@puzzle-ui/auth 0.0.0-stage → 0.5.0

package/dist/auth.lifecycle.manager.cjs

@@ -0,0 +1,835 @@
+const require_auth_errors = require("./errors/auth.errors.cjs");
+const require_auth_storage = require("./auth.storage.cjs");
+const require_auth_crypto_utils = require("./utils/auth-crypto.utils.cjs");
+const require_email_utils = require("./utils/email.utils.cjs");
+const require_auth_rate_limit = require("./auth.rate-limit.cjs");
+let _puzzle_ui_storage = require("@puzzle-ui/storage");
+// src/auth.lifecycle.manager.ts
+const DEFAULT_TOKEN_LIFETIMES = {
+	emailVerification: 3600,
+	passwordReset: 3600,
+	emailChange: 3600
+};
+const DEFAULT_RATE_LIMITS = {
+	emailVerification: {
+		email: {
+			limit: 3,
+			windowSeconds: 3600
+		},
+		ip: {
+			limit: 10,
+			windowSeconds: 3600
+		}
+	},
+	passwordReset: {
+		email: {
+			limit: 3,
+			windowSeconds: 3600
+		},
+		ip: {
+			limit: 10,
+			windowSeconds: 3600
+		}
+	},
+	emailChange: {
+		email: {
+			limit: 3,
+			windowSeconds: 3600
+		},
+		ip: {
+			limit: 10,
+			windowSeconds: 3600
+		}
+	}
+};
+const toPublicUser = (record) => ({
+	id: record.id,
+	email: record.email,
+	emailVerifiedAt: record.emailVerifiedAt,
+	name: record.name,
+	image: record.image,
+	createdAt: record.createdAt,
+	updatedAt: record.updatedAt
+});
+const validateIpAddress = (ipAddress) => {
+	if (typeof ipAddress !== "string" || ipAddress.trim().length === 0 || ipAddress.trim().length > 128) throw new require_auth_errors.AuthValidationError("A valid client IP address is required.");
+	return ipAddress.trim();
+};
+const validatePassword = (password, minimumLength, maximumLength) => {
+	if (typeof password !== "string") throw new require_auth_errors.AuthValidationError("A password is required.");
+	const length = Array.from(password).length;
+	const byteLength = new TextEncoder().encode(password).byteLength;
+	if (length < minimumLength) throw new require_auth_errors.AuthValidationError(`Password must contain at least ${minimumLength} characters.`);
+	if (length > maximumLength || byteLength > 4096) throw new require_auth_errors.AuthValidationError(`Password must contain no more than ${maximumLength} characters.`);
+};
+const validateImageUrl = (image) => {
+	if (image === void 0 || image === null || image === "") return null;
+	if (typeof image !== "string" || image.length > 2048) throw new require_auth_errors.AuthValidationError("The profile image URL is invalid.");
+	let url;
+	try {
+		url = new URL(image);
+	} catch {
+		throw new require_auth_errors.AuthValidationError("The profile image URL is invalid.");
+	}
+	if (url.protocol !== "https:" || url.username || url.password) throw new require_auth_errors.AuthValidationError("Profile image URLs must use HTTPS and cannot contain credentials.");
+	return url.toString();
+};
+const createTokenUrl = (baseUrl, token) => {
+	let url;
+	try {
+		url = new URL(baseUrl);
+	} catch {
+		throw new require_auth_errors.AuthValidationError("The configured authentication callback URL is invalid.");
+	}
+	const isLocalhost = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+	if (url.protocol !== "https:" && !(isLocalhost && url.protocol === "http:") || url.username || url.password) throw new require_auth_errors.AuthValidationError("Authentication callback URLs must use HTTPS.");
+	url.searchParams.set("token", token);
+	return url.toString();
+};
+const validateRateLimitRule = (name, rule) => {
+	if (!rule || !Number.isInteger(rule.limit) || rule.limit < 1 || !Number.isFinite(rule.windowSeconds) || rule.windowSeconds <= 0) throw new require_auth_errors.AuthConfigurationError(`${name} must have a positive integer limit and a positive window.`);
+};
+var StorageAuthLifecycleManager = class {
+	storage;
+	passwordHasher;
+	emailProvider;
+	sessions;
+	rateLimitProvider;
+	rateLimitKeySecret;
