@rpcbase/auth 0.176.0 → 0.178.0

package/dist/api/me/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/me";
+export declare const ROUTE = "/api/rb/auth/me";
 export declare const requestSchema: z.ZodObject<{}, z.core.$strip>;
 export type RequestPayload = z.infer<typeof requestSchema>;
 export declare const responseSchema: z.ZodObject<{

package/dist/api/request-password-reset/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/request-password-reset";
+export declare const ROUTE = "/api/rb/auth/request-password-reset";
 export declare const requestSchema: z.ZodObject<{
     email: z.ZodString;
 }, z.core.$strip>;

package/dist/api/resend-otp/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/resend-otp";
+export declare const ROUTE = "/api/rb/auth/resend-otp";
 export declare const requestSchema: z.ZodObject<{
     email: z.ZodString;
 }, z.core.$strip>;

package/dist/api/set-active-account/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/set-active-account";
+export declare const ROUTE = "/api/rb/auth/set-active-account";
 export declare const requestSchema: z.ZodObject<{
     tenantId: z.ZodString;
 }, z.core.$strip>;

package/dist/api/set-new-password/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/set-new-password";
+export declare const ROUTE = "/api/rb/auth/set-new-password";
 export declare const requestSchema: z.ZodObject<{
     email: z.ZodString;
     resetToken: z.ZodString;

package/dist/api/sign-in/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/sign-in";
+export declare const ROUTE = "/api/rb/auth/sign-in";
 export declare const requestSchema: z.ZodObject<{
     email: z.ZodString;
     password: z.ZodString;

package/dist/api/sign-out/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/sign-out";
+export declare const ROUTE = "/api/rb/auth/sign-out";
 export declare const requestSchema: z.ZodObject<{}, z.core.$strip>;
 export type RequestPayload = z.infer<typeof requestSchema>;
 export declare const responseSchema: z.ZodObject<{

package/dist/api/sign-up/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/sign-up";
+export declare const ROUTE = "/api/rb/auth/sign-up";
 export declare const requestSchema: z.ZodObject<{
     email: z.ZodString;
     password: z.ZodString;

package/dist/api/verify-otp/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/verify-otp";
+export declare const ROUTE = "/api/rb/auth/verify-otp";
 export declare const requestSchema: z.ZodObject<{
     email: z.ZodString;
     code: z.ZodString;

package/dist/api/verify-password-reset-otp/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const Route = "/api/rb/auth/verify-password-reset-otp";
+export declare const ROUTE = "/api/rb/auth/verify-password-reset-otp";
 export declare const requestSchema: z.ZodObject<{
     email: z.ZodString;
     code: z.ZodString;

package/dist/{handler-0nKR-P5B.js → handler-BGjAGBrc.js}

@@ -1,4 +1,4 @@
-import { n as requestSchema, t as Route } from "./sign-up-BCVi8UC9.js";
+import { n as requestSchema, t as ROUTE } from "./sign-up-Di48rzbG.js";
 import crypto from "crypto";
 import { models } from "@rpcbase/db";
 import { hashPasswordForStorage, sendEmail } from "@rpcbase/server";
@@ -76,9 +76,9 @@ var signUp = async (payload, ctx) => {
 	};
 };
 var handler_default = (api) => {
-	api.post(Route, signUp);
+	api.post(ROUTE, signUp);
 };
 //#endregion
 export { handler_default as default, signUp };
 
-//# sourceMappingURL=handler-0nKR-P5B.js.map
+//# sourceMappingURL=handler-BGjAGBrc.js.map

package/dist/{handler-0nKR-P5B.js.map → handler-BGjAGBrc.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-0nKR-P5B.js","names":["crypto","Api","Ctx","ApiHandler","models","hashPasswordForStorage","sendEmail","AuthSessionUser","SignUp","signUp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","Tenant","parsed","requestSchema","safeParse","success","res","status","error","email","password","rememberMe","_rememberMe","data","existingUser","findOne","console","log","hashedPassword","tenantId","randomUUID","emailVerificationCode","randomInt","toString","padStart","emailVerificationExpiresAt","Date","now","user","tenants","tenantRoles","save","to","subject","html","text","err","deleteOne","_id","rollbackErr","create","name","warn","userId","api","post","Route"],"sources":["../src/api/sign-up/handler.ts"],"sourcesContent":["import crypto from \"crypto\"\n\nimport { Api, Ctx, ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage, sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SignUp from \"./index\"\n\n\nexport const signUp: ApiHandler<SignUp.RequestPayload, SignUp.ResponsePayload, AuthSessionUser> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SignUp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const Tenant = await models.getGlobal(\"RBTenant\", ctx)\n\n  const parsed = SignUp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  const { email, password, rememberMe: _rememberMe } = parsed.data\n\n  const existingUser = await User.findOne({ email })\n\n  if (existingUser) {\n    console.log(\"user with email already exists\", email)\n    // For security, we don't want to reveal if an email is registered.\n    // But for this implementation, we'll make it simple.\n    ctx.res.status(409)\n    return { success: false, error: \"user_exists\" }\n  }\n\n  const hashedPassword = await hashPasswordForStorage(password)\n\n  const tenantId = crypto.randomUUID()\n\n  const emailVerificationCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1000)\n\n  const user = new User({\n    email,\n    password: hashedPassword,\n    tenants: [tenantId],\n    tenantRoles: {\n      [tenantId]: [\"owner\"],\n    },\n    emailVerificationCode,\n    emailVerificationExpiresAt,\n  })\n  await user.save()\n\n  try {\n    await sendEmail({\n      to: email,\n      subject: `Verify your email: ${emailVerificationCode}`,\n      html: `\n        <p>Welcome to rpcbase!</p>\n        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Welcome to rpcbase! Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to send sign-up email\", err)\n\n    try {\n      await User.deleteOne({ _id: user._id })\n    } catch (rollbackErr) {\n      console.error(\"failed to roll back user after sign-up email failure\", rollbackErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  try {\n    await Tenant.create({\n      tenantId,\n      name: email,\n    })\n  } catch (err) {\n    // best-effort tenant creation; log and continue\n    console.warn(\"failed to create tenant for user\", err)\n  }\n\n  console.log(\"created new user\", user._id.toString())\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SignUp.Route, signUp)\n}\n"],"mappings":";;;;;AAWA,IAAaS,SAAqF,OAChGG,SACAC,QACoC;CACpC,MAAME,OAAO,MAAMX,OAAOY,UAAU,UAAUH,GAAG;CACjD,MAAMI,SAAS,MAAMb,OAAOY,UAAU,YAAYH,GAAG;CAErD,MAAMK,SAAAA,cAA8BE,UAAUR,OAAO;CAErD,IAAI,CAACM,OAAOG,SAAS;EACnBR,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAGA,MAAM,EAAEC,OAAOC,UAAUC,YAAYC,gBAAgBV,OAAOW;CAI5D,IAAIC,MAFuBf,KAAKgB,QAAQ,EAAEN,MAAM,CAAC,GAE/B;EAChBO,QAAQC,IAAI,kCAAkCR,KAAK;EAGnDZ,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAc;CAChD;CAEA,MAAMU,iBAAiB,MAAM7B,uBAAuBqB,QAAQ;CAE5D,MAAMS,WAAWnC,OAAOoC,WAAW;CAEnC,MAAMC,wBAAwBrC,OAAOsC,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACvF,MAAMC,6BAA6B,IAAIC,KAAKA,KAAKC,IAAI,IAAI,MAAU,GAAI;CAEvE,MAAMC,OAAO,IAAI7B,KAAK;EACpBU;EACAC,UAAUQ;EACVW,SAAS,CAACV,QAAQ;EAClBW,aAAa,GACVX,WAAW,CAAC,OAAO,EACtB;EACAE;EACAI;CACF,CAAC;CACD,MAAMG,KAAKG,KAAK;CAEhB,IAAI;EACF,MAAMzC,UAAU;GACd0C,IAAIvB;GACJwB,SAAS,sBAAsBZ;GAC/Ba,MAAM;;+CAEmCb,sBAAqB;;;GAG9Dc,MAAM,iDAAiDd,sBAAqB;EAC9E,CAAC;CACH,SAASe,KAAK;EACZpB,QAAQR,MAAM,gCAAgC4B,GAAG;EAEjD,IAAI;GACF,MAAMrC,KAAKsC,UAAU,EAAEC,KAAKV,KAAKU,IAAI,CAAC;EACxC,SAASC,aAAa;GACpBvB,QAAQR,MAAM,wDAAwD+B,WAAW;EACnF;EAEA1C,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,IAAI;EACF,MAAMP,OAAOuC,OAAO;GAClBrB;GACAsB,MAAMhC;EACR,CAAC;CACH,SAAS2B,KAAK;EAEZpB,QAAQ0B,KAAK,oCAAoCN,GAAG;CACtD;CAEApB,QAAQC,IAAI,oBAAoBW,KAAKU,IAAIf,SAAS,CAAC;CAEnD,OAAO;EAAElB,SAAS;EAAMsC,QAAQf,KAAKU,IAAIf,SAAS;EAAGJ;CAAS;AAChE;AAEA,IAAA,mBAAgByB,QAA8B;CAC5CA,IAAIC,KAAKrD,OAAcC,MAAM;AAC/B"}
+{"version":3,"file":"handler-BGjAGBrc.js","names":["crypto","Api","Ctx","ApiHandler","models","hashPasswordForStorage","sendEmail","AuthSessionUser","SignUp","signUp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","Tenant","parsed","requestSchema","safeParse","success","res","status","error","email","password","rememberMe","_rememberMe","data","existingUser","findOne","console","log","hashedPassword","tenantId","randomUUID","emailVerificationCode","randomInt","toString","padStart","emailVerificationExpiresAt","Date","now","user","tenants","tenantRoles","save","to","subject","html","text","err","deleteOne","_id","rollbackErr","create","name","warn","userId","api","post","ROUTE"],"sources":["../src/api/sign-up/handler.ts"],"sourcesContent":["import crypto from \"crypto\"\n\nimport { Api, Ctx, ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage, sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SignUp from \"./index\"\n\n\nexport const signUp: ApiHandler<SignUp.RequestPayload, SignUp.ResponsePayload, AuthSessionUser> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SignUp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const Tenant = await models.getGlobal(\"RBTenant\", ctx)\n\n  const parsed = SignUp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  const { email, password, rememberMe: _rememberMe } = parsed.data\n\n  const existingUser = await User.findOne({ email })\n\n  if (existingUser) {\n    console.log(\"user with email already exists\", email)\n    // For security, we don't want to reveal if an email is registered.\n    // But for this implementation, we'll make it simple.\n    ctx.res.status(409)\n    return { success: false, error: \"user_exists\" }\n  }\n\n  const hashedPassword = await hashPasswordForStorage(password)\n\n  const tenantId = crypto.randomUUID()\n\n  const emailVerificationCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1000)\n\n  const user = new User({\n    email,\n    password: hashedPassword,\n    tenants: [tenantId],\n    tenantRoles: {\n      [tenantId]: [\"owner\"],\n    },\n    emailVerificationCode,\n    emailVerificationExpiresAt,\n  })\n  await user.save()\n\n  try {\n    await sendEmail({\n      to: email,\n      subject: `Verify your email: ${emailVerificationCode}`,\n      html: `\n        <p>Welcome to rpcbase!</p>\n        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Welcome to rpcbase! Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to send sign-up email\", err)\n\n    try {\n      await User.deleteOne({ _id: user._id })\n    } catch (rollbackErr) {\n      console.error(\"failed to roll back user after sign-up email failure\", rollbackErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  try {\n    await Tenant.create({\n      tenantId,\n      name: email,\n    })\n  } catch (err) {\n    // best-effort tenant creation; log and continue\n    console.warn(\"failed to create tenant for user\", err)\n  }\n\n  console.log(\"created new user\", user._id.toString())\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SignUp.ROUTE, signUp)\n}\n"],"mappings":";;;;;AAWA,IAAaS,SAAqF,OAChGG,SACAC,QACoC;CACpC,MAAME,OAAO,MAAMX,OAAOY,UAAU,UAAUH,GAAG;CACjD,MAAMI,SAAS,MAAMb,OAAOY,UAAU,YAAYH,GAAG;CAErD,MAAMK,SAAAA,cAA8BE,UAAUR,OAAO;CAErD,IAAI,CAACM,OAAOG,SAAS;EACnBR,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAGA,MAAM,EAAEC,OAAOC,UAAUC,YAAYC,gBAAgBV,OAAOW;CAI5D,IAAIC,MAFuBf,KAAKgB,QAAQ,EAAEN,MAAM,CAAC,GAE/B;EAChBO,QAAQC,IAAI,kCAAkCR,KAAK;EAGnDZ,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAc;CAChD;CAEA,MAAMU,iBAAiB,MAAM7B,uBAAuBqB,QAAQ;CAE5D,MAAMS,WAAWnC,OAAOoC,WAAW;CAEnC,MAAMC,wBAAwBrC,OAAOsC,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACvF,MAAMC,6BAA6B,IAAIC,KAAKA,KAAKC,IAAI,IAAI,MAAU,GAAI;CAEvE,MAAMC,OAAO,IAAI7B,KAAK;EACpBU;EACAC,UAAUQ;EACVW,SAAS,CAACV,QAAQ;EAClBW,aAAa,GACVX,WAAW,CAAC,OAAO,EACtB;EACAE;EACAI;CACF,CAAC;CACD,MAAMG,KAAKG,KAAK;CAEhB,IAAI;EACF,MAAMzC,UAAU;GACd0C,IAAIvB;GACJwB,SAAS,sBAAsBZ;GAC/Ba,MAAM;;+CAEmCb,sBAAqB;;;GAG9Dc,MAAM,iDAAiDd,sBAAqB;EAC9E,CAAC;CACH,SAASe,KAAK;EACZpB,QAAQR,MAAM,gCAAgC4B,GAAG;EAEjD,IAAI;GACF,MAAMrC,KAAKsC,UAAU,EAAEC,KAAKV,KAAKU,IAAI,CAAC;EACxC,SAASC,aAAa;GACpBvB,QAAQR,MAAM,wDAAwD+B,WAAW;EACnF;EAEA1C,IAAIS,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,IAAI;EACF,MAAMP,OAAOuC,OAAO;GAClBrB;GACAsB,MAAMhC;EACR,CAAC;CACH,SAAS2B,KAAK;EAEZpB,QAAQ0B,KAAK,oCAAoCN,GAAG;CACtD;CAEApB,QAAQC,IAAI,oBAAoBW,KAAKU,IAAIf,SAAS,CAAC;CAEnD,OAAO;EAAElB,SAAS;EAAMsC,QAAQf,KAAKU,IAAIf,SAAS;EAAGJ;CAAS;AAChE;AAEA,IAAA,mBAAgByB,QAA8B;CAC5CA,IAAIC,KAAKrD,OAAcC,MAAM;AAC/B"}

package/dist/{handler-GKdEwnBO.js → handler-C7SfLP4c.js}

@@ -3,7 +3,7 @@ import crypto from "crypto";
 import { models } from "@rpcbase/db";
 import { sendEmail } from "@rpcbase/server";
 //#region src/api/resend-otp/index.ts
-var Route = "/api/rb/auth/resend-otp";
+var ROUTE = "/api/rb/auth/resend-otp";
 var requestSchema = object({ email: string().email() });
 object({
 	success: boolean(),
@@ -67,9 +67,9 @@ var resendOtp = async (payload, ctx) => {
 	return { success: true };
 };
 var handler_default = (api) => {
-	api.post(Route, resendOtp);
+	api.post(ROUTE, resendOtp);
 };
 //#endregion
 export { handler_default as default, resendOtp };
 
