@rovela-ai/sdk 0.3.34 → 0.4.1

package/dist/admin/server/admin-invite.js

@@ -1,235 +0,0 @@
-/**
- * @rovela/sdk/admin/server/admin-invite
- *
- * Admin invite token lifecycle: validation, acceptance, and housekeeping.
- *
- * Paired with `user-management.ts::inviteAdmin` which creates the token +
- * sends the email. This file handles the INVITEE's side of the flow: they
- * click the email link, land on `/admin/accept-invite?token=X`, and this
- * module validates + consumes the token.
- *
- * # Failure modes (all graceful — no exceptions leak out)
- *
- *   - Token unknown            → `{valid: false}` / `INVALID_TOKEN`
- *   - Token expired            → delete row, return `{valid: false}` with "expired"
- *   - Admin deleted            → cascaded delete already removed the token;
- *                                caller will see `{valid: false}`
- *   - Admin already accepted   → `{valid: false}` with "already accepted"
- *                                (protects against double-clicks)
- *   - Admin was deactivated    → same as "already accepted" from UX point of view
- *   - Concurrent acceptance    → atomic UPDATE returns 0 rows → `INVALID_STATE`
- *
- * # Design notes
- *
- * The structure mirrors `admin-password-reset.ts` from Phase 1 exactly:
- *   1. `validate*` is non-destructive (opportunistically cleans up expired
- *      tokens but doesn't touch the admin row).
- *   2. `accept*` is destructive — it updates the password, flips status,
- *      and deletes ALL tokens for the admin (both invite + reset tokens,
- *      so a stale reset link can't resurrect access).
- *   3. `delete*ForAdmin` helper used by `cancelInvite` / `resendInvite` to
- *      wipe stale tokens before issuing a new one.
- *   4. `cleanupExpired` is an optional cron hook.
- */
-import { eq, lt } from 'drizzle-orm';
-import { nanoid } from 'nanoid';
-import { getDb } from '../../core/db/client';
-import * as schema from '../../core/db/schema';
-import { findAdminById, updateAdminPassword } from './admin-service';
-import { deleteAdminPasswordResetTokens } from './admin-password-reset';
-import { validatePassword } from '../../auth/server/password';
-// =============================================================================
-// Constants
-// =============================================================================
-/**
- * Invite token lifetime: 72 hours. Matches industry standard
- * (Google Workspace, GitHub, Shopify).
- */
-export const INVITE_EXPIRY_MS = 72 * 60 * 60 * 1000;
-/** Token length — nanoid(32) = ~192 bits of entropy, URL-safe. */
-export const INVITE_TOKEN_LENGTH = 32;
-/** Display string for the expiry duration. */
-export const INVITE_EXPIRY_HOURS = '72';
-// =============================================================================
-// Token creation (used by inviteAdmin + resendAdminInvite in user-management.ts)
-// =============================================================================
-/**
- * Create a new invite token for an existing `invited` admin row.
- *
- * The caller is responsible for:
- *   - Validating the admin exists and is in `invited` status
- *   - Deleting any existing invite tokens for this admin (via
- *     `deleteAdminInviteTokens`) before calling this to keep "one active
- *     token" semantics
- *
- * @returns The plain-text token that should be embedded in the email link.
- */
-export async function createInviteToken(params) {
-    const db = getDb();
-    const token = nanoid(INVITE_TOKEN_LENGTH);
-    const expires = new Date(Date.now() + INVITE_EXPIRY_MS);
-    await db.insert(schema.adminInviteTokens).values({
-        adminId: params.adminId,
-        token,
-        expires,
-        invitedBy: params.invitedBy,
-    });
-    return { token, expires };
-}
-// =============================================================================
-// Validate (non-destructive)
-// =============================================================================
-/**
- * Validate an invite token without consuming it.
- *
- * Used by the accept-invite page on mount to decide between rendering the
- * password form or an "invalid/expired" error view.
- *
- * Side effect: expired tokens are opportunistically deleted as part of the
- * check. All other failure modes leave the DB untouched.
