@rpcbase/auth 0.165.0 → 0.167.0

package/dist/handler-0nKR-P5B.js

@@ -0,0 +1,84 @@
+import { n as requestSchema, t as Route } from "./sign-up-BCVi8UC9.js";
+import crypto from "crypto";
+import { models } from "@rpcbase/db";
+import { hashPasswordForStorage, sendEmail } from "@rpcbase/server";
+//#region src/api/sign-up/handler.ts
+var signUp = async (payload, ctx) => {
+	const User = await models.getGlobal("RBUser", ctx);
+	const Tenant = await models.getGlobal("RBTenant", ctx);
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const { email, password, rememberMe: _rememberMe } = parsed.data;
+	if (await User.findOne({ email })) {
+		console.log("user with email already exists", email);
+		ctx.res.status(409);
+		return {
+			success: false,
+			error: "user_exists"
+		};
+	}
+	const hashedPassword = await hashPasswordForStorage(password);
+	const tenantId = crypto.randomUUID();
+	const emailVerificationCode = crypto.randomInt(0, 1e6).toString().padStart(6, "0");
+	const emailVerificationExpiresAt = new Date(Date.now() + 600 * 1e3);
+	const user = new User({
+		email,
+		password: hashedPassword,
+		tenants: [tenantId],
+		tenantRoles: { [tenantId]: ["owner"] },
+		emailVerificationCode,
+		emailVerificationExpiresAt
+	});
+	await user.save();
+	try {
+		await sendEmail({
+			to: email,
+			subject: `Verify your email: ${emailVerificationCode}`,
+			html: `
+        <p>Welcome to rpcbase!</p>
+        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>
+        <p>If you didn't request this, you can ignore this message.</p>
+      `,
+			text: `Welcome to rpcbase! Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`
+		});
+	} catch (err) {
+		console.error("failed to send sign-up email", err);
+		try {
+			await User.deleteOne({ _id: user._id });
+		} catch (rollbackErr) {
+			console.error("failed to roll back user after sign-up email failure", rollbackErr);
+		}
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "email_delivery_failed"
+		};
+	}
+	try {
+		await Tenant.create({
+			tenantId,
+			name: email
+		});
+	} catch (err) {
+		console.warn("failed to create tenant for user", err);
+	}
+	console.log("created new user", user._id.toString());
+	return {
+		success: true,
+		userId: user._id.toString(),
+		tenantId
+	};
+};
+var handler_default = (api) => {
+	api.post(Route, signUp);
+};
+//#endregion
+export { handler_default as default, signUp };
+
+//# sourceMappingURL=handler-0nKR-P5B.js.map

package/dist/handler-0nKR-P5B.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-0nKR-P5B.js","names":["crypto","Api","Ctx","ApiHandler","models","hashPasswordForStorage","sendEmail","AuthSessionUser","SignUp","signUp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","Tenant","parsed","requestSchema","safeParse","success","res","status","error","email","password","rememberMe","_rememberMe","data","existingUser","findOne","console","log","hashedPassword","tenantId","randomUUID","emailVerificationCode","randomInt","toString","padStart","emailVerificationExpiresAt","Date","now","user","tenants","tenantRoles","save","to","subject","html","text","err","deleteOne","_id","rollbackErr","create","name","warn","userId","api","post","Route"],"sources":["../src/api/sign-up/handler.ts"],"sourcesContent":["import crypto from \"crypto\"\n\nimport { Api, Ctx, ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage, sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SignUp from \"./index\"\n\n\nexport const signUp: ApiHandler<SignUp.RequestPayload, SignUp.ResponsePayload, AuthSessionUser> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SignUp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const Tenant = await models.getGlobal(\"RBTenant\", ctx)\n\n  const parsed = SignUp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  const { email, password, rememberMe: _rememberMe } = parsed.data\n\n  const existingUser = await User.findOne({ email })\n\n  if (existingUser) {\n    console.log(\"user with email already exists\", email)\n    // For security, we don't want to reveal if an email is registered.\n    // But for this implementation, we'll make it simple.\n    ctx.res.status(409)\n    return { success: false, error: \"user_exists\" }\n  }\n\n  const hashedPassword = await hashPasswordForStorage(password)\n\n  const tenantId = crypto.randomUUID()\n\n  const emailVerificationCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1000)\n\n  const user = new User({\n    email,\n    password: hashedPassword,\n    tenants: [tenantId],\n    tenantRoles: {\n      [tenantId]: [\"owner\"],\n    },\n    emailVerificationCode,\n    emailVerificationExpiresAt,\n  })\n  await user.save()\n\n  try {\n    await sendEmail({\n      to: email,\n      subject: `Verify your email: ${emailVerificationCode}`,\n      html: `\n        <p>Welcome to rpcbase!</p>\n        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Welcome to rpcbase! Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to send sign-up email\", err)\n\n    try {\n      await User.deleteOne({ _id: user._id })\n    } catch (rollbackErr) {\n      console.error(\"failed to roll back user after sign-up email failure\", rollbackErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  try {\n    await Tenant.create({\n      tenantId,\n      name: email,\n    })\n  } catch (err) {\n    // best-effort tenant creation; log and continue\n    console.warn(\"failed to create tenant for user\", err)\n  }\n\n  console.log(\"created new user\", user._id.toString())\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SignUp.Route, signUp)\n}\n"],"mappings":";;;;;AAWA,IAAaS,SAAqF,OAChGG,SACAC,QACoC;CACpC,MAAME,OAAO,MAAMX,OAAOY,UAAU,UAAUH,GAAG;CACjD,MAAMI,SAAS,MAAMb,OAAOY,UAAU,YAAYH,GAAG;CAErD,MAAMK,SAAAA,cAA8BE,UAAUR,OAAO;CAErD,IAAI,CAACM,OAAOG,SAAS;EACnBR,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAGA,MAAM,EAAEC,OAAOC,UAAUC,YAAYC,gBAAgBV,OAAOW;CAI5D,IAAIC,MAFuBf,KAAKgB,QAAQ,EAAEN,MAAM,CAAC,GAE/B;EAChBO,QAAQC,IAAI,kCAAkCR,KAAK;EAGnDZ,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAc;CAChD;CAEA,MAAMU,iBAAiB,MAAM7B,uBAAuBqB,QAAQ;CAE5D,MAAMS,WAAWnC,OAAOoC,WAAW;CAEnC,MAAMC,wBAAwBrC,OAAOsC,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACvF,MAAMC,6BAA6B,IAAIC,KAAKA,KAAKC,IAAI,IAAI,MAAU,GAAI;CAEvE,MAAMC,OAAO,IAAI7B,KAAK;EACpBU;EACAC,UAAUQ;EACVW,SAAS,CAACV,QAAQ;EAClBW,aAAa,GACVX,WAAW,CAAC,OAAO,EACtB;EACAE;EACAI;CACF,CAAC;CACD,MAAMG,KAAKG,KAAK;CAEhB,IAAI;EACF,MAAMzC,UAAU;GACd0C,IAAIvB;GACJwB,SAAS,sBAAsBZ;GAC/Ba,MAAM;;+CAEmCb,sBAAqB;;;GAG9Dc,MAAM,iDAAiDd,sBAAqB;EAC9E,CAAC;CACH,SAASe,KAAK;EACZpB,QAAQR,MAAM,gCAAgC4B,GAAG;EAEjD,IAAI;GACF,MAAMrC,KAAKsC,UAAU,EAAEC,KAAKV,KAAKU,IAAI,CAAC;EACxC,SAASC,aAAa;GACpBvB,QAAQR,MAAM,wDAAwD+B,WAAW;EACnF;EAEA1C,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,IAAI;EACF,MAAMP,OAAOuC,OAAO;GAClBrB;GACAsB,MAAMhC;EACR,CAAC;CACH,SAAS2B,KAAK;EAEZpB,QAAQ0B,KAAK,oCAAoCN,GAAG;CACtD;CAEApB,QAAQC,IAAI,oBAAoBW,KAAKU,IAAIf,SAAS,CAAC;CAEnD,OAAO;EAAElB,SAAS;EAAMsC,QAAQf,KAAKU,IAAIf,SAAS;EAAGJ;CAAS;AAChE;AAEA,IAAA,mBAAgByB,QAA8B;CAC5CA,IAAIC,KAAKrD,OAAcC,MAAM;AAC/B"}

