentication/establishSession");
 var Signup_1 = require("../services/Signup");
 var logger = new logger_1.Logger({ name: 'devLogin' });
 /** Lowercased domain of an email address (the whole string when there is no `@`, which can never
@@ -100,19 +101,12 @@ exports.devLogin = {
                     if (creation === 'created') {
                         logger.info({ message: 'Dev auto-login created missing test account', obj: { email: email } });
                     }
-                    return [4 /*yield*/, new Promise(function (resolve) { return request.login(email, resolve); })];
+                    // establishSession commits the session row before the redirect — the redirected GET / must
+                    // never read the store ahead of the write (observed: first /dev/login load landed on /login).
+                    return [4 /*yield*/, (0, establishSession_1.establishSession)(request, email)];
                 case 2:
-                    _c.sent();
-                    // Explicit save before redirecting: with a DB-backed session store, save-on-response-end
-                    // races the redirected GET / — the follow-up request can read the session row before the
-                    // write commits and render the login page (observed: first /dev/login load lands on /login,
-                    // second succeeds). Awaiting the store write closes the race.
-                    return [4 /*yield*/, new Promise(function (resolve) { return request.session.save(resolve); })];
-                case 3:
-                    // Explicit save before redirecting: with a DB-backed session store, save-on-response-end
-                    // races the redirected GET / — the follow-up request can read the session row before the
-                    // write commits and render the login page (observed: first /dev/login load lands on /login,
-                    // second succeeds). Awaiting the store write closes the race.
+                    // establishSession commits the session row before the redirect — the redirected GET / must
+                    // never read the store ahead of the write (observed: first /dev/login load landed on /login).
                     _c.sent();
                     logger.info({ message: 'Dev auto-login session established', obj: { email: email } });
                     response.redirect('/');

package/dist/src/routes/devLogin.js.map

@@ -1 +1 @@
-{"version":3,"file":"devLogin.js","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,6CAA4C;AAE5C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEhD;kFACkF;AAClF,IAAM,WAAW,GAAG,UAAC,OAAe,IAAK,OAAA,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAzD,CAAyD,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;GAmBG;AACU,QAAA,QAAQ,GAAU;IAC7B,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,QAAQ,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;wBACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,sBAAO;qBACR;oBAEG,KAAK,GAAG,QAAQ,CAAC;oBACf,UAAU,GAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,CAAC;oBACxC,IAAI,UAAU,KAAK,SAAS,EAAE;wBACtB,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,EAAE;4BACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAA4C,WAAW,CAAC,QAAQ,CAAC,YAAS,CAAC,CAAC;4BACtG,sBAAO;yBACR;wBACD,KAAK,GAAG,SAAS,CAAC;qBACnB;oBACD,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBAEX,qBAAM,IAAI,eAAM,EAAE,CAAC,aAAa,CAAC;4BAChD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,KAAK,OAAA;4BACL,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI;yBAChB,CAAC,EAAA;;oBANI,QAAQ,GAAG,SAMf;oBACF,IAAI,QAAQ,KAAK,SAAS,EAAE;wBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;qBACzF;oBAED,qBAAM,IAAI,OAAO,CAAC,UAAC,OAAO,IAAK,OAAA,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAA7B,CAA6B,CAAC,EAAA;;oBAA7D,SAA6D,CAAC;oBAC9D,yFAAyF;oBACzF,yFAAyF;oBACzF,4FAA4F;oBAC5F,8DAA8D;oBAC9D,qBAAM,IAAI,OAAO,CAAC,UAAC,OAAO,IAAK,OAAA,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAA7B,CAA6B,CAAC,EAAA;;oBAJ7D,yFAAyF;oBACzF,yFAAyF;oBACzF,4FAA4F;oBAC5F,8DAA8D;oBAC9D,SAA6D,CAAC;oBAC9D,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;oBAC/E,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;;;;SACxB;CACF,CAAC"}
+{"version":3,"file":"devLogin.js","sourceRoot":"","sources":["../../../src/routes/devLogin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,uEAAsE;AACtE,6CAA4C;AAE5C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEhD;kFACkF;AAClF,IAAM,WAAW,GAAG,UAAC,OAAe,IAAK,OAAA,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAzD,CAAyD,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;GAmBG;AACU,QAAA,QAAQ,GAAU;IAC7B,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,QAAQ,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE;wBACzC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,sBAAO;qBACR;oBAEG,KAAK,GAAG,QAAQ,CAAC;oBACf,UAAU,GAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,CAAC;oBACxC,IAAI,UAAU,KAAK,SAAS,EAAE;wBACtB,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC,EAAE;4BACpD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mDAA4C,WAAW,CAAC,QAAQ,CAAC,YAAS,CAAC,CAAC;4BACtG,sBAAO;yBACR;wBACD,KAAK,GAAG,SAAS,CAAC;qBACnB;oBACD,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBAEX,qBAAM,IAAI,eAAM,EAAE,CAAC,aAAa,CAAC;4BAChD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,KAAK,OAAA;4BACL,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,KAAK;4BACpB,SAAS,EAAE,IAAI;yBAChB,CAAC,EAAA;;oBANI,QAAQ,GAAG,SAMf;oBACF,IAAI,QAAQ,KAAK,SAAS,EAAE;wBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;qBACzF;oBAED,2FAA2F;oBAC3F,8FAA8F;oBAC9F,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,KAAK,CAAC,EAAA;;oBAFtC,2FAA2F;oBAC3F,8FAA8F;oBAC9F,SAAsC,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;oBAC/E,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;;;;SACxB;CACF,CAAC"}