- */
-export async function validateInviteToken(token) {
-    if (!token) {
-        return {
-            valid: false,
-            error: 'Invite link is missing a token. Please request a new invite.',
-        };
-    }
-    const db = getDb();
-    const [record] = await db
-        .select()
-        .from(schema.adminInviteTokens)
-        .where(eq(schema.adminInviteTokens.token, token))
-        .limit(1);
-    if (!record) {
-        return {
-            valid: false,
-            error: 'Invalid or expired invite link. Please request a new one.',
-        };
-    }
-    if (new Date() > record.expires) {
-        // Opportunistic cleanup
-        await db
-            .delete(schema.adminInviteTokens)
-            .where(eq(schema.adminInviteTokens.id, record.id));
-        return {
-            valid: false,
-            error: 'Invite link has expired. Please request a new one.',
-        };
-    }
-    const admin = await findAdminById(record.adminId);
-    if (!admin) {
-        // Cascaded delete should have prevented this — defensive
-        return {
-            valid: false,
-            error: 'Invalid or expired invite link. Please request a new one.',
-        };
-    }
-    if (admin.status !== 'invited') {
-        return {
-            valid: false,
-            error: admin.status === 'active'
-                ? 'This invite has already been accepted. Please sign in with your password.'
-                : 'This invite is no longer valid.',
-        };
-    }
-    return {
-        valid: true,
-        admin: {
-            id: admin.id,
-            email: admin.email,
-            name: admin.name,
-            role: admin.role,
-        },
-    };
-}
-// =============================================================================
-// Accept (destructive — consumes token, activates admin)
-// =============================================================================
-/**
- * Consume an invite token and activate the invited admin.
- *
- * Atomically:
- *   1. Validates the token + admin row.
- *   2. Hashes + stores the new password via the existing
- *      `updateAdminPassword` helper.
- *   3. Flips status from 'invited' → 'active' via an atomic guarded UPDATE
- *      (if two clicks race, the second one fails with INVALID_STATE).
- *   4. Deletes all invite tokens for this admin (single-use batch).
- *   5. Defensively deletes any stale password reset tokens too — a
- *      previously abandoned reset flow shouldn't grant access after the
- *      user has taken ownership of the account via accept-invite.
- */
-export async function acceptAdminInvite(token, newPassword) {
-    // 1. Re-validate (fresh read — the validate* function is idempotent)
-    const validation = await validateInviteToken(token);
-    if (!validation.valid || !validation.admin) {
-        return {
-            success: false,
-            error: validation.error || 'Invalid or expired invite link.',
-        };
-    }
-    const adminId = validation.admin.id;
-    // 2. Password strength check
-    const passwordCheck = validatePassword(newPassword);
-    if (!passwordCheck.valid) {
-        return { success: false, error: passwordCheck.error };
-    }
-    const db = getDb();
-    // 3. Hash + store password (updateAdminPassword handles hashing internally)
-    await updateAdminPassword(adminId, newPassword);
-    // 4. Flip status — guarded so a concurrent accept gets rejected cleanly
-    const statusUpdate = await db
-        .update(schema.storeAdmins)
-        .set({ status: 'active' })
-        .where(eq(schema.storeAdmins.id, adminId))
-        .returning({ id: schema.storeAdmins.id, status: schema.storeAdmins.status });
-    if (statusUpdate.length === 0) {
-        // Target was deleted between validate and update — race condition
-        return {
-            success: false,
-            error: 'Admin state changed while accepting invite. Please try again.',
-        };
-    }
-    // 5. Wipe all invite tokens for this admin (single-use batch)
-    await deleteAdminInviteTokens(adminId);
-    // 6. Defensive: wipe any stale password reset tokens too
-    await deleteAdminPasswordResetTokens(adminId);
-    return { success: true };
-}
-// =============================================================================
-// Housekeeping
-// =============================================================================
-/**
- * Delete all invite tokens for a specific admin.