-//# sourceMappingURL=handler-GKdEwnBO.js.map
+//# sourceMappingURL=handler-C7SfLP4c.js.map

package/dist/{handler-GKdEwnBO.js.map → handler-C7SfLP4c.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-GKdEwnBO.js","names":["z","Route","requestSchema","object","email","string","RequestPayload","infer","responseSchema","success","boolean","error","optional","ResponsePayload","crypto","Api","ApiHandler","Ctx","models","sendEmail","AuthSessionUser","ResendOtp","resendOtp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","data","user","findOne","emailVerificationCode","randomInt","toString","padStart","emailVerificationExpiresAt","Date","now","save","to","subject","html","text","err","console","updateOne","_id","$unset","releaseErr","api","post","Route"],"sources":["../src/api/resend-otp/index.ts","../src/api/resend-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/resend-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as ResendOtp from \"./index\"\n\n\nexport const resendOtp: ApiHandler<ResendOtp.RequestPayload, ResendOtp.ResponsePayload, AuthSessionUser> = async (\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<ResendOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = ResendOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email } = parsed.data\n\n  const user = await User.findOne({ email })\n\n  if (!user) {\n    // TODO(auth): avoid account enumeration (return a generic success response even when the user doesn't exist)\n    ctx.res.status(404)\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  // TODO(auth): add server-side throttling / rate limiting for resend-otp\n  const emailVerificationCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1000)\n\n  user.emailVerificationCode = emailVerificationCode\n  user.emailVerificationExpiresAt = emailVerificationExpiresAt\n  await user.save()\n\n  try {\n    await sendEmail({\n      to: email,\n      subject: `Your verification code: ${emailVerificationCode}`,\n      html: `\n        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to resend otp email\", err)\n\n    try {\n      await User.updateOne(\n        { _id: user._id, emailVerificationCode },\n        {\n          $unset: {\n            emailVerificationCode: \"\",\n            emailVerificationExpiresAt: \"\",\n          },\n        },\n      )\n    } catch (releaseErr) {\n      console.error(\"failed to clear unsent otp\", releaseErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  return { success: true }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(ResendOtp.Route, resendOtp)\n}\n"],"mappings":";;;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS,EACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM,EAC1B,CAAC;AAI6BJ,OAAS;CACrCS,SAAST,QAAU;CACnBW,OAAOX,OAAS,CAAC,CAACY,SAAS;AAC7B,CAAC;;;ACHD,IAAaU,YAA8F,OACzGG,SACAC,QACuC;CACvC,MAAME,OAAO,MAAMV,OAAOW,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAAiCE,UAAUP,OAAO;CAExD,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,UAAUP,OAAOQ;CAEzB,MAAMC,OAAO,MAAMX,KAAKY,QAAQ,EAAEH,MAAM,CAAC;CAEzC,IAAI,CAACE,MAAM;EAETb,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAiB;CACnD;CAGA,MAAMK,wBAAwB3B,OAAO4B,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACvF,MAAMC,6BAA6B,IAAIC,KAAKA,KAAKC,IAAI,IAAI,MAAU,GAAI;CAEvER,KAAKE,wBAAwBA;CAC7BF,KAAKM,6BAA6BA;CAClC,MAAMN,KAAKS,KAAK;CAEhB,IAAI;EACF,MAAM7B,UAAU;GACd8B,IAAIZ;GACJa,SAAS,2BAA2BT;GACpCU,MAAM;+CACmCV,sBAAqB;;;GAG9DW,MAAM,6BAA6BX,sBAAqB;EAC1D,CAAC;CACH,SAASY,KAAK;EACZC,QAAQlB,MAAM,8BAA8BiB,GAAG;EAE/C,IAAI;GACF,MAAMzB,KAAK2B,UACT;IAAEC,KAAKjB,KAAKiB;IAAKf;GAAsB,GACvC,EACEgB,QAAQ;IACNhB,uBAAuB;IACvBI,4BAA4B;GAC9B,EACF,CACF;EACF,SAASa,YAAY;GACnBJ,QAAQlB,MAAM,8BAA8BsB,UAAU;EACxD;EAEAhC,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,OAAO,EAAEH,SAAS,KAAK;AACzB;AAEA,IAAA,mBAAgB0B,QAA8B;CAC5CA,IAAIC,KAAKvC,OAAiBC,SAAS;AACrC"}
+{"version":3,"file":"handler-C7SfLP4c.js","names":["z","ROUTE","requestSchema","object","email","string","RequestPayload","infer","responseSchema","success","boolean","error","optional","ResponsePayload","crypto","Api","ApiHandler","Ctx","models","sendEmail","AuthSessionUser","ResendOtp","resendOtp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","data","user","findOne","emailVerificationCode","randomInt","toString","padStart","emailVerificationExpiresAt","Date","now","save","to","subject","html","text","err","console","updateOne","_id","$unset","releaseErr","api","post","ROUTE"],"sources":["../src/api/resend-otp/index.ts","../src/api/resend-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/resend-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as ResendOtp from \"./index\"\n\n\nexport const resendOtp: ApiHandler<ResendOtp.RequestPayload, ResendOtp.ResponsePayload, AuthSessionUser> = async (\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<ResendOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = ResendOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email } = parsed.data\n\n  const user = await User.findOne({ email })\n\n  if (!user) {\n    // TODO(auth): avoid account enumeration (return a generic success response even when the user doesn't exist)\n    ctx.res.status(404)\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  // TODO(auth): add server-side throttling / rate limiting for resend-otp\n  const emailVerificationCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1000)\n\n  user.emailVerificationCode = emailVerificationCode\n  user.emailVerificationExpiresAt = emailVerificationExpiresAt\n  await user.save()\n\n  try {\n    await sendEmail({\n      to: email,\n      subject: `Your verification code: ${emailVerificationCode}`,\n      html: `\n        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to resend otp email\", err)\n\n    try {\n      await User.updateOne(\n        { _id: user._id, emailVerificationCode },\n        {\n          $unset: {\n            emailVerificationCode: \"\",\n            emailVerificationExpiresAt: \"\",\n          },\n        },\n      )\n    } catch (releaseErr) {\n      console.error(\"failed to clear unsent otp\", releaseErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  return { success: true }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(ResendOtp.ROUTE, resendOtp)\n}\n"],"mappings":";;;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS,EACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM,EAC1B,CAAC;AAI6BJ,OAAS;CACrCS,SAAST,QAAU;CACnBW,OAAOX,OAAS,CAAC,CAACY,SAAS;AAC7B,CAAC;;;ACHD,IAAaU,YAA8F,OACzGG,SACAC,QACuC;CACvC,MAAME,OAAO,MAAMV,OAAOW,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAAiCE,UAAUP,OAAO;CAExD,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,UAAUP,OAAOQ;CAEzB,MAAMC,OAAO,MAAMX,KAAKY,QAAQ,EAAEH,MAAM,CAAC;CAEzC,IAAI,CAACE,MAAM;EAETb,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAiB;CACnD;CAGA,MAAMK,wBAAwB3B,OAAO4B,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACvF,MAAMC,6BAA6B,IAAIC,KAAKA,KAAKC,IAAI,IAAI,MAAU,GAAI;CAEvER,KAAKE,wBAAwBA;CAC7BF,KAAKM,6BAA6BA;CAClC,MAAMN,KAAKS,KAAK;CAEhB,IAAI;EACF,MAAM7B,UAAU;GACd8B,IAAIZ;GACJa,SAAS,2BAA2BT;GACpCU,MAAM;+CACmCV,sBAAqB;;;GAG9DW,MAAM,6BAA6BX,sBAAqB;EAC1D,CAAC;CACH,SAASY,KAAK;EACZC,QAAQlB,MAAM,8BAA8BiB,GAAG;EAE/C,IAAI;GACF,MAAMzB,KAAK2B,UACT;IAAEC,KAAKjB,KAAKiB;IAAKf;GAAsB,GACvC,EACEgB,QAAQ;IACNhB,uBAAuB;IACvBI,4BAA4B;GAC9B,EACF,CACF;EACF,SAASa,YAAY;GACnBJ,QAAQlB,MAAM,8BAA8BsB,UAAU;EACxD;EAEAhC,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,OAAO,EAAEH,SAAS,KAAK;AACzB;AAEA,IAAA,mBAAgB0B,QAA8B;CAC5CA,IAAIC,KAAKvC,OAAiBC,SAAS;AACrC"}

package/dist/{handler-ClyVm_Us.js → handler-DAKI9QOQ.js}

@@ -2,7 +2,7 @@ import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
 import { n as completeAuthSignIn } from "./session-BQ06Yo3C.js";
 import { models } from "@rpcbase/db";
 //#region src/api/verify-otp/index.ts
-var Route = "/api/rb/auth/verify-otp";
+var ROUTE = "/api/rb/auth/verify-otp";
 var requestSchema = object({
 	email: string().email(),
 	code: string().length(6, "Code must be 6 digits"),
@@ -84,9 +84,9 @@ var verifyOtp = async (payload, ctx) => {
 	};
 };
 var handler_default = (api) => {
-	api.post(Route, verifyOtp);
+	api.post(ROUTE, verifyOtp);
 };
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-ClyVm_Us.js.map
+//# sourceMappingURL=handler-DAKI9QOQ.js.map

package/dist/{handler-ClyVm_Us.js.map → handler-DAKI9QOQ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-ClyVm_Us.js","names":["z","Route","requestSchema","object","email","string","code","length","rememberMe","boolean","default","RequestPayload","infer","responseSchema","success","error","optional","userId","tenantId","ResponsePayload","Api","ApiHandler","Ctx","models","completeAuthSignIn","AuthSessionUser","VerifyOtp","verifyOtp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","code","data","user","findOne","emailVerificationCode","emailVerificationExpiresAt","tenants","tenantRoles","storedCode","expiresAt","isExpired","Date","getTime","now","undefined","save","signedInTenants","map","String","defaultTenantId","tenantId","tenantRolesMap","get","Map","Object","fromEntries","entries","userId","_id","toString","currentTenantId","length","api","post","Route"],"sources":["../src/api/verify-otp/index.ts","../src/api/verify-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/verify-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n  code: z.string().length(6, \"Code must be 6 digits\"),\n  rememberMe: z.boolean().default(true),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  userId: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport { completeAuthSignIn } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as VerifyOtp from \"./index\"\n\n\nconst verifyOtp: ApiHandler<VerifyOtp.RequestPayload, VerifyOtp.ResponsePayload, AuthSessionUser> = async (\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<VerifyOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = VerifyOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, code } = parsed.data\n\n  const user = await User.findOne({ email }, { emailVerificationCode: 1, emailVerificationExpiresAt: 1, tenants: 1, tenantRoles: 1 })\n\n  if (!user) {\n    ctx.res.status(404)\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  const storedCode = user.emailVerificationCode\n  const expiresAt = user.emailVerificationExpiresAt\n\n  const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now()\n  if (!storedCode || storedCode !== code || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_code\" }\n  }\n\n  user.emailVerificationCode = undefined\n  user.emailVerificationExpiresAt = undefined\n  await user.save()\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const defaultTenantId = signedInTenants[0]\n  if (!defaultTenantId) {\n    ctx.res.status(500)\n    return { success: false, error: \"tenant_unavailable\" }\n  }\n  const tenantId = defaultTenantId\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    ctx.res.status(500)\n    return { success: false, error: \"session_unavailable\" }\n  }\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(VerifyOtp.Route, verifyOtp)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM;CACxBE,MAAMN,OAAS,CAAC,CAACO,OAAO,GAAG,uBAAuB;CAClDC,YAAYR,QAAU,CAAC,CAACU,QAAQ,IAAI;AACtC,CAAC;AAI6BV,OAAS;CACrCc,SAASd,QAAU;CACnBe,OAAOf,OAAS,CAAC,CAACgB,SAAS;CAC3BC,QAAQjB,OAAS,CAAC,CAACgB,SAAS;CAC5BE,UAAUlB,OAAS,CAAC,CAACgB,SAAS;AAChC,CAAC;;;ACTD,IAAMW,YAA8F,OAClGG,SACAC,QACuC;CACvC,MAAME,OAAO,MAAMV,OAAOW,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAAiCE,UAAUP,OAAO;CAExD,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,SAASR,OAAOS;CAE/B,MAAMC,OAAO,MAAMZ,KAAKa,QAAQ,EAAEJ,MAAM,GAAG;EAAEK,uBAAuB;EAAGC,4BAA4B;EAAGC,SAAS;EAAGC,aAAa;CAAE,CAAC;CAElI,IAAI,CAACL,MAAM;EACTd,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAiB;CACnD;CAEA,MAAMU,aAAaN,KAAKE;CACxB,MAAMK,YAAYP,KAAKG;CAEvB,MAAMK,YAAYD,qBAAqBE,QAAQF,UAAUG,QAAQ,IAAID,KAAKE,IAAI;CAC9E,IAAI,CAACL,cAAcA,eAAeR,QAAQU,WAAW;EACnDtB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAe;CACjD;CAEAI,KAAKE,wBAAwBU,KAAAA;CAC7BZ,KAAKG,6BAA6BS,KAAAA;CAClC,MAAMZ,KAAKa,KAAK;CAEhB,MAAMC,mBAAmBd,KAAKI,WAAW,CAAA,EAAA,CAAIW,IAAIC,MAAM;CACvD,MAAMC,kBAAkBH,gBAAgB;CACxC,IAAI,CAACG,iBAAiB;EACpB/B,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAqB;CACvD;CACA,MAAMsB,WAAWD;CACjB,MAAME,iBAAiBnB,KAAKoB,IAAI,aAAa;CAC7C,MAAMf,cAAcc,iBAAiBG,OAAOC,YAAYJ,eAAeK,QAAQ,CAAC,IAAIZ,KAAAA;CAEpF,IAAI,CAACjC,mBAAmBO,KAAK;EAC3BuC,QAAQzB,KAAK0B,IAAIC,SAAS;EAC1BC,iBAAiBV;EACjBJ,iBAAiBA,gBAAgBe,SAASf,kBAAkB,CAACI,QAAQ;EACrEb;CACF,CAAC,GAAG;EACFnB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,OAAO;EAAEH,SAAS;EAAMgC,QAAQzB,KAAK0B,IAAIC,SAAS;EAAGT;CAAS;AAChE;AAEA,IAAA,mBAAgBY,QAA8B;CAC5CA,IAAIC,KAAKlD,OAAiBC,SAAS;AACrC"}
+{"version":3,"file":"handler-DAKI9QOQ.js","names":["z","ROUTE","requestSchema","object","email","string","code","length","rememberMe","boolean","default","RequestPayload","infer","responseSchema","success","error","optional","userId","tenantId","ResponsePayload","Api","ApiHandler","Ctx","models","completeAuthSignIn","AuthSessionUser","VerifyOtp","verifyOtp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","code","data","user","findOne","emailVerificationCode","emailVerificationExpiresAt","tenants","tenantRoles","storedCode","expiresAt","isExpired","Date","getTime","now","undefined","save","signedInTenants","map","String","defaultTenantId","tenantId","tenantRolesMap","get","Map","Object","fromEntries","entries","userId","_id","toString","currentTenantId","length","api","post","ROUTE"],"sources":["../src/api/verify-otp/index.ts","../src/api/verify-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/verify-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n  code: z.string().length(6, \"Code must be 6 digits\"),\n  rememberMe: z.boolean().default(true),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  userId: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport { completeAuthSignIn } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as VerifyOtp from \"./index\"\n\n\nconst verifyOtp: ApiHandler<VerifyOtp.RequestPayload, VerifyOtp.ResponsePayload, AuthSessionUser> = async (\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<VerifyOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = VerifyOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, code } = parsed.data\n\n  const user = await User.findOne({ email }, { emailVerificationCode: 1, emailVerificationExpiresAt: 1, tenants: 1, tenantRoles: 1 })\n\n  if (!user) {\n    ctx.res.status(404)\n    return { success: false, error: \"user_not_found\" }\n  }\n\n  const storedCode = user.emailVerificationCode\n  const expiresAt = user.emailVerificationExpiresAt\n\n  const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now()\n  if (!storedCode || storedCode !== code || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_code\" }\n  }\n\n  user.emailVerificationCode = undefined\n  user.emailVerificationExpiresAt = undefined\n  await user.save()\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const defaultTenantId = signedInTenants[0]\n  if (!defaultTenantId) {\n    ctx.res.status(500)\n    return { success: false, error: \"tenant_unavailable\" }\n  }\n  const tenantId = defaultTenantId\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    ctx.res.status(500)\n    return { success: false, error: \"session_unavailable\" }\n  }\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(VerifyOtp.ROUTE, verifyOtp)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM;CACxBE,MAAMN,OAAS,CAAC,CAACO,OAAO,GAAG,uBAAuB;CAClDC,YAAYR,QAAU,CAAC,CAACU,QAAQ,IAAI;AACtC,CAAC;AAI6BV,OAAS;CACrCc,SAASd,QAAU;CACnBe,OAAOf,OAAS,CAAC,CAACgB,SAAS;CAC3BC,QAAQjB,OAAS,CAAC,CAACgB,SAAS;CAC5BE,UAAUlB,OAAS,CAAC,CAACgB,SAAS;AAChC,CAAC;;;ACTD,IAAMW,YAA8F,OAClGG,SACAC,QACuC;CACvC,MAAME,OAAO,MAAMV,OAAOW,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAAiCE,UAAUP,OAAO;CAExD,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,SAASR,OAAOS;CAE/B,MAAMC,OAAO,MAAMZ,KAAKa,QAAQ,EAAEJ,MAAM,GAAG;EAAEK,uBAAuB;EAAGC,4BAA4B;EAAGC,SAAS;EAAGC,aAAa;CAAE,CAAC;CAElI,IAAI,CAACL,MAAM;EACTd,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAiB;CACnD;CAEA,MAAMU,aAAaN,KAAKE;CACxB,MAAMK,YAAYP,KAAKG;CAEvB,MAAMK,YAAYD,qBAAqBE,QAAQF,UAAUG,QAAQ,IAAID,KAAKE,IAAI;CAC9E,IAAI,CAACL,cAAcA,eAAeR,QAAQU,WAAW;EACnDtB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAe;CACjD;CAEAI,KAAKE,wBAAwBU,KAAAA;CAC7BZ,KAAKG,6BAA6BS,KAAAA;CAClC,MAAMZ,KAAKa,KAAK;CAEhB,MAAMC,mBAAmBd,KAAKI,WAAW,CAAA,EAAA,CAAIW,IAAIC,MAAM;CACvD,MAAMC,kBAAkBH,gBAAgB;CACxC,IAAI,CAACG,iBAAiB;EACpB/B,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAqB;CACvD;CACA,MAAMsB,WAAWD;CACjB,MAAME,iBAAiBnB,KAAKoB,IAAI,aAAa;CAC7C,MAAMf,cAAcc,iBAAiBG,OAAOC,YAAYJ,eAAeK,QAAQ,CAAC,IAAIZ,KAAAA;CAEpF,IAAI,CAACjC,mBAAmBO,KAAK;EAC3BuC,QAAQzB,KAAK0B,IAAIC,SAAS;EAC1BC,iBAAiBV;EACjBJ,iBAAiBA,gBAAgBe,SAASf,kBAAkB,CAACI,QAAQ;EACrEb;CACF,CAAC,GAAG;EACFnB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,OAAO;EAAEH,SAAS;EAAMgC,QAAQzB,KAAK0B,IAAIC,SAAS;EAAGT;CAAS;AAChE;AAEA,IAAA,mBAAgBY,QAA8B;CAC5CA,IAAIC,KAAKlD,OAAiBC,SAAS;AACrC"}