+	usersCollection;
+	credentialsCollection;
+	actionTokensCollection;
+	auditCollection;
+	rateLimitsCollection;
+	requireVerifiedEmail;
+	onSessionRevocationError;
+	emailTemplates;
+	emailSubjects;
+	minimumPasswordLength;
+	maximumPasswordLength;
+	tokenLifetimes;
+	rateLimits;
+	clock;
+	onEmailDeliveryError;
+	initialized = false;
+	initializationPromise = null;
+	constructor(dependencies, options) {
+		this.storage = dependencies.storage;
+		this.passwordHasher = dependencies.passwordHasher;
+		this.emailProvider = dependencies.emailProvider;
+		this.sessions = dependencies.sessions;
+		if (typeof options.rateLimitKeySecret !== "string" || options.rateLimitKeySecret.length < 32) throw new require_auth_errors.AuthConfigurationError("rateLimitKeySecret must contain at least 32 characters.");
+		this.rateLimitKeySecret = options.rateLimitKeySecret;
+		this.usersCollection = options.usersCollection ?? "auth_users";
+		this.credentialsCollection = options.credentialsCollection ?? "auth_credentials";
+		this.actionTokensCollection = options.actionTokensCollection ?? "auth_action_tokens";
+		this.auditCollection = options.auditCollection ?? "auth_audit_events";
+		this.rateLimitsCollection = options.rateLimitsCollection ?? "auth_rate_limits";
+		this.requireVerifiedEmail = options.requireVerifiedEmail ?? false;
+		this.onSessionRevocationError = options.onSessionRevocationError;
+		this.emailTemplates = {
+			emailVerification: options.emailTemplates?.emailVerification ?? "auth/email-verification",
+			passwordReset: options.emailTemplates?.passwordReset ?? "auth/password-reset",
+			emailChange: options.emailTemplates?.emailChange ?? "auth/email-change-verification"
+		};
+		this.emailSubjects = {
+			emailVerification: options.emailSubjects?.emailVerification ?? "Verify your email address",
+			passwordReset: options.emailSubjects?.passwordReset ?? "Reset your password",
+			emailChange: options.emailSubjects?.emailChange ?? "Confirm your new email address"
+		};
+		this.minimumPasswordLength = options.minimumPasswordLength ?? 8;
+		this.maximumPasswordLength = options.maximumPasswordLength ?? 1024;
+		if (!Number.isInteger(this.minimumPasswordLength) || !Number.isInteger(this.maximumPasswordLength) || this.minimumPasswordLength < 1 || this.maximumPasswordLength < this.minimumPasswordLength) throw new require_auth_errors.AuthConfigurationError("Password length configuration is invalid.");
+		this.tokenLifetimes = {
+			emailVerification: options.emailVerificationTokenLifetimeSeconds ?? DEFAULT_TOKEN_LIFETIMES.emailVerification,
+			passwordReset: options.passwordResetTokenLifetimeSeconds ?? DEFAULT_TOKEN_LIFETIMES.passwordReset,
+			emailChange: options.emailChangeTokenLifetimeSeconds ?? DEFAULT_TOKEN_LIFETIMES.emailChange
+		};
+		for (const [name, lifetime] of Object.entries(this.tokenLifetimes)) if (!Number.isFinite(lifetime) || lifetime <= 0) throw new require_auth_errors.AuthConfigurationError(`${name} token lifetime must be positive.`);
+		this.rateLimits = {
+			emailVerification: {
+				...DEFAULT_RATE_LIMITS.emailVerification,
+				...options.rateLimits?.emailVerification
+			},
+			passwordReset: {
+				...DEFAULT_RATE_LIMITS.passwordReset,
+				...options.rateLimits?.passwordReset
+			},
+			emailChange: {
+				...DEFAULT_RATE_LIMITS.emailChange,
+				...options.rateLimits?.emailChange
+			}
+		};
+		for (const [action, policy] of Object.entries(this.rateLimits)) {
+			validateRateLimitRule(`${action} email rate limit`, policy.email);
+			validateRateLimitRule(`${action} IP rate limit`, policy.ip);
+		}
+		this.clock = options.clock ?? (() => /* @__PURE__ */ new Date());
+		this.onEmailDeliveryError = options.onEmailDeliveryError;