- *
- * Called from:
- *   - `user-management.ts::inviteAdmin` — not called; the admin is newly
- *     created so there are no tokens to delete
- *   - `user-management.ts::resendAdminInvite` — clear stale tokens before
- *     creating a new one
- *   - `acceptAdminInvite` above — invalidate the used batch
- *   - `user-management.ts::cancelAdminInvite` — cascade handles this
- *     automatically via FK, but we call explicitly for clarity
- */
-export async function deleteAdminInviteTokens(adminId) {
-    const db = getDb();
-    await db
-        .delete(schema.adminInviteTokens)
-        .where(eq(schema.adminInviteTokens.adminId, adminId));
-}
-/**
- * Delete all expired invite tokens. Optional hook for a periodic cleanup
- * job. Safe to call anytime — no-op if nothing is expired.
- *
- * @returns Number of tokens deleted
- */
-export async function cleanupExpiredInviteTokens() {
-    const db = getDb();
-    const result = await db
-        .delete(schema.adminInviteTokens)
-        .where(lt(schema.adminInviteTokens.expires, new Date()))
-        .returning({ id: schema.adminInviteTokens.id });
-    return result.length;
-}
-//# sourceMappingURL=admin-invite.js.map

package/dist/admin/server/admin-invite.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-invite.js","sourceRoot":"","sources":["../../../src/admin/server/admin-invite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAG7D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAErC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAwBvC,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAGvC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,CAAA;IAEvD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;QAC/C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK;QACL,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAA;IAEF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAC3B,CAAC;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa;IAEb,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,8DAA8D;SACtE,CAAA;IACH,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC9B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;SAChD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,2DAA2D;SACnE,CAAA;IACH,CAAC;IAED,IAAI,IAAI,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAChC,wBAAwB;QACxB,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;aAChC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QAEpD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,oDAAoD;SAC5D,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,yDAAyD;QACzD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,2DAA2D;SACnE,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EACH,KAAK,CAAC,MAAM,KAAK,QAAQ;gBACvB,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,iCAAiC;SACxC,CAAA;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,KAAK,EAAE;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAiB;SAC9B;KACF,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,yDAAyD;AACzD,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,WAAmB;IAEnB,qEAAqE;IACrE,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACnD,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,iCAAiC;SAC7D,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAA;IAEnC,6BAA6B;IAC7B,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAA;IACnD,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAA;IACvD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,4EAA4E;IAC5E,MAAM,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAE/C,wEAAwE;IACxE,MAAM,YAAY,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SACzB,KAAK,CACJ,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CACnC;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IAE9E,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,kEAAkE;QAClE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+DAA+D;SACvE,CAAA;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAA;IAEtC,yDAAyD;IACzD,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAA;IAE7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAChC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAChC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SACvD,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAA;IACjD,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC"}

package/dist/admin/server/admin-password-reset.d.ts

@@ -1,87 +0,0 @@
-/**
- * @rovela/sdk/admin/server/admin-password-reset
- *
- * Admin password reset token management.
- *
- * Mirrors `auth/server/password-reset-service.ts` (the customer version),
- * with one critical addition: admins whose status is not 'active' are
- * silently skipped. This blocks deactivated and invited admins from
- * recovering access via the reset flow — deactivated admins must stay
- * deactivated, invited admins must go through the invite-accept flow
- * (Phase 3). The caller always receives `{success: true}` regardless
- * to preserve enumeration safety.
- *
- * Each store has its own database (via Neon branches), so there's no
- * tenant filtering. The `admin_password_reset_tokens` table was created
- * for every active store during the Phase 0 migration.
- */
-/**
- * Request a password reset for an admin.
- *
- * Creates a token and sends the reset email. Always returns `{success: true}`
- * regardless of whether the email belongs to a real admin — this prevents
- * email enumeration attacks and keeps the HTTP response shape identical for
- * all outcomes.
- *
- * Silently skipped cases (all return success without side effects):
- *   - Email doesn't belong to any admin
- *   - Admin exists but status !== 'active' (deactivated or invited)
- *   - Email sending fails (error is logged, not exposed)
- *
- * @param email - The admin's email address
- * @returns Always `{success: true}` — see above
- *
- * @example
- * ```typescript
- * await requestAdminPasswordReset('owner@store.com')
- * // Always show: "If an account exists with this email, we've sent a reset link."