package/dist/handler-B8jPw9zh.js

@@ -0,0 +1,74 @@
+import { n as requestSchema, t as Route } from "./sign-in-BG2ND3cO.js";
+import { n as completeAuthSignIn } from "./session-BQ06Yo3C.js";
+import { models } from "@rpcbase/db";
+import { verifyPasswordFromStorage } from "@rpcbase/server";
+//#region src/api/sign-in/handler.ts
+var signIn = async (payload, ctx) => {
+	const User = await models.getGlobal("RBUser", ctx);
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const { email, password } = parsed.data;
+	const user = await User.findOne({ email }, {
+		password: 1,
+		tenants: 1,
+		tenantRoles: 1
+	});
+	if (!user?.password) {
+		ctx.res.status(401);
+		return {
+			success: false,
+			error: "invalid_credentials"
+		};
+	}
+	const stored = String(user.password);
+	if (!await verifyPasswordFromStorage(password, stored)) {
+		if (!stored.startsWith("$scrypt$")) console.warn("auth::sign-in invalid stored password format", user._id.toString());
+		ctx.res.status(401);
+		return {
+			success: false,
+			error: "invalid_credentials"
+		};
+	}
+	const signedInTenants = (user.tenants || []).map(String);
+	const defaultTenantId = signedInTenants[0];
+	if (!defaultTenantId) {
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "tenant_unavailable"
+		};
+	}
+	const tenantId = defaultTenantId;
+	const tenantRolesMap = user.get("tenantRoles");
+	const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : void 0;
+	if (!completeAuthSignIn(ctx, {
+		userId: user._id.toString(),
+		currentTenantId: tenantId,
+		signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],
+		tenantRoles
+	})) {
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "session_unavailable"
+		};
+	}
+	return {
+		success: true,
+		userId: user._id.toString(),
+		tenantId
+	};
+};
+var handler_default = (api) => {
+	api.post(Route, signIn);
+};
+//#endregion
+export { handler_default as default };
+
+//# sourceMappingURL=handler-B8jPw9zh.js.map

package/dist/handler-B8jPw9zh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-B8jPw9zh.js","names":["Api","ApiHandler","Ctx","models","verifyPasswordFromStorage","completeAuthSignIn","AuthSessionUser","SignIn","signIn","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","password","data","user","findOne","tenants","tenantRoles","stored","String","passwordMatches","startsWith","console","warn","_id","toString","signedInTenants","map","defaultTenantId","tenantId","tenantRolesMap","get","Map","Object","fromEntries","entries","undefined","userId","currentTenantId","length","api","post","Route"],"sources":["../src/api/sign-in/handler.ts"],"sourcesContent":["import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { verifyPasswordFromStorage } from \"@rpcbase/server\"\n\nimport { completeAuthSignIn } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SignIn from \"./index\"\n\n\nconst signIn: ApiHandler<SignIn.RequestPayload, SignIn.ResponsePayload, AuthSessionUser> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SignIn.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = SignIn.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, password } = parsed.data\n\n  const user = await User.findOne({ email }, { password: 1, tenants: 1, tenantRoles: 1 })\n\n  if (!user?.password) {\n    ctx.res.status(401)\n    return { success: false, error: \"invalid_credentials\" }\n  }\n\n  const stored = String(user.password)\n  const passwordMatches = await verifyPasswordFromStorage(password, stored)\n\n  if (!passwordMatches) {\n    if (!stored.startsWith(\"$scrypt$\")) {\n      console.warn(\"auth::sign-in invalid stored password format\", user._id.toString())\n    }\n    ctx.res.status(401)\n    return { success: false, error: \"invalid_credentials\" }\n  }\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const defaultTenantId = signedInTenants[0]\n  if (!defaultTenantId) {\n    ctx.res.status(500)\n    return { success: false, error: \"tenant_unavailable\" }\n  }\n  const tenantId = defaultTenantId\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    ctx.res.status(500)\n    return { success: false, error: \"session_unavailable\" }\n  }\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SignIn.Route, signIn)\n}\n"],"mappings":";;;;;AAUA,IAAMQ,SAAqF,OACzFG,SACAC,QACoC;CACpC,MAAME,OAAO,MAAMX,OAAOY,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAA8BE,UAAUP,OAAO;CAErD,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,aAAaR,OAAOS;CAEnC,MAAMC,OAAO,MAAMZ,KAAKa,QAAQ,EAAEJ,MAAM,GAAG;EAAEC,UAAU;EAAGI,SAAS;EAAGC,aAAa;CAAE,CAAC;CAEtF,IAAI,CAACH,MAAMF,UAAU;EACnBZ,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,MAAMQ,SAASC,OAAOL,KAAKF,QAAQ;CAGnC,IAAI,CAACQ,MAFyB5B,0BAA0BoB,UAAUM,MAAM,GAElD;EACpB,IAAI,CAACA,OAAOG,WAAW,UAAU,GAC/BC,QAAQC,KAAK,gDAAgDT,KAAKU,IAAIC,SAAS,CAAC;EAElFzB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,MAAMgB,mBAAmBZ,KAAKE,WAAW,CAAA,EAAA,CAAIW,IAAIR,MAAM;CACvD,MAAMS,kBAAkBF,gBAAgB;CACxC,IAAI,CAACE,iBAAiB;EACpB5B,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAqB;CACvD;CACA,MAAMmB,WAAWD;CACjB,MAAME,iBAAiBhB,KAAKiB,IAAI,aAAa;CAC7C,MAAMd,cAAca,iBAAiBG,OAAOC,YAAYJ,eAAeK,QAAQ,CAAC,IAAIC,KAAAA;CAEpF,IAAI,CAAC3C,mBAAmBO,KAAK;EAC3BqC,QAAQvB,KAAKU,IAAIC,SAAS;EAC1Ba,iBAAiBT;EACjBH,iBAAiBA,gBAAgBa,SAASb,kBAAkB,CAACG,QAAQ;EACrEZ;CACF,CAAC,GAAG;EACFjB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,OAAO;EAAEH,SAAS;EAAM8B,QAAQvB,KAAKU,IAAIC,SAAS;EAAGI;CAAS;AAChE;AAEA,IAAA,mBAAgBW,QAA8B;CAC5CA,IAAIC,KAAK9C,OAAcC,MAAM;AAC/B"}

