@rakun-kit/core 1.4.11 → 1.5.0

package/dist/esm/auth/completePrimaryAuthentication.js

@@ -0,0 +1,46 @@
+import { randomBytes } from 'crypto';
+import { ManagerUser, MfaChallenge, Session, UserMfa } from '../internal-content-types/index.js';
+import { getMongoService } from '../orm/index.js';
+import { SESSION_MAX_AGE_MS } from '../api/sessionCookie.js';
+export const completePrimaryAuthentication = async (userId) => {
+    const db = await getMongoService();
+    const mfa = await db.find(UserMfa, { 'user._id': userId });
+    if (mfa?.enabled) {
+        const challenge = randomBytes(32).toString('hex');
+        const expiresAt = new Date(Date.now() + 1000 * 60 * 5);
+        await db.create(MfaChallenge, {
+            token: challenge,
+            user: {
+                _id: userId,
+                contentType: ManagerUser.name,
+                type: 'existing',
+            },
+            method: mfa.preferredMethod ?? 'totp',
+            expiresAt,
+            attempts: 0,
+            _type: 'MfaChallenge',
+        });
+        return {
+            challenge,
+            method: mfa.preferredMethod ?? 'totp',
+            expiresAt: expiresAt.toISOString(),
+        };
+    }
+    const token = crypto.randomUUID();
+    const expiresAt = new Date(Date.now() + SESSION_MAX_AGE_MS);
+    await db.create(Session, {
+        token,
+        user: {
+            _id: userId,
+            contentType: ManagerUser.name,
+            type: 'existing',
+        },
+        expiresAt,
+        _type: 'Session',
+    });
+    return {
+        token,
+        expiresAt: expiresAt.toISOString(),
+    };
+};
+//# sourceMappingURL=completePrimaryAuthentication.js.map

package/dist/esm/auth/completePrimaryAuthentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"completePrimaryAuthentication.js","sourceRoot":"","sources":["../../../src/auth/completePrimaryAuthentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEpC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAExC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,EAAE,MAAc,EAAwB,EAAE;IAC1F,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IAE1D,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QAEtD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE;YAC5B,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE;gBACJ,GAAG,EAAE,MAAM;gBACX,WAAW,EAAE,WAAW,CAAC,IAAI;gBAC7B,IAAI,EAAE,UAAU;aACjB;YACD,MAAM,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;YACrC,SAAS;YACT,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,cAAc;SACtB,CAAC,CAAA;QAEF,OAAO;YACL,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;YACrC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAA;IAE3D,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;QACvB,KAAK;QACL,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM;YACX,WAAW,EAAE,WAAW,CAAC,IAAI;YAC7B,IAAI,EAAE,UAAU;SACjB;QACD,SAAS;QACT,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IAEF,OAAO;QACL,KAAK;QACL,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;KACnC,CAAA;AACH,CAAC,CAAA"}

package/dist/esm/auth/loginAdapters.d.ts

@@ -0,0 +1,57 @@
+export type LoginAdapterIcon = 'github' | 'google' | 'microsoft' | 'generic';
+export type LoginAdapterIdentity = {
+    id: string;
+    email: string;
+    emailVerified: boolean;
+    name?: string;
+};
+export type LoginAdapterAuthorizationInput = {
+    state: string;
+    codeChallenge: string;
+};
+export type LoginAdapterCallbackInput = {
+    code: string;
+    codeVerifier: string;
+};
+export type LoginAdapter = {
+    id: string;
+    label: string;
+    icon?: LoginAdapterIcon;
+    createAuthorizationUrl: (input: LoginAdapterAuthorizationInput) => Promise<string> | string;
+    authenticate: (input: LoginAdapterCallbackInput) => Promise<LoginAdapterIdentity>;
+};
+export type PasswordFail2banConfig = {
+    /** Failed attempts before the IP is blocked. Defaults to 5. */
+    maxAttempts?: number;
+    /** Override IP resolution when running behind a custom proxy. */
+    resolveIp?: (context: import('../api/context.js').RakunRequestContext) => string | undefined;
+};
+export type LoginConfig = {
+    /** Enable the built-in email/password form. Defaults to true. */
+    password?: boolean;
+    /** Persistent IP blocking for failed password logins. Enabled by default. */
+    fail2ban?: false | PasswordFail2banConfig;
+    adapters?: readonly LoginAdapter[];
+};
+export declare const defineLoginAdapter: <TAdapter extends LoginAdapter>(adapter: TAdapter) => TAdapter;
+type OAuthClientConfig = {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    label?: string;
+};
+export type GitHubLoginAdapterConfig = OAuthClientConfig & {
+    allowSignup?: boolean;
+};
+export declare const createGitHubLoginAdapter: (config: GitHubLoginAdapterConfig) => LoginAdapter;
+export type GoogleLoginAdapterConfig = OAuthClientConfig & {
+    hostedDomain?: string;
+    prompt?: 'none' | 'consent' | 'select_account';
+};
+export declare const createGoogleLoginAdapter: (config: GoogleLoginAdapterConfig) => LoginAdapter;
+export type MicrosoftLoginAdapterConfig = OAuthClientConfig & {
+    tenant?: string;
+};
+export declare const createMicrosoftLoginAdapter: (config: MicrosoftLoginAdapterConfig) => LoginAdapter;
+export {};
+//# sourceMappingURL=loginAdapters.d.ts.map