package/dist/src/routes/executePasswordReset.js

@@ -44,7 +44,7 @@ var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var logger_1 = require("@proteinjs/logger");
 var moment_1 = __importDefault(require("moment"));
-var sha256_1 = __importDefault(require("crypto-js/sha256"));
+var PasswordHasher_1 = require("../authentication/PasswordHasher");
 /**
  * Route handler for executing a password reset.
  *
@@ -82,14 +82,16 @@ exports.executePasswordReset = {
                         response.status(400).send({ error: 'Reset token has expired' });
                         return [2 /*return*/];
                     }
-                    hashedPassword = (0, sha256_1.default)(newPassword).toString();
+                    return [4 /*yield*/, new PasswordHasher_1.PasswordHasher().hash(newPassword)];
+                case 2:
+                    hashedPassword = _b.sent();
                     return [4 /*yield*/, db.update(user_1.tables.User, {
                             id: user.id,
                             password: hashedPassword,
                             passwordResetToken: null,
                             passwordResetTokenExpiration: null,
                         })];
-                case 2:
+                case 3:
                     _b.sent();
                     logger.info({ message: "Password successfully reset", obj: { email: user.email } });
                     response.send({ message: 'Password has been successfully reset' });

package/dist/src/routes/executePasswordReset.js.map

@@ -1 +1 @@
-{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAiD;AACjD,4CAA2C;AAC3C,kDAA4B;AAC5B,4DAAsC;AAEtC;;;;;;;;;;GAUG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,OAAO,CAAC,IAAI,EAAnC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAkB;oBACtC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAGd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA/D,IAAI,GAAG,SAAwD;oBACrE,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAGK,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;oBACvB,eAAe,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAClE,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;wBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAGK,cAAc,GAAG,IAAA,gBAAM,EAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACtD,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;4BAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,QAAQ,EAAE,cAAc;4BACxB,kBAAkB,EAAE,IAAI;4BACxB,4BAA4B,EAAE,IAAI;yBACnC,CAAC,EAAA;;oBALF,SAKE,CAAC;oBAEH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}
+{"version":3,"file":"executePasswordReset.js","sourceRoot":"","sources":["../../../src/routes/executePasswordReset.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAiD;AACjD,4CAA2C;AAC3C,kDAA4B;AAC5B,mEAAkE;AAElE;;;;;;;;;;GAUG;AACU,QAAA,oBAAoB,GAAU;IACzC,IAAI,EAAE,aAAM,CAAC,oBAAoB,CAAC,IAAI;IACtC,MAAM,EAAE,aAAM,CAAC,oBAAoB,CAAC,MAAM;IAC1C,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACtD,KAAyB,OAAO,CAAC,IAAI,EAAnC,KAAK,WAAA,EAAE,WAAW,iBAAA,CAAkB;oBACtC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAGd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA/D,IAAI,GAAG,SAAwD;oBACrE,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;wBACvE,sBAAO;qBACR;oBAGK,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;oBACvB,eAAe,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAClE,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;wBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;wBAChE,sBAAO;qBACR;oBAGsB,qBAAM,IAAI,+BAAc,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAA;;oBAA7D,cAAc,GAAG,SAA4C;oBACnE,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;4BAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,QAAQ,EAAE,cAAc;4BACxB,kBAAkB,EAAE,IAAI;4BACxB,4BAA4B,EAAE,IAAI;yBACnC,CAAC,EAAA;;oBALF,SAKE,CAAC;oBAEH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;;;;SACpE;CACF,CAAC"}