package/dist/handler-BGNM_dz1.js

@@ -0,0 +1,19 @@
+import { i as object, n as boolean } from "./schemas-BgOpQqUv.js";
+//#region src/api/sign-out/index.ts
+var Route = "/api/rb/auth/sign-out";
+object({});
+object({ success: boolean() });
+//#endregion
+//#region src/api/sign-out/handler.ts
+var handleSignOut = async (_, ctx) => {
+	if (!ctx.req.session) return { success: true };
+	await new Promise((resolve) => ctx.req.session.destroy(() => resolve()));
+	return { success: true };
+};
+var handler_default = (api) => {
+	api.post(Route, handleSignOut);
+};
+//#endregion
+export { handler_default as default };
+
+//# sourceMappingURL=handler-BGNM_dz1.js.map

package/dist/handler-BGNM_dz1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-BGNM_dz1.js","names":["z","Route","requestSchema","object","RequestPayload","infer","responseSchema","success","boolean","ResponsePayload","Api","Ctx","SignOut","handleSignOut","_","RequestPayload","ctx","Promise","ResponsePayload","req","session","success","resolve","destroy","api","post","Route"],"sources":["../src/api/sign-out/index.ts","../src/api/sign-out/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/sign-out\"\n\n// No request payload needed for signout\nexport const requestSchema = z.object({})\n\nexport type RequestPayload = z.infer<typeof requestSchema>;\n\nexport const responseSchema = z.object({\n  success: z.boolean()\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>;\n","import { Api, Ctx } from \"@rpcbase/api\"\n\nimport * as SignOut from \"./index\"\n\n\nconst handleSignOut = async(_: SignOut.RequestPayload, ctx: Ctx): Promise<SignOut.ResponsePayload> => {\n  // Destroy the session\n  if (!ctx.req.session) {\n    return { success: true }\n  }\n\n  await new Promise<void>((resolve) => ctx.req.session!.destroy(() => resolve()))\n\n  return {\n    success: true\n  }\n}\n\nexport default (api: Api) => {\n  api.post(SignOut.Route, handleSignOut)\n}\n"],"mappings":";;AAGA,IAAaC,QAAQ;AAGQD,OAAS,CAAC,CAAC;AAIVA,OAAS,EACrCO,SAASP,QAAU,EACrB,CAAC;;;ACPD,IAAMa,gBAAgB,OAAMC,GAA2BE,QAA+C;CAEpG,IAAI,CAACA,IAAIG,IAAIC,SACX,OAAO,EAAEC,SAAS,KAAK;CAGzB,MAAM,IAAIJ,SAAeK,YAAYN,IAAIG,IAAIC,QAASG,cAAcD,QAAQ,CAAC,CAAC;CAE9E,OAAO,EACLD,SAAS,KACX;AACF;AAEA,IAAA,mBAAgBG,QAAa;CAC3BA,IAAIC,KAAKb,OAAeC,aAAa;AACvC"}

package/dist/handler-BoWTfKWi.js

@@ -0,0 +1,56 @@
+import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
+import crypto from "crypto";
+import { models } from "@rpcbase/db";
+//#region src/api/verify-password-reset-otp/index.ts
+var Route = "/api/rb/auth/verify-password-reset-otp";
+var requestSchema = object({
+	email: string().email(),
+	code: string().length(6, "Code must be 6 digits")
+});
+object({
+	success: boolean(),
+	error: string().optional(),
+	resetToken: string().optional()
+});
+//#endregion
+//#region src/api/verify-password-reset-otp/handler.ts
+var verifyPasswordResetOtp = async (payload, ctx) => {
+	const User = await models.getGlobal("RBUser", ctx);
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const { email, code } = parsed.data;
+	const user = await User.findOne({ email });
+	const storedCode = user?.passwordResetCode;
+	const expiresAt = user?.passwordResetCodeExpiresAt;
+	const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now();
+	if (!user || !storedCode || storedCode !== code || isExpired) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_code"
+		};
+	}
+	const resetToken = crypto.randomBytes(24).toString("hex");
+	user.passwordResetCode = void 0;
+	user.passwordResetCodeExpiresAt = void 0;
+	user.passwordResetToken = resetToken;
+	user.passwordResetTokenExpiresAt = new Date(Date.now() + 900 * 1e3);
+	await user.save();
+	return {
+		success: true,
+		resetToken
+	};
+};
+var handler_default = (api) => {
+	api.post(Route, verifyPasswordResetOtp);
+};
+//#endregion
+export { handler_default as default };
+
+//# sourceMappingURL=handler-BoWTfKWi.js.map