package/dist/esm/auth/loginAdapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginAdapters.d.ts","sourceRoot":"","sources":["../../../src/auth/loginAdapters.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAA;AAE5E,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC3C,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,sBAAsB,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;IAC3F,YAAY,EAAE,CAAC,KAAK,EAAE,yBAAyB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAA;CAClF,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iEAAiE;IACjE,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,OAAO,gBAAgB,EAAE,mBAAmB,KAClD,MAAM,GAAG,SAAS,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,KAAK,GAAG,sBAAsB,CAAA;IACzC,QAAQ,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CACnC,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,QAAQ,SAAS,YAAY,EAAE,SAAS,QAAQ,KAAG,QAC7E,CAAA;AAET,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AA6BD,MAAM,MAAM,wBAAwB,GAAG,iBAAiB,GAAG;IACzD,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAI,QAAQ,wBAAwB,KAAG,YA+DxE,CAAA;AAEJ,MAAM,MAAM,wBAAwB,GAAG,iBAAiB,GAAG;IACzD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAAA;CAC/C,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAI,QAAQ,wBAAwB,KAAG,YA0DxE,CAAA;AAEJ,MAAM,MAAM,2BAA2B,GAAG,iBAAiB,GAAG;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,eAAO,MAAM,2BAA2B,GAAI,QAAQ,2BAA2B,KAAG,YA4DjF,CAAA"}