- * ```
- */
-export declare function requestAdminPasswordReset(email: string): Promise<{
-    success: boolean;
-}>;
-/**
- * Validate a reset token without consuming it.
- *
- * Used by the reset page to decide whether to show the "enter new password"
- * form or an "invalid/expired link" error. Expired tokens are cleaned up
- * opportunistically as a side effect.
- *
- * @param token - The token from the reset link
- */
-export declare function validateAdminResetToken(token: string): Promise<{
-    valid: boolean;
-    error?: string;
-}>;
-/**
- * Reset an admin's password using a valid token.
- *
- * Validates the token, updates the password via `updateAdminPassword`
- * (which handles hashing), then deletes ALL reset tokens for that admin
- * so a stale link can't be reused after a successful reset.
- *
- * @param token - The token from the reset link
- * @param newPassword - The new plain-text password (will be hashed)
- */
-export declare function resetAdminPassword(token: string, newPassword: string): Promise<{
-    success: boolean;
-    error?: string;
-}>;
-/**
- * Delete all password reset tokens for a specific admin.
- *
- * Called at two points:
- *   1. Before issuing a new token (clear stale ones)
- *   2. After a successful reset (invalidate the used batch)
- */
-export declare function deleteAdminPasswordResetTokens(adminId: string): Promise<void>;
-/**
- * Delete expired reset tokens across all admins.
- *
- * Optional hook for a periodic cleanup job (e.g. cron). Safe to call
- * anytime — no-op if nothing is expired.
- *
- * @returns Number of tokens deleted
- */
-export declare function cleanupExpiredAdminResetTokens(): Promise<number>;
-//# sourceMappingURL=admin-password-reset.d.ts.map

package/dist/admin/server/admin-password-reset.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-password-reset.d.ts","sourceRoot":"","sources":["../../../src/admin/server/admin-password-reset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAkCH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,OAAO,EAAE,OAAO,CAAA;CACjB,CAAC,CAoDD;AAMD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACpE,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAC,CA6BD;AAMD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkC/C;AAMD;;;;;;GAMG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,MAAM,CAAC,CAStE"}

package/dist/admin/server/admin-password-reset.js

@@ -1,220 +0,0 @@
-/**
- * @rovela/sdk/admin/server/admin-password-reset
- *
- * Admin password reset token management.
- *
- * Mirrors `auth/server/password-reset-service.ts` (the customer version),
- * with one critical addition: admins whose status is not 'active' are
- * silently skipped. This blocks deactivated and invited admins from
- * recovering access via the reset flow — deactivated admins must stay
- * deactivated, invited admins must go through the invite-accept flow
- * (Phase 3). The caller always receives `{success: true}` regardless
- * to preserve enumeration safety.
- *
- * Each store has its own database (via Neon branches), so there's no
- * tenant filtering. The `admin_password_reset_tokens` table was created
- * for every active store during the Phase 0 migration.
- */
-import { eq, lt } from 'drizzle-orm';
-import { nanoid } from 'nanoid';
-import { getDb } from '../../core/db/client';
-import * as schema from '../../core/db/schema';
-import { findAdminByEmail, updateAdminPassword } from './admin-service';
-import { sendAdminPasswordResetEmail } from '../../emails/send/admin-auth';
-import { getStoreUrl } from '../../emails/config';
-// =============================================================================
-// Constants
-// =============================================================================
-/**
- * Password reset token expiry time in milliseconds (1 hour).
- * Matches customer reset flow.
- */
-const TOKEN_EXPIRY_MS = 60 * 60 * 1000;
-/**
- * Token length (URL-safe, ~192 bits of entropy with nanoid).
- */
-const TOKEN_LENGTH = 32;
-/**
- * Display string for the expiry duration — passed to the email template.
- */
-const TOKEN_EXPIRY_HOURS = '1';
-// =============================================================================
-// Request reset
-// =============================================================================
-/**
- * Request a password reset for an admin.