+		if (!this.storage.capabilities.conditionalWrites || !this.storage.capabilities.atomicBatch || !this.storage.capabilities.uniqueConstraints) throw new require_auth_errors.AuthConfigurationError("Auth lifecycle workflows require conditional writes, unique constraints and atomic batches.");
+		this.rateLimitProvider = dependencies.rateLimitProvider ?? new require_auth_rate_limit.StorageRateLimitProvider(this.storage, {
+			collectionName: this.rateLimitsCollection,
+			clock: this.clock
+		});
+	}
+	async initialize() {
+		if (!this.initializationPromise) {
+			const initialization = (async () => {
+				await require_auth_storage.initializeAuthStorage(this.storage, {
+					usersCollection: this.usersCollection,
+					credentialsCollection: this.credentialsCollection,
+					actionTokensCollection: this.actionTokensCollection,
+					auditCollection: this.auditCollection,
+					rateLimitsCollection: this.rateLimitsCollection
+				});
+				if (this.rateLimitProvider instanceof require_auth_rate_limit.StorageRateLimitProvider) await this.rateLimitProvider.initialize();
+				this.initialized = true;
+			})();
+			this.initializationPromise = initialization.catch((error) => {
+				this.initializationPromise = null;
+				throw error;
+			});
+		}
+		return this.initializationPromise;
+	}
+	assertInitialized() {
+		if (!this.initialized) throw new require_auth_errors.AuthConfigurationError("Auth lifecycle manager must be initialized before use.");
+	}
+	now() {
+		const now = this.clock();
+		if (!(now instanceof Date) || !Number.isFinite(now.getTime())) throw new require_auth_errors.AuthConfigurationError("The configured clock returned an invalid date.");
+		return now;
+	}
+	async consumeRateLimit(action, scope, identifier) {
+		const rule = this.rateLimits[action][scope];
+		const key = await require_auth_crypto_utils.createRateLimitKey(this.rateLimitKeySecret, `auth:${action}:${scope}:${identifier}`);
+		let decision;
+		try {
+			decision = await this.rateLimitProvider.consume({
+				key,
+				limit: rule.limit,
+				windowSeconds: rule.windowSeconds
+			});
+		} catch (error) {
+			throw new require_auth_errors.AuthProviderError("The authentication rate limiter is unavailable.", { cause: error });
+		}
+		if (!decision || typeof decision.allowed !== "boolean" || !(decision.resetAt instanceof Date) || !Number.isFinite(decision.resetAt.getTime())) throw new require_auth_errors.AuthProviderError("The rate limiter returned an invalid response.");
+		if (!decision.allowed) throw new require_auth_errors.AuthRateLimitError(decision.resetAt);
+	}
+	async enforceRateLimits(action, email, ipAddress) {
+		await this.consumeRateLimit(action, "email", email);
+		await this.consumeRateLimit(action, "ip", ipAddress);
+	}
+	async createActionToken(input) {
+		const now = this.now();
+		const token = require_auth_crypto_utils.generateSecureAuthToken();
+		return {
+			token,
+			record: {
+				id: require_auth_crypto_utils.generateAuthId("action-token"),
+				userId: input.userId,
+				purpose: input.purpose,
+				tokenHash: await require_auth_crypto_utils.hashAuthToken(token),
+				expiresAt: new Date(now.getTime() + input.lifetimeSeconds * 1e3),
+				consumedAt: null,
+				targetEmail: input.targetEmail ?? null,
+				createdAt: now,
+				updatedAt: now,
+				revision: 1,
+				revokedAt: null
+			}
+		};
+	}
+	createAuditRecord(action, userId, sessionId = null, metadata) {
+		const now = this.now();
+		return {
+			id: require_auth_crypto_utils.generateAuthId("auth-audit"),
+			action,
+			userId,
+			sessionId,
+			metadata,
+			createdAt: now,
+			updatedAt: now,
+			revision: 1
+		};
+	}
+	/**
+	* All operations in a lifecycle batch must succeed.
+	*
+	* Storage adapters may report a missing conditional update or delete
+	* through the batch result rather than by throwing an error. Treat those
+	* results as conflicts so a token cannot be consumed without its related
+	* account or credential mutation.