package/dist/src/routes/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAI9C,eAAO,MAAM,KAAK,EAAE,KAwBnB,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C,eAAO,MAAM,KAAK,EAAE,KA4CnB,CAAC"}

package/dist/src/routes/login.js

@@ -39,11 +39,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.login = void 0;
 var user_1 = require("@proteinjs/user");
 var authenticate_1 = require("../authentication/authenticate");
+var establishSession_1 = require("../authentication/establishSession");
+var AccountDeletion_1 = require("../services/AccountDeletion");
 exports.login = {
     path: user_1.routes.login.path,
     method: user_1.routes.login.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
-        var credentials, error, result;
+        var credentials, error, result, outcome, error_1, error;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
@@ -62,10 +64,31 @@ exports.login = {
                         response.send({ error: result });
                         return [2 /*return*/];
                     }
-                    return [4 /*yield*/, new Promise(function (resolve, reject) {
-                            request.login(credentials.email, resolve);
-                        })];
+                    _a.label = 2;
                 case 2:
+                    _a.trys.push([2, 4, , 5]);
+                    return [4 /*yield*/, new AccountDeletion_1.AccountDeletion().cancelPendingDeletion(credentials.email)];
+                case 3:
+                    outcome = _a.sent();
+                    return [3 /*break*/, 5];
+                case 4:
+                    error_1 = _a.sent();
+                    // Security boundary: the login response never carries internal error detail — an
+                    // attacker probing emails must learn nothing from failure shapes (founder ruling
+                    // 2026-08-18 after a watcher error surfaced verbatim in the login form). The real
+                    // error stays loud in the server log.
+                    console.error('cancelPendingDeletion failed during login', error_1);
+                    response.send({ error: 'Unable to log in right now. Please try again.' });
+                    return [2 /*return*/];
+                case 5:
+                    if (outcome === 'purging') {
+                        error = 'This account is being deleted and can no longer be restored.';
+                        console.error(error);
+                        response.send({ error: error });
+                        return [2 /*return*/];
+                    }
+                    return [4 /*yield*/, (0, establishSession_1.establishSession)(request, credentials.email)];
+                case 6:
                     _a.sent();
                     response.send({});
                     return [2 /*return*/];