package/dist/handler-BoWTfKWi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-BoWTfKWi.js","names":["z","Route","requestSchema","object","email","string","code","length","RequestPayload","infer","responseSchema","success","boolean","error","optional","resetToken","ResponsePayload","crypto","Api","ApiHandler","Ctx","models","AuthSessionUser","VerifyPasswordResetOtp","verifyPasswordResetOtp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","code","data","user","findOne","storedCode","passwordResetCode","expiresAt","passwordResetCodeExpiresAt","isExpired","Date","getTime","now","resetToken","randomBytes","toString","undefined","passwordResetToken","passwordResetTokenExpiresAt","save","api","post","Route"],"sources":["../src/api/verify-password-reset-otp/index.ts","../src/api/verify-password-reset-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/verify-password-reset-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n  code: z.string().length(6, \"Code must be 6 digits\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  resetToken: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as VerifyPasswordResetOtp from \"./index\"\n\n\nconst verifyPasswordResetOtp: ApiHandler<\n  VerifyPasswordResetOtp.RequestPayload,\n  VerifyPasswordResetOtp.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<VerifyPasswordResetOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = VerifyPasswordResetOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, code } = parsed.data\n  const user = await User.findOne({ email })\n\n  const storedCode = user?.passwordResetCode\n  const expiresAt = user?.passwordResetCodeExpiresAt\n  const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now()\n\n  if (!user || !storedCode || storedCode !== code || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_code\" }\n  }\n\n  const resetToken = crypto.randomBytes(24).toString(\"hex\")\n\n  user.passwordResetCode = undefined\n  user.passwordResetCodeExpiresAt = undefined\n  user.passwordResetToken = resetToken\n  user.passwordResetTokenExpiresAt = new Date(Date.now() + 15 * 60 * 1000)\n  await user.save()\n\n  return { success: true, resetToken }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(VerifyPasswordResetOtp.Route, verifyPasswordResetOtp)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM;CACxBE,MAAMN,OAAS,CAAC,CAACO,OAAO,GAAG,uBAAuB;AACpD,CAAC;AAI6BP,OAAS;CACrCW,SAASX,QAAU;CACnBa,OAAOb,OAAS,CAAC,CAACc,SAAS;CAC3BC,YAAYf,OAAS,CAAC,CAACc,SAAS;AAClC,CAAC;;;ACND,IAAMU,yBAIF,OACFG,SACAC,QACoD;CACpD,MAAME,OAAO,MAAMT,OAAOU,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAA8CE,UAAUP,OAAO;CAErE,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,SAASR,OAAOS;CAC/B,MAAMC,OAAO,MAAMZ,KAAKa,QAAQ,EAAEJ,MAAM,CAAC;CAEzC,MAAMK,aAAaF,MAAMG;CACzB,MAAMC,YAAYJ,MAAMK;CACxB,MAAMC,YAAYF,qBAAqBG,QAAQH,UAAUI,QAAQ,IAAID,KAAKE,IAAI;CAE9E,IAAI,CAACT,QAAQ,CAACE,cAAcA,eAAeJ,QAAQQ,WAAW;EAC5DpB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAe;CACjD;CAEA,MAAMc,aAAanC,OAAOoC,YAAY,EAAE,CAAC,CAACC,SAAS,KAAK;CAExDZ,KAAKG,oBAAoBU,KAAAA;CACzBb,KAAKK,6BAA6BQ,KAAAA;CAClCb,KAAKc,qBAAqBJ;CAC1BV,KAAKe,8BAA8B,IAAIR,KAAKA,KAAKE,IAAI,IAAI,MAAU,GAAI;CACvE,MAAMT,KAAKgB,KAAK;CAEhB,OAAO;EAAEvB,SAAS;EAAMiB;CAAW;AACrC;AAEA,IAAA,mBAAgBO,QAA8B;CAC5CA,IAAIC,KAAKrC,OAA8BC,sBAAsB;AAC/D"}

package/dist/handler-ClyVm_Us.js

@@ -0,0 +1,92 @@
+import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
+import { n as completeAuthSignIn } from "./session-BQ06Yo3C.js";
+import { models } from "@rpcbase/db";
+//#region src/api/verify-otp/index.ts
+var Route = "/api/rb/auth/verify-otp";
+var requestSchema = object({
+	email: string().email(),
+	code: string().length(6, "Code must be 6 digits"),
+	rememberMe: boolean().default(true)
+});
+object({
+	success: boolean(),
+	error: string().optional(),
+	userId: string().optional(),
+	tenantId: string().optional()
+});
+//#endregion
+//#region src/api/verify-otp/handler.ts
+var verifyOtp = async (payload, ctx) => {
+	const User = await models.getGlobal("RBUser", ctx);
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const { email, code } = parsed.data;
+	const user = await User.findOne({ email }, {
+		emailVerificationCode: 1,
+		emailVerificationExpiresAt: 1,
+		tenants: 1,
+		tenantRoles: 1
+	});
+	if (!user) {
+		ctx.res.status(404);
+		return {
+			success: false,
+			error: "user_not_found"
+		};
+	}
+	const storedCode = user.emailVerificationCode;
+	const expiresAt = user.emailVerificationExpiresAt;
+	const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now();
+	if (!storedCode || storedCode !== code || isExpired) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_code"
+		};
+	}
+	user.emailVerificationCode = void 0;
+	user.emailVerificationExpiresAt = void 0;
+	await user.save();
+	const signedInTenants = (user.tenants || []).map(String);
+	const defaultTenantId = signedInTenants[0];
+	if (!defaultTenantId) {
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "tenant_unavailable"
+		};
+	}
+	const tenantId = defaultTenantId;
+	const tenantRolesMap = user.get("tenantRoles");
+	const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : void 0;
+	if (!completeAuthSignIn(ctx, {
+		userId: user._id.toString(),
+		currentTenantId: tenantId,
+		signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],
+		tenantRoles
+	})) {
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "session_unavailable"
+		};
+	}
+	return {
+		success: true,
+		userId: user._id.toString(),
+		tenantId
+	};
+};
+var handler_default = (api) => {
+	api.post(Route, verifyOtp);
+};
+//#endregion
+export { handler_default as default };
+
+//# sourceMappingURL=handler-ClyVm_Us.js.map