package/dist/esm/auth/loginAdapters.js

@@ -0,0 +1,176 @@
+export const defineLoginAdapter = (adapter) => adapter;
+const fetchJson = async (url, init) => {
+    const response = await fetch(url, init);
+    if (!response.ok) {
+        throw new Error(`OAuth provider request failed with status ${response.status}`);
+    }
+    return (await response.json());
+};
+const bearerHeaders = (accessToken) => ({
+    Accept: 'application/json',
+    Authorization: `Bearer ${accessToken}`,
+});
+const requireAccessToken = (value) => {
+    if (!value ||
+        typeof value !== 'object' ||
+        typeof value.access_token !== 'string') {
+        throw new Error('OAuth provider did not return an access token');
+    }
+    return value.access_token;
+};
+export const createGitHubLoginAdapter = (config) => defineLoginAdapter({
+    id: 'github',
+    label: config.label ?? 'GitHub',
+    icon: 'github',
+    createAuthorizationUrl: ({ state, codeChallenge }) => {
+        const url = new URL('https://github.com/login/oauth/authorize');
+        url.searchParams.set('client_id', config.clientId);
+        url.searchParams.set('redirect_uri', config.redirectUri);
+        url.searchParams.set('scope', 'read:user user:email');
+        url.searchParams.set('state', state);
+        url.searchParams.set('code_challenge', codeChallenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+        url.searchParams.set('allow_signup', String(config.allowSignup ?? true));
+        return url.toString();
+    },
+    authenticate: async ({ code, codeVerifier }) => {
+        const token = await fetchJson('https://github.com/login/oauth/access_token', {
+            method: 'POST',
+            headers: {
+                Accept: 'application/json',
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                client_id: config.clientId,
+                client_secret: config.clientSecret,
+                code,
+                redirect_uri: config.redirectUri,
+                code_verifier: codeVerifier,
+            }),
+        });
+        const accessToken = requireAccessToken(token);
+        const headers = {
+            ...bearerHeaders(accessToken),
+            'X-GitHub-Api-Version': '2022-11-28',
+        };
+        const [profile, emails] = await Promise.all([
+            fetchJson('https://api.github.com/user', {
+                headers,
+            }),
+            fetchJson('https://api.github.com/user/emails', { headers }),
+        ]);
+        const email = emails.find((item) => item.primary && item.verified)?.email ??
+            emails.find((item) => item.verified)?.email;
+        if (profile.id === undefined || !email) {
+            throw new Error('GitHub did not return a verified email identity');
+        }
+        return {
+            id: String(profile.id),
+            email,
+            emailVerified: true,
+            name: profile.name ?? undefined,
+        };
+    },
+});
+export const createGoogleLoginAdapter = (config) => defineLoginAdapter({
+    id: 'google',
+    label: config.label ?? 'Google',
+    icon: 'google',
+    createAuthorizationUrl: ({ state, codeChallenge }) => {
+        const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
+        url.searchParams.set('client_id', config.clientId);
+        url.searchParams.set('redirect_uri', config.redirectUri);
+        url.searchParams.set('response_type', 'code');
+        url.searchParams.set('scope', 'openid profile email');
+        url.searchParams.set('state', state);
+        url.searchParams.set('code_challenge', codeChallenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+        if (config.hostedDomain)
+            url.searchParams.set('hd', config.hostedDomain);
+        if (config.prompt)
+            url.searchParams.set('prompt', config.prompt);
+        return url.toString();
+    },
+    authenticate: async ({ code, codeVerifier }) => {
+        const token = await fetchJson('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: config.clientId,
+                client_secret: config.clientSecret,
+                code,
+                code_verifier: codeVerifier,
+                grant_type: 'authorization_code',
+                redirect_uri: config.redirectUri,
+            }),
+        });
+        const accessToken = requireAccessToken(token);
+        const profile = await fetchJson('https://openidconnect.googleapis.com/v1/userinfo', {
+            headers: bearerHeaders(accessToken),
+        });
+        if (!profile.sub ||
+            !profile.email ||
+            profile.email_verified !== true ||
+            (config.hostedDomain && profile.hd !== config.hostedDomain)) {
+            throw new Error('Google did not return a verified email identity');
+        }
+        return {
+            id: profile.sub,
+            email: profile.email,
+            emailVerified: true,
+            name: profile.name,
+        };
+    },
+});
+export const createMicrosoftLoginAdapter = (config) => {
+    const tenant = config.tenant ?? 'common';
+    const scope = 'openid profile email User.Read';
+    return defineLoginAdapter({
+        id: 'microsoft',
+        label: config.label ?? 'Microsoft',
+        icon: 'microsoft',
+        createAuthorizationUrl: ({ state, codeChallenge }) => {
+            const url = new URL(`https://login.microsoftonline.com/${encodeURIComponent(tenant)}/oauth2/v2.0/authorize`);
+            url.searchParams.set('client_id', config.clientId);
+            url.searchParams.set('redirect_uri', config.redirectUri);
+            url.searchParams.set('response_type', 'code');
+            url.searchParams.set('response_mode', 'query');
+            url.searchParams.set('scope', scope);
+            url.searchParams.set('state', state);
+            url.searchParams.set('code_challenge', codeChallenge);
+            url.searchParams.set('code_challenge_method', 'S256');
+            return url.toString();
+        },
+        authenticate: async ({ code, codeVerifier }) => {
+            const tokenUrl = `https://login.microsoftonline.com/${encodeURIComponent(tenant)}/oauth2/v2.0/token`;
+            const token = await fetchJson(tokenUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    client_id: config.clientId,
+                    client_secret: config.clientSecret,
+                    code,
+                    code_verifier: codeVerifier,
+                    grant_type: 'authorization_code',
+                    redirect_uri: config.redirectUri,
+                    scope,
+                }),
+            });
+            const accessToken = requireAccessToken(token);
+            const profile = await fetchJson('https://graph.microsoft.com/v1.0/me?$select=id,displayName,mail,userPrincipalName', {
+                headers: bearerHeaders(accessToken),
+            });
+            const email = profile.mail || profile.userPrincipalName;
+            if (!profile.id || !email) {
+                throw new Error('Microsoft did not return an email identity');
+            }
+            return {
+                id: profile.id,
+                email,
+                emailVerified: true,
+                name: profile.displayName,
+            };
+        },
+    });
+};
+//# sourceMappingURL=loginAdapters.js.map