- *
- * Creates a token and sends the reset email. Always returns `{success: true}`
- * regardless of whether the email belongs to a real admin — this prevents
- * email enumeration attacks and keeps the HTTP response shape identical for
- * all outcomes.
- *
- * Silently skipped cases (all return success without side effects):
- *   - Email doesn't belong to any admin
- *   - Admin exists but status !== 'active' (deactivated or invited)
- *   - Email sending fails (error is logged, not exposed)
- *
- * @param email - The admin's email address
- * @returns Always `{success: true}` — see above
- *
- * @example
- * ```typescript
- * await requestAdminPasswordReset('owner@store.com')
- * // Always show: "If an account exists with this email, we've sent a reset link."
- * ```
- */
-export async function requestAdminPasswordReset(email) {
-    const admin = await findAdminByEmail(email);
-    // Enumeration-safe fast exits
-    if (!admin) {
-        return { success: true };
-    }
-    // Block deactivated and invited admins from using the reset flow.
-    // Deactivated: must stay locked out. Invited: should use the invite
-    // accept flow (Phase 3), not the reset flow.
-    const status = admin.status ?? 'active';
-    if (status !== 'active') {
-        return { success: true };
-    }
-    // Clear any existing reset tokens for this admin — "only the latest
-    // reset link works" policy, same as customer flow.
-    await deleteAdminPasswordResetTokens(admin.id);
-    // Generate new token
-    const db = getDb();
-    const token = nanoid(TOKEN_LENGTH);
-    const expires = new Date(Date.now() + TOKEN_EXPIRY_MS);
-    await db.insert(schema.adminPasswordResetTokens).values({
-        adminId: admin.id,
-        token,
-        expires,
-    });
-    // Send the email. Failures are logged but never propagated — returning
-    // success keeps the enumeration-safe contract and prevents leaking
-    // infrastructure state (e.g. "Resend is down").
-    try {
-        const storeUrl = getStoreUrl();
-        const resetLink = `${storeUrl}/admin/reset-password?token=${encodeURIComponent(token)}`;
-        await sendAdminPasswordResetEmail({
-            to: email,
-            adminName: admin.name,
-            resetLink,
-            expiryTime: TOKEN_EXPIRY_HOURS,
-        });
-    }
-    catch (error) {
-        console.error('[admin-password-reset] Failed to send reset email:', error instanceof Error ? error.message : error);
-        // Do not fail the request — enumeration safety + infra privacy.
-    }
-    return { success: true };
-}
-// =============================================================================
-// Validate token (non-destructive check)
-// =============================================================================
-/**
- * Validate a reset token without consuming it.
- *
- * Used by the reset page to decide whether to show the "enter new password"
- * form or an "invalid/expired link" error. Expired tokens are cleaned up
- * opportunistically as a side effect.
- *
- * @param token - The token from the reset link
- */
-export async function validateAdminResetToken(token) {
-    const db = getDb();
-    const [record] = await db
-        .select()
-        .from(schema.adminPasswordResetTokens)
-        .where(eq(schema.adminPasswordResetTokens.token, token))
-        .limit(1);
-    if (!record) {
-        return {
-            valid: false,
-            error: 'Invalid or expired reset link. Please request a new one.',
-        };
-    }
-    if (new Date() > record.expires) {
-        // Opportunistic cleanup
-        await db
-            .delete(schema.adminPasswordResetTokens)
-            .where(eq(schema.adminPasswordResetTokens.id, record.id));
-        return {
-            valid: false,
-            error: 'Reset link has expired. Please request a new one.',
-        };
-    }
-    return { valid: true };
-}
-// =============================================================================
-// Reset password (consumes token)
-// =============================================================================
-/**
- * Reset an admin's password using a valid token.
- *
- * Validates the token, updates the password via `updateAdminPassword`
- * (which handles hashing), then deletes ALL reset tokens for that admin
- * so a stale link can't be reused after a successful reset.
