@rpcbase/auth 0.199.0 → 0.200.0

package/dist/handler-BPoWo5Qy.js

@@ -0,0 +1,85 @@
+import { ROUTE, requestSchema } from "./api/sign-in/index.js";
+import { t as isPendingRegistration } from "./registrationStatus-BP6yReMw.js";
+import { n as completeAuthSignIn } from "./session-BQ06Yo3C.js";
+import { models } from "@rpcbase/db";
+import { verifyPasswordFromStorage } from "@rpcbase/server";
+//#region src/api/sign-in/handler.ts
+var signIn = async (payload, ctx) => {
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const [User, Tenant] = await Promise.all([models.getGlobal("RBUser", ctx), models.getGlobal("RBTenant", ctx)]);
+	const user = await User.findOne({ email: parsed.data.email }, {
+		password: 1,
+		tenants: 1,
+		tenantRoles: 1,
+		registrationStatus: 1,
+		emailVerificationCode: 1
+	});
+	if (!user?.password || !await verifyPasswordFromStorage(parsed.data.password, String(user.password))) {
+		ctx.res.status(401);
+		return {
+			success: false,
+			error: "invalid_credentials"
+		};
+	}
+	if (isPendingRegistration({
+		registrationStatus: user.get("registrationStatus"),
+		emailVerificationCode: user.get("emailVerificationCode")
+	})) {
+		ctx.res.status(403);
+		return {
+			success: false,
+			error: "email_verification_required"
+		};
+	}
+	const signedInTenants = Array.isArray(user.tenants) ? user.tenants.map(String) : [];
+	const tenantId = signedInTenants[0]?.trim() ?? "";
+	if (!tenantId) {
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "tenant_unavailable"
+		};
+	}
+	const tenant = await Tenant.findOne({ tenantId }, { provisioningStatus: 1 }).lean();
+	if (!tenant || tenant.provisioningStatus && tenant.provisioningStatus !== "active") {
+		ctx.res.status(503);
+		return {
+			success: false,
+			error: "tenant_unavailable"
+		};
+	}
+	const tenantRolesMap = user.get("tenantRoles");
+	const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : void 0;
+	const userId = user._id.toString();
+	if (!completeAuthSignIn(ctx, {
+		userId,
+		currentTenantId: tenantId,
+		signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],
+		tenantRoles
+	})) {
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "session_unavailable"
+		};
+	}
+	return {
+		success: true,
+		userId,
+		tenantId
+	};
+};
+var handler_default = (api) => {
+	api.post(ROUTE, signIn);
+};
+//#endregion
+export { handler_default as default, signIn };
+
+//# sourceMappingURL=handler-BPoWo5Qy.js.map