package/dist/esm/auth/loginAdapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginAdapters.js","sourceRoot":"","sources":["../../../src/auth/loginAdapters.ts"],"names":[],"mappings":"AA4CA,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAgC,OAAiB,EAAY,EAAE,CAC/F,OAAO,CAAA;AAST,MAAM,SAAS,GAAG,KAAK,EAAK,GAAiB,EAAE,IAAkB,EAAc,EAAE;IAC/E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAEvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAA;AACrC,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,WAAmB,EAA0B,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,kBAAkB;IAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;CACvC,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAU,EAAE;IACpD,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAAoC,CAAC,YAAY,KAAK,QAAQ,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,OAAQ,KAAkC,CAAC,YAAY,CAAA;AACzD,CAAC,CAAA;AAMD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAAgC,EAAgB,EAAE,CACzF,kBAAkB,CAAC;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ;IAC/B,IAAI,EAAE,QAAQ;IACd,sBAAsB,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,0CAA0C,CAAC,CAAA;QAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAA;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAA;QACxE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IACD,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAU,6CAA6C,EAAE;YACpF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,IAAI;gBACJ,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,aAAa,EAAE,YAAY;aAC5B,CAAC;SACH,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG;YACd,GAAG,aAAa,CAAC,WAAW,CAAC;YAC7B,sBAAsB,EAAE,YAAY;SACrC,CAAA;QACD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,SAAS,CAAiD,6BAA6B,EAAE;gBACvF,OAAO;aACR,CAAC;YACF,SAAS,CAMP,oCAAoC,EAAE,EAAE,OAAO,EAAE,CAAC;SACrD,CAAC,CAAA;QACF,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK;YAC3D,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;QAE7C,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QAED,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,KAAK;YACL,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;SAChC,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAOJ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAAgC,EAAgB,EAAE,CACzF,kBAAkB,CAAC;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ;IAC/B,IAAI,EAAE,QAAQ;IACd,sBAAsB,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,8CAA8C,CAAC,CAAA;QACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;QAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAA;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;QACrD,IAAI,MAAM,CAAC,YAAY;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QACxE,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QAChE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IACD,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAU,qCAAqC,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,IAAI;gBACJ,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,oBAAoB;gBAChC,YAAY,EAAE,MAAM,CAAC,WAAW;aACjC,CAAC;SACH,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,MAAM,SAAS,CAM5B,kDAAkD,EAAE;YACrD,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC;SACpC,CAAC,CAAA;QAEF,IACE,CAAC,OAAO,CAAC,GAAG;YACZ,CAAC,OAAO,CAAC,KAAK;YACd,OAAO,CAAC,cAAc,KAAK,IAAI;YAC/B,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,YAAY,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QAED,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,GAAG;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAA;IACH,CAAC;CACF,CAAC,CAAA;AAMJ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,MAAmC,EAAgB,EAAE;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAA;IACxC,MAAM,KAAK,GAAG,gCAAgC,CAAA;IAE9C,OAAO,kBAAkB,CAAC;QACxB,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,WAAW;QAClC,IAAI,EAAE,WAAW;QACjB,sBAAsB,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,qCAAqC,kBAAkB,CAAC,MAAM,CAAC,wBAAwB,CACxF,CAAA;YACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;YACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YACrD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;QACvB,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE;YAC7C,MAAM,QAAQ,GAAG,qCAAqC,kBAAkB,CAAC,MAAM,CAAC,oBAAoB,CAAA;YACpG,MAAM,KAAK,GAAG,MAAM,SAAS,CAAU,QAAQ,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,IAAI;oBACJ,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,oBAAoB;oBAChC,YAAY,EAAE,MAAM,CAAC,WAAW;oBAChC,KAAK;iBACN,CAAC;aACH,CAAC,CAAA;YACF,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,OAAO,GAAG,MAAM,SAAS,CAK5B,mFAAmF,EAAE;gBACtF,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC;aACpC,CAAC,CAAA;YACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,iBAAiB,CAAA;YAEvD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK;gBACL,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,OAAO,CAAC,WAAW;aAC1B,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/esm/auth/passwordFail2ban.d.ts

@@ -0,0 +1,20 @@
+import type { RakunRequestContext } from '../api/context.js';
+export declare const DEFAULT_PASSWORD_FAIL2BAN_MAX_ATTEMPTS = 5;
+export declare const normalizePasswordLoginIp: (value: string | undefined) => string | undefined;
+export declare const getPasswordFail2banConfig: () => {
+    maxAttempts: number;
+    resolveIp: ((context: import("../api/context.js").RakunRequestContext) => string | undefined) | undefined;
+} | null;
+export declare const resolvePasswordLoginIp: (ctx?: RakunRequestContext) => string | undefined;
+export declare const getBlockedPasswordIp: (ip?: string) => Promise<{
+    recordId: string;
+    failedAttempts: number;
+} | null>;
+export declare const recordPasswordFailure: (ip?: string) => Promise<{
+    blocked: boolean;
+    newlyBlocked: boolean;
+    recordId?: string;
+    failedAttempts?: number;
+}>;
+export declare const clearPasswordFailures: (ip?: string) => Promise<void>;
+//# sourceMappingURL=passwordFail2ban.d.ts.map

package/dist/esm/auth/passwordFail2ban.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordFail2ban.d.ts","sourceRoot":"","sources":["../../../src/auth/passwordFail2ban.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAGzD,eAAO,MAAM,sCAAsC,IAAI,CAAA;AAEvD,eAAO,MAAM,wBAAwB,GACnC,OAAO,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SAYX,CAAA;AAED,eAAO,MAAM,yBAAyB;;;QASrC,CAAA;AAED,eAAO,MAAM,sBAAsB,GACjC,MAAM,mBAAmB,KACxB,MAAM,GAAG,SAQX,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAU,KAAK,MAAM;;;SAWrD,CAAA;AAED,eAAO,MAAM,qBAAqB,GAChC,KAAK,MAAM,KACV,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,CAqEA,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAU,KAAK,MAAM,kBAMtD,CAAA"}