- *
- * @param token - The token from the reset link
- * @param newPassword - The new plain-text password (will be hashed)
- */
-export async function resetAdminPassword(token, newPassword) {
-    const db = getDb();
-    const [record] = await db
-        .select()
-        .from(schema.adminPasswordResetTokens)
-        .where(eq(schema.adminPasswordResetTokens.token, token))
-        .limit(1);
-    if (!record) {
-        return {
-            success: false,
-            error: 'Invalid or expired reset link. Please request a new one.',
-        };
-    }
-    if (new Date() > record.expires) {
-        await db
-            .delete(schema.adminPasswordResetTokens)
-            .where(eq(schema.adminPasswordResetTokens.id, record.id));
-        return {
-            success: false,
-            error: 'Reset link has expired. Please request a new one.',
-        };
-    }
-    // Hash + update via the existing admin-service helper
-    await updateAdminPassword(record.adminId, newPassword);
-    // Wipe all reset tokens for this admin — one-time use for the whole batch
-    await deleteAdminPasswordResetTokens(record.adminId);
-    return { success: true };
-}
-// =============================================================================
-// Housekeeping
-// =============================================================================
-/**
- * Delete all password reset tokens for a specific admin.
- *
- * Called at two points:
- *   1. Before issuing a new token (clear stale ones)
- *   2. After a successful reset (invalidate the used batch)
- */
-export async function deleteAdminPasswordResetTokens(adminId) {
-    const db = getDb();
-    await db
-        .delete(schema.adminPasswordResetTokens)
-        .where(eq(schema.adminPasswordResetTokens.adminId, adminId));
-}
-/**
- * Delete expired reset tokens across all admins.
- *
- * Optional hook for a periodic cleanup job (e.g. cron). Safe to call
- * anytime — no-op if nothing is expired.
- *
- * @returns Number of tokens deleted
- */
-export async function cleanupExpiredAdminResetTokens() {
-    const db = getDb();
-    const result = await db
-        .delete(schema.adminPasswordResetTokens)
-        .where(lt(schema.adminPasswordResetTokens.expires, new Date()))
-        .returning({ id: schema.adminPasswordResetTokens.id });
-    return result.length;
-}
-//# sourceMappingURL=admin-password-reset.js.map

package/dist/admin/server/admin-password-reset.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-password-reset.js","sourceRoot":"","sources":["../../../src/admin/server/admin-password-reset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAA;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEtC;;GAEG;AACH,MAAM,YAAY,GAAG,EAAE,CAAA;AAEvB;;GAEG;AACH,MAAM,kBAAkB,GAAG,GAAG,CAAA;AAE9B,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAAa;IAG3D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAE3C,8BAA8B;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,6CAA6C;IAC7C,MAAM,MAAM,GAAI,KAA6B,CAAC,MAAM,IAAI,QAAQ,CAAA;IAChE,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAE9C,qBAAqB;IACrB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAA;IAEtD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,KAAK;QACL,OAAO;KACR,CAAC,CAAA;IAEF,uEAAuE;IACvE,mEAAmE;IACnE,gDAAgD;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;QAC9B,MAAM,SAAS,GAAG,GAAG,QAAQ,+BAA+B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;QACvF,MAAM,2BAA2B,CAAC;YAChC,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,SAAS;YACT,UAAU,EAAE,kBAAkB;SAC/B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CACX,oDAAoD,EACpD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAA;QACD,gEAAgE;IAClE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAa;IAIzD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;SACvD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,0DAA0D;SAClE,CAAA;IACH,CAAC;IAED,IAAI,IAAI,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAChC,wBAAwB;QACxB,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;aACvC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QAE3D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,mDAAmD;SAC3D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC;AAED,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,WAAmB;IAEnB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;SACvD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0DAA0D;SAClE,CAAA;IACH,CAAC;IAED,IAAI,IAAI,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;aACvC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QAE3D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mDAAmD;SAC3D,CAAA;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAEtD,0EAA0E;IAC1E,MAAM,8BAA8B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAEpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAe;IAEf,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B;IAClD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SAC9D,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAA;IAExD,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC"}

package/dist/admin/server/admin-self-service.d.ts

@@ -1,86 +0,0 @@
-/**
- * @rovela/sdk/admin/server/admin-self-service
- *
- * Self-service helpers for logged-in admins — change their own password,
- * edit their own profile. Never accepts an `actor` vs `target` distinction:
- * these operations always act on the caller themselves, enforced by the
- * API layer passing `session.user.id` as the adminId.