package/dist/handler-BPoWo5Qy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-BPoWo5Qy.js","names":[],"sources":["../src/api/sign-in/handler.ts"],"sourcesContent":["import { Api, type ApiHandler, type Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { verifyPasswordFromStorage } from \"@rpcbase/server\"\n\nimport { completeAuthSignIn } from \"../../session\"\nimport { isPendingRegistration } from \"../../registrationStatus\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SignIn from \"./index\"\n\n\nexport const signIn: ApiHandler<SignIn.RequestPayload, SignIn.ResponsePayload, AuthSessionUser> = async (\n  payload,\n  ctx: Ctx<AuthSessionUser>,\n): Promise<SignIn.ResponsePayload> => {\n  const parsed = SignIn.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const [User, Tenant] = await Promise.all([\n    models.getGlobal(\"RBUser\", ctx),\n    models.getGlobal(\"RBTenant\", ctx),\n  ])\n  const user = await User.findOne(\n    { email: parsed.data.email },\n    {\n      password: 1,\n      tenants: 1,\n      tenantRoles: 1,\n      registrationStatus: 1,\n      emailVerificationCode: 1,\n    },\n  )\n\n  if (!user?.password || !await verifyPasswordFromStorage(parsed.data.password, String(user.password))) {\n    ctx.res.status(401)\n    return { success: false, error: \"invalid_credentials\" }\n  }\n\n  if (isPendingRegistration({\n    registrationStatus: user.get(\"registrationStatus\"),\n    emailVerificationCode: user.get(\"emailVerificationCode\"),\n  })) {\n    ctx.res.status(403)\n    return { success: false, error: \"email_verification_required\" }\n  }\n\n  const signedInTenants = Array.isArray(user.tenants) ? user.tenants.map(String) : []\n  const tenantId = signedInTenants[0]?.trim() ?? \"\"\n  if (!tenantId) {\n    ctx.res.status(500)\n    return { success: false, error: \"tenant_unavailable\" }\n  }\n\n  const tenant = await Tenant.findOne({ tenantId }, { provisioningStatus: 1 }).lean() as {\n    provisioningStatus?: unknown\n  } | null\n  if (!tenant || (tenant.provisioningStatus && tenant.provisioningStatus !== \"active\")) {\n    ctx.res.status(503)\n    return { success: false, error: \"tenant_unavailable\" }\n  }\n\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n  const userId = user._id.toString()\n\n  if (!completeAuthSignIn(ctx, {\n    userId,\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    ctx.res.status(500)\n    return { success: false, error: \"session_unavailable\" }\n  }\n\n  return { success: true, userId, tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SignIn.ROUTE, signIn)\n}\n"],"mappings":";;;;;;AAWA,IAAa,SAAqF,OAChG,SACA,QACoC;CACpC,MAAM,SAAA,cAA8B,UAAU,OAAO;CAErD,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,MAAM,CAAC,MAAM,UAAU,MAAM,QAAQ,IAAI,CACvC,OAAO,UAAU,UAAU,GAAG,GAC9B,OAAO,UAAU,YAAY,GAAG,CAAC,CAClC;CACD,MAAM,OAAO,MAAM,KAAK,QACtB,EAAE,OAAO,OAAO,KAAK,MAAM,GAC3B;EACE,UAAU;EACV,SAAS;EACT,aAAa;EACb,oBAAoB;EACpB,uBAAuB;CACzB,CACF;CAEA,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,0BAA0B,OAAO,KAAK,UAAU,OAAO,KAAK,QAAQ,CAAC,GAAG;EACpG,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAsB;CACxD;CAEA,IAAI,sBAAsB;EACxB,oBAAoB,KAAK,IAAI,oBAAoB;EACjD,uBAAuB,KAAK,IAAI,uBAAuB;CACzD,CAAC,GAAG;EACF,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAA8B;CAChE;CAEA,MAAM,kBAAkB,MAAM,QAAQ,KAAK,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAA;CACjF,MAAM,WAAW,gBAAgB,EAAE,EAAE,KAAK,KAAK;CAC/C,IAAI,CAAC,UAAU;EACb,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAqB;CACvD;CAEA,MAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,SAAS,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,KAAK;CAGlF,IAAI,CAAC,UAAW,OAAO,sBAAsB,OAAO,uBAAuB,UAAW;EACpF,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAqB;CACvD;CAEA,MAAM,iBAAiB,KAAK,IAAI,aAAa;CAC7C,MAAM,cAAc,iBAAiB,OAAO,YAAY,eAAe,QAAQ,CAAC,IAAI,KAAA;CACpF,MAAM,SAAS,KAAK,IAAI,SAAS;CAEjC,IAAI,CAAC,mBAAmB,KAAK;EAC3B;EACA,iBAAiB;EACjB,iBAAiB,gBAAgB,SAAS,kBAAkB,CAAC,QAAQ;EACrE;CACF,CAAC,GAAG;EACF,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAsB;CACxD;CAEA,OAAO;EAAE,SAAS;EAAM;EAAQ;CAAS;AAC3C;AAEA,IAAA,mBAAgB,QAA8B;CAC5C,IAAI,KAAK,OAAc,MAAM;AAC/B"}

package/dist/{handler-DBbjgU-f.js → handler-BenTgwfT.js}

@@ -1,4 +1,4 @@
-import { i as object, n as boolean } from "./schemas-CMgO_xn9.js";
+import { a as object, r as boolean } from "./schemas-DABNKHVA.js";
 //#region src/api/sign-out/index.ts
 var ROUTE = "/api/rb/auth/sign-out";
 object({});
@@ -16,4 +16,4 @@ var handler_default = (api) => {
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-DBbjgU-f.js.map
+//# sourceMappingURL=handler-BenTgwfT.js.map