package/dist/{handler-BoWTfKWi.js → handler-DAfIloZR.js}

@@ -2,7 +2,7 @@ import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
 import crypto from "crypto";
 import { models } from "@rpcbase/db";
 //#region src/api/verify-password-reset-otp/index.ts
-var Route = "/api/rb/auth/verify-password-reset-otp";
+var ROUTE = "/api/rb/auth/verify-password-reset-otp";
 var requestSchema = object({
 	email: string().email(),
 	code: string().length(6, "Code must be 6 digits")
@@ -48,9 +48,9 @@ var verifyPasswordResetOtp = async (payload, ctx) => {
 	};
 };
 var handler_default = (api) => {
-	api.post(Route, verifyPasswordResetOtp);
+	api.post(ROUTE, verifyPasswordResetOtp);
 };
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-BoWTfKWi.js.map
+//# sourceMappingURL=handler-DAfIloZR.js.map

package/dist/{handler-BoWTfKWi.js.map → handler-DAfIloZR.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-BoWTfKWi.js","names":["z","Route","requestSchema","object","email","string","code","length","RequestPayload","infer","responseSchema","success","boolean","error","optional","resetToken","ResponsePayload","crypto","Api","ApiHandler","Ctx","models","AuthSessionUser","VerifyPasswordResetOtp","verifyPasswordResetOtp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","code","data","user","findOne","storedCode","passwordResetCode","expiresAt","passwordResetCodeExpiresAt","isExpired","Date","getTime","now","resetToken","randomBytes","toString","undefined","passwordResetToken","passwordResetTokenExpiresAt","save","api","post","Route"],"sources":["../src/api/verify-password-reset-otp/index.ts","../src/api/verify-password-reset-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/verify-password-reset-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n  code: z.string().length(6, \"Code must be 6 digits\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  resetToken: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as VerifyPasswordResetOtp from \"./index\"\n\n\nconst verifyPasswordResetOtp: ApiHandler<\n  VerifyPasswordResetOtp.RequestPayload,\n  VerifyPasswordResetOtp.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<VerifyPasswordResetOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = VerifyPasswordResetOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, code } = parsed.data\n  const user = await User.findOne({ email })\n\n  const storedCode = user?.passwordResetCode\n  const expiresAt = user?.passwordResetCodeExpiresAt\n  const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now()\n\n  if (!user || !storedCode || storedCode !== code || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_code\" }\n  }\n\n  const resetToken = crypto.randomBytes(24).toString(\"hex\")\n\n  user.passwordResetCode = undefined\n  user.passwordResetCodeExpiresAt = undefined\n  user.passwordResetToken = resetToken\n  user.passwordResetTokenExpiresAt = new Date(Date.now() + 15 * 60 * 1000)\n  await user.save()\n\n  return { success: true, resetToken }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(VerifyPasswordResetOtp.Route, verifyPasswordResetOtp)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM;CACxBE,MAAMN,OAAS,CAAC,CAACO,OAAO,GAAG,uBAAuB;AACpD,CAAC;AAI6BP,OAAS;CACrCW,SAASX,QAAU;CACnBa,OAAOb,OAAS,CAAC,CAACc,SAAS;CAC3BC,YAAYf,OAAS,CAAC,CAACc,SAAS;AAClC,CAAC;;;ACND,IAAMU,yBAIF,OACFG,SACAC,QACoD;CACpD,MAAME,OAAO,MAAMT,OAAOU,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAA8CE,UAAUP,OAAO;CAErE,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,SAASR,OAAOS;CAC/B,MAAMC,OAAO,MAAMZ,KAAKa,QAAQ,EAAEJ,MAAM,CAAC;CAEzC,MAAMK,aAAaF,MAAMG;CACzB,MAAMC,YAAYJ,MAAMK;CACxB,MAAMC,YAAYF,qBAAqBG,QAAQH,UAAUI,QAAQ,IAAID,KAAKE,IAAI;CAE9E,IAAI,CAACT,QAAQ,CAACE,cAAcA,eAAeJ,QAAQQ,WAAW;EAC5DpB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAe;CACjD;CAEA,MAAMc,aAAanC,OAAOoC,YAAY,EAAE,CAAC,CAACC,SAAS,KAAK;CAExDZ,KAAKG,oBAAoBU,KAAAA;CACzBb,KAAKK,6BAA6BQ,KAAAA;CAClCb,KAAKc,qBAAqBJ;CAC1BV,KAAKe,8BAA8B,IAAIR,KAAKA,KAAKE,IAAI,IAAI,MAAU,GAAI;CACvE,MAAMT,KAAKgB,KAAK;CAEhB,OAAO;EAAEvB,SAAS;EAAMiB;CAAW;AACrC;AAEA,IAAA,mBAAgBO,QAA8B;CAC5CA,IAAIC,KAAKrC,OAA8BC,sBAAsB;AAC/D"}
+{"version":3,"file":"handler-DAfIloZR.js","names":["z","ROUTE","requestSchema","object","email","string","code","length","RequestPayload","infer","responseSchema","success","boolean","error","optional","resetToken","ResponsePayload","crypto","Api","ApiHandler","Ctx","models","AuthSessionUser","VerifyPasswordResetOtp","verifyPasswordResetOtp","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","code","data","user","findOne","storedCode","passwordResetCode","expiresAt","passwordResetCodeExpiresAt","isExpired","Date","getTime","now","resetToken","randomBytes","toString","undefined","passwordResetToken","passwordResetTokenExpiresAt","save","api","post","ROUTE"],"sources":["../src/api/verify-password-reset-otp/index.ts","../src/api/verify-password-reset-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/verify-password-reset-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n  code: z.string().length(6, \"Code must be 6 digits\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  resetToken: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as VerifyPasswordResetOtp from \"./index\"\n\n\nconst verifyPasswordResetOtp: ApiHandler<\n  VerifyPasswordResetOtp.RequestPayload,\n  VerifyPasswordResetOtp.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<VerifyPasswordResetOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = VerifyPasswordResetOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, code } = parsed.data\n  const user = await User.findOne({ email })\n\n  const storedCode = user?.passwordResetCode\n  const expiresAt = user?.passwordResetCodeExpiresAt\n  const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now()\n\n  if (!user || !storedCode || storedCode !== code || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_code\" }\n  }\n\n  const resetToken = crypto.randomBytes(24).toString(\"hex\")\n\n  user.passwordResetCode = undefined\n  user.passwordResetCodeExpiresAt = undefined\n  user.passwordResetToken = resetToken\n  user.passwordResetTokenExpiresAt = new Date(Date.now() + 15 * 60 * 1000)\n  await user.save()\n\n  return { success: true, resetToken }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(VerifyPasswordResetOtp.ROUTE, verifyPasswordResetOtp)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM;CACxBE,MAAMN,OAAS,CAAC,CAACO,OAAO,GAAG,uBAAuB;AACpD,CAAC;AAI6BP,OAAS;CACrCW,SAASX,QAAU;CACnBa,OAAOb,OAAS,CAAC,CAACc,SAAS;CAC3BC,YAAYf,OAAS,CAAC,CAACc,SAAS;AAClC,CAAC;;;ACND,IAAMU,yBAIF,OACFG,SACAC,QACoD;CACpD,MAAME,OAAO,MAAMT,OAAOU,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAA8CE,UAAUP,OAAO;CAErE,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,SAASR,OAAOS;CAC/B,MAAMC,OAAO,MAAMZ,KAAKa,QAAQ,EAAEJ,MAAM,CAAC;CAEzC,MAAMK,aAAaF,MAAMG;CACzB,MAAMC,YAAYJ,MAAMK;CACxB,MAAMC,YAAYF,qBAAqBG,QAAQH,UAAUI,QAAQ,IAAID,KAAKE,IAAI;CAE9E,IAAI,CAACT,QAAQ,CAACE,cAAcA,eAAeJ,QAAQQ,WAAW;EAC5DpB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAe;CACjD;CAEA,MAAMc,aAAanC,OAAOoC,YAAY,EAAE,CAAC,CAACC,SAAS,KAAK;CAExDZ,KAAKG,oBAAoBU,KAAAA;CACzBb,KAAKK,6BAA6BQ,KAAAA;CAClCb,KAAKc,qBAAqBJ;CAC1BV,KAAKe,8BAA8B,IAAIR,KAAKA,KAAKE,IAAI,IAAI,MAAU,GAAI;CACvE,MAAMT,KAAKgB,KAAK;CAEhB,OAAO;EAAEvB,SAAS;EAAMiB;CAAW;AACrC;AAEA,IAAA,mBAAgBO,QAA8B;CAC5CA,IAAIC,KAAKrC,OAA8BC,sBAAsB;AAC/D"}

package/dist/{handler-B8jPw9zh.js → handler-DH9FPTNh.js}

@@ -1,4 +1,4 @@
-import { n as requestSchema, t as Route } from "./sign-in-BG2ND3cO.js";
+import { n as requestSchema, t as ROUTE } from "./sign-in-BkhQovKN.js";
 import { n as completeAuthSignIn } from "./session-BQ06Yo3C.js";
 import { models } from "@rpcbase/db";
 import { verifyPasswordFromStorage } from "@rpcbase/server";
@@ -66,9 +66,9 @@ var signIn = async (payload, ctx) => {
 	};
 };
 var handler_default = (api) => {
-	api.post(Route, signIn);
+	api.post(ROUTE, signIn);
 };
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-B8jPw9zh.js.map
+//# sourceMappingURL=handler-DH9FPTNh.js.map