package/dist/esm/auth/passwordFail2ban.js

@@ -0,0 +1,110 @@
+import { isIP } from 'node:net';
+import { getRakunBootstrapOptions } from '../bootstrapState.js';
+import { LoginIpBlock } from '../internal-content-types/index.js';
+import { getMongoService } from '../orm/index.js';
+import { getRequestRateLimitIdentifier } from '../api/utils/authRateLimit.js';
+export const DEFAULT_PASSWORD_FAIL2BAN_MAX_ATTEMPTS = 5;
+export const normalizePasswordLoginIp = (value) => {
+    const candidate = value?.trim();
+    if (!candidate || candidate === 'unknown')
+        return undefined;
+    if (candidate.startsWith('::ffff:')) {
+        const ipv4 = candidate.slice('::ffff:'.length);
+        if (isIP(ipv4) === 4)
+            return ipv4;
+    }
+    if (isIP(candidate))
+        return candidate;
+    return undefined;
+};
+export const getPasswordFail2banConfig = () => {
+    const configured = getRakunBootstrapOptions()?.login?.fail2ban;
+    if (configured === false)
+        return null;
+    return {
+        maxAttempts: configured?.maxAttempts ?? DEFAULT_PASSWORD_FAIL2BAN_MAX_ATTEMPTS,
+        resolveIp: configured?.resolveIp,
+    };
+};
+export const resolvePasswordLoginIp = (ctx) => {
+    if (!ctx)
+        return undefined;
+    const config = getPasswordFail2banConfig();
+    if (!config)
+        return undefined;
+    return normalizePasswordLoginIp(config.resolveIp?.(ctx) ?? getRequestRateLimitIdentifier(ctx));
+};
+export const getBlockedPasswordIp = async (ip) => {
+    if (!ip)
+        return null;
+    const db = await getMongoService();
+    const record = await db.find(LoginIpBlock, { ip });
+    return record?.blockedAt
+        ? {
+            recordId: record._id,
+            failedAttempts: record.failedAttempts,
+        }
+        : null;
+};
+export const recordPasswordFailure = async (ip) => {
+    const config = getPasswordFail2banConfig();
+    if (!ip || !config)
+        return { blocked: false, newlyBlocked: false };
+    const db = await getMongoService();
+    const collection = db.rawDB.collection(LoginIpBlock.name);
+    const now = new Date();
+    const update = {
+        $inc: { failedAttempts: 1 },
+        $set: { lastFailedAt: now, updatedAt: now },
+        $setOnInsert: {
+            _type: LoginIpBlock.name,
+            ip,
+            createdAt: now,
+        },
+    };
+    let record;
+    try {
+        record = await collection.findOneAndUpdate({ ip }, update, { upsert: true, returnDocument: 'after' });
+    }
+    catch (error) {
+        if (!error ||
+            typeof error !== 'object' ||
+            !('code' in error) ||
+            error.code !== 11000) {
+            throw error;
+        }
+        record = await collection.findOneAndUpdate({ ip }, {
+            $inc: update.$inc,
+            $set: update.$set,
+        }, { returnDocument: 'after' });
+    }
+    const failedAttempts = Number(record?.failedAttempts ?? 1);
+    if (record?.blockedAt) {
+        return {
+            blocked: true,
+            newlyBlocked: false,
+            recordId: String(record._id),
+            failedAttempts,
+        };
+    }
+    let newlyBlocked = false;
+    if (failedAttempts >= config.maxAttempts && record?._id) {
+        const blocked = await collection.findOneAndUpdate({ _id: record._id, blockedAt: { $exists: false } }, { $set: { blockedAt: now, updatedAt: now } }, { returnDocument: 'after' });
+        newlyBlocked = Boolean(blocked);
+    }
+    return {
+        blocked: failedAttempts >= config.maxAttempts,
+        newlyBlocked,
+        recordId: record?._id ? String(record._id) : undefined,
+        failedAttempts,
+    };
+};
+export const clearPasswordFailures = async (ip) => {
+    if (!ip || !getPasswordFail2banConfig())
+        return;
+    const db = await getMongoService();
+    await db.rawDB
+        .collection(LoginIpBlock.name)
+        .deleteOne({ ip, blockedAt: { $exists: false } });
+};
+//# sourceMappingURL=passwordFail2ban.js.map