package/dist/src/routes/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,+DAA8D;AAEjD,QAAA,KAAK,GAAU;IAC1B,IAAI,EAAE,aAAM,CAAC,KAAK,CAAC,IAAI;IACvB,MAAM,EAAE,aAAM,CAAC,KAAK,CAAC,MAAM;IAC3B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;oBAChC,WAAW,GAAwC,OAAO,CAAC,IAAI,CAAC;oBACtE,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;wBACzC,KAAK,GAAG,oCAAoC,CAAC;wBACnD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAEc,qBAAM,IAAA,2BAAY,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAA;;oBAApE,MAAM,GAAG,SAA2D;oBAC1E,IAAI,MAAM,KAAK,IAAI,EAAE;wBACnB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;wBACjC,sBAAO;qBACR;oBAED,qBAAM,IAAI,OAAO,CAAC,UAAC,OAAO,EAAE,MAAM;4BAChC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;wBAC5C,CAAC,CAAC,EAAA;;oBAFF,SAEE,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;;;SACnB;CACF,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/routes/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,+DAA8D;AAC9D,uEAAsE;AACtE,+DAA8D;AAEjD,QAAA,KAAK,GAAU;IAC1B,IAAI,EAAE,aAAM,CAAC,KAAK,CAAC,IAAI;IACvB,MAAM,EAAE,aAAM,CAAC,KAAK,CAAC,MAAM;IAC3B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;oBAChC,WAAW,GAAwC,OAAO,CAAC,IAAI,CAAC;oBACtE,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;wBACzC,KAAK,GAAG,oCAAoC,CAAC;wBACnD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAEc,qBAAM,IAAA,2BAAY,EAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAA;;oBAApE,MAAM,GAAG,SAA2D;oBAC1E,IAAI,MAAM,KAAK,IAAI,EAAE;wBACnB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;wBACjC,sBAAO;qBACR;;;;oBAOW,qBAAM,IAAI,iCAAe,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAA;;oBAA9E,OAAO,GAAG,SAAoE,CAAC;;;;oBAE/E,iFAAiF;oBACjF,iFAAiF;oBACjF,kFAAkF;oBAClF,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,OAAK,CAAC,CAAC;oBAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;oBAC1E,sBAAO;;oBAET,IAAI,OAAO,KAAK,SAAS,EAAE;wBACnB,KAAK,GAAG,8DAA8D,CAAC;wBAC7E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,CAAC;wBACzB,sBAAO;qBACR;oBAED,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAAA;;oBAAlD,SAAkD,CAAC;oBACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;;;SACnB;CACF,CAAC"}

package/dist/src/routes/logout.d.ts

@@ -1,3 +1,13 @@
 import { Route } from '@proteinjs/server-api';
+/**
+ * Logout rides passport's own `request.logout` (functional for store-backed sessions since
+ * passport 0.6, which added the callback form): it clears the user from the session and SAVES —
+ * a replayed old session id is logged out even before the id rotates — then REGENERATES the
+ * session id (fixation hygiene on the privilege change, mirroring login's rotation). The
+ * regenerate destroys the old session row through the store (`DbSessionStore.destroy`), whose
+ * row delete also disconnects the session's sockets (SocketIOSessionWatcher). The pre-0.6
+ * manual compensation — calling `destroySession` and nulling `session.passport.user` by hand
+ * because `request.logout` was broken — is retired with the workaround era that spawned it.
+ */
 export declare const logout: Route;
 //# sourceMappingURL=logout.d.ts.map

package/dist/src/routes/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAI9C,eAAO,MAAM,MAAM,EAAE,KAuBpB,CAAC"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/routes/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAG9C;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,EAAE,KASpB,CAAC"}