package/dist/{handler-B8jPw9zh.js.map → handler-DH9FPTNh.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-B8jPw9zh.js","names":["Api","ApiHandler","Ctx","models","verifyPasswordFromStorage","completeAuthSignIn","AuthSessionUser","SignIn","signIn","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","password","data","user","findOne","tenants","tenantRoles","stored","String","passwordMatches","startsWith","console","warn","_id","toString","signedInTenants","map","defaultTenantId","tenantId","tenantRolesMap","get","Map","Object","fromEntries","entries","undefined","userId","currentTenantId","length","api","post","Route"],"sources":["../src/api/sign-in/handler.ts"],"sourcesContent":["import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { verifyPasswordFromStorage } from \"@rpcbase/server\"\n\nimport { completeAuthSignIn } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SignIn from \"./index\"\n\n\nconst signIn: ApiHandler<SignIn.RequestPayload, SignIn.ResponsePayload, AuthSessionUser> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SignIn.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = SignIn.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, password } = parsed.data\n\n  const user = await User.findOne({ email }, { password: 1, tenants: 1, tenantRoles: 1 })\n\n  if (!user?.password) {\n    ctx.res.status(401)\n    return { success: false, error: \"invalid_credentials\" }\n  }\n\n  const stored = String(user.password)\n  const passwordMatches = await verifyPasswordFromStorage(password, stored)\n\n  if (!passwordMatches) {\n    if (!stored.startsWith(\"$scrypt$\")) {\n      console.warn(\"auth::sign-in invalid stored password format\", user._id.toString())\n    }\n    ctx.res.status(401)\n    return { success: false, error: \"invalid_credentials\" }\n  }\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const defaultTenantId = signedInTenants[0]\n  if (!defaultTenantId) {\n    ctx.res.status(500)\n    return { success: false, error: \"tenant_unavailable\" }\n  }\n  const tenantId = defaultTenantId\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    ctx.res.status(500)\n    return { success: false, error: \"session_unavailable\" }\n  }\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SignIn.Route, signIn)\n}\n"],"mappings":";;;;;AAUA,IAAMQ,SAAqF,OACzFG,SACAC,QACoC;CACpC,MAAME,OAAO,MAAMX,OAAOY,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAA8BE,UAAUP,OAAO;CAErD,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,aAAaR,OAAOS;CAEnC,MAAMC,OAAO,MAAMZ,KAAKa,QAAQ,EAAEJ,MAAM,GAAG;EAAEC,UAAU;EAAGI,SAAS;EAAGC,aAAa;CAAE,CAAC;CAEtF,IAAI,CAACH,MAAMF,UAAU;EACnBZ,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,MAAMQ,SAASC,OAAOL,KAAKF,QAAQ;CAGnC,IAAI,CAACQ,MAFyB5B,0BAA0BoB,UAAUM,MAAM,GAElD;EACpB,IAAI,CAACA,OAAOG,WAAW,UAAU,GAC/BC,QAAQC,KAAK,gDAAgDT,KAAKU,IAAIC,SAAS,CAAC;EAElFzB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,MAAMgB,mBAAmBZ,KAAKE,WAAW,CAAA,EAAA,CAAIW,IAAIR,MAAM;CACvD,MAAMS,kBAAkBF,gBAAgB;CACxC,IAAI,CAACE,iBAAiB;EACpB5B,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAqB;CACvD;CACA,MAAMmB,WAAWD;CACjB,MAAME,iBAAiBhB,KAAKiB,IAAI,aAAa;CAC7C,MAAMd,cAAca,iBAAiBG,OAAOC,YAAYJ,eAAeK,QAAQ,CAAC,IAAIC,KAAAA;CAEpF,IAAI,CAAC3C,mBAAmBO,KAAK;EAC3BqC,QAAQvB,KAAKU,IAAIC,SAAS;EAC1Ba,iBAAiBT;EACjBH,iBAAiBA,gBAAgBa,SAASb,kBAAkB,CAACG,QAAQ;EACrEZ;CACF,CAAC,GAAG;EACFjB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,OAAO;EAAEH,SAAS;EAAM8B,QAAQvB,KAAKU,IAAIC,SAAS;EAAGI;CAAS;AAChE;AAEA,IAAA,mBAAgBW,QAA8B;CAC5CA,IAAIC,KAAK9C,OAAcC,MAAM;AAC/B"}
+{"version":3,"file":"handler-DH9FPTNh.js","names":["Api","ApiHandler","Ctx","models","verifyPasswordFromStorage","completeAuthSignIn","AuthSessionUser","SignIn","signIn","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","password","data","user","findOne","tenants","tenantRoles","stored","String","passwordMatches","startsWith","console","warn","_id","toString","signedInTenants","map","defaultTenantId","tenantId","tenantRolesMap","get","Map","Object","fromEntries","entries","undefined","userId","currentTenantId","length","api","post","ROUTE"],"sources":["../src/api/sign-in/handler.ts"],"sourcesContent":["import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { verifyPasswordFromStorage } from \"@rpcbase/server\"\n\nimport { completeAuthSignIn } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SignIn from \"./index\"\n\n\nconst signIn: ApiHandler<SignIn.RequestPayload, SignIn.ResponsePayload, AuthSessionUser> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SignIn.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = SignIn.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, password } = parsed.data\n\n  const user = await User.findOne({ email }, { password: 1, tenants: 1, tenantRoles: 1 })\n\n  if (!user?.password) {\n    ctx.res.status(401)\n    return { success: false, error: \"invalid_credentials\" }\n  }\n\n  const stored = String(user.password)\n  const passwordMatches = await verifyPasswordFromStorage(password, stored)\n\n  if (!passwordMatches) {\n    if (!stored.startsWith(\"$scrypt$\")) {\n      console.warn(\"auth::sign-in invalid stored password format\", user._id.toString())\n    }\n    ctx.res.status(401)\n    return { success: false, error: \"invalid_credentials\" }\n  }\n\n  const signedInTenants = (user.tenants || []).map(String)\n  const defaultTenantId = signedInTenants[0]\n  if (!defaultTenantId) {\n    ctx.res.status(500)\n    return { success: false, error: \"tenant_unavailable\" }\n  }\n  const tenantId = defaultTenantId\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n\n  if (!completeAuthSignIn(ctx, {\n    userId: user._id.toString(),\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    ctx.res.status(500)\n    return { success: false, error: \"session_unavailable\" }\n  }\n\n  return { success: true, userId: user._id.toString(), tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SignIn.ROUTE, signIn)\n}\n"],"mappings":";;;;;AAUA,IAAMQ,SAAqF,OACzFG,SACAC,QACoC;CACpC,MAAME,OAAO,MAAMX,OAAOY,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAA8BE,UAAUP,OAAO;CAErD,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,aAAaR,OAAOS;CAEnC,MAAMC,OAAO,MAAMZ,KAAKa,QAAQ,EAAEJ,MAAM,GAAG;EAAEC,UAAU;EAAGI,SAAS;EAAGC,aAAa;CAAE,CAAC;CAEtF,IAAI,CAACH,MAAMF,UAAU;EACnBZ,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,MAAMQ,SAASC,OAAOL,KAAKF,QAAQ;CAGnC,IAAI,CAACQ,MAFyB5B,0BAA0BoB,UAAUM,MAAM,GAElD;EACpB,IAAI,CAACA,OAAOG,WAAW,UAAU,GAC/BC,QAAQC,KAAK,gDAAgDT,KAAKU,IAAIC,SAAS,CAAC;EAElFzB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,MAAMgB,mBAAmBZ,KAAKE,WAAW,CAAA,EAAA,CAAIW,IAAIR,MAAM;CACvD,MAAMS,kBAAkBF,gBAAgB;CACxC,IAAI,CAACE,iBAAiB;EACpB5B,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAqB;CACvD;CACA,MAAMmB,WAAWD;CACjB,MAAME,iBAAiBhB,KAAKiB,IAAI,aAAa;CAC7C,MAAMd,cAAca,iBAAiBG,OAAOC,YAAYJ,eAAeK,QAAQ,CAAC,IAAIC,KAAAA;CAEpF,IAAI,CAAC3C,mBAAmBO,KAAK;EAC3BqC,QAAQvB,KAAKU,IAAIC,SAAS;EAC1Ba,iBAAiBT;EACjBH,iBAAiBA,gBAAgBa,SAASb,kBAAkB,CAACG,QAAQ;EACrEZ;CACF,CAAC,GAAG;EACFjB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAsB;CACxD;CAEA,OAAO;EAAEH,SAAS;EAAM8B,QAAQvB,KAAKU,IAAIC,SAAS;EAAGI;CAAS;AAChE;AAEA,IAAA,mBAAgBW,QAA8B;CAC5CA,IAAIC,KAAK9C,OAAcC,MAAM;AAC/B"}

package/dist/{handler-IBGVDW5w.js → handler-DOaODKMb.js}

@@ -3,7 +3,7 @@ import crypto from "crypto";
 import { models } from "@rpcbase/db";
 import { sendEmail } from "@rpcbase/server";
 //#region src/api/request-password-reset/index.ts
-var Route = "/api/rb/auth/request-password-reset";
+var ROUTE = "/api/rb/auth/request-password-reset";
 var requestSchema = object({ email: string().email() });
 object({
 	success: boolean(),
@@ -117,9 +117,9 @@ var requestPasswordReset = async (payload, ctx) => {
 	};
 };
 var handler_default = (api) => {
-	api.post(Route, requestPasswordReset);
+	api.post(ROUTE, requestPasswordReset);
 };
 //#endregion
 export { PASSWORD_RESET_COOLDOWN_SECONDS, handler_default as default, requestPasswordReset };
 
-//# sourceMappingURL=handler-IBGVDW5w.js.map
+//# sourceMappingURL=handler-DOaODKMb.js.map