+	*/
+	async atomic(operations) {
+		try {
+			const result = await this.storage.atomicBatch(operations);
+			for (const [index, operation] of operations.entries()) {
+				const operationResult = result.results[index];
+				if (operation.type === "update") {
+					if (!operationResult || operationResult.type !== "update" || !operationResult.record) throw new _puzzle_ui_storage.StorageConflictError("A conditional authentication update did not match its record.");
+				}
+				if (operation.type === "delete") {
+					if (!operationResult || operationResult.type !== "delete" || !operationResult.deleted) throw new _puzzle_ui_storage.StorageConflictError("A conditional authentication delete did not match its record.");
+				}
+				if (operation.type === "insert") {
+					if (!operationResult || operationResult.type !== "insert") throw new _puzzle_ui_storage.StorageConflictError("An authentication insert did not return its record.");
+				}
+			}
+		} catch (error) {
+			if (error instanceof _puzzle_ui_storage.StorageDuplicateError) throw new require_auth_errors.AuthAccountConflictError({ cause: error });
+			throw error;
+		}
+	}
+	async deliverEmail(message, suppressFailure) {
+		try {
+			await this.emailProvider.send(message);
+		} catch (error) {
+			try {
+				this.onEmailDeliveryError?.(error);
+			} catch {}
+			if (!suppressFailure) throw new require_auth_errors.AuthProviderError("Authentication email delivery failed.", { cause: error });
+		}
+	}
+	async getSessionContext(token) {
+		if (typeof token !== "string" || token.length === 0) throw new require_auth_errors.AuthSessionError("An authenticated session is required.");
+		let session;
+		try {
+			session = await this.sessions.validate(token);
+		} catch (error) {
+			throw new require_auth_errors.AuthSessionError("Could not validate the authentication session.", { cause: error });
+		}
+		if (!session || session.kind !== "authenticated" || !session.userId) throw new require_auth_errors.AuthSessionError("An authenticated session is required.");
+		const user = await this.storage.findById(this.usersCollection, session.userId);
+		if (!user || user.deactivatedAt != null) throw new require_auth_errors.AuthSessionError("The authenticated account is unavailable.");
+		if (user.sessionsInvalidatedAt && session.createdAt.getTime() <= user.sessionsInvalidatedAt.getTime()) throw new require_auth_errors.AuthSessionError("The authentication session is no longer valid.");
+		if (this.requireVerifiedEmail && !user.emailVerifiedAt) throw new require_auth_errors.AuthEmailVerificationRequiredError();
+		return {
+			session,
+			user
+		};
+	}
+	async findActionToken(token, purpose) {
+		if (typeof token !== "string" || token.length < 32 || token.length > 256) throw new require_auth_errors.AuthTokenError();
+		const tokenHash = await require_auth_crypto_utils.hashAuthToken(token);
+		const record = await this.storage.findOne(this.actionTokensCollection, { where: { tokenHash: {
+			operator: "eq",
+			value: tokenHash
+		} } });
+		const now = this.now();
+		if (!record || record.purpose !== purpose || record.consumedAt !== null || record.revokedAt != null || record.expiresAt.getTime() <= now.getTime()) throw new require_auth_errors.AuthTokenError();
+		return record;
+	}
+	async findCredential(userId) {
+		return this.storage.findOne(this.credentialsCollection, { where: {
+			userId: {
+				operator: "eq",
+				value: userId
+			},
+			kind: {
+				operator: "eq",
+				value: "password"
+			}
+		} });
+	}
+	async verifyPassword(password, stored) {
+		try {
+			return await this.passwordHasher.verify(password, stored);
+		} catch (error) {
+			throw new require_auth_errors.AuthProviderError("Password verification failed.", { cause: error });
+		}
+	}
+	async hashPassword(password) {
+		try {
+			const result = await this.passwordHasher.hash(password);
+			if (!result || result.algorithm !== "argon2id" || typeof result.hash !== "string" || result.hash.length === 0) throw new Error("PasswordHasher returned an invalid Argon2id hash.");
+			return result;
+		} catch (error) {
+			throw new require_auth_errors.AuthProviderError("Password hashing failed.", { cause: error });
+		}
+	}
+	async revokeAllSessions(userId) {
+		try {
+			await this.sessions.revokeAll(userId);
+		} catch (error) {
+			try {
+				this.onSessionRevocationError?.(error);
+			} catch {}