package/dist/src/routes/logout.js

@@ -38,46 +38,27 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.logout = void 0;
 var user_1 = require("@proteinjs/user");
-var destroySession_1 = require("../authentication/destroySession");
+/**
+ * Logout rides passport's own `request.logout` (functional for store-backed sessions since
+ * passport 0.6, which added the callback form): it clears the user from the session and SAVES —
+ * a replayed old session id is logged out even before the id rotates — then REGENERATES the
+ * session id (fixation hygiene on the privilege change, mirroring login's rotation). The
+ * regenerate destroys the old session row through the store (`DbSessionStore.destroy`), whose
+ * row delete also disconnects the session's sockets (SocketIOSessionWatcher). The pre-0.6
+ * manual compensation — calling `destroySession` and nulling `session.passport.user` by hand
+ * because `request.logout` was broken — is retired with the workaround era that spawned it.
+ */
 exports.logout = {
     path: user_1.routes.logout.path,
     method: user_1.routes.logout.method,
     onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
         return __generator(this, function (_a) {
             switch (_a.label) {
-                case 0: 
-                // request.logout();
-                // await request.session.destroy();
-                // await new Promise((resolve, reject) => {
-                //     request.session?.destroy((error: any) => {
-                //         if (error) {
-                //             reject(error);
-                //             return;
-                //         }
-                //         resolve();
-                //     });
-                // });
-                // delete request._passport?.session?.user;
-                // console.info(`request.sessionID: ${request.sessionID}`);
-                // console.info(`request.session?.id: ${request.session?.id}`);
-                return [4 /*yield*/, (0, destroySession_1.destroySession)(request.sessionID)];
+                case 0: return [4 /*yield*/, new Promise(function (resolve, reject) {
+                        return request.logout(function (error) { return (error ? reject(error) : resolve()); });
+                    })];
                 case 1:
-                    // request.logout();
-                    // await request.session.destroy();
-                    // await new Promise((resolve, reject) => {
-                    //     request.session?.destroy((error: any) => {
-                    //         if (error) {
-                    //             reject(error);
-                    //             return;
-                    //         }
-                    //         resolve();
-                    //     });
-                    // });
-                    // delete request._passport?.session?.user;
-                    // console.info(`request.sessionID: ${request.sessionID}`);
-                    // console.info(`request.session?.id: ${request.session?.id}`);
                     _a.sent();
-                    request.session.passport.user = null;
                     response.redirect('/login');
                     return [2 /*return*/];
             }

package/dist/src/routes/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/routes/logout.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AACzC,mEAAkE;AAErD,QAAA,MAAM,GAAU;IAC3B,IAAI,EAAE,aAAM,CAAC,MAAM,CAAC,IAAI;IACxB,MAAM,EAAE,aAAM,CAAC,MAAM,CAAC,MAAM;IAC5B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;gBACtC,oBAAoB;gBACpB,mCAAmC;gBACnC,2CAA2C;gBAC3C,iDAAiD;gBACjD,uBAAuB;gBACvB,6BAA6B;gBAC7B,sBAAsB;gBACtB,YAAY;gBAEZ,qBAAqB;gBACrB,UAAU;gBACV,MAAM;gBACN,2CAA2C;gBAC3C,2DAA2D;gBAC3D,+DAA+D;gBAC/D,qBAAM,IAAA,+BAAc,EAAC,OAAO,CAAC,SAAS,CAAC,EAAA;;oBAfvC,oBAAoB;oBACpB,mCAAmC;oBACnC,2CAA2C;oBAC3C,iDAAiD;oBACjD,uBAAuB;oBACvB,6BAA6B;oBAC7B,sBAAsB;oBACtB,YAAY;oBAEZ,qBAAqB;oBACrB,UAAU;oBACV,MAAM;oBACN,2CAA2C;oBAC3C,2DAA2D;oBAC3D,+DAA+D;oBAC/D,SAAuC,CAAC;oBACxC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;oBACrC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;;;;SAC7B;CACF,CAAC"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/routes/logout.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,wCAAyC;AAEzC;;;;;;;;;GASG;AACU,QAAA,MAAM,GAAU;IAC3B,IAAI,EAAE,aAAM,CAAC,MAAM,CAAC,IAAI;IACxB,MAAM,EAAE,aAAM,CAAC,MAAM,CAAC,MAAM;IAC5B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;wBACtC,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,EAAE,MAAM;wBACtC,OAAA,OAAO,CAAC,MAAM,CAAC,UAAC,KAAc,IAAK,OAAA,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAnC,CAAmC,CAAC;oBAAvE,CAAuE,CACxE,EAAA;;oBAFD,SAEC,CAAC;oBACF,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;;;;SAC7B;CACF,CAAC"}