package/dist/{handler-IBGVDW5w.js.map → handler-DOaODKMb.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-IBGVDW5w.js","names":["z","Route","requestSchema","object","email","string","RequestPayload","infer","responseSchema","success","boolean","error","optional","retryAfterSeconds","number","int","positive","ResponsePayload","crypto","Api","ApiHandler","Ctx","models","sendEmail","AuthSessionUser","RequestPasswordReset","PASSWORD_RESET_COOLDOWN_SECONDS","PASSWORD_RESET_CODE_TTL_SECONDS","maskEmailForLog","email","localRaw","domainRaw","split","local","domain","localPrefix","slice","Math","min","length","localMask","repeat","max","domainTailLength","domainTail","domainMask","requestPasswordReset","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","data","requestedAt","Date","cooldownEligibleExpiresAt","getTime","passwordResetCode","randomInt","toString","padStart","passwordResetCodeExpiresAt","user","findOneAndUpdate","$or","$exists","$lte","$set","$unset","passwordResetToken","passwordResetTokenExpiresAt","returnDocument","setHeader","String","existingUser","findOne","_id","console","info","to","subject","html","text","err","retryAfterSeconds","releaseResult","updateOne","modifiedCount","removeHeader","releaseErr","api","post","Route"],"sources":["../src/api/request-password-reset/index.ts","../src/api/request-password-reset/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/request-password-reset\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  retryAfterSeconds: z.number().int().positive().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as RequestPasswordReset from \"./index\"\n\n\nexport const PASSWORD_RESET_COOLDOWN_SECONDS = 60\nconst PASSWORD_RESET_CODE_TTL_SECONDS = 10 * 60\n\nconst maskEmailForLog = (email: string) => {\n  const [localRaw, domainRaw = \"\"] = email.split(\"@\")\n  const local = localRaw || \"\"\n  const domain = domainRaw || \"\"\n  const localPrefix = local.slice(0, Math.min(3, local.length))\n  const localMask = \"*\".repeat(Math.max(5, local.length - localPrefix.length))\n\n  if (!domain) {\n    return `${localPrefix}${localMask}@****`\n  }\n\n  const domainTailLength = Math.min(7, domain.length)\n  const domainTail = domain.slice(-domainTailLength)\n  const domainMask = \"*\".repeat(Math.max(4, domain.length - domainTailLength))\n\n  return `${localPrefix}${localMask}@${domainMask}${domainTail}`\n}\n\n\nexport const requestPasswordReset: ApiHandler<\n  RequestPasswordReset.RequestPayload,\n  RequestPasswordReset.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<RequestPasswordReset.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = RequestPasswordReset.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email } = parsed.data\n  const requestedAt = new Date()\n  const cooldownEligibleExpiresAt = new Date(\n    requestedAt.getTime() + (PASSWORD_RESET_CODE_TTL_SECONDS - PASSWORD_RESET_COOLDOWN_SECONDS) * 1000,\n  )\n  const passwordResetCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const passwordResetCodeExpiresAt = new Date(requestedAt.getTime() + PASSWORD_RESET_CODE_TTL_SECONDS * 1000)\n\n  const user = await User.findOneAndUpdate(\n    {\n      email,\n      $or: [\n        { passwordResetCodeExpiresAt: { $exists: false } },\n        { passwordResetCodeExpiresAt: { $lte: cooldownEligibleExpiresAt } },\n      ],\n    },\n    {\n      $set: {\n        passwordResetCode,\n        passwordResetCodeExpiresAt,\n      },\n      $unset: {\n        passwordResetToken: \"\",\n        passwordResetTokenExpiresAt: \"\",\n      },\n    },\n    { returnDocument: \"after\" },\n  )\n\n  ctx.res.setHeader(\"Retry-After\", String(PASSWORD_RESET_COOLDOWN_SECONDS))\n\n  if (!user) {\n    const existingUser = await User.findOne({ email }, { _id: 1 })\n\n    if (!existingUser) {\n      try {\n        console.info(`sending password reset account notice to email ${maskEmailForLog(email)}`)\n        await sendEmail({\n          to: email,\n          subject: \"No account found for your password reset request\",\n          html: `\n            <p>Hello,</p>\n            <p>You requested a new password reset code for this email address, but unfortunately we couldn't find an account associated with it.</p>\n            <p>If you didn't request this, you can ignore this message.</p>\n            <p>If you're having trouble accessing your account, please contact support.</p>\n          `,\n          text: \"Hello, You requested a new password reset code for this email address, but unfortunately we couldn't find an account associated with it. If you didn't request this, you can ignore this message. If you're having trouble accessing your account, please contact support.\",\n        })\n      } catch (err) {\n        console.error(\"failed to send password reset account notice email\", err)\n        ctx.res.status(500)\n        return { success: false, error: \"email_delivery_failed\" }\n      }\n    }\n\n    return { success: true, retryAfterSeconds: PASSWORD_RESET_COOLDOWN_SECONDS }\n  }\n\n  try {\n    console.info(`sending password reset to email ${maskEmailForLog(email)}`)\n    await sendEmail({\n      to: email,\n      subject: `Your password reset code: ${passwordResetCode}`,\n      html: `\n        <p>Your password reset code is <strong>${passwordResetCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Your password reset code is ${passwordResetCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to send password reset email\", err)\n\n    try {\n      const releaseResult = await User.updateOne(\n        { _id: user._id, passwordResetCode },\n        {\n          $unset: {\n            passwordResetCode: \"\",\n            passwordResetCodeExpiresAt: \"\",\n          },\n        },\n      )\n      if (releaseResult.modifiedCount > 0) {\n        ctx.res.removeHeader(\"Retry-After\")\n      }\n    } catch (releaseErr) {\n      console.error(\"failed to release password reset cooldown\", releaseErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  return { success: true, retryAfterSeconds: PASSWORD_RESET_COOLDOWN_SECONDS }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(RequestPasswordReset.Route, requestPasswordReset)\n}\n"],"mappings":";;;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS,EACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM,EAC1B,CAAC;AAI6BJ,OAAS;CACrCS,SAAST,QAAU;CACnBW,OAAOX,OAAS,CAAC,CAACY,SAAS;CAC3BC,mBAAmBb,OAAS,CAAC,CAACe,IAAI,CAAC,CAACC,SAAS,CAAC,CAACJ,SAAS;AAC1D,CAAC;;;ACJD,IAAac,kCAAkC;AAC/C,IAAMC,kCAAkC;AAExC,IAAMC,mBAAmBC,UAAkB;CACzC,MAAM,CAACC,UAAUC,YAAY,MAAMF,MAAMG,MAAM,GAAG;CAClD,MAAMC,QAAQH,YAAY;CAC1B,MAAMI,SAASH,aAAa;CAC5B,MAAMI,cAAcF,MAAMG,MAAM,GAAGC,KAAKC,IAAI,GAAGL,MAAMM,MAAM,CAAC;CAC5D,MAAMC,YAAY,IAAIC,OAAOJ,KAAKK,IAAI,GAAGT,MAAMM,SAASJ,YAAYI,MAAM,CAAC;CAE3E,IAAI,CAACL,QACH,OAAO,GAAGC,cAAcK,UAAS;CAGnC,MAAMG,mBAAmBN,KAAKC,IAAI,GAAGJ,OAAOK,MAAM;CAClD,MAAMK,aAAaV,OAAOE,MAAM,CAACO,gBAAgB;CAGjD,OAAO,GAAGR,cAAcK,UAAS,GAFd,IAAIC,OAAOJ,KAAKK,IAAI,GAAGR,OAAOK,SAASI,gBAAgB,CAErCE,IAAaD;AACpD;AAGA,IAAaE,uBAIT,OACFG,SACAC,QACkD;CAClD,MAAME,OAAO,MAAM9B,OAAO+B,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAA4CE,UAAUP,OAAO;CAEnE,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAE/B,UAAUyB,OAAOO;CACzB,MAAMC,8BAAc,IAAIC,KAAK;CAC7B,MAAMC,4BAA4B,IAAID,KACpCD,YAAYG,QAAQ,KAAKtC,kCAAAA,MAAqE,GAChG;CACA,MAAMuC,oBAAoBhD,OAAOiD,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACnF,MAAMC,6BAA6B,IAAIP,KAAKD,YAAYG,QAAQ,IAAItC,kCAAkC,GAAI;CAE1G,MAAM4C,OAAO,MAAMnB,KAAKoB,iBACtB;EACE3C;EACA4C,KAAK,CACH,EAAEH,4BAA4B,EAAEI,SAAS,MAAM,EAAE,GACjD,EAAEJ,4BAA4B,EAAEK,MAAMX,0BAA0B,EAAE,CAAC;CAEvE,GACA;EACEY,MAAM;GACJV;GACAI;EACF;EACAO,QAAQ;GACNC,oBAAoB;GACpBC,6BAA6B;EAC/B;CACF,GACA,EAAEC,gBAAgB,QAAQ,CAC5B;CAEA9B,IAAIQ,IAAIuB,UAAU,eAAeC,OAAAA,EAAsC,CAAC;CAExE,IAAI,CAACX,MAAM;EAGT,IAAI,CAACY,MAFsB/B,KAAKgC,QAAQ,EAAEvD,MAAM,GAAG,EAAEwD,KAAK,EAAE,CAAC,GAG3D,IAAI;GACFC,QAAQC,KAAK,kDAAkD3D,gBAAgBC,KAAK,GAAG;GACvF,MAAMN,UAAU;IACdiE,IAAI3D;IACJ4D,SAAS;IACTC,MAAM;;;;;;IAMNC,MAAM;GACR,CAAC;EACH,SAASC,KAAK;GACZN,QAAQ1B,MAAM,sDAAsDgC,GAAG;GACvE1C,IAAIQ,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEF,SAAS;IAAOG,OAAO;GAAwB;EAC1D;EAGF,OAAO;GAAEH,SAAS;GAAMoC,mBAAAA;EAAmD;CAC7E;CAEA,IAAI;EACFP,QAAQC,KAAK,mCAAmC3D,gBAAgBC,KAAK,GAAG;EACxE,MAAMN,UAAU;GACdiE,IAAI3D;GACJ4D,SAAS,6BAA6BvB;GACtCwB,MAAM;iDACqCxB,kBAAiB;;;GAG5DyB,MAAM,+BAA+BzB,kBAAiB;EACxD,CAAC;CACH,SAAS0B,KAAK;EACZN,QAAQ1B,MAAM,uCAAuCgC,GAAG;EAExD,IAAI;GAUF,KAAIE,MATwB1C,KAAK2C,UAC/B;IAAEV,KAAKd,KAAKc;IAAKnB;GAAkB,GACnC,EACEW,QAAQ;IACNX,mBAAmB;IACnBI,4BAA4B;GAC9B,EACF,CACF,EAAA,CACkB0B,gBAAgB,GAChC9C,IAAIQ,IAAIuC,aAAa,aAAa;EAEtC,SAASC,YAAY;GACnBZ,QAAQ1B,MAAM,6CAA6CsC,UAAU;EACvE;EAEAhD,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,OAAO;EAAEH,SAAS;EAAMoC,mBAAAA;CAAmD;AAC7E;AAEA,IAAA,mBAAgBM,QAA8B;CAC5CA,IAAIC,KAAK3E,OAA4BqB,oBAAoB;AAC3D"}
+{"version":3,"file":"handler-DOaODKMb.js","names":["z","ROUTE","requestSchema","object","email","string","RequestPayload","infer","responseSchema","success","boolean","error","optional","retryAfterSeconds","number","int","positive","ResponsePayload","crypto","Api","ApiHandler","Ctx","models","sendEmail","AuthSessionUser","RequestPasswordReset","PASSWORD_RESET_COOLDOWN_SECONDS","PASSWORD_RESET_CODE_TTL_SECONDS","maskEmailForLog","email","localRaw","domainRaw","split","local","domain","localPrefix","slice","Math","min","length","localMask","repeat","max","domainTailLength","domainTail","domainMask","requestPasswordReset","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","data","requestedAt","Date","cooldownEligibleExpiresAt","getTime","passwordResetCode","randomInt","toString","padStart","passwordResetCodeExpiresAt","user","findOneAndUpdate","$or","$exists","$lte","$set","$unset","passwordResetToken","passwordResetTokenExpiresAt","returnDocument","setHeader","String","existingUser","findOne","_id","console","info","to","subject","html","text","err","retryAfterSeconds","releaseResult","updateOne","modifiedCount","removeHeader","releaseErr","api","post","ROUTE"],"sources":["../src/api/request-password-reset/index.ts","../src/api/request-password-reset/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/request-password-reset\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  retryAfterSeconds: z.number().int().positive().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { sendEmail } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as RequestPasswordReset from \"./index\"\n\n\nexport const PASSWORD_RESET_COOLDOWN_SECONDS = 60\nconst PASSWORD_RESET_CODE_TTL_SECONDS = 10 * 60\n\nconst maskEmailForLog = (email: string) => {\n  const [localRaw, domainRaw = \"\"] = email.split(\"@\")\n  const local = localRaw || \"\"\n  const domain = domainRaw || \"\"\n  const localPrefix = local.slice(0, Math.min(3, local.length))\n  const localMask = \"*\".repeat(Math.max(5, local.length - localPrefix.length))\n\n  if (!domain) {\n    return `${localPrefix}${localMask}@****`\n  }\n\n  const domainTailLength = Math.min(7, domain.length)\n  const domainTail = domain.slice(-domainTailLength)\n  const domainMask = \"*\".repeat(Math.max(4, domain.length - domainTailLength))\n\n  return `${localPrefix}${localMask}@${domainMask}${domainTail}`\n}\n\n\nexport const requestPasswordReset: ApiHandler<\n  RequestPasswordReset.RequestPayload,\n  RequestPasswordReset.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<RequestPasswordReset.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = RequestPasswordReset.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email } = parsed.data\n  const requestedAt = new Date()\n  const cooldownEligibleExpiresAt = new Date(\n    requestedAt.getTime() + (PASSWORD_RESET_CODE_TTL_SECONDS - PASSWORD_RESET_COOLDOWN_SECONDS) * 1000,\n  )\n  const passwordResetCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const passwordResetCodeExpiresAt = new Date(requestedAt.getTime() + PASSWORD_RESET_CODE_TTL_SECONDS * 1000)\n\n  const user = await User.findOneAndUpdate(\n    {\n      email,\n      $or: [\n        { passwordResetCodeExpiresAt: { $exists: false } },\n        { passwordResetCodeExpiresAt: { $lte: cooldownEligibleExpiresAt } },\n      ],\n    },\n    {\n      $set: {\n        passwordResetCode,\n        passwordResetCodeExpiresAt,\n      },\n      $unset: {\n        passwordResetToken: \"\",\n        passwordResetTokenExpiresAt: \"\",\n      },\n    },\n    { returnDocument: \"after\" },\n  )\n\n  ctx.res.setHeader(\"Retry-After\", String(PASSWORD_RESET_COOLDOWN_SECONDS))\n\n  if (!user) {\n    const existingUser = await User.findOne({ email }, { _id: 1 })\n\n    if (!existingUser) {\n      try {\n        console.info(`sending password reset account notice to email ${maskEmailForLog(email)}`)\n        await sendEmail({\n          to: email,\n          subject: \"No account found for your password reset request\",\n          html: `\n            <p>Hello,</p>\n            <p>You requested a new password reset code for this email address, but unfortunately we couldn't find an account associated with it.</p>\n            <p>If you didn't request this, you can ignore this message.</p>\n            <p>If you're having trouble accessing your account, please contact support.</p>\n          `,\n          text: \"Hello, You requested a new password reset code for this email address, but unfortunately we couldn't find an account associated with it. If you didn't request this, you can ignore this message. If you're having trouble accessing your account, please contact support.\",\n        })\n      } catch (err) {\n        console.error(\"failed to send password reset account notice email\", err)\n        ctx.res.status(500)\n        return { success: false, error: \"email_delivery_failed\" }\n      }\n    }\n\n    return { success: true, retryAfterSeconds: PASSWORD_RESET_COOLDOWN_SECONDS }\n  }\n\n  try {\n    console.info(`sending password reset to email ${maskEmailForLog(email)}`)\n    await sendEmail({\n      to: email,\n      subject: `Your password reset code: ${passwordResetCode}`,\n      html: `\n        <p>Your password reset code is <strong>${passwordResetCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Your password reset code is ${passwordResetCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to send password reset email\", err)\n\n    try {\n      const releaseResult = await User.updateOne(\n        { _id: user._id, passwordResetCode },\n        {\n          $unset: {\n            passwordResetCode: \"\",\n            passwordResetCodeExpiresAt: \"\",\n          },\n        },\n      )\n      if (releaseResult.modifiedCount > 0) {\n        ctx.res.removeHeader(\"Retry-After\")\n      }\n    } catch (releaseErr) {\n      console.error(\"failed to release password reset cooldown\", releaseErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  return { success: true, retryAfterSeconds: PASSWORD_RESET_COOLDOWN_SECONDS }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(RequestPasswordReset.ROUTE, requestPasswordReset)\n}\n"],"mappings":";;;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS,EACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM,EAC1B,CAAC;AAI6BJ,OAAS;CACrCS,SAAST,QAAU;CACnBW,OAAOX,OAAS,CAAC,CAACY,SAAS;CAC3BC,mBAAmBb,OAAS,CAAC,CAACe,IAAI,CAAC,CAACC,SAAS,CAAC,CAACJ,SAAS;AAC1D,CAAC;;;ACJD,IAAac,kCAAkC;AAC/C,IAAMC,kCAAkC;AAExC,IAAMC,mBAAmBC,UAAkB;CACzC,MAAM,CAACC,UAAUC,YAAY,MAAMF,MAAMG,MAAM,GAAG;CAClD,MAAMC,QAAQH,YAAY;CAC1B,MAAMI,SAASH,aAAa;CAC5B,MAAMI,cAAcF,MAAMG,MAAM,GAAGC,KAAKC,IAAI,GAAGL,MAAMM,MAAM,CAAC;CAC5D,MAAMC,YAAY,IAAIC,OAAOJ,KAAKK,IAAI,GAAGT,MAAMM,SAASJ,YAAYI,MAAM,CAAC;CAE3E,IAAI,CAACL,QACH,OAAO,GAAGC,cAAcK,UAAS;CAGnC,MAAMG,mBAAmBN,KAAKC,IAAI,GAAGJ,OAAOK,MAAM;CAClD,MAAMK,aAAaV,OAAOE,MAAM,CAACO,gBAAgB;CAGjD,OAAO,GAAGR,cAAcK,UAAS,GAFd,IAAIC,OAAOJ,KAAKK,IAAI,GAAGR,OAAOK,SAASI,gBAAgB,CAErCE,IAAaD;AACpD;AAGA,IAAaE,uBAIT,OACFG,SACAC,QACkD;CAClD,MAAME,OAAO,MAAM9B,OAAO+B,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAA4CE,UAAUP,OAAO;CAEnE,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAE/B,UAAUyB,OAAOO;CACzB,MAAMC,8BAAc,IAAIC,KAAK;CAC7B,MAAMC,4BAA4B,IAAID,KACpCD,YAAYG,QAAQ,KAAKtC,kCAAAA,MAAqE,GAChG;CACA,MAAMuC,oBAAoBhD,OAAOiD,UAAU,GAAG,GAAS,CAAC,CAACC,SAAS,CAAC,CAACC,SAAS,GAAG,GAAG;CACnF,MAAMC,6BAA6B,IAAIP,KAAKD,YAAYG,QAAQ,IAAItC,kCAAkC,GAAI;CAE1G,MAAM4C,OAAO,MAAMnB,KAAKoB,iBACtB;EACE3C;EACA4C,KAAK,CACH,EAAEH,4BAA4B,EAAEI,SAAS,MAAM,EAAE,GACjD,EAAEJ,4BAA4B,EAAEK,MAAMX,0BAA0B,EAAE,CAAC;CAEvE,GACA;EACEY,MAAM;GACJV;GACAI;EACF;EACAO,QAAQ;GACNC,oBAAoB;GACpBC,6BAA6B;EAC/B;CACF,GACA,EAAEC,gBAAgB,QAAQ,CAC5B;CAEA9B,IAAIQ,IAAIuB,UAAU,eAAeC,OAAAA,EAAsC,CAAC;CAExE,IAAI,CAACX,MAAM;EAGT,IAAI,CAACY,MAFsB/B,KAAKgC,QAAQ,EAAEvD,MAAM,GAAG,EAAEwD,KAAK,EAAE,CAAC,GAG3D,IAAI;GACFC,QAAQC,KAAK,kDAAkD3D,gBAAgBC,KAAK,GAAG;GACvF,MAAMN,UAAU;IACdiE,IAAI3D;IACJ4D,SAAS;IACTC,MAAM;;;;;;IAMNC,MAAM;GACR,CAAC;EACH,SAASC,KAAK;GACZN,QAAQ1B,MAAM,sDAAsDgC,GAAG;GACvE1C,IAAIQ,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEF,SAAS;IAAOG,OAAO;GAAwB;EAC1D;EAGF,OAAO;GAAEH,SAAS;GAAMoC,mBAAAA;EAAmD;CAC7E;CAEA,IAAI;EACFP,QAAQC,KAAK,mCAAmC3D,gBAAgBC,KAAK,GAAG;EACxE,MAAMN,UAAU;GACdiE,IAAI3D;GACJ4D,SAAS,6BAA6BvB;GACtCwB,MAAM;iDACqCxB,kBAAiB;;;GAG5DyB,MAAM,+BAA+BzB,kBAAiB;EACxD,CAAC;CACH,SAAS0B,KAAK;EACZN,QAAQ1B,MAAM,uCAAuCgC,GAAG;EAExD,IAAI;GAUF,KAAIE,MATwB1C,KAAK2C,UAC/B;IAAEV,KAAKd,KAAKc;IAAKnB;GAAkB,GACnC,EACEW,QAAQ;IACNX,mBAAmB;IACnBI,4BAA4B;GAC9B,EACF,CACF,EAAA,CACkB0B,gBAAgB,GAChC9C,IAAIQ,IAAIuC,aAAa,aAAa;EAEtC,SAASC,YAAY;GACnBZ,QAAQ1B,MAAM,6CAA6CsC,UAAU;EACvE;EAEAhD,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAwB;CAC1D;CAEA,OAAO;EAAEH,SAAS;EAAMoC,mBAAAA;CAAmD;AAC7E;AAEA,IAAA,mBAAgBM,QAA8B;CAC5CA,IAAIC,KAAK3E,OAA4BqB,oBAAoB;AAC3D"}

package/dist/{handler-BGNM_dz1.js → handler-DQvdRpG2.js}

@@ -1,6 +1,6 @@
 import { i as object, n as boolean } from "./schemas-BgOpQqUv.js";
 //#region src/api/sign-out/index.ts
-var Route = "/api/rb/auth/sign-out";
+var ROUTE = "/api/rb/auth/sign-out";
 object({});
 object({ success: boolean() });
 //#endregion
@@ -11,9 +11,9 @@ var handleSignOut = async (_, ctx) => {
 	return { success: true };
 };
 var handler_default = (api) => {
-	api.post(Route, handleSignOut);
+	api.post(ROUTE, handleSignOut);
 };
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-BGNM_dz1.js.map
+//# sourceMappingURL=handler-DQvdRpG2.js.map