+		}
+	}
+	async sendEmailVerification(input) {
+		this.assertInitialized();
+		const ipAddress = validateIpAddress(input.ipAddress);
+		const initialUser = await this.storage.findById(this.usersCollection, input.userId);
+		if (!initialUser) throw new require_auth_errors.AuthValidationError("The account does not exist.");
+		if (initialUser.emailVerifiedAt) return;
+		await this.enforceRateLimits("emailVerification", initialUser.normalizedEmail, ipAddress);
+		const maximumAttempts = 5;
+		for (let attempt = 0; attempt < maximumAttempts; attempt += 1) {
+			const user = await this.storage.findById(this.usersCollection, input.userId);
+			if (!user) throw new require_auth_errors.AuthValidationError("The account does not exist.");
+			if (user.emailVerifiedAt) return;
+			const created = await this.createActionToken({
+				userId: user.id,
+				purpose: "email-verification",
+				lifetimeSeconds: this.tokenLifetimes.emailVerification
+			});
+			const outstandingTokens = await this.storage.findMany(this.actionTokensCollection, { where: {
+				userId: {
+					operator: "eq",
+					value: user.id
+				},
+				purpose: {
+					operator: "eq",
+					value: "email-verification"
+				},
+				consumedAt: {
+					operator: "eq",
+					value: null
+				}
+			} });
+			const operations = [
+				{
+					type: "update",
+					collection: this.usersCollection,
+					id: user.id,
+					condition: { expectedRevision: user.revision },
+					changes: { updatedAt: created.record.createdAt }
+				},
+				{
+					type: "insert",
+					collection: this.actionTokensCollection,
+					record: created.record
+				},
+				{
+					type: "insert",
+					collection: this.auditCollection,
+					record: this.createAuditRecord("email-verification-requested", user.id)
+				}
+			];
+			for (const outstanding of outstandingTokens) {
+				if (outstanding.revokedAt != null) continue;
+				operations.push({
+					type: "update",
+					collection: this.actionTokensCollection,
+					id: outstanding.id,
+					condition: { expectedRevision: outstanding.revision },
+					changes: { revokedAt: created.record.createdAt }
+				});
+			}
+			try {
+				await this.atomic(operations);
+			} catch (error) {
+				if (error instanceof _puzzle_ui_storage.StorageConflictError) {
+					if (attempt < 4) continue;
+					throw new require_auth_errors.AuthProviderError("Could not safely issue an email verification token due to concurrent account updates.", { cause: error });
+				}
+				throw error;
+			}
+			const verificationUrl = createTokenUrl(input.verificationUrl, created.token);
+			await this.deliverEmail({
+				to: user.email,
+				subject: this.emailSubjects.emailVerification,
+				template: this.emailTemplates.emailVerification,
+				variables: {
+					url: verificationUrl,
+					expiresAt: created.record.expiresAt.toISOString()
+				}
+			}, false);
+			return;
+		}
+	}
+	async verifyEmail(token) {
+		this.assertInitialized();
+		const actionToken = await this.findActionToken(token, "email-verification");
+		const user = await this.storage.findById(this.usersCollection, actionToken.userId);
+		if (!user) throw new require_auth_errors.AuthTokenError();
+		const now = this.now();
+		try {
+			await this.atomic([
+				{
+					type: "update",
+					collection: this.actionTokensCollection,
+					id: actionToken.id,
+					condition: { expectedRevision: actionToken.revision },
+					changes: { consumedAt: now }
+				},
+				{
+					type: "update",
+					collection: this.usersCollection,
+					id: user.id,
+					condition: { expectedRevision: user.revision },
+					changes: {
+						emailVerifiedAt: now,
+						updatedAt: now
+					}
+				},
+				{
+					type: "insert",
+					collection: this.auditCollection,
+					record: this.createAuditRecord("email-verified", user.id)
+				}
+			]);
+		} catch (error) {
+			if (error instanceof _puzzle_ui_storage.StorageConflictError) throw new require_auth_errors.AuthTokenError();
+			throw error;
+		}
+		const updated = await this.storage.findById(this.usersCollection, user.id);
+		if (!updated) throw new require_auth_errors.AuthProviderError("The verified account could not be retrieved.");
+		return toPublicUser(updated);
+	}
+	/**
+	* Always resolves with the same public result, whether or not the email
+	* address belongs to an account. Delivery errors are reported only through
+	* onEmailDeliveryError.