package/dist/esm/auth/passwordFail2ban.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordFail2ban.js","sourceRoot":"","sources":["../../../src/auth/passwordFail2ban.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAG/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAExC,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAE1E,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAA;AAEvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,KAAyB,EACL,EAAE;IACtB,MAAM,SAAS,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAC/B,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAE3D,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IACnC,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAErC,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,EAAE;IAC5C,MAAM,UAAU,GAAG,wBAAwB,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAA;IAC9D,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAErC,OAAO;QACL,WAAW,EACT,UAAU,EAAE,WAAW,IAAI,sCAAsC;QACnE,SAAS,EAAE,UAAU,EAAE,SAAS;KACjC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAyB,EACL,EAAE;IACtB,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAA;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,OAAO,wBAAwB,CAC7B,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAC9D,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,EAAW,EAAE,EAAE;IACxD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IACpB,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAElD,OAAO,MAAM,EAAE,SAAS;QACtB,CAAC,CAAC;YACE,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC;QACH,CAAC,CAAC,IAAI,CAAA;AACV,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,EAAW,EAMV,EAAE;IACH,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;IAElE,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAM,UAAU,GAAI,EAAE,CAAC,KAAY,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE;QAC3B,IAAI,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE;QAC3C,YAAY,EAAE;YACZ,KAAK,EAAE,YAAY,CAAC,IAAI;YACxB,EAAE;YACF,SAAS,EAAE,GAAG;SACf;KACF,CAAA;IACD,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CACxC,EAAE,EAAE,EAAE,EACN,MAAM,EACN,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAC1C,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,CAAC,KAAK;YACN,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;YAClB,KAAK,CAAC,IAAI,KAAK,KAAK,EACpB,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CACxC,EAAE,EAAE,EAAE,EACN;YACE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,EACD,EAAE,cAAc,EAAE,OAAO,EAAE,CAC5B,CAAA;IACH,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,IAAI,CAAC,CAAC,CAAA;IAE1D,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAC5B,cAAc;SACf,CAAA;IACH,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,cAAc,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAC/C,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAClD,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAC5C,EAAE,cAAc,EAAE,OAAO,EAAE,CAC5B,CAAA;QACD,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAED,OAAO;QACL,OAAO,EAAE,cAAc,IAAI,MAAM,CAAC,WAAW;QAC7C,YAAY;QACZ,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACtD,cAAc;KACf,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EAAE,EAAW,EAAE,EAAE;IACzD,IAAI,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE;QAAE,OAAM;IAC/C,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAA;IAClC,MAAO,EAAE,CAAC,KAAY;SACnB,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC;SAC7B,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;AACrD,CAAC,CAAA"}

package/dist/esm/auth/passwordResetMailTemplate.d.ts

@@ -0,0 +1,3 @@
+import type { PasswordResetMailProps } from './accountRecovery.js';
+export declare const passwordResetMailTemplate: import("../index.js").MailTemplate<PasswordResetMailProps>;
+//# sourceMappingURL=passwordResetMailTemplate.d.ts.map

package/dist/esm/auth/passwordResetMailTemplate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordResetMailTemplate.d.ts","sourceRoot":"","sources":["../../../src/auth/passwordResetMailTemplate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAe/D,eAAO,MAAM,yBAAyB,mDA+ElC,CAAA"}

package/dist/esm/auth/passwordResetMailTemplate.js

@@ -0,0 +1,87 @@
+import { defineMailTemplate } from '../mail/index.js';
+const escapeHtml = (value) => value.replace(/[&<>"']/g, (character) => ({
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#039;',
+})[character] ?? character);
+export const passwordResetMailTemplate = defineMailTemplate({
+    subject: 'Reset your Rakun manager password',
+    render: ({ expiresAt, resetUrl, user }) => {
+        const recipient = user.name?.trim() || user.email;
+        const expiresAtText = expiresAt.toUTCString();
+        const safeRecipient = escapeHtml(recipient);
+        const safeResetUrl = escapeHtml(resetUrl);
+        return {
+            text: [