package/dist/{handler-BGNM_dz1.js.map → handler-DQvdRpG2.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-BGNM_dz1.js","names":["z","Route","requestSchema","object","RequestPayload","infer","responseSchema","success","boolean","ResponsePayload","Api","Ctx","SignOut","handleSignOut","_","RequestPayload","ctx","Promise","ResponsePayload","req","session","success","resolve","destroy","api","post","Route"],"sources":["../src/api/sign-out/index.ts","../src/api/sign-out/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/sign-out\"\n\n// No request payload needed for signout\nexport const requestSchema = z.object({})\n\nexport type RequestPayload = z.infer<typeof requestSchema>;\n\nexport const responseSchema = z.object({\n  success: z.boolean()\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>;\n","import { Api, Ctx } from \"@rpcbase/api\"\n\nimport * as SignOut from \"./index\"\n\n\nconst handleSignOut = async(_: SignOut.RequestPayload, ctx: Ctx): Promise<SignOut.ResponsePayload> => {\n  // Destroy the session\n  if (!ctx.req.session) {\n    return { success: true }\n  }\n\n  await new Promise<void>((resolve) => ctx.req.session!.destroy(() => resolve()))\n\n  return {\n    success: true\n  }\n}\n\nexport default (api: Api) => {\n  api.post(SignOut.Route, handleSignOut)\n}\n"],"mappings":";;AAGA,IAAaC,QAAQ;AAGQD,OAAS,CAAC,CAAC;AAIVA,OAAS,EACrCO,SAASP,QAAU,EACrB,CAAC;;;ACPD,IAAMa,gBAAgB,OAAMC,GAA2BE,QAA+C;CAEpG,IAAI,CAACA,IAAIG,IAAIC,SACX,OAAO,EAAEC,SAAS,KAAK;CAGzB,MAAM,IAAIJ,SAAeK,YAAYN,IAAIG,IAAIC,QAASG,cAAcD,QAAQ,CAAC,CAAC;CAE9E,OAAO,EACLD,SAAS,KACX;AACF;AAEA,IAAA,mBAAgBG,QAAa;CAC3BA,IAAIC,KAAKb,OAAeC,aAAa;AACvC"}
+{"version":3,"file":"handler-DQvdRpG2.js","names":["z","ROUTE","requestSchema","object","RequestPayload","infer","responseSchema","success","boolean","ResponsePayload","Api","Ctx","SignOut","handleSignOut","_","RequestPayload","ctx","Promise","ResponsePayload","req","session","success","resolve","destroy","api","post","ROUTE"],"sources":["../src/api/sign-out/index.ts","../src/api/sign-out/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/sign-out\"\n\n// No request payload needed for signout\nexport const requestSchema = z.object({})\n\nexport type RequestPayload = z.infer<typeof requestSchema>;\n\nexport const responseSchema = z.object({\n  success: z.boolean()\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>;\n","import { Api, Ctx } from \"@rpcbase/api\"\n\nimport * as SignOut from \"./index\"\n\n\nconst handleSignOut = async(_: SignOut.RequestPayload, ctx: Ctx): Promise<SignOut.ResponsePayload> => {\n  // Destroy the session\n  if (!ctx.req.session) {\n    return { success: true }\n  }\n\n  await new Promise<void>((resolve) => ctx.req.session!.destroy(() => resolve()))\n\n  return {\n    success: true\n  }\n}\n\nexport default (api: Api) => {\n  api.post(SignOut.ROUTE, handleSignOut)\n}\n"],"mappings":";;AAGA,IAAaC,QAAQ;AAGQD,OAAS,CAAC,CAAC;AAIVA,OAAS,EACrCO,SAASP,QAAU,EACrB,CAAC;;;ACPD,IAAMa,gBAAgB,OAAMC,GAA2BE,QAA+C;CAEpG,IAAI,CAACA,IAAIG,IAAIC,SACX,OAAO,EAAEC,SAAS,KAAK;CAGzB,MAAM,IAAIJ,SAAeK,YAAYN,IAAIG,IAAIC,QAASG,cAAcD,QAAQ,CAAC,CAAC;CAE9E,OAAO,EACLD,SAAS,KACX;AACF;AAEA,IAAA,mBAAgBG,QAAa;CAC3BA,IAAIC,KAAKb,OAAeC,aAAa;AACvC"}

package/dist/{handler-J2OwFTyf.js → handler-DoyR_l2O.js}

@@ -2,7 +2,7 @@ import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
 import { models } from "@rpcbase/db";
 import { hashPasswordForStorage } from "@rpcbase/server";
 //#region src/api/set-new-password/index.ts
-var Route = "/api/rb/auth/set-new-password";
+var ROUTE = "/api/rb/auth/set-new-password";
 var requestSchema = object({
 	email: string().email(),
 	resetToken: string().min(1),
@@ -43,9 +43,9 @@ var setNewPassword = async (payload, ctx) => {
 	return { success: true };
 };
 var handler_default = (api) => {
-	api.post(Route, setNewPassword);
+	api.post(ROUTE, setNewPassword);
 };
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-J2OwFTyf.js.map
+//# sourceMappingURL=handler-DoyR_l2O.js.map

package/dist/{handler-J2OwFTyf.js.map → handler-DoyR_l2O.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-J2OwFTyf.js","names":["z","Route","requestSchema","object","email","string","resetToken","min","password","message","RequestPayload","infer","responseSchema","success","boolean","error","optional","ResponsePayload","Api","ApiHandler","Ctx","models","hashPasswordForStorage","AuthSessionUser","SetNewPassword","setNewPassword","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","resetToken","password","data","user","findOne","storedToken","passwordResetToken","tokenExpiresAt","passwordResetTokenExpiresAt","isExpired","Date","getTime","now","hashedPassword","undefined","save","api","post","Route"],"sources":["../src/api/set-new-password/index.ts","../src/api/set-new-password/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/set-new-password\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n  resetToken: z.string().min(1),\n  password: z.string().min(8, { message: \"Password must be at least 8 characters long.\" }),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetNewPassword from \"./index\"\n\n\nconst setNewPassword: ApiHandler<\n  SetNewPassword.RequestPayload,\n  SetNewPassword.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetNewPassword.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = SetNewPassword.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, resetToken, password } = parsed.data\n\n  const user = await User.findOne({ email })\n  const storedToken = user?.passwordResetToken\n  const tokenExpiresAt = user?.passwordResetTokenExpiresAt\n  const isExpired = tokenExpiresAt instanceof Date && tokenExpiresAt.getTime() < Date.now()\n\n  if (!user || !storedToken || storedToken !== resetToken || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_token\" }\n  }\n\n  const hashedPassword = await hashPasswordForStorage(password)\n  user.password = hashedPassword\n  user.passwordResetToken = undefined\n  user.passwordResetTokenExpiresAt = undefined\n  await user.save()\n\n  return { success: true }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SetNewPassword.Route, setNewPassword)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM;CACxBE,YAAYN,OAAS,CAAC,CAACO,IAAI,CAAC;CAC5BC,UAAUR,OAAS,CAAC,CAACO,IAAI,GAAG,EAAEE,SAAS,+CAA+C,CAAC;AACzF,CAAC;AAI6BT,OAAS;CACrCa,SAASb,QAAU;CACnBe,OAAOf,OAAS,CAAC,CAACgB,SAAS;AAC7B,CAAC;;;ACPD,IAAMS,iBAIF,OACFG,SACAC,QAC4C;CAC5C,MAAME,OAAO,MAAMV,OAAOW,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAAsCE,UAAUP,OAAO;CAE7D,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,YAAYC,aAAaT,OAAOU;CAE/C,MAAMC,OAAO,MAAMb,KAAKc,QAAQ,EAAEL,MAAM,CAAC;CACzC,MAAMM,cAAcF,MAAMG;CAC1B,MAAMC,iBAAiBJ,MAAMK;CAC7B,MAAMC,YAAYF,0BAA0BG,QAAQH,eAAeI,QAAQ,IAAID,KAAKE,IAAI;CAExF,IAAI,CAACT,QAAQ,CAACE,eAAeA,gBAAgBL,cAAcS,WAAW;EACpErB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAgB;CAClD;CAGAK,KAAKF,WAAWY,MADahC,uBAAuBoB,QAAQ;CAE5DE,KAAKG,qBAAqBQ,KAAAA;CAC1BX,KAAKK,8BAA8BM,KAAAA;CACnC,MAAMX,KAAKY,KAAK;CAEhB,OAAO,EAAEpB,SAAS,KAAK;AACzB;AAEA,IAAA,mBAAgBqB,QAA8B;CAC5CA,IAAIC,KAAKlC,OAAsBC,cAAc;AAC/C"}
+{"version":3,"file":"handler-DoyR_l2O.js","names":["z","ROUTE","requestSchema","object","email","string","resetToken","min","password","message","RequestPayload","infer","responseSchema","success","boolean","error","optional","ResponsePayload","Api","ApiHandler","Ctx","models","hashPasswordForStorage","AuthSessionUser","SetNewPassword","setNewPassword","RequestPayload","ResponsePayload","payload","ctx","Promise","User","getGlobal","parsed","requestSchema","safeParse","success","res","status","error","email","resetToken","password","data","user","findOne","storedToken","passwordResetToken","tokenExpiresAt","passwordResetTokenExpiresAt","isExpired","Date","getTime","now","hashedPassword","undefined","save","api","post","ROUTE"],"sources":["../src/api/set-new-password/index.ts","../src/api/set-new-password/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/set-new-password\"\n\nexport const requestSchema = z.object({\n  email: z.string().email(),\n  resetToken: z.string().min(1),\n  password: z.string().min(8, { message: \"Password must be at least 8 characters long.\" }),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetNewPassword from \"./index\"\n\n\nconst setNewPassword: ApiHandler<\n  SetNewPassword.RequestPayload,\n  SetNewPassword.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetNewPassword.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = SetNewPassword.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, resetToken, password } = parsed.data\n\n  const user = await User.findOne({ email })\n  const storedToken = user?.passwordResetToken\n  const tokenExpiresAt = user?.passwordResetTokenExpiresAt\n  const isExpired = tokenExpiresAt instanceof Date && tokenExpiresAt.getTime() < Date.now()\n\n  if (!user || !storedToken || storedToken !== resetToken || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_token\" }\n  }\n\n  const hashedPassword = await hashPasswordForStorage(password)\n  user.password = hashedPassword\n  user.passwordResetToken = undefined\n  user.passwordResetTokenExpiresAt = undefined\n  await user.save()\n\n  return { success: true }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SetNewPassword.ROUTE, setNewPassword)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OAAS,CAAC,CAACI,MAAM;CACxBE,YAAYN,OAAS,CAAC,CAACO,IAAI,CAAC;CAC5BC,UAAUR,OAAS,CAAC,CAACO,IAAI,GAAG,EAAEE,SAAS,+CAA+C,CAAC;AACzF,CAAC;AAI6BT,OAAS;CACrCa,SAASb,QAAU;CACnBe,OAAOf,OAAS,CAAC,CAACgB,SAAS;AAC7B,CAAC;;;ACPD,IAAMS,iBAIF,OACFG,SACAC,QAC4C;CAC5C,MAAME,OAAO,MAAMV,OAAOW,UAAU,UAAUH,GAAG;CAEjD,MAAMI,SAAAA,cAAsCE,UAAUP,OAAO;CAE7D,IAAI,CAACK,OAAOG,SAAS;EACnBP,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAEC,OAAOC,YAAYC,aAAaT,OAAOU;CAE/C,MAAMC,OAAO,MAAMb,KAAKc,QAAQ,EAAEL,MAAM,CAAC;CACzC,MAAMM,cAAcF,MAAMG;CAC1B,MAAMC,iBAAiBJ,MAAMK;CAC7B,MAAMC,YAAYF,0BAA0BG,QAAQH,eAAeI,QAAQ,IAAID,KAAKE,IAAI;CAExF,IAAI,CAACT,QAAQ,CAACE,eAAeA,gBAAgBL,cAAcS,WAAW;EACpErB,IAAIQ,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAgB;CAClD;CAGAK,KAAKF,WAAWY,MADahC,uBAAuBoB,QAAQ;CAE5DE,KAAKG,qBAAqBQ,KAAAA;CAC1BX,KAAKK,8BAA8BM,KAAAA;CACnC,MAAMX,KAAKY,KAAK;CAEhB,OAAO,EAAEpB,SAAS,KAAK;AACzB;AAEA,IAAA,mBAAgBqB,QAA8B;CAC5CA,IAAIC,KAAKlC,OAAsBC,cAAc;AAC/C"}

package/dist/{handler-DNxEmrtP.js → handler-J2FOxq-2.js}

@@ -2,7 +2,7 @@ import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
 import { r as restrictSessionMiddleware } from "./middleware-BT3Uput1.js";
 import { t as AUTHENTICATED_TENANT_ID_HEADER } from "./session-BQ06Yo3C.js";
 //#region src/api/set-active-account/index.ts
-var Route = "/api/rb/auth/set-active-account";
+var ROUTE = "/api/rb/auth/set-active-account";
 var requestSchema = object({ tenantId: string().min(1, "Tenant is required") });
 object({
 	success: boolean(),
@@ -58,10 +58,10 @@ var setActiveAccount = async (payload, ctx) => {
 	};
 };
 var handler_default = (api) => {
-	api.use(Route, restrictSessionMiddleware);
-	api.post(Route, setActiveAccount);
+	api.use(ROUTE, restrictSessionMiddleware);
+	api.post(ROUTE, setActiveAccount);
 };
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-DNxEmrtP.js.map
+//# sourceMappingURL=handler-J2FOxq-2.js.map