package/dist/src/routes/signup.d.ts

@@ -0,0 +1,19 @@
+import { Route } from '@proteinjs/server-api';
+/**
+ * `POST /user/signup` — create the account AND establish its session in the same request
+ * (auto-login), so a new user lands in the app instead of being bounced to the login form to
+ * re-type the credentials they just submitted. Signup lives at the route layer beside login
+ * because session establishment is a request-level concern services never see; the domain flow
+ * (invite validation, account creation, notification emails) stays owned by `Signup.createUser`.
+ *
+ * Body: `UserSignup` (+ optional invite `token`; the invite carries the email on that path).
+ * Response mirrors the login route's contract: 200 with `{}` on success, `{ error }` with
+ * user-readable copy otherwise.
+ *
+ * When the email is already registered the response is byte-identical to success but NO session
+ * is minted — auto-login must never hand out a session for an account the caller didn't just
+ * create; the caller falls through to the login screen exactly as before. Existence is reported
+ * to the mailbox owner by email, never to the caller.
+ */
+export declare const signup: Route;
+//# sourceMappingURL=signup.d.ts.map

package/dist/src/routes/signup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../src/routes/signup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQ9C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,MAAM,EAAE,KA8BpB,CAAC"}

package/dist/src/routes/signup.js

@@ -0,0 +1,102 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signup = void 0;
+var logger_1 = require("@proteinjs/logger");
+var user_1 = require("@proteinjs/user");
+var establishSession_1 = require("../authentication/establishSession");
+var Signup_1 = require("../services/Signup");
+var logger = new logger_1.Logger({ name: 'signup' });
+/**
+ * `POST /user/signup` — create the account AND establish its session in the same request
+ * (auto-login), so a new user lands in the app instead of being bounced to the login form to
+ * re-type the credentials they just submitted. Signup lives at the route layer beside login
+ * because session establishment is a request-level concern services never see; the domain flow
+ * (invite validation, account creation, notification emails) stays owned by `Signup.createUser`.
+ *
+ * Body: `UserSignup` (+ optional invite `token`; the invite carries the email on that path).
+ * Response mirrors the login route's contract: 200 with `{}` on success, `{ error }` with
+ * user-readable copy otherwise.
+ *
+ * When the email is already registered the response is byte-identical to success but NO session
+ * is minted — auto-login must never hand out a session for an account the caller didn't just
+ * create; the caller falls through to the login screen exactly as before. Existence is reported
+ * to the mailbox owner by email, never to the caller.
+ */
+exports.signup = {
+    path: user_1.routes.signup.path,
+    method: user_1.routes.signup.method,
+    onRequest: function (request, response) { return __awaiter(void 0, void 0, void 0, function () {
+        var body, result, error_1;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    body = (_a = request.body) !== null && _a !== void 0 ? _a : {};
+                    if (!body.name || !body.password) {
+                        response.send({ error: 'Name and password cannot be blank' });
+                        return [2 /*return*/];
+                    }
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, new Signup_1.Signup().createUser({ name: body.name, email: body.email, password: body.password }, body.token)];
+                case 2:
+                    result = _b.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_1 = _b.sent();
+                    // createUser throws plain-words errors deliberately (invite expired / invite required /
+                    // email missing); the message is the user-facing contract, same as the RPC layer's.
+                    logger.error({ message: 'Signup failed', error: error_1 });
+                    response.send({ error: error_1 instanceof Error ? error_1.message : 'Sign up failed.' });
+                    return [2 /*return*/];
+                case 4:
+                    if (!(result.outcome === 'created')) return [3 /*break*/, 6];
+                    return [4 /*yield*/, (0, establishSession_1.establishSession)(request, result.email)];
+                case 5:
+                    _b.sent();
+                    _b.label = 6;
+                case 6:
+                    response.send({});
+                    return [2 /*return*/];
+            }
+        });
+    }); },
+};
+//# sourceMappingURL=signup.js.map