+                `Hello ${recipient},`,
+                'We received a request to reset your Rakun Manager password.',
+                `Choose a new password: ${resetUrl}`,
+                `This single-use link expires on ${expiresAtText}.`,
+                'If you did not request this change, you can safely ignore this email. Your password will remain unchanged.',
+            ].join('\n\n'),
+            html: `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Reset your Rakun manager password</title>
+  </head>
+  <body style="background-color:#f7f8f7;color:#141a1f;font-family:Inter,-apple-system,BlinkMacSystemFont,'Segoe UI',Arial,sans-serif;margin:0;padding:0;">
+    <div style="display:none;font-size:1px;color:#f7f8f7;line-height:1px;max-height:0;max-width:0;opacity:0;overflow:hidden;">Reset your Rakun manager password</div>
+    <table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color:#f7f8f7;border-collapse:collapse;width:100%;">
+      <tr>
+        <td align="center" style="padding:40px 12px;">
+          <table role="presentation" cellpadding="0" cellspacing="0" border="0" width="600" style="background-color:#ffffff;border:1px solid #e2e6e9;border-collapse:separate;border-radius:8px;max-width:600px;width:100%;">
+            <tr>
+              <td style="border-bottom:1px solid #edf0f2;padding:20px 28px;">
+                <table role="presentation" cellpadding="0" cellspacing="0" border="0">
+                  <tr>
+                    <td align="center" bgcolor="#2abb67" width="32" height="32" style="background-color:#2abb67;border-radius:8px;color:#ffffff;font-size:16px;font-weight:700;line-height:32px;text-align:center;">R</td>
+                    <td style="color:#141a1f;font-size:16px;font-weight:700;line-height:24px;padding-left:10px;">Rakun <span style="color:#67737e;font-weight:500;">Manager</span></td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+            <tr>
+              <td style="padding:34px 32px 32px;">
+                <p style="color:#219150;font-size:12px;font-weight:700;letter-spacing:.08em;line-height:18px;margin:0 0 10px;text-transform:uppercase;">Account security</p>
+                <h1 style="color:#141a1f;font-size:28px;font-weight:700;line-height:36px;margin:0 0 22px;">Reset your password</h1>
+                <p style="color:#46515b;font-size:15px;line-height:24px;margin:0 0 12px;">Hello ${safeRecipient},</p>
+                <p style="color:#46515b;font-size:15px;line-height:24px;margin:0 0 12px;">We received a request to reset your manager password. Use the button below to choose a new one.</p>
+                <table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:28px 0;">
+                  <tr>
+                    <td align="center" bgcolor="#2abb67" style="background-color:#2abb67;border-radius:8px;">
+                      <a href="${safeResetUrl}" style="color:#ffffff;display:inline-block;font-size:14px;font-weight:700;line-height:20px;padding:12px 22px;text-align:center;text-decoration:none;">Choose new password</a>
+                    </td>
+                  </tr>
+                </table>
+                <table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="background-color:#f0f2f4;border:1px solid #e2e6e9;border-radius:8px;margin:0 0 24px;width:100%;">
+                  <tr>
+                    <td style="padding:15px 17px;">
+                      <p style="color:#141a1f;font-size:14px;font-weight:700;line-height:20px;margin:0;">Single-use security link</p>
+                      <p style="color:#67737e;font-size:13px;line-height:20px;margin:4px 0 0;">This link can only be used once and expires on ${expiresAtText}.</p>
+                    </td>
+                  </tr>
+                </table>
+                <p style="color:#67737e;font-size:13px;line-height:20px;margin:0 0 6px;">If the button does not work, copy and paste this address into your browser:</p>
+                <p style="font-size:13px;line-height:20px;margin:0;word-wrap:break-word;"><a href="${safeResetUrl}" style="color:#219150;text-decoration:underline;">${safeResetUrl}</a></p>
+                <p style="border-top:1px solid #edf0f2;color:#67737e;font-size:13px;line-height:20px;margin:28px 0 0;padding-top:20px;">If you did not request this change, you can safely ignore this email. Your password will remain unchanged.</p>
+              </td>
+            </tr>
+            <tr>
+              <td style="background-color:#f7f8f7;border-top:1px solid #edf0f2;padding:17px 28px;">
+                <p style="color:#8f99a3;font-size:12px;line-height:18px;margin:0;">This message was sent automatically by Rakun Manager.</p>
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`,
+        };
+    },
+});
+//# sourceMappingURL=passwordResetMailTemplate.js.map