+	*/
+	async requestPasswordReset(input) {
+		this.assertInitialized();
+		const email = require_email_utils.normalizeEmail(input.email);
+		const ipAddress = validateIpAddress(input.ipAddress);
+		await this.enforceRateLimits("passwordReset", email, ipAddress);
+		const user = await this.storage.findOne(this.usersCollection, { where: { normalizedEmail: {
+			operator: "eq",
+			value: email
+		} } });
+		if (!user) {
+			await this.storage.insert(this.auditCollection, this.createAuditRecord("password-reset-requested", null));
+			return;
+		}
+		const created = await this.createActionToken({
+			userId: user.id,
+			purpose: "password-reset",
+			lifetimeSeconds: this.tokenLifetimes.passwordReset
+		});
+		await this.atomic([{
+			type: "insert",
+			collection: this.actionTokensCollection,
+			record: created.record
+		}, {
+			type: "insert",
+			collection: this.auditCollection,
+			record: this.createAuditRecord("password-reset-requested", user.id)
+		}]);
+		const resetUrl = createTokenUrl(input.resetUrl, created.token);
+		await this.deliverEmail({
+			to: user.email,
+			subject: this.emailSubjects.passwordReset,
+			template: this.emailTemplates.passwordReset,
+			variables: {
+				url: resetUrl,
+				expiresAt: created.record.expiresAt.toISOString()
+			}
+		}, true);
+	}
+	async resetPassword(input) {
+		this.assertInitialized();
+		validatePassword(input.newPassword, this.minimumPasswordLength, this.maximumPasswordLength);
+		const actionToken = await this.findActionToken(input.token, "password-reset");
+		const user = await this.storage.findById(this.usersCollection, actionToken.userId);
+		if (!user || user.deactivatedAt != null) throw new require_auth_errors.AuthTokenError();
+		const credential = await this.findCredential(actionToken.userId);
+		if (!credential || credential.revokedAt !== null) throw new require_auth_errors.AuthTokenError();
+		const passwordHash = await this.hashPassword(input.newPassword);
+		const now = this.now();
+		const otherTokens = await this.storage.findMany(this.actionTokensCollection, { where: {
+			userId: {
+				operator: "eq",
+				value: actionToken.userId
+			},
+			purpose: {
+				operator: "eq",
+				value: "password-reset"
+			},
+			consumedAt: {
+				operator: "eq",
+				value: null
+			}
+		} });
+		const operations = [
+			{
+				type: "update",
+				collection: this.actionTokensCollection,
+				id: actionToken.id,
+				condition: { expectedRevision: actionToken.revision },
+				changes: { consumedAt: now }
+			},
+			{
+				type: "update",
+				collection: this.credentialsCollection,
+				id: credential.id,
+				condition: { expectedRevision: credential.revision },
+				changes: {
+					passwordHash,
+					passwordUpdatedAt: now,
+					updatedAt: now,
+					revokedAt: null
+				}
+			},
+			{
+				type: "update",
+				collection: this.usersCollection,
+				id: user.id,
+				condition: { expectedRevision: user.revision },
+				changes: {
+					sessionsInvalidatedAt: now,
+					updatedAt: now
+				}
+			},
+			{
+				type: "insert",
+				collection: this.auditCollection,
+				record: this.createAuditRecord("password-reset-completed", actionToken.userId)
+			}
+		];
+		for (const other of otherTokens) {
+			if (other.id === actionToken.id || other.revokedAt != null) continue;
+			operations.push({
+				type: "update",
+				collection: this.actionTokensCollection,
+				id: other.id,
+				condition: { expectedRevision: other.revision },
+				changes: { revokedAt: now }
+			});
+		}
+		try {
+			await this.atomic(operations);
+		} catch (error) {
+			if (error instanceof _puzzle_ui_storage.StorageConflictError || error instanceof require_auth_errors.AuthAccountConflictError) throw new require_auth_errors.AuthTokenError();
+			throw error;
+		}
+		await this.revokeAllSessions(actionToken.userId);
+	}
+	async changePassword(input) {
+		this.assertInitialized();
+		validatePassword(input.newPassword, this.minimumPasswordLength, this.maximumPasswordLength);
+		const { session, user } = await this.getSessionContext(input.sessionToken);
+		const credential = await this.findCredential(user.id);