- *
- * # What these do that admin-service.ts doesn't
- *
- * `admin-service.ts` has the raw CRUD helpers (`updateAdmin`,
- * `updateAdminPassword`). Those are called from multiple contexts —
- * forgot-password flow, invite acceptance, emergency reset, user-management
- * actions. This file wraps them in self-service semantics:
- *
- *   1. `changeOwnPassword` requires the current password as proof of
- *      identity. Mere session possession isn't enough — we want defense
- *      against "attacker on coffee shop laptop" scenarios where the
- *      session cookie is borrowed.
- *
- *   2. `updateOwnProfile` checks email uniqueness against every other
- *      admin (not just-not-self) before persisting, to surface clean
- *      error codes to the caller.
- *
- * Both helpers return typed discriminated unions — they never throw on
- * business errors, only on unexpected infra failures (DB connectivity,
- * which the API layer catches).
- */
-import type { StoreAdmin } from '../../core/db/schema';
-export interface SelfServiceError {
-    code: 'NOT_FOUND' | 'INVALID_CREDENTIALS' | 'VALIDATION_ERROR' | 'EMAIL_EXISTS';
-    message: string;
-}
-export type ChangeOwnPasswordResult = {
-    ok: true;
-} | {
-    ok: false;
-    error: SelfServiceError;
-};
-export type UpdateOwnProfileResult = {
-    ok: true;
-    admin: StoreAdmin;
-} | {
-    ok: false;
-    error: SelfServiceError;
-};
-/**
- * Change the logged-in admin's password.
- *
- * Requires the current password as proof of identity. Validates the new
- * password via the shared `validatePassword` helper (min 8 chars). On
- * success, bumps `session_version` (via `updateAdminPassword`), cleans up
- * any stale reset tokens, and invalidates the in-memory session cache so
- * other active sessions for this admin are kicked out on their next
- * request.
- *
- * The admin's CURRENT session (the one that initiated this change) also
- * carries a now-stale `sessionVersion` JWT claim, which means the next
- * request from that session will also fail `requireAdmin`'s version
- * check → forced logout. That's correct behavior: after a password
- * rotation, the user must re-authenticate with the new password.
- *
- * If that's undesirable (the UI would need to immediately re-sign-in),
- * the API handler can call `nextAuthSignIn` server-side after a
- * successful change. For Phase 4, we accept the forced re-login as the
- * honest behavior.
- */
-export declare function changeOwnPassword(adminId: string, currentPassword: string, newPassword: string): Promise<ChangeOwnPasswordResult>;
-/**
- * Update the logged-in admin's name and/or email.
- *
- * Email uniqueness is checked against every OTHER admin (not self). If
- * both fields are omitted, returns a VALIDATION_ERROR so the caller gets
- * a clean error rather than a silent no-op.
- *
- * Changing email does NOT require a separate re-verification — the admin
- * is already authenticated and the client-side confirmation dialog in
- * `AdminAccountPage` warns them about the forgot-password implication.
- *
- * No sessionVersion bump — profile changes don't invalidate sessions.
- */
-export declare function updateOwnProfile(adminId: string, data: {
-    name?: string;
-    email?: string;
-}): Promise<UpdateOwnProfileResult>;
-//# sourceMappingURL=admin-self-service.d.ts.map

package/dist/admin/server/admin-self-service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-self-service.d.ts","sourceRoot":"","sources":["../../../src/admin/server/admin-self-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AASH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAMtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EACA,WAAW,GACX,qBAAqB,GACrB,kBAAkB,GAClB,cAAc,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAE1C,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAM1C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,uBAAuB,CAAC,CA0DlC;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,sBAAsB,CAAC,CAuEjC"}