package/dist/handler-ClyVm_Us.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-ClyVm_Us.js","names":["z","Route","requestSchema","object","email","string","code","length","rememberMe","boolean","default","RequestPayload","infer","responseSchema","success","error","optional","userId","tenantId","ResponsePayload","Api","ApiHandler","Ctx","models","completeAuthSignIn","AuthSessionUser","VerifyOtp","verifyOtp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","code","data","user","findOne","emailVerificationCode","emailVerificationExpiresAt","tenants","tenantRoles","storedCode","expiresAt","isExpired","Date","getTime","now","undefined","save","signedInTenants","map","String","defaultTenantId","tenantId","tenantRolesMap","get","Map","Object","fromEntries","entries","userId","_id","toString","currentTenantId","length","api","post","Route"],"sources":["../src/api/verify-otp/index.ts","../src/api/verify-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/verify-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n  code: z.string().length(6, \"Code must be 6 digits\"),\n  rememberMe: z.boolean().default(true),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  userId: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport { completeAuthSignIn } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as VerifyOtp from \"./index\"\n\n\nconst verifyOtp: ApiHandler<VerifyOtp.RequestPayload, VerifyOtp.ResponsePayload, AuthSessionUser> = async (\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<VerifyOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = VerifyOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, code } = parsed.data\n\n  const user = await User.findOne({ email }, { emailVerificationCode: 1, emailVerificationExpiresAt: 1, tenants: 1, tenantRoles: 1 })\n\n  if (!user) {\n    ctx.res.status(404)\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  const storedCode = user.emailVerificationCode\n  const expiresAt = user.emailVerificationExpiresAt\n\n  const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now()\n  if (!storedCode || storedCode !== code || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_code\" }\n  }\n\n  user.emailVerificationCode = undefined\n  user.emailVerificationExpiresAt = undefined\n  await user.save()\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const defaultTenantId = signedInTenants[0]\n  if (!defaultTenantId) {\n    ctx.res.status(500)\n    return { success: false, error: \"tenant_unavailable\" }\n  }\n  const tenantId = defaultTenantId\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    ctx.res.status(500)\n    return { success: false, error: \"session_unavailable\" }\n  }\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(VerifyOtp.Route, verifyOtp)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM;CACxBE,MAAMN,OAAS,CAAC,CAACO,OAAO,GAAG,uBAAuB;CAClDC,YAAYR,QAAU,CAAC,CAACU,QAAQ,IAAI;AACtC,CAAC;AAI6BV,OAAS;CACrCc,SAASd,QAAU;CACnBe,OAAOf,OAAS,CAAC,CAACgB,SAAS;CAC3BC,QAAQjB,OAAS,CAAC,CAACgB,SAAS;CAC5BE,UAAUlB,OAAS,CAAC,CAACgB,SAAS;AAChC,CAAC;;;ACTD,IAAMW,YAA8F,OAClGG,SACAC,QACuC;CACvC,MAAME,OAAO,MAAMV,OAAOW,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAAiCE,UAAUP,OAAO;CAExD,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,SAASR,OAAOS;CAE/B,MAAMC,OAAO,MAAMZ,KAAKa,QAAQ,EAAEJ,MAAM,GAAG;EAAEK,uBAAuB;EAAGC,4BAA4B;EAAGC,SAAS;EAAGC,aAAa;CAAE,CAAC;CAElI,IAAI,CAACL,MAAM;EACTd,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAiB;CACnD;CAEA,MAAMU,aAAaN,KAAKE;CACxB,MAAMK,YAAYP,KAAKG;CAEvB,MAAMK,YAAYD,qBAAqBE,QAAQF,UAAUG,QAAQ,IAAID,KAAKE,IAAI;CAC9E,IAAI,CAACL,cAAcA,eAAeR,QAAQU,WAAW;EACnDtB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAe;CACjD;CAEAI,KAAKE,wBAAwBU,KAAAA;CAC7BZ,KAAKG,6BAA6BS,KAAAA;CAClC,MAAMZ,KAAKa,KAAK;CAEhB,MAAMC,mBAAmBd,KAAKI,WAAW,CAAA,EAAA,CAAIW,IAAIC,MAAM;CACvD,MAAMC,kBAAkBH,gBAAgB;CACxC,IAAI,CAACG,iBAAiB;EACpB/B,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAqB;CACvD;CACA,MAAMsB,WAAWD;CACjB,MAAME,iBAAiBnB,KAAKoB,IAAI,aAAa;CAC7C,MAAMf,cAAcc,iBAAiBG,OAAOC,YAAYJ,eAAeK,QAAQ,CAAC,IAAIZ,KAAAA;CAEpF,IAAI,CAACjC,mBAAmBO,KAAK;EAC3BuC,QAAQzB,KAAK0B,IAAIC,SAAS;EAC1BC,iBAAiBV;EACjBJ,iBAAiBA,gBAAgBe,SAASf,kBAAkB,CAACI,QAAQ;EACrEb;CACF,CAAC,GAAG;EACFnB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,OAAO;EAAEH,SAAS;EAAMgC,QAAQzB,KAAK0B,IAAIC,SAAS;EAAGT;CAAS;AAChE;AAEA,IAAA,mBAAgBY,QAA8B;CAC5CA,IAAIC,KAAKlD,OAAiBC,SAAS;AACrC"}

package/dist/handler-DNxEmrtP.js

@@ -0,0 +1,67 @@
+import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
+import { r as restrictSessionMiddleware } from "./middleware-BT3Uput1.js";
+import { t as AUTHENTICATED_TENANT_ID_HEADER } from "./session-BQ06Yo3C.js";
+//#region src/api/set-active-account/index.ts
+var Route = "/api/rb/auth/set-active-account";
+var requestSchema = object({ tenantId: string().min(1, "Tenant is required") });
+object({
+	success: boolean(),
+	error: string().optional(),
+	tenantId: string().optional()
+});
+//#endregion
+//#region src/api/set-active-account/handler.ts
+var setActiveAccount = async (payload, ctx) => {
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const sessionUser = ctx.req.session?.user;
+	if (!sessionUser?.id) {
+		ctx.res.status(401);
+		return {
+			success: false,
+			error: "unauthorized"
+		};
+	}
+	const tenantId = parsed.data.tenantId.trim();
+	const signedInTenants = Array.isArray(sessionUser.signedInTenants) ? sessionUser.signedInTenants.map(String) : [];
+	if (signedInTenants.length > 0 && !signedInTenants.includes(tenantId)) {
+		ctx.res.status(403);
+		return {
+			success: false,
+			error: "invalid_account"
+		};
+	}
+	if (signedInTenants.length === 0) {
+		const currentTenantId = typeof sessionUser.currentTenantId === "string" ? sessionUser.currentTenantId.trim() : "";
+		if (!currentTenantId || currentTenantId !== tenantId) {
+			ctx.res.status(403);
+			return {
+				success: false,
+				error: "invalid_account"
+			};
+		}
+	}
+	ctx.req.session.user = {
+		...sessionUser,
+		currentTenantId: tenantId
+	};
+	ctx.res.setHeader(AUTHENTICATED_TENANT_ID_HEADER, tenantId);
+	return {
+		success: true,
+		tenantId
+	};
+};
+var handler_default = (api) => {
+	api.use(Route, restrictSessionMiddleware);
+	api.post(Route, setActiveAccount);
+};
+//#endregion
+export { handler_default as default };
+
+//# sourceMappingURL=handler-DNxEmrtP.js.map