package/dist/esm/auth/passwordResetMailTemplate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordResetMailTemplate.js","sourceRoot":"","sources":["../../../src/auth/passwordResetMailTemplate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAG5C,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CACnC,KAAK,CAAC,OAAO,CACX,UAAU,EACV,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC;IACC,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAC7B,CAAA;AAEH,MAAM,CAAC,MAAM,yBAAyB,GACpC,kBAAkB,CAAyB;IACzC,OAAO,EAAE,mCAAmC;IAC5C,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAA;QACjD,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,EAAE,CAAA;QAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QAEzC,OAAO;YACL,IAAI,EAAE;gBACJ,SAAS,SAAS,GAAG;gBACrB,6DAA6D;gBAC7D,0BAA0B,QAAQ,EAAE;gBACpC,mCAAmC,aAAa,GAAG;gBACnD,4GAA4G;aAC7G,CAAC,IAAI,CAAC,MAAM,CAAC;YACd,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;kGA2BoF,aAAa;;;;;iCAK9E,YAAY;;;;;;;;gJAQmG,aAAa;;;;;qGAKxD,YAAY,sDAAsD,YAAY;;;;;;;;;;;;;;QAc3K;SACD,CAAA;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/esm/bootstrapState.d.ts

@@ -2,11 +2,16 @@ import type ContentType from "./lib/ContentType.js";
 import type { createLogger } from "./lib/Logger.js";
 import type { LiteralCatalogInput } from "./literals/definitions.js";
 import type { MediaServiceConfig } from "./media/index.js";
+import type { MailServiceConfig } from "./mail/index.js";
+import type { EventLogServiceConfig } from "./eventLog/index.js";
 import type { TranslationServiceConfig } from "./translation/index.js";
 import type { MongoConfig } from "./orm/database.js";
 import type { RouteDefinition } from "./api/utils/routes/routeDefinitions.js";
 import type { RakunOperationMap } from "./api/operations/types.js";
-import type { RakunPluginDefinition, RakunPluginFieldDefinition, RakunResolvedPluginContributions } from './plugins.js';
+import type { RakunPluginDefinition, RakunPluginFieldDefinition, RakunResolvedPluginContributions } from "./plugins.js";
+import type { ManagerLanguagePack } from "./schemas/manager/uiLocales.js";
+import type { AccountRecoveryConfig } from "./auth/accountRecovery.js";
+import type { LoginConfig } from "./auth/loginAdapters.js";
 export interface RakunBootstrapOptions {
     literals: LiteralCatalogInput;
     contentTypes: RakunContentType[];
@@ -17,8 +22,25 @@ export interface RakunBootstrapOptions {
     apiOperations?: RakunOperationMap;
     plugins?: readonly RakunPluginDefinition[];
     permissions?: readonly string[];
+    /**
+     * Installable manager UI locale packs (ICU key/value messages).
+     * English is always built into the manager client; list extra locales here.
+     */
+    managerLanguages?: readonly ManagerLanguagePack[];
     mongo?: MongoConfig;
     media?: MediaServiceConfig;
+    mail?: MailServiceConfig;
+    /**
+     * Manager password-reset URL builder, expiry, and optional mail template.
+     * Requires `mail`; core provides the default template.
+     */
+    accountRecovery?: AccountRecoveryConfig;
+    /** Manager login methods. Password login is enabled by default. */
+    login?: LoginConfig;
+    /**
+     * Persistent business event log. Defaults to the built-in MongoDB adapter.
+     */
+    eventLog?: EventLogServiceConfig;
     translation?: TranslationServiceConfig;
     logger?: Parameters<typeof createLogger>[0];
     revalidate?: {
@@ -29,7 +51,7 @@ export interface RakunBootstrapOptions {
     syncRoutes?: boolean;
 }
 export type RakunContentType = ContentType;
-export type ResolvedRakunBootstrapOptions = Omit<RakunBootstrapOptions, 'contentTypes' | 'routes' | 'apiOperations' | 'literals' | 'permissions'> & RakunResolvedPluginContributions & {
+export type ResolvedRakunBootstrapOptions = Omit<RakunBootstrapOptions, "contentTypes" | "routes" | "apiOperations" | "literals" | "permissions"> & RakunResolvedPluginContributions & {
     fields: RakunPluginFieldDefinition[];
 };
 export declare const getRakunBootstrapOptions: () => ResolvedRakunBootstrapOptions | null;

package/dist/esm/bootstrapState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrapState.d.ts","sourceRoot":"","sources":["../../src/bootstrapState.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,WAAW,CAAA;AAElB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,oBAAoB,CAAC,EAAE;QACrB,IAAI,CAAC,EAAE,gBAAgB,CAAC;KACzB,CAAC;IACF,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,OAAO,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC3C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,UAAU,CAAC,EACP;QACE,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACD,KAAK,CAAC;IACV,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAC9C,qBAAqB,EACrB,cAAc,GAAG,QAAQ,GAAG,eAAe,GAAG,UAAU,GAAG,aAAa,CACzE,GACC,gCAAgC,GAAG;IACjC,MAAM,EAAE,0BAA0B,EAAE,CAAA;CACrC,CAAA;AAKH,eAAO,MAAM,wBAAwB,QAAO,6BAA6B,GAAG,IAC1D,CAAC;AAEnB,eAAO,MAAM,wBAAwB,GACnC,SAAS,6BAA6B,KACrC,IAGF,CAAC;AAEF,eAAO,MAAM,oBAAoB,QAAO,OAAuB,CAAC"}
+{"version":3,"file":"bootstrapState.d.ts","sourceRoot":"","sources":["../../src/bootstrapState.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,oBAAoB,CAAC,EAAE;QACrB,IAAI,CAAC,EAAE,gBAAgB,CAAC;KACzB,CAAC;IACF,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,OAAO,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC3C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,mEAAmE;IACnE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;OAEG;IACH,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,UAAU,CAAC,EACP;QACE,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACD,KAAK,CAAC;IACV,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAC9C,qBAAqB,EACrB,cAAc,GAAG,QAAQ,GAAG,eAAe,GAAG,UAAU,GAAG,aAAa,CACzE,GACC,gCAAgC,GAAG;IACjC,MAAM,EAAE,0BAA0B,EAAE,CAAC;CACtC,CAAC;AAKJ,eAAO,MAAM,wBAAwB,QAC/B,6BAA6B,GAAG,IAAwB,CAAC;AAE/D,eAAO,MAAM,wBAAwB,GACnC,SAAS,6BAA6B,KACrC,IAGF,CAAC;AAEF,eAAO,MAAM,oBAAoB,QAAO,OAAuB,CAAC"}

package/dist/esm/bootstrapState.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrapState.js","sourceRoot":"","sources":["../../src/bootstrapState.ts"],"names":[],"mappings":"AAgDA,IAAI,gBAAgB,GAAyC,IAAI,CAAC;AAClE,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAyC,EAAE,CACjF,gBAAgB,CAAC;AAEnB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,OAAsC,EAChC,EAAE;IACR,gBAAgB,GAAG,OAAO,CAAC;IAC3B,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAY,EAAE,CAAC,YAAY,CAAC"}
+{"version":3,"file":"bootstrapState.js","sourceRoot":"","sources":["../../src/bootstrapState.ts"],"names":[],"mappings":"AAsEA,IAAI,gBAAgB,GAAyC,IAAI,CAAC;AAClE,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GACnC,GAAyC,EAAE,CAAC,gBAAgB,CAAC;AAE/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,OAAsC,EAChC,EAAE;IACR,gBAAgB,GAAG,OAAO,CAAC;IAC3B,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAY,EAAE,CAAC,YAAY,CAAC"}