package/dist/{handler-DNxEmrtP.js.map → handler-J2FOxq-2.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-DNxEmrtP.js","names":["z","Route","requestSchema","object","tenantId","string","min","RequestPayload","infer","responseSchema","success","boolean","error","optional","ResponsePayload","Api","ApiHandler","Ctx","restrictSessionMiddleware","AUTHENTICATED_TENANT_ID_HEADER","AuthSessionUser","SetActiveAccount","setActiveAccount","RequestPayload","ResponsePayload","payload","ctx","Promise","parsed","requestSchema","safeParse","success","res","status","error","sessionUser","req","session","user","id","tenantId","data","trim","signedInTenants","Array","isArray","map","String","length","includes","currentTenantId","setHeader","api","use","Route","post"],"sources":["../src/api/set-active-account/index.ts","../src/api/set-active-account/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/set-active-account\"\n\nexport const requestSchema = z.object({\n  tenantId: z.string().min(1, \"Tenant is required\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\n\nimport { restrictSessionMiddleware } from \"../../middleware\"\nimport { AUTHENTICATED_TENANT_ID_HEADER } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetActiveAccount from \"./index\"\n\n\nconst setActiveAccount: ApiHandler<\n  SetActiveAccount.RequestPayload,\n  SetActiveAccount.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetActiveAccount.ResponsePayload> => {\n  const parsed = SetActiveAccount.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const sessionUser = ctx.req.session?.user\n  if (!sessionUser?.id) {\n    ctx.res.status(401)\n    return { success: false, error: \"unauthorized\" }\n  }\n\n  const tenantId = parsed.data.tenantId.trim()\n  const signedInTenants = Array.isArray(sessionUser.signedInTenants)\n    ? sessionUser.signedInTenants.map(String)\n    : []\n\n  if (signedInTenants.length > 0 && !signedInTenants.includes(tenantId)) {\n    ctx.res.status(403)\n    return { success: false, error: \"invalid_account\" }\n  }\n\n  if (signedInTenants.length === 0) {\n    const currentTenantId = typeof sessionUser.currentTenantId === \"string\" ? sessionUser.currentTenantId.trim() : \"\"\n    if (!currentTenantId || currentTenantId !== tenantId) {\n      ctx.res.status(403)\n      return { success: false, error: \"invalid_account\" }\n    }\n  }\n\n  ctx.req.session.user = {\n    ...sessionUser,\n    currentTenantId: tenantId,\n  }\n  ctx.res.setHeader(AUTHENTICATED_TENANT_ID_HEADER, tenantId)\n\n  return { success: true, tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.use(SetActiveAccount.Route, restrictSessionMiddleware)\n  api.post(SetActiveAccount.Route, setActiveAccount)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS,EACpCI,UAAUJ,OAAS,CAAC,CAACM,IAAI,GAAG,oBAAoB,EAClD,CAAC;AAI6BN,OAAS;CACrCU,SAASV,QAAU;CACnBY,OAAOZ,OAAS,CAAC,CAACa,SAAS;CAC3BT,UAAUJ,OAAS,CAAC,CAACa,SAAS;AAChC,CAAC;;;ACND,IAAMS,mBAIF,OACFG,SACAC,QAC8C;CAC9C,MAAME,SAAAA,cAAwCE,UAAUL,OAAO;CAE/D,IAAI,CAACG,OAAOG,SAAS;EACnBL,IAAIM,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAMC,cAAcT,IAAIU,IAAIC,SAASC;CACrC,IAAI,CAACH,aAAaI,IAAI;EACpBb,IAAIM,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAe;CACjD;CAEA,MAAMM,WAAWZ,OAAOa,KAAKD,SAASE,KAAK;CAC3C,MAAMC,kBAAkBC,MAAMC,QAAQV,YAAYQ,eAAe,IAC7DR,YAAYQ,gBAAgBG,IAAIC,MAAM,IACtC,CAAA;CAEJ,IAAIJ,gBAAgBK,SAAS,KAAK,CAACL,gBAAgBM,SAAST,QAAQ,GAAG;EACrEd,IAAIM,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,IAAIS,gBAAgBK,WAAW,GAAG;EAChC,MAAME,kBAAkB,OAAOf,YAAYe,oBAAoB,WAAWf,YAAYe,gBAAgBR,KAAK,IAAI;EAC/G,IAAI,CAACQ,mBAAmBA,oBAAoBV,UAAU;GACpDd,IAAIM,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEF,SAAS;IAAOG,OAAO;GAAkB;EACpD;CACF;CAEAR,IAAIU,IAAIC,QAAQC,OAAO;EACrB,GAAGH;EACHe,iBAAiBV;CACnB;CACAd,IAAIM,IAAImB,UAAUhC,gCAAgCqB,QAAQ;CAE1D,OAAO;EAAET,SAAS;EAAMS;CAAS;AACnC;AAEA,IAAA,mBAAgBY,QAA8B;CAC5CA,IAAIC,IAAIhC,OAAwBH,yBAAyB;CACzDkC,IAAIG,KAAKlC,OAAwBC,gBAAgB;AACnD"}
+{"version":3,"file":"handler-J2FOxq-2.js","names":["z","ROUTE","requestSchema","object","tenantId","string","min","RequestPayload","infer","responseSchema","success","boolean","error","optional","ResponsePayload","Api","ApiHandler","Ctx","restrictSessionMiddleware","AUTHENTICATED_TENANT_ID_HEADER","AuthSessionUser","SetActiveAccount","setActiveAccount","RequestPayload","ResponsePayload","payload","ctx","Promise","parsed","requestSchema","safeParse","success","res","status","error","sessionUser","req","session","user","id","tenantId","data","trim","signedInTenants","Array","isArray","map","String","length","includes","currentTenantId","setHeader","api","use","ROUTE","post"],"sources":["../src/api/set-active-account/index.ts","../src/api/set-active-account/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/set-active-account\"\n\nexport const requestSchema = z.object({\n  tenantId: z.string().min(1, \"Tenant is required\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\n\nimport { restrictSessionMiddleware } from \"../../middleware\"\nimport { AUTHENTICATED_TENANT_ID_HEADER } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetActiveAccount from \"./index\"\n\n\nconst setActiveAccount: ApiHandler<\n  SetActiveAccount.RequestPayload,\n  SetActiveAccount.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetActiveAccount.ResponsePayload> => {\n  const parsed = SetActiveAccount.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const sessionUser = ctx.req.session?.user\n  if (!sessionUser?.id) {\n    ctx.res.status(401)\n    return { success: false, error: \"unauthorized\" }\n  }\n\n  const tenantId = parsed.data.tenantId.trim()\n  const signedInTenants = Array.isArray(sessionUser.signedInTenants)\n    ? sessionUser.signedInTenants.map(String)\n    : []\n\n  if (signedInTenants.length > 0 && !signedInTenants.includes(tenantId)) {\n    ctx.res.status(403)\n    return { success: false, error: \"invalid_account\" }\n  }\n\n  if (signedInTenants.length === 0) {\n    const currentTenantId = typeof sessionUser.currentTenantId === \"string\" ? sessionUser.currentTenantId.trim() : \"\"\n    if (!currentTenantId || currentTenantId !== tenantId) {\n      ctx.res.status(403)\n      return { success: false, error: \"invalid_account\" }\n    }\n  }\n\n  ctx.req.session.user = {\n    ...sessionUser,\n    currentTenantId: tenantId,\n  }\n  ctx.res.setHeader(AUTHENTICATED_TENANT_ID_HEADER, tenantId)\n\n  return { success: true, tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.use(SetActiveAccount.ROUTE, restrictSessionMiddleware)\n  api.post(SetActiveAccount.ROUTE, setActiveAccount)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS,EACpCI,UAAUJ,OAAS,CAAC,CAACM,IAAI,GAAG,oBAAoB,EAClD,CAAC;AAI6BN,OAAS;CACrCU,SAASV,QAAU;CACnBY,OAAOZ,OAAS,CAAC,CAACa,SAAS;CAC3BT,UAAUJ,OAAS,CAAC,CAACa,SAAS;AAChC,CAAC;;;ACND,IAAMS,mBAIF,OACFG,SACAC,QAC8C;CAC9C,MAAME,SAAAA,cAAwCE,UAAUL,OAAO;CAE/D,IAAI,CAACG,OAAOG,SAAS;EACnBL,IAAIM,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,MAAMC,cAAcT,IAAIU,IAAIC,SAASC;CACrC,IAAI,CAACH,aAAaI,IAAI;EACpBb,IAAIM,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAe;CACjD;CAEA,MAAMM,WAAWZ,OAAOa,KAAKD,SAASE,KAAK;CAC3C,MAAMC,kBAAkBC,MAAMC,QAAQV,YAAYQ,eAAe,IAC7DR,YAAYQ,gBAAgBG,IAAIC,MAAM,IACtC,CAAA;CAEJ,IAAIJ,gBAAgBK,SAAS,KAAK,CAACL,gBAAgBM,SAAST,QAAQ,GAAG;EACrEd,IAAIM,IAAIC,OAAO,GAAG;EAClB,OAAO;GAAEF,SAAS;GAAOG,OAAO;EAAkB;CACpD;CAEA,IAAIS,gBAAgBK,WAAW,GAAG;EAChC,MAAME,kBAAkB,OAAOf,YAAYe,oBAAoB,WAAWf,YAAYe,gBAAgBR,KAAK,IAAI;EAC/G,IAAI,CAACQ,mBAAmBA,oBAAoBV,UAAU;GACpDd,IAAIM,IAAIC,OAAO,GAAG;GAClB,OAAO;IAAEF,SAAS;IAAOG,OAAO;GAAkB;EACpD;CACF;CAEAR,IAAIU,IAAIC,QAAQC,OAAO;EACrB,GAAGH;EACHe,iBAAiBV;CACnB;CACAd,IAAIM,IAAImB,UAAUhC,gCAAgCqB,QAAQ;CAE1D,OAAO;EAAET,SAAS;EAAMS;CAAS;AACnC;AAEA,IAAA,mBAAgBY,QAA8B;CAC5CA,IAAIC,IAAIhC,OAAwBH,yBAAyB;CACzDkC,IAAIG,KAAKlC,OAAwBC,gBAAgB;AACnD"}

package/dist/{handler-DsPS6JXV.js → handler-W_XZ0lnx.js}

@@ -2,7 +2,7 @@ import { a as string, i as object, t as array } from "./schemas-BgOpQqUv.js";
 import { r as restrictSessionMiddleware } from "./middleware-BT3Uput1.js";
 import { models } from "@rpcbase/db";
 //#region src/api/me/index.ts
-var Route = "/api/rb/auth/me";
+var ROUTE = "/api/rb/auth/me";
 object({});
 object({
 	id: string().optional(),
@@ -61,10 +61,10 @@ var me = async (_payload, ctx) => {
 	};
 };
 var handler_default = (api) => {
-	api.use(Route, restrictSessionMiddleware);
-	api.get(Route, me);
+	api.use(ROUTE, restrictSessionMiddleware);
+	api.get(ROUTE, me);
 };
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-DsPS6JXV.js.map
+//# sourceMappingURL=handler-W_XZ0lnx.js.map

package/dist/{handler-DsPS6JXV.js.map → handler-W_XZ0lnx.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-DsPS6JXV.js","names":["z","Route","requestSchema","object","RequestPayload","infer","responseSchema","id","string","optional","email","phone","name","tenants","array","default","currentTenantId","signedInTenants","error","ResponsePayload","Api","ApiHandler","Ctx","models","AuthSessionUser","restrictSessionMiddleware","Me","me","RequestPayload","ResponsePayload","_payload","ctx","Promise","sessionUser","req","session","user","id","res","status","currentTenantId","signedInTenants","tenants","error","User","getGlobal","findById","tenantId","trim","_id","toString","email","phone","get","name","map","String","api","use","Route"],"sources":["../src/api/me/index.ts","../src/api/me/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/me\"\n\nexport const requestSchema = z.object({})\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  id: z.string().optional(),\n  email: z.string().email().optional(),\n  phone: z.string().optional(),\n  name: z.string().optional(),\n  tenants: z.array(z.string()).default([]),\n  currentTenantId: z.string().optional(),\n  signedInTenants: z.array(z.string()).default([]).optional(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport type { AuthSessionUser } from \"../../types\"\nimport { restrictSessionMiddleware } from \"../../middleware\"\n\nimport * as Me from \"./index\"\n\n\nconst me: ApiHandler<Me.RequestPayload, Me.ResponsePayload, AuthSessionUser> = async(\n  _payload: Me.RequestPayload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<Me.ResponsePayload> => {\n  const sessionUser = ctx.req.session?.user\n\n  if (!sessionUser?.id) {\n    ctx.res.status(401)\n    return {\n      id: \"\",\n      currentTenantId: \"\",\n      signedInTenants: [],\n      tenants: [],\n      error: \"not_authenticated\",\n    } as unknown as Me.ResponsePayload\n  }\n\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const user = await User.findById(sessionUser.id)\n\n  if (!user) {\n    ctx.res.status(404)\n    return {\n      id: \"\",\n      currentTenantId: \"\",\n      signedInTenants: [],\n      tenants: [],\n      error: \"user_not_found\",\n    } as unknown as Me.ResponsePayload\n  }\n\n  const tenantId = typeof sessionUser.currentTenantId === \"string\" ? sessionUser.currentTenantId.trim() : \"\"\n  if (!tenantId) {\n    ctx.res.status(500)\n    return {\n      id: \"\",\n      currentTenantId: \"\",\n      signedInTenants: [],\n      tenants: [],\n      error: \"tenant_missing\",\n    } as unknown as Me.ResponsePayload\n  }\n\n  return {\n    id: user._id.toString(),\n    email: user.email,\n    phone: user.get(\"phone\") as string | undefined,\n    name: user.name,\n    tenants: (user.tenants || []).map(String),\n    currentTenantId: tenantId,\n    signedInTenants: sessionUser.signedInTenants || [],\n  }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.use(Me.Route, restrictSessionMiddleware)\n  api.get(Me.Route, me)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAEQD,OAAS,CAAC,CAAC;AAGVA,OAAS;CACrCO,IAAIP,OAAS,CAAC,CAACS,SAAS;CACxBC,OAAOV,OAAS,CAAC,CAACU,MAAM,CAAC,CAACD,SAAS;CACnCE,OAAOX,OAAS,CAAC,CAACS,SAAS;CAC3BG,MAAMZ,OAAS,CAAC,CAACS,SAAS;CAC1BI,SAASb,MAAQA,OAAS,CAAC,CAAC,CAACe,QAAQ,CAAA,CAAE;CACvCC,iBAAiBhB,OAAS,CAAC,CAACS,SAAS;CACrCQ,iBAAiBjB,MAAQA,OAAS,CAAC,CAAC,CAACe,QAAQ,CAAA,CAAE,CAAC,CAACN,SAAS;CAC1DS,OAAOlB,OAAS,CAAC,CAACS,SAAS;AAC7B,CAAC;;;ACRD,IAAMkB,KAAyE,OAC7EG,UACAC,QACgC;CAChC,MAAME,cAAcF,IAAIG,IAAIC,SAASC;CAErC,IAAI,CAACH,aAAaI,IAAI;EACpBN,IAAIO,IAAIC,OAAO,GAAG;EAClB,OAAO;GACLF,IAAI;GACJG,iBAAiB;GACjBC,iBAAiB,CAAA;GACjBC,SAAS,CAAA;GACTC,OAAO;EACT;CACF;CAGA,MAAMP,OAAO,OAAMQ,MADArB,OAAOsB,UAAU,UAAUd,GAAG,EAAA,CACzBe,SAASb,YAAYI,EAAE;CAE/C,IAAI,CAACD,MAAM;EACTL,IAAIO,IAAIC,OAAO,GAAG;EAClB,OAAO;GACLF,IAAI;GACJG,iBAAiB;GACjBC,iBAAiB,CAAA;GACjBC,SAAS,CAAA;GACTC,OAAO;EACT;CACF;CAEA,MAAMI,WAAW,OAAOd,YAAYO,oBAAoB,WAAWP,YAAYO,gBAAgBQ,KAAK,IAAI;CACxG,IAAI,CAACD,UAAU;EACbhB,IAAIO,IAAIC,OAAO,GAAG;EAClB,OAAO;GACLF,IAAI;GACJG,iBAAiB;GACjBC,iBAAiB,CAAA;GACjBC,SAAS,CAAA;GACTC,OAAO;EACT;CACF;CAEA,OAAO;EACLN,IAAID,KAAKa,IAAIC,SAAS;EACtBC,OAAOf,KAAKe;EACZC,OAAOhB,KAAKiB,IAAI,OAAO;EACvBC,MAAMlB,KAAKkB;EACXZ,UAAUN,KAAKM,WAAW,CAAA,EAAA,CAAIa,IAAIC,MAAM;EACxChB,iBAAiBO;EACjBN,iBAAiBR,YAAYQ,mBAAmB,CAAA;CAClD;AACF;AAEA,IAAA,mBAAgBgB,QAA8B;CAC5CA,IAAIC,IAAIhC,OAAUD,yBAAyB;CAC3CgC,IAAIJ,IAAI3B,OAAUC,EAAE;AACtB"}
+{"version":3,"file":"handler-W_XZ0lnx.js","names":["z","ROUTE","requestSchema","object","RequestPayload","infer","responseSchema","id","string","optional","email","phone","name","tenants","array","default","currentTenantId","signedInTenants","error","ResponsePayload","Api","ApiHandler","Ctx","models","AuthSessionUser","restrictSessionMiddleware","Me","me","RequestPayload","ResponsePayload","_payload","ctx","Promise","sessionUser","req","session","user","id","res","status","currentTenantId","signedInTenants","tenants","error","User","getGlobal","findById","tenantId","trim","_id","toString","email","phone","get","name","map","String","api","use","ROUTE"],"sources":["../src/api/me/index.ts","../src/api/me/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/me\"\n\nexport const requestSchema = z.object({})\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  id: z.string().optional(),\n  email: z.string().email().optional(),\n  phone: z.string().optional(),\n  name: z.string().optional(),\n  tenants: z.array(z.string()).default([]),\n  currentTenantId: z.string().optional(),\n  signedInTenants: z.array(z.string()).default([]).optional(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport type { AuthSessionUser } from \"../../types\"\nimport { restrictSessionMiddleware } from \"../../middleware\"\n\nimport * as Me from \"./index\"\n\n\nconst me: ApiHandler<Me.RequestPayload, Me.ResponsePayload, AuthSessionUser> = async(\n  _payload: Me.RequestPayload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<Me.ResponsePayload> => {\n  const sessionUser = ctx.req.session?.user\n\n  if (!sessionUser?.id) {\n    ctx.res.status(401)\n    return {\n      id: \"\",\n      currentTenantId: \"\",\n      signedInTenants: [],\n      tenants: [],\n      error: \"not_authenticated\",\n    } as unknown as Me.ResponsePayload\n  }\n\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const user = await User.findById(sessionUser.id)\n\n  if (!user) {\n    ctx.res.status(404)\n    return {\n      id: \"\",\n      currentTenantId: \"\",\n      signedInTenants: [],\n      tenants: [],\n      error: \"user_not_found\",\n    } as unknown as Me.ResponsePayload\n  }\n\n  const tenantId = typeof sessionUser.currentTenantId === \"string\" ? sessionUser.currentTenantId.trim() : \"\"\n  if (!tenantId) {\n    ctx.res.status(500)\n    return {\n      id: \"\",\n      currentTenantId: \"\",\n      signedInTenants: [],\n      tenants: [],\n      error: \"tenant_missing\",\n    } as unknown as Me.ResponsePayload\n  }\n\n  return {\n    id: user._id.toString(),\n    email: user.email,\n    phone: user.get(\"phone\") as string | undefined,\n    name: user.name,\n    tenants: (user.tenants || []).map(String),\n    currentTenantId: tenantId,\n    signedInTenants: sessionUser.signedInTenants || [],\n  }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.use(Me.ROUTE, restrictSessionMiddleware)\n  api.get(Me.ROUTE, me)\n}\n"],"mappings":";;;;AAGA,IAAaC,QAAQ;AAEQD,OAAS,CAAC,CAAC;AAGVA,OAAS;CACrCO,IAAIP,OAAS,CAAC,CAACS,SAAS;CACxBC,OAAOV,OAAS,CAAC,CAACU,MAAM,CAAC,CAACD,SAAS;CACnCE,OAAOX,OAAS,CAAC,CAACS,SAAS;CAC3BG,MAAMZ,OAAS,CAAC,CAACS,SAAS;CAC1BI,SAASb,MAAQA,OAAS,CAAC,CAAC,CAACe,QAAQ,CAAA,CAAE;CACvCC,iBAAiBhB,OAAS,CAAC,CAACS,SAAS;CACrCQ,iBAAiBjB,MAAQA,OAAS,CAAC,CAAC,CAACe,QAAQ,CAAA,CAAE,CAAC,CAACN,SAAS;CAC1DS,OAAOlB,OAAS,CAAC,CAACS,SAAS;AAC7B,CAAC;;;ACRD,IAAMkB,KAAyE,OAC7EG,UACAC,QACgC;CAChC,MAAME,cAAcF,IAAIG,IAAIC,SAASC;CAErC,IAAI,CAACH,aAAaI,IAAI;EACpBN,IAAIO,IAAIC,OAAO,GAAG;EAClB,OAAO;GACLF,IAAI;GACJG,iBAAiB;GACjBC,iBAAiB,CAAA;GACjBC,SAAS,CAAA;GACTC,OAAO;EACT;CACF;CAGA,MAAMP,OAAO,OAAMQ,MADArB,OAAOsB,UAAU,UAAUd,GAAG,EAAA,CACzBe,SAASb,YAAYI,EAAE;CAE/C,IAAI,CAACD,MAAM;EACTL,IAAIO,IAAIC,OAAO,GAAG;EAClB,OAAO;GACLF,IAAI;GACJG,iBAAiB;GACjBC,iBAAiB,CAAA;GACjBC,SAAS,CAAA;GACTC,OAAO;EACT;CACF;CAEA,MAAMI,WAAW,OAAOd,YAAYO,oBAAoB,WAAWP,YAAYO,gBAAgBQ,KAAK,IAAI;CACxG,IAAI,CAACD,UAAU;EACbhB,IAAIO,IAAIC,OAAO,GAAG;EAClB,OAAO;GACLF,IAAI;GACJG,iBAAiB;GACjBC,iBAAiB,CAAA;GACjBC,SAAS,CAAA;GACTC,OAAO;EACT;CACF;CAEA,OAAO;EACLN,IAAID,KAAKa,IAAIC,SAAS;EACtBC,OAAOf,KAAKe;EACZC,OAAOhB,KAAKiB,IAAI,OAAO;EACvBC,MAAMlB,KAAKkB;EACXZ,UAAUN,KAAKM,WAAW,CAAA,EAAA,CAAIa,IAAIC,MAAM;EACxChB,iBAAiBO;EACjBN,iBAAiBR,YAAYQ,mBAAmB,CAAA;CAClD;AACF;AAEA,IAAA,mBAAgBgB,QAA8B;CAC5CA,IAAIC,IAAIhC,OAAUD,yBAAyB;CAC3CgC,IAAIJ,IAAI3B,OAAUC,EAAE;AACtB"}