package/dist/{handler-B_lItxOC.js.map → handler-DNxEmrtP.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-B_lItxOC.js","sources":["../src/api/set-active-account/index.ts","../src/api/set-active-account/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/set-active-account\"\n\nexport const requestSchema = z.object({\n  tenantId: z.string().min(1, \"Tenant is required\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\n\nimport { restrictSessionMiddleware } from \"../../middleware\"\nimport { AUTHENTICATED_TENANT_ID_HEADER } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetActiveAccount from \"./index\"\n\n\nconst setActiveAccount: ApiHandler<\n  SetActiveAccount.RequestPayload,\n  SetActiveAccount.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetActiveAccount.ResponsePayload> => {\n  const parsed = SetActiveAccount.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const sessionUser = ctx.req.session?.user\n  if (!sessionUser?.id) {\n    ctx.res.status(401)\n    return { success: false, error: \"unauthorized\" }\n  }\n\n  const tenantId = parsed.data.tenantId.trim()\n  const signedInTenants = Array.isArray(sessionUser.signedInTenants)\n    ? sessionUser.signedInTenants.map(String)\n    : []\n\n  if (signedInTenants.length > 0 && !signedInTenants.includes(tenantId)) {\n    ctx.res.status(403)\n    return { success: false, error: \"invalid_account\" }\n  }\n\n  if (signedInTenants.length === 0) {\n    const currentTenantId = typeof sessionUser.currentTenantId === \"string\" ? sessionUser.currentTenantId.trim() : \"\"\n    if (!currentTenantId || currentTenantId !== tenantId) {\n      ctx.res.status(403)\n      return { success: false, error: \"invalid_account\" }\n    }\n  }\n\n  ctx.req.session.user = {\n    ...sessionUser,\n    currentTenantId: tenantId,\n  }\n  ctx.res.setHeader(AUTHENTICATED_TENANT_ID_HEADER, tenantId)\n\n  return { success: true, tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.use(SetActiveAccount.Route, restrictSessionMiddleware)\n  api.post(SetActiveAccount.Route, setActiveAccount)\n}\n"],"names":["Route","requestSchema","z","tenantId","string","min","success","boolean","error","optional","setActiveAccount","payload","ctx","parsed","SetActiveAccount","safeParse","res","status","sessionUser","req","session","user","id","data","trim","signedInTenants","Array","isArray","map","String","length","includes","currentTenantId","setHeader","AUTHENTICATED_TENANT_ID_HEADER","api","use","restrictSessionMiddleware","post"],"mappings":";;;AAGO,MAAMA,QAAQ;AAEd,MAAMC,gBAAgBC,OAAS;AAAA,EACpCC,UAAUD,OAAEE,EAASC,IAAI,GAAG,oBAAoB;AAClD,CAAC;AAI6BH,OAAS;AAAA,EACrCI,SAASJ,QAAEK;AAAAA,EACXC,OAAON,OAAEE,EAASK,SAAAA;AAAAA,EAClBN,UAAUD,OAAEE,EAASK,SAAAA;AACvB,CAAC;ACND,MAAMC,mBAIF,OACFC,SACAC,QAC8C;AAC9C,QAAMC,SAASC,cAA+BC,UAAUJ,OAAO;AAE/D,MAAI,CAACE,OAAOP,SAAS;AACnBM,QAAII,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEX,SAAS;AAAA,MAAOE,OAAO;AAAA,IAAA;AAAA,EAClC;AAEA,QAAMU,cAAcN,IAAIO,IAAIC,SAASC;AACrC,MAAI,CAACH,aAAaI,IAAI;AACpBV,QAAII,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEX,SAAS;AAAA,MAAOE,OAAO;AAAA,IAAA;AAAA,EAClC;AAEA,QAAML,WAAWU,OAAOU,KAAKpB,SAASqB,KAAAA;AACtC,QAAMC,kBAAkBC,MAAMC,QAAQT,YAAYO,eAAe,IAC7DP,YAAYO,gBAAgBG,IAAIC,MAAM,IACtC,CAAA;AAEJ,MAAIJ,gBAAgBK,SAAS,KAAK,CAACL,gBAAgBM,SAAS5B,QAAQ,GAAG;AACrES,QAAII,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEX,SAAS;AAAA,MAAOE,OAAO;AAAA,IAAA;AAAA,EAClC;AAEA,MAAIiB,gBAAgBK,WAAW,GAAG;AAChC,UAAME,kBAAkB,OAAOd,YAAYc,oBAAoB,WAAWd,YAAYc,gBAAgBR,SAAS;AAC/G,QAAI,CAACQ,mBAAmBA,oBAAoB7B,UAAU;AACpDS,UAAII,IAAIC,OAAO,GAAG;AAClB,aAAO;AAAA,QAAEX,SAAS;AAAA,QAAOE,OAAO;AAAA,MAAA;AAAA,IAClC;AAAA,EACF;AAEAI,MAAIO,IAAIC,QAAQC,OAAO;AAAA,IACrB,GAAGH;AAAAA,IACHc,iBAAiB7B;AAAAA,EAAAA;AAEnBS,MAAII,IAAIiB,UAAUC,gCAAgC/B,QAAQ;AAE1D,SAAO;AAAA,IAAEG,SAAS;AAAA,IAAMH;AAAAA,EAAAA;AAC1B;AAEA,MAAA,UAAe,CAACgC,QAA8B;AAC5CA,MAAIC,IAAItB,OAAwBuB,yBAAyB;AACzDF,MAAIG,KAAKxB,OAAwBJ,gBAAgB;AACnD;"}
+{"version":3,"file":"handler-DNxEmrtP.js","names":["z","Route","requestSchema","object","tenantId","string","min","RequestPayload","infer","responseSchema","success","boolean","error","optional","ResponsePayload","Api","ApiHandler","Ctx","restrictSessionMiddleware","AUTHENTICATED_TENANT_ID_HEADER","AuthSessionUser","SetActiveAccount","setActiveAccount","RequestPayload","ResponsePayload","payload","ctx","Promise","parsed","requestSchema","safeParse","success","res","status","error","sessionUser","req","session","user","id","tenantId","data","trim","signedInTenants","Array","isArray","map","String","length","includes","currentTenantId","setHeader","api","use","Route","post"],"sources":["../src/api/set-active-account/index.ts","../src/api/set-active-account/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/set-active-account\"\n\nexport const requestSchema = z.object({\n  tenantId: z.string().min(1, \"Tenant is required\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\n\nimport { restrictSessionMiddleware } from \"../../middleware\"\nimport { AUTHENTICATED_TENANT_ID_HEADER } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetActiveAccount from \"./index\"\n\n\nconst setActiveAccount: ApiHandler<\n  SetActiveAccount.RequestPayload,\n  SetActiveAccount.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetActiveAccount.ResponsePayload> => {\n  const parsed = SetActiveAccount.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const sessionUser = ctx.req.session?.user\n  if (!sessionUser?.id) {\n    ctx.res.status(401)\n    return { success: false, error: \"unauthorized\" }\n  }\n\n  const tenantId = parsed.data.tenantId.trim()\n  const signedInTenants = Array.isArray(sessionUser.signedInTenants)\n    ? sessionUser.signedInTenants.map(String)\n    : []\n\n  if (signedInTenants.length > 0 && !signedInTenants.includes(tenantId)) {\n    ctx.res.status(403)\n    return { success: false, error: \"invalid_account\" }\n  }\n\n  if (signedInTenants.length === 0) {\n    const currentTenantId = typeof sessionUser.currentTenantId === \"string\" ? sessionUser.currentTenantId.trim() : \"\"\n    if (!currentTenantId || currentTenantId !== tenantId) {\n      ctx.res.status(403)\n      return { success: false, error: \"invalid_account\" }\n    }\n  }\n\n  ctx.req.session.user = {\n    ...sessionUser,\n    currentTenantId: tenantId,\n  }\n  ctx.res.setHeader(AUTHENTICATED_TENANT_ID_HEADER, tenantId)\n\n  return { success: true, tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.use(SetActiveAccount.Route, restrictSessionMiddleware)\n  api.post(SetActiveAccount.Route, setActiveAccount)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS,EACpCI,UAAUJ,OAAS,CAAC,CAACM,IAAI,GAAG,oBAAoB,EAClD,CAAC;AAI6BN,OAAS;CACrCU,SAASV,QAAU;CACnBY,OAAOZ,OAAS,CAAC,CAACa,SAAS;CAC3BT,UAAUJ,OAAS,CAAC,CAACa,SAAS;AAChC,CAAC;;;ACND,IAAMS,mBAIF,OACFG,SACAC,QAC8C;CAC9C,MAAME,SAAAA,cAAwCE,UAAUL,OAAO;CAE/D,IAAI,CAACG,OAAOG,SAAS;EACnBL,IAAIM,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAMC,cAAcT,IAAIU,IAAIC,SAASC;CACrC,IAAI,CAACH,aAAaI,IAAI;EACpBb,IAAIM,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAe;CACjD;CAEA,MAAMM,WAAWZ,OAAOa,KAAKD,SAASE,KAAK;CAC3C,MAAMC,kBAAkBC,MAAMC,QAAQV,YAAYQ,eAAe,IAC7DR,YAAYQ,gBAAgBG,IAAIC,MAAM,IACtC,CAAA;CAEJ,IAAIJ,gBAAgBK,SAAS,KAAK,CAACL,gBAAgBM,SAAST,QAAQ,GAAG;EACrEd,IAAIM,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,IAAIS,gBAAgBK,WAAW,GAAG;EAChC,MAAME,kBAAkB,OAAOf,YAAYe,oBAAoB,WAAWf,YAAYe,gBAAgBR,KAAK,IAAI;EAC/G,IAAI,CAACQ,mBAAmBA,oBAAoBV,UAAU;GACpDd,IAAIM,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEF,SAAS;IAAOG,OAAO;GAAkB;EACpD;CACF;CAEAR,IAAIU,IAAIC,QAAQC,OAAO;EACrB,GAAGH;EACHe,iBAAiBV;CACnB;CACAd,IAAIM,IAAImB,UAAUhC,gCAAgCqB,QAAQ;CAE1D,OAAO;EAAET,SAAS;EAAMS;CAAS;AACnC;AAEA,IAAA,mBAAgBY,QAA8B;CAC5CA,IAAIC,IAAIhC,OAAwBH,yBAAyB;CACzDkC,IAAIG,KAAKlC,OAAwBC,gBAAgB;AACnD"}