+		if (!credential || credential.revokedAt !== null || !await this.verifyPassword(input.currentPassword, credential.passwordHash)) throw new require_auth_errors.AuthValidationError("The current password is incorrect.");
+		const passwordHash = await this.hashPassword(input.newPassword);
+		const now = this.now();
+		const resetTokens = await this.storage.findMany(this.actionTokensCollection, { where: {
+			userId: {
+				operator: "eq",
+				value: user.id
+			},
+			purpose: {
+				operator: "eq",
+				value: "password-reset"
+			},
+			consumedAt: {
+				operator: "eq",
+				value: null
+			}
+		} });
+		const operations = [
+			{
+				type: "update",
+				collection: this.credentialsCollection,
+				id: credential.id,
+				condition: { expectedRevision: credential.revision },
+				changes: {
+					passwordHash,
+					passwordUpdatedAt: now,
+					updatedAt: now
+				}
+			},
+			{
+				type: "update",
+				collection: this.usersCollection,
+				id: user.id,
+				condition: { expectedRevision: user.revision },
+				changes: {
+					sessionsInvalidatedAt: now,
+					updatedAt: now
+				}
+			},
+			{
+				type: "insert",
+				collection: this.auditCollection,
+				record: this.createAuditRecord("password-changed", user.id, session.id)
+			}
+		];
+		for (const token of resetTokens) {
+			if (token.revokedAt != null) continue;
+			operations.push({
+				type: "update",
+				collection: this.actionTokensCollection,
+				id: token.id,
+				condition: { expectedRevision: token.revision },
+				changes: { revokedAt: now }
+			});
+		}
+		await this.atomic(operations);
+		await this.revokeAllSessions(user.id);
+	}
+	async updateProfile(input) {
+		this.assertInitialized();
+		const { session, user } = await this.getSessionContext(input.sessionToken);
+		const changes = { updatedAt: this.now() };
+		if (input.name !== void 0) changes.name = require_email_utils.normalizeDisplayName(input.name);
+		if (input.image !== void 0) changes.image = validateImageUrl(input.image);
+		await this.atomic([{
+			type: "update",
+			collection: this.usersCollection,
+			id: user.id,
+			condition: { expectedRevision: user.revision },
+			changes
+		}, {
+			type: "insert",
+			collection: this.auditCollection,
+			record: this.createAuditRecord("profile-updated", user.id, session.id)
+		}]);
+		const updated = await this.storage.findById(this.usersCollection, user.id);
+		if (!updated) throw new require_auth_errors.AuthProviderError("The updated account could not be retrieved.");
+		return toPublicUser(updated);
+	}
+	async requestEmailChange(input) {
+		this.assertInitialized();
+		const { session, user } = await this.getSessionContext(input.sessionToken);
+		const credential = await this.findCredential(user.id);
+		if (!credential || credential.revokedAt !== null || !await this.verifyPassword(input.currentPassword, credential.passwordHash)) throw new require_auth_errors.AuthValidationError("The current password is incorrect.");
+		const newEmail = require_email_utils.normalizeEmail(input.email);
+		if (newEmail === user.normalizedEmail) throw new require_auth_errors.AuthValidationError("The new email address is already the current email address.");
+		const ipAddress = validateIpAddress(input.ipAddress);
+		await this.enforceRateLimits("emailChange", newEmail, ipAddress);
+		if (await this.storage.findOne(this.usersCollection, { where: { normalizedEmail: {
+			operator: "eq",
+			value: newEmail
+		} } })) throw new require_auth_errors.AuthAccountConflictError();
+		const created = await this.createActionToken({
+			userId: user.id,
+			purpose: "email-change",
+			targetEmail: newEmail,
+			lifetimeSeconds: this.tokenLifetimes.emailChange
+		});
+		await this.atomic([{
+			type: "insert",
+			collection: this.actionTokensCollection,
+			record: created.record
+		}, {
+			type: "insert",
+			collection: this.auditCollection,
+			record: this.createAuditRecord("email-change-requested", user.id, session.id)
+		}]);
+		const verificationUrl = createTokenUrl(input.verificationUrl, created.token);
+		await this.deliverEmail({
+			to: newEmail,
+			subject: this.emailSubjects.emailChange,
+			template: this.emailTemplates.emailChange,
+			variables: {
+				url: verificationUrl,
+				expiresAt: created.record.expiresAt.toISOString()
+			}