package/dist/index.js

@@ -1,5 +1,5 @@
-import { n as requestSchema } from "./sign-in-BG2ND3cO.js";
-import { n as requestSchema$1 } from "./sign-up-BCVi8UC9.js";
+import { n as requestSchema } from "./sign-in-BkhQovKN.js";
+import { n as requestSchema$1 } from "./sign-up-Di48rzbG.js";
 import { n as requireSession, r as restrictSessionMiddleware, t as redirectAuthMiddleware } from "./middleware-BT3Uput1.js";
 import { c } from "react/compiler-runtime";
 import { createContext, createElement, forwardRef, useContext, useEffect, useRef, useState } from "react";

package/dist/routes.js

@@ -1,15 +1,15 @@
 //#region src/routes.ts
 var routes = Object.entries({ .../* #__PURE__ */ Object.assign({
-	"./api/me/handler.ts": () => import("./handler-DsPS6JXV.js"),
-	"./api/request-password-reset/handler.ts": () => import("./handler-IBGVDW5w.js"),
-	"./api/resend-otp/handler.ts": () => import("./handler-GKdEwnBO.js"),
-	"./api/set-active-account/handler.ts": () => import("./handler-DNxEmrtP.js"),
-	"./api/set-new-password/handler.ts": () => import("./handler-J2OwFTyf.js"),
-	"./api/sign-in/handler.ts": () => import("./handler-B8jPw9zh.js"),
-	"./api/sign-out/handler.ts": () => import("./handler-BGNM_dz1.js"),
-	"./api/sign-up/handler.ts": () => import("./handler-0nKR-P5B.js"),
-	"./api/verify-otp/handler.ts": () => import("./handler-ClyVm_Us.js"),
-	"./api/verify-password-reset-otp/handler.ts": () => import("./handler-BoWTfKWi.js")
+	"./api/me/handler.ts": () => import("./handler-W_XZ0lnx.js"),
+	"./api/request-password-reset/handler.ts": () => import("./handler-DOaODKMb.js"),
+	"./api/resend-otp/handler.ts": () => import("./handler-C7SfLP4c.js"),
+	"./api/set-active-account/handler.ts": () => import("./handler-J2FOxq-2.js"),
+	"./api/set-new-password/handler.ts": () => import("./handler-DoyR_l2O.js"),
+	"./api/sign-in/handler.ts": () => import("./handler-DH9FPTNh.js"),
+	"./api/sign-out/handler.ts": () => import("./handler-DQvdRpG2.js"),
+	"./api/sign-up/handler.ts": () => import("./handler-BGjAGBrc.js"),
+	"./api/verify-otp/handler.ts": () => import("./handler-DAKI9QOQ.js"),
+	"./api/verify-password-reset-otp/handler.ts": () => import("./handler-DAfIloZR.js")
 }) }).reduce((acc, [path, mod]) => {
 	acc[path.replace("./api/", "@rpcbase/auth/api/")] = mod;
 	return acc;

package/dist/{sign-in-BG2ND3cO.js → sign-in-BkhQovKN.js}

@@ -1,6 +1,6 @@
 import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
 //#region src/api/sign-in/index.ts
-var Route = "/api/rb/auth/sign-in";
+var ROUTE = "/api/rb/auth/sign-in";
 var requestSchema = object({
 	email: string().nonempty("Email is required").email("Please enter a valid email address"),
 	password: string().min(1, { message: "Password is required" }),
@@ -13,6 +13,6 @@ object({
 	tenantId: string().optional()
 });
 //#endregion
-export { requestSchema as n, Route as t };
+export { requestSchema as n, ROUTE as t };
 
-//# sourceMappingURL=sign-in-BG2ND3cO.js.map
+//# sourceMappingURL=sign-in-BkhQovKN.js.map

package/dist/{sign-in-BG2ND3cO.js.map → sign-in-BkhQovKN.js.map}

@@ -1 +1 @@
-{"version":3,"file":"sign-in-BG2ND3cO.js","names":["z","Route","requestSchema","object","email","string","nonempty","password","min","message","rememberMe","boolean","default","RequestPayload","infer","responseSchema","success","error","optional","userId","tenantId","ResponsePayload"],"sources":["../src/api/sign-in/index.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/sign-in\"\n\nexport const requestSchema = z.object({\n  email: z\n    .string()\n    .nonempty(\"Email is required\")\n    .email(\"Please enter a valid email address\"),\n  password: z.string().min(1, { message: \"Password is required\" }),\n  rememberMe: z.boolean().default(true),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  userId: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n"],"mappings":";;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OACG,CAAC,CACRM,SAAS,mBAAmB,CAAC,CAC7BF,MAAM,oCAAoC;CAC7CG,UAAUP,OAAS,CAAC,CAACQ,IAAI,GAAG,EAAEC,SAAS,uBAAuB,CAAC;CAC/DC,YAAYV,QAAU,CAAC,CAACY,QAAQ,IAAI;AACtC,CAAC;AAI6BZ,OAAS;CACrCgB,SAAShB,QAAU;CACnBiB,OAAOjB,OAAS,CAAC,CAACkB,SAAS;CAC3BC,QAAQnB,OAAS,CAAC,CAACkB,SAAS;CAC5BE,UAAUpB,OAAS,CAAC,CAACkB,SAAS;AAChC,CAAC"}
+{"version":3,"file":"sign-in-BkhQovKN.js","names":["z","ROUTE","requestSchema","object","email","string","nonempty","password","min","message","rememberMe","boolean","default","RequestPayload","infer","responseSchema","success","error","optional","userId","tenantId","ResponsePayload"],"sources":["../src/api/sign-in/index.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/sign-in\"\n\nexport const requestSchema = z.object({\n  email: z\n    .string()\n    .nonempty(\"Email is required\")\n    .email(\"Please enter a valid email address\"),\n  password: z.string().min(1, { message: \"Password is required\" }),\n  rememberMe: z.boolean().default(true),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  userId: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n"],"mappings":";;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OAAS;CACpCI,OAAOJ,OACG,CAAC,CACRM,SAAS,mBAAmB,CAAC,CAC7BF,MAAM,oCAAoC;CAC7CG,UAAUP,OAAS,CAAC,CAACQ,IAAI,GAAG,EAAEC,SAAS,uBAAuB,CAAC;CAC/DC,YAAYV,QAAU,CAAC,CAACY,QAAQ,IAAI;AACtC,CAAC;AAI6BZ,OAAS;CACrCgB,SAAShB,QAAU;CACnBiB,OAAOjB,OAAS,CAAC,CAACkB,SAAS;CAC3BC,QAAQnB,OAAS,CAAC,CAACkB,SAAS;CAC5BE,UAAUpB,OAAS,CAAC,CAACkB,SAAS;AAChC,CAAC"}

package/dist/{sign-up-BCVi8UC9.js → sign-up-Di48rzbG.js}

@@ -1,6 +1,6 @@
 import { a as string, i as object, n as boolean } from "./schemas-BgOpQqUv.js";
 //#region src/api/sign-up/index.ts
-var Route = "/api/rb/auth/sign-up";
+var ROUTE = "/api/rb/auth/sign-up";
 var requestSchema = object({
 	email: string().nonempty("Email is required").email("Please enter a valid email address"),
 	password: string().min(8, { message: "Password must be at least 8 characters long." }),
@@ -13,6 +13,6 @@ object({
 	tenantId: string().optional()
 });
 //#endregion
-export { requestSchema as n, Route as t };
+export { requestSchema as n, ROUTE as t };
 
-//# sourceMappingURL=sign-up-BCVi8UC9.js.map
+//# sourceMappingURL=sign-up-Di48rzbG.js.map

package/dist/{sign-up-BCVi8UC9.js.map → sign-up-Di48rzbG.js.map}

@@ -1 +1 @@
-{"version":3,"file":"sign-up-BCVi8UC9.js","names":["z","Route","requestSchema","object","email","string","nonempty","password","min","message","rememberMe","boolean","default","RequestPayload","infer","responseSchema","success","error","optional","userId","tenantId","ResponsePayload"],"sources":["../src/api/sign-up/index.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const Route = \"/api/rb/auth/sign-up\"\n\nexport const requestSchema = z\n  .object({\n    email: z\n      .string()\n      .nonempty(\"Email is required\")\n      .email(\"Please enter a valid email address\"),\n    password: z.string().min(8, { message: \"Password must be at least 8 characters long.\" }),\n    rememberMe: z.boolean().default(true),\n  })\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  userId: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n"],"mappings":";;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OACnB;CACNI,OAAOJ,OACG,CAAC,CACRM,SAAS,mBAAmB,CAAC,CAC7BF,MAAM,oCAAoC;CAC7CG,UAAUP,OAAS,CAAC,CAACQ,IAAI,GAAG,EAAEC,SAAS,+CAA+C,CAAC;CACvFC,YAAYV,QAAU,CAAC,CAACY,QAAQ,IAAI;AACtC,CAAC;AAI2BZ,OAAS;CACrCgB,SAAShB,QAAU;CACnBiB,OAAOjB,OAAS,CAAC,CAACkB,SAAS;CAC3BC,QAAQnB,OAAS,CAAC,CAACkB,SAAS;CAC5BE,UAAUpB,OAAS,CAAC,CAACkB,SAAS;AAChC,CAAC"}
+{"version":3,"file":"sign-up-Di48rzbG.js","names":["z","ROUTE","requestSchema","object","email","string","nonempty","password","min","message","rememberMe","boolean","default","RequestPayload","infer","responseSchema","success","error","optional","userId","tenantId","ResponsePayload"],"sources":["../src/api/sign-up/index.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/sign-up\"\n\nexport const requestSchema = z\n  .object({\n    email: z\n      .string()\n      .nonempty(\"Email is required\")\n      .email(\"Please enter a valid email address\"),\n    password: z.string().min(8, { message: \"Password must be at least 8 characters long.\" }),\n    rememberMe: z.boolean().default(true),\n  })\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  userId: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n"],"mappings":";;AAGA,IAAaC,QAAQ;AAErB,IAAaC,gBAAgBF,OACnB;CACNI,OAAOJ,OACG,CAAC,CACRM,SAAS,mBAAmB,CAAC,CAC7BF,MAAM,oCAAoC;CAC7CG,UAAUP,OAAS,CAAC,CAACQ,IAAI,GAAG,EAAEC,SAAS,+CAA+C,CAAC;CACvFC,YAAYV,QAAU,CAAC,CAACY,QAAQ,IAAI;AACtC,CAAC;AAI2BZ,OAAS;CACrCgB,SAAShB,QAAU;CACnBiB,OAAOjB,OAAS,CAAC,CAACkB,SAAS;CAC3BC,QAAQnB,OAAS,CAAC,CAACkB,SAAS;CAC5BE,UAAUpB,OAAS,CAAC,CAACkB,SAAS;AAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpcbase/auth",
-  "version": "0.176.0",
+  "version": "0.178.0",
   "type": "module",
   "files": [
     "dist",