package/dist/handler-DsPS6JXV.js

@@ -0,0 +1,70 @@
+import { a as string, i as object, t as array } from "./schemas-BgOpQqUv.js";
+import { r as restrictSessionMiddleware } from "./middleware-BT3Uput1.js";
+import { models } from "@rpcbase/db";
+//#region src/api/me/index.ts
+var Route = "/api/rb/auth/me";
+object({});
+object({
+	id: string().optional(),
+	email: string().email().optional(),
+	phone: string().optional(),
+	name: string().optional(),
+	tenants: array(string()).default([]),
+	currentTenantId: string().optional(),
+	signedInTenants: array(string()).default([]).optional(),
+	error: string().optional()
+});
+//#endregion
+//#region src/api/me/handler.ts
+var me = async (_payload, ctx) => {
+	const sessionUser = ctx.req.session?.user;
+	if (!sessionUser?.id) {
+		ctx.res.status(401);
+		return {
+			id: "",
+			currentTenantId: "",
+			signedInTenants: [],
+			tenants: [],
+			error: "not_authenticated"
+		};
+	}
+	const user = await (await models.getGlobal("RBUser", ctx)).findById(sessionUser.id);
+	if (!user) {
+		ctx.res.status(404);
+		return {
+			id: "",
+			currentTenantId: "",
+			signedInTenants: [],
+			tenants: [],
+			error: "user_not_found"
+		};
+	}
+	const tenantId = typeof sessionUser.currentTenantId === "string" ? sessionUser.currentTenantId.trim() : "";
+	if (!tenantId) {
+		ctx.res.status(500);
+		return {
+			id: "",
+			currentTenantId: "",
+			signedInTenants: [],
+			tenants: [],
+			error: "tenant_missing"
+		};
+	}
+	return {
+		id: user._id.toString(),
+		email: user.email,
+		phone: user.get("phone"),
+		name: user.name,
+		tenants: (user.tenants || []).map(String),
+		currentTenantId: tenantId,
+		signedInTenants: sessionUser.signedInTenants || []
+	};
+};
+var handler_default = (api) => {
+	api.use(Route, restrictSessionMiddleware);
+	api.get(Route, me);
+};
+//#endregion
+export { handler_default as default };
+
+//# sourceMappingURL=handler-DsPS6JXV.js.map