+		}, false);
+	}
+	async verifyEmailChange(token) {
+		this.assertInitialized();
+		const actionToken = await this.findActionToken(token, "email-change");
+		if (!actionToken.targetEmail) throw new require_auth_errors.AuthTokenError();
+		const user = await this.storage.findById(this.usersCollection, actionToken.userId);
+		if (!user) throw new require_auth_errors.AuthTokenError();
+		const newEmail = require_email_utils.normalizeEmail(actionToken.targetEmail);
+		const now = this.now();
+		try {
+			await this.atomic([
+				{
+					type: "update",
+					collection: this.actionTokensCollection,
+					id: actionToken.id,
+					condition: { expectedRevision: actionToken.revision },
+					changes: { consumedAt: now }
+				},
+				{
+					type: "update",
+					collection: this.usersCollection,
+					id: user.id,
+					condition: { expectedRevision: user.revision },
+					changes: {
+						email: newEmail,
+						normalizedEmail: newEmail,
+						emailVerifiedAt: now,
+						sessionsInvalidatedAt: now,
+						updatedAt: now
+					}
+				},
+				{
+					type: "insert",
+					collection: this.auditCollection,
+					record: this.createAuditRecord("email-changed", user.id)
+				}
+			]);
+		} catch (error) {
+			if (error instanceof require_auth_errors.AuthAccountConflictError) throw error;
+			if (error instanceof _puzzle_ui_storage.StorageConflictError) throw new require_auth_errors.AuthTokenError();
+			throw error;
+		}
+		await this.revokeAllSessions(user.id);
+		const updated = await this.storage.findById(this.usersCollection, user.id);
+		if (!updated) throw new require_auth_errors.AuthProviderError("The updated account could not be retrieved.");
+		return toPublicUser(updated);
+	}
+	async deactivateAccount(input) {
+		this.assertInitialized();
+		const { session, user } = await this.getSessionContext(input.sessionToken);
+		const credential = await this.findCredential(user.id);
+		if (!credential || credential.revokedAt !== null || !await this.verifyPassword(input.password, credential.passwordHash)) throw new require_auth_errors.AuthValidationError("The password confirmation is incorrect.");
+		const now = this.now();
+		await this.atomic([{
+			type: "update",
+			collection: this.usersCollection,
+			id: user.id,
+			condition: { expectedRevision: user.revision },
+			changes: {
+				deactivatedAt: now,
+				sessionsInvalidatedAt: now,
+				updatedAt: now
+			}
+		}, {
+			type: "insert",
+			collection: this.auditCollection,
+			record: this.createAuditRecord("account-deactivated", user.id, session.id)
+		}]);
+		await this.revokeAllSessions(user.id);
+	}
+	async deleteAccount(input) {
+		this.assertInitialized();
+		const { session, user } = await this.getSessionContext(input.sessionToken);
+		const credential = await this.findCredential(user.id);
+		if (!credential || credential.revokedAt !== null || !await this.verifyPassword(input.password, credential.passwordHash)) throw new require_auth_errors.AuthValidationError("The password confirmation is incorrect.");
+		const credentials = await this.storage.findMany(this.credentialsCollection, { where: { userId: {
+			operator: "eq",
+			value: user.id
+		} } });
+		const actionTokens = await this.storage.findMany(this.actionTokensCollection, { where: { userId: {
+			operator: "eq",
+			value: user.id
+		} } });
+		const operations = [{
+			type: "delete",
+			collection: this.usersCollection,
+			id: user.id,
+			condition: { expectedRevision: user.revision }
+		}, {
+			type: "insert",
+			collection: this.auditCollection,
+			record: this.createAuditRecord("account-deleted", user.id, session.id)
+		}];
+		for (const item of credentials) operations.push({
+			type: "delete",
+			collection: this.credentialsCollection,
+			id: item.id,
+			condition: { expectedRevision: item.revision }
+		});
+		for (const item of actionTokens) operations.push({
+			type: "delete",
+			collection: this.actionTokensCollection,
+			id: item.id,
+			condition: { expectedRevision: item.revision }
+		});
+		await this.atomic(operations);
+		await this.revokeAllSessions(user.id);
+	}
+};
+exports.StorageAuthLifecycleManager = StorageAuthLifecycleManager;
+
+//# sourceMappingURL=auth.lifecycle.manager.cjs.map