package/dist/src/routes/signup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../../src/routes/signup.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAA2C;AAC3C,wCAAqD;AACrD,uEAAsE;AACtE,6CAA4C;AAE5C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE9C;;;;;;;;;;;;;;;GAeG;AACU,QAAA,MAAM,GAAU;IAC3B,IAAI,EAAE,aAAM,CAAC,MAAM,CAAC,IAAI;IACxB,MAAM,EAAE,aAAM,CAAC,MAAM,CAAC,MAAM;IAC5B,SAAS,EAAE,UAAO,OAAY,EAAE,QAAQ;;;;;;oBAChC,IAAI,GAA6C,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC;oBAC1E,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;wBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;wBAC9D,sBAAO;qBACR;;;;oBAIU,qBAAM,IAAI,eAAM,EAAE,CAAC,UAAU,CACpC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC/D,IAAI,CAAC,KAAK,CACX,EAAA;;oBAHD,MAAM,GAAG,SAGR,CAAC;;;;oBAEF,wFAAwF;oBACxF,oFAAoF;oBACpF,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;oBACrF,sBAAO;;yBAGL,CAAA,MAAM,CAAC,OAAO,KAAK,SAAS,CAAA,EAA5B,wBAA4B;oBAC9B,qBAAM,IAAA,mCAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAA;;oBAA7C,SAA6C,CAAC;;;oBAGhD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;;;SACnB;CACF,CAAC"}

package/dist/src/routes/validateResetPasswordToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateResetPasswordToken.d.ts","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C,eAAO,MAAM,0BAA0B,EAAE,KAgCxC,CAAC"}
+{"version":3,"file":"validateResetPasswordToken.d.ts","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAM9C,eAAO,MAAM,0BAA0B,EAAE,KAoCxC,CAAC"}

package/dist/src/routes/validateResetPasswordToken.js

@@ -74,7 +74,11 @@ exports.validateResetPasswordToken = {
                         response.status(200).send({ isValid: false, message: 'Token has expired' });
                         return [2 /*return*/];
                     }
-                    response.status(200).send({ isValid: true });
+                    // The account email rides the VALID response only: the reset page renders it as the
+                    // read-only `autocomplete="username"` field so password managers associate the updated
+                    // password with the stored credential. The token was delivered to this very inbox, so a
+                    // valid-token holder learns nothing new; invalid/expired verdicts stay email-free.
+                    response.status(200).send({ isValid: true, email: user.email });
                     return [2 /*return*/];
             }
         });

package/dist/src/routes/validateResetPasswordToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateResetPasswordToken.js","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAiD;AACjD,4CAA2C;AAC3C,kDAA4B;AAEf,QAAA,0BAA0B,GAAU;IAC/C,IAAI,EAAE,aAAM,CAAC,kBAAkB,CAAC,IAAI;IACpC,MAAM,EAAE,aAAM,CAAC,kBAAkB,CAAC,MAAM;IACxC,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAClD,KAAK,GAAK,OAAO,CAAC,KAAK,MAAlB,CAAmB;oBAC1B,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAE3B,IAAI,CAAC,KAAK,EAAE;wBACV,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAGY,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA/D,IAAI,GAAG,SAAwD;oBACrE,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;wBACxE,sBAAO;qBACR;oBAGK,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;oBACvB,eAAe,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAClE,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;wBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAED,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;;;;SAC9C;CACF,CAAC"}
+{"version":3,"file":"validateResetPasswordToken.js","sourceRoot":"","sources":["../../../src/routes/validateResetPasswordToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAiD;AACjD,4CAA2C;AAC3C,kDAA4B;AAEf,QAAA,0BAA0B,GAAU;IAC/C,IAAI,EAAE,aAAM,CAAC,kBAAkB,CAAC,IAAI;IACpC,MAAM,EAAE,aAAM,CAAC,kBAAkB,CAAC,MAAM;IACxC,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBAC3B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAClD,KAAK,GAAK,OAAO,CAAC,KAAK,MAAlB,CAAmB;oBAC1B,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAE3B,IAAI,CAAC,KAAK,EAAE;wBACV,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAGY,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA/D,IAAI,GAAG,SAAwD;oBACrE,IAAI,CAAC,IAAI,EAAE;wBACT,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACrE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;wBACxE,sBAAO;qBACR;oBAGK,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;oBACvB,eAAe,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAClE,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;wBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAC5E,sBAAO;qBACR;oBAED,oFAAoF;oBACpF,uFAAuF;oBACvF,wFAAwF;oBACxF,mFAAmF;oBACnF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;;;;SACjE;CACF,CAAC"}