package/dist/handler-DsPS6JXV.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-DsPS6JXV.js","names":["z","Route","requestSchema","object","RequestPayload","infer","responseSchema","id","string","optional","email","phone","name","tenants","array","default","currentTenantId","signedInTenants","error","ResponsePayload","Api","ApiHandler","Ctx","models","AuthSessionUser","restrictSessionMiddleware","Me","me","RequestPayload","ResponsePayload","_payload","ctx","Promise","sessionUser","req","session","user","id","res","status","currentTenantId","signedInTenants","tenants","error","User","getGlobal","findById","tenantId","trim","_id","toString","email","phone","get","name","map","String","api","use","Route"],"sources":["../src/api/me/index.ts","../src/api/me/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/me\"\n\nexport const requestSchema = z.object({})\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  id: z.string().optional(),\n  email: z.string().email().optional(),\n  phone: z.string().optional(),\n  name: z.string().optional(),\n  tenants: z.array(z.string()).default([]),\n  currentTenantId: z.string().optional(),\n  signedInTenants: z.array(z.string()).default([]).optional(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport type { AuthSessionUser } from \"../../types\"\nimport { restrictSessionMiddleware } from \"../../middleware\"\n\nimport * as Me from \"./index\"\n\n\nconst me: ApiHandler<Me.RequestPayload, Me.ResponsePayload, AuthSessionUser> = async(\n  _payload: Me.RequestPayload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<Me.ResponsePayload> => {\n  const sessionUser = ctx.req.session?.user\n\n  if (!sessionUser?.id) {\n    ctx.res.status(401)\n    return {\n      id: \"\",\n      currentTenantId: \"\",\n      signedInTenants: [],\n      tenants: [],\n      error: \"not_authenticated\",\n    } as unknown as Me.ResponsePayload\n  }\n\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const user = await User.findById(sessionUser.id)\n\n  if (!user) {\n    ctx.res.status(404)\n    return {\n      id: \"\",\n      currentTenantId: \"\",\n      signedInTenants: [],\n      tenants: [],\n      error: \"user_not_found\",\n    } as unknown as Me.ResponsePayload\n  }\n\n  const tenantId = typeof sessionUser.currentTenantId === \"string\" ? sessionUser.currentTenantId.trim() : \"\"\n  if (!tenantId) {\n    ctx.res.status(500)\n    return {\n      id: \"\",\n      currentTenantId: \"\",\n      signedInTenants: [],\n      tenants: [],\n      error: \"tenant_missing\",\n    } as unknown as Me.ResponsePayload\n  }\n\n  return {\n    id: user._id.toString(),\n    email: user.email,\n    phone: user.get(\"phone\") as string | undefined,\n    name: user.name,\n    tenants: (user.tenants || []).map(String),\n    currentTenantId: tenantId,\n    signedInTenants: sessionUser.signedInTenants || [],\n  }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.use(Me.Route, restrictSessionMiddleware)\n  api.get(Me.Route, me)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAEQD,OAAS,CAAC,CAAC;AAGVA,OAAS;CACrCO,IAAIP,OAAS,CAAC,CAACS,SAAS;CACxBC,OAAOV,OAAS,CAAC,CAACU,MAAM,CAAC,CAACD,SAAS;CACnCE,OAAOX,OAAS,CAAC,CAACS,SAAS;CAC3BG,MAAMZ,OAAS,CAAC,CAACS,SAAS;CAC1BI,SAASb,MAAQA,OAAS,CAAC,CAAC,CAACe,QAAQ,CAAA,CAAE;CACvCC,iBAAiBhB,OAAS,CAAC,CAACS,SAAS;CACrCQ,iBAAiBjB,MAAQA,OAAS,CAAC,CAAC,CAACe,QAAQ,CAAA,CAAE,CAAC,CAACN,SAAS;CAC1DS,OAAOlB,OAAS,CAAC,CAACS,SAAS;AAC7B,CAAC;;;ACRD,IAAMkB,KAAyE,OAC7EG,UACAC,QACgC;CAChC,MAAME,cAAcF,IAAIG,IAAIC,SAASC;CAErC,IAAI,CAACH,aAAaI,IAAI;EACpBN,IAAIO,IAAIC,OAAO,GAAG;EAClB,OAAO;GACLF,IAAI;GACJG,iBAAiB;GACjBC,iBAAiB,CAAA;GACjBC,SAAS,CAAA;GACTC,OAAO;EACT;CACF;CAGA,MAAMP,OAAO,OAAMQ,MADArB,OAAOsB,UAAU,UAAUd,GAAG,EAAA,CACzBe,SAASb,YAAYI,EAAE;CAE/C,IAAI,CAACD,MAAM;EACTL,IAAIO,IAAIC,OAAO,GAAG;EAClB,OAAO;GACLF,IAAI;GACJG,iBAAiB;GACjBC,iBAAiB,CAAA;GACjBC,SAAS,CAAA;GACTC,OAAO;EACT;CACF;CAEA,MAAMI,WAAW,OAAOd,YAAYO,oBAAoB,WAAWP,YAAYO,gBAAgBQ,KAAK,IAAI;CACxG,IAAI,CAACD,UAAU;EACbhB,IAAIO,IAAIC,OAAO,GAAG;EAClB,OAAO;GACLF,IAAI;GACJG,iBAAiB;GACjBC,iBAAiB,CAAA;GACjBC,SAAS,CAAA;GACTC,OAAO;EACT;CACF;CAEA,OAAO;EACLN,IAAID,KAAKa,IAAIC,SAAS;EACtBC,OAAOf,KAAKe;EACZC,OAAOhB,KAAKiB,IAAI,OAAO;EACvBC,MAAMlB,KAAKkB;EACXZ,UAAUN,KAAKM,WAAW,CAAA,EAAA,CAAIa,IAAIC,MAAM;EACxChB,iBAAiBO;EACjBN,iBAAiBR,YAAYQ,mBAAmB,CAAA;CAClD;AACF;AAEA,IAAA,mBAAgBgB,QAA8B;CAC5CA,IAAIC,IAAIhC,OAAUD,yBAAyB;CAC3CgC,IAAIJ,IAAI3B,OAAUC,EAAE;AACtB"}

package/dist/handler-GKdEwnBO.js

@@ -0,0 +1,75 @@
+import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
+import crypto from "crypto";
+import { models } from "@rpcbase/db";
+import { sendEmail } from "@rpcbase/server";
+//#region src/api/resend-otp/index.ts
+var Route = "/api/rb/auth/resend-otp";
+var requestSchema = object({ email: string().email() });
+object({
+	success: boolean(),
+	error: string().optional()
+});
+//#endregion
+//#region src/api/resend-otp/handler.ts
+var resendOtp = async (payload, ctx) => {
+	const User = await models.getGlobal("RBUser", ctx);
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const { email } = parsed.data;
+	const user = await User.findOne({ email });
+	if (!user) {
+		ctx.res.status(404);
+		return {
+			success: false,
+			error: "user_not_found"
+		};
+	}
+	const emailVerificationCode = crypto.randomInt(0, 1e6).toString().padStart(6, "0");
+	const emailVerificationExpiresAt = new Date(Date.now() + 600 * 1e3);
+	user.emailVerificationCode = emailVerificationCode;
+	user.emailVerificationExpiresAt = emailVerificationExpiresAt;
+	await user.save();
+	try {
+		await sendEmail({
+			to: email,
+			subject: `Your verification code: ${emailVerificationCode}`,
+			html: `
+        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>
+        <p>If you didn't request this, you can ignore this message.</p>
+      `,
+			text: `Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`
+		});
+	} catch (err) {
+		console.error("failed to resend otp email", err);
+		try {
+			await User.updateOne({
+				_id: user._id,
+				emailVerificationCode
+			}, { $unset: {
+				emailVerificationCode: "",
+				emailVerificationExpiresAt: ""
+			} });
+		} catch (releaseErr) {
+			console.error("failed to clear unsent otp", releaseErr);
+		}
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "email_delivery_failed"
+		};
+	}
+	return { success: true };
+};
+var handler_default = (api) => {
+	api.post(Route, resendOtp);
+};
+//#endregion
+export { handler_default as default, resendOtp };
+
+//# sourceMappingURL=handler-GKdEwnBO.js.map