package/dist/{handler-DBbjgU-f.js.map → handler-BenTgwfT.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-DBbjgU-f.js","names":[],"sources":["../src/api/sign-out/index.ts","../src/api/sign-out/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/sign-out\"\n\n// No request payload needed for signout\nexport const requestSchema = z.object({})\n\nexport type RequestPayload = z.infer<typeof requestSchema>;\n\nexport const responseSchema = z.object({\n  success: z.boolean()\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>;\n","import { Api, Ctx } from \"@rpcbase/api\"\n\nimport * as SignOut from \"./index\"\n\n\nconst handleSignOut = async(_: SignOut.RequestPayload, ctx: Ctx): Promise<SignOut.ResponsePayload> => {\n  // Destroy the session\n  if (!ctx.req.session) {\n    return { success: true }\n  }\n\n  await new Promise<void>((resolve) => ctx.req.session!.destroy(() => resolve()))\n\n  return {\n    success: true\n  }\n}\n\nexport default (api: Api) => {\n  api.post(SignOut.ROUTE, handleSignOut)\n}\n"],"mappings":";;AAGA,IAAa,QAAQ;AAGQ,OAAS,CAAC,CAAC;AAIV,OAAS,EACrC,SAAS,QAAU,EACrB,CAAC;;;ACPD,IAAM,gBAAgB,OAAM,GAA2B,QAA+C;CAEpG,IAAI,CAAC,IAAI,IAAI,SACX,OAAO,EAAE,SAAS,KAAK;CAGzB,MAAM,IAAI,SAAe,YAAY,IAAI,IAAI,QAAS,cAAc,QAAQ,CAAC,CAAC;CAE9E,OAAO,EACL,SAAS,KACX;AACF;AAEA,IAAA,mBAAgB,QAAa;CAC3B,IAAI,KAAK,OAAe,aAAa;AACvC"}
+{"version":3,"file":"handler-BenTgwfT.js","names":[],"sources":["../src/api/sign-out/index.ts","../src/api/sign-out/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/sign-out\"\n\n// No request payload needed for signout\nexport const requestSchema = z.object({})\n\nexport type RequestPayload = z.infer<typeof requestSchema>;\n\nexport const responseSchema = z.object({\n  success: z.boolean()\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>;\n","import { Api, Ctx } from \"@rpcbase/api\"\n\nimport * as SignOut from \"./index\"\n\n\nconst handleSignOut = async(_: SignOut.RequestPayload, ctx: Ctx): Promise<SignOut.ResponsePayload> => {\n  // Destroy the session\n  if (!ctx.req.session) {\n    return { success: true }\n  }\n\n  await new Promise<void>((resolve) => ctx.req.session!.destroy(() => resolve()))\n\n  return {\n    success: true\n  }\n}\n\nexport default (api: Api) => {\n  api.post(SignOut.ROUTE, handleSignOut)\n}\n"],"mappings":";;AAGA,IAAa,QAAQ;AAGQ,OAAS,CAAC,CAAC;AAIV,OAAS,EACrC,SAAS,QAAU,EACrB,CAAC;;;ACPD,IAAM,gBAAgB,OAAM,GAA2B,QAA+C;CAEpG,IAAI,CAAC,IAAI,IAAI,SACX,OAAO,EAAE,SAAS,KAAK;CAGzB,MAAM,IAAI,SAAe,YAAY,IAAI,IAAI,QAAS,cAAc,QAAQ,CAAC,CAAC;CAE9E,OAAO,EACL,SAAS,KACX;AACF;AAEA,IAAA,mBAAgB,QAAa;CAC3B,IAAI,KAAK,OAAe,aAAa;AACvC"}

package/dist/{handler-Dbw6BOmj.js → handler-BhPmGpUq.js}

@@ -1,11 +1,11 @@
-import { a as string, i as object, n as boolean, r as number } from "./schemas-CMgO_xn9.js";
+import { a as object, i as number, o as string, r as boolean } from "./schemas-DABNKHVA.js";
 import { t as email_validation_exports } from "./email-validation/index.js";
 import crypto from "crypto";
 import { models } from "@rpcbase/db";
 import { sendEmail } from "@rpcbase/server";
 //#region src/api/request-password-reset/index.ts
 var ROUTE = "/api/rb/auth/request-password-reset";
-var requestSchema = object({ email: string().email() });
+var requestSchema = object({ email: string().trim().toLowerCase().email() });
 object({
 	success: boolean(),
 	error: string().optional(),
@@ -130,4 +130,4 @@ var handler_default = (api) => {
 //#endregion
 export { PASSWORD_RESET_COOLDOWN_SECONDS, handler_default as default, requestPasswordReset };
 
-//# sourceMappingURL=handler-Dbw6BOmj.js.map
+//# sourceMappingURL=handler-BhPmGpUq.js.map

package/dist/handler-BhPmGpUq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-BhPmGpUq.js","names":[],"sources":["../src/api/request-password-reset/index.ts","../src/api/request-password-reset/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/request-password-reset\"\n\nexport const requestSchema = z.object({\n  email: z.string().trim().toLowerCase().email(),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  retryAfterSeconds: z.number().int().positive().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { sendEmail } from \"@rpcbase/server\"\n\nimport { isEmailAddressValid } from \"../../email-validation\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as RequestPasswordReset from \"./index\"\n\n\nexport const PASSWORD_RESET_COOLDOWN_SECONDS = 60\nconst PASSWORD_RESET_CODE_TTL_SECONDS = 10 * 60\n\nconst maskEmailForLog = (email: string) => {\n  const [localRaw, domainRaw = \"\"] = email.split(\"@\")\n  const local = localRaw || \"\"\n  const domain = domainRaw || \"\"\n  const localPrefix = local.slice(0, Math.min(3, local.length))\n  const localMask = \"*\".repeat(Math.max(5, local.length - localPrefix.length))\n\n  if (!domain) {\n    return `${localPrefix}${localMask}@****`\n  }\n\n  const domainTailLength = Math.min(7, domain.length)\n  const domainTail = domain.slice(-domainTailLength)\n  const domainMask = \"*\".repeat(Math.max(4, domain.length - domainTailLength))\n\n  return `${localPrefix}${localMask}@${domainMask}${domainTail}`\n}\n\n\nexport const requestPasswordReset: ApiHandler<\n  RequestPasswordReset.RequestPayload,\n  RequestPasswordReset.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<RequestPasswordReset.ResponsePayload> => {\n  const parsed = RequestPasswordReset.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email } = parsed.data\n\n  if (!await isEmailAddressValid(email)) {\n    ctx.res.setHeader(\"Retry-After\", String(PASSWORD_RESET_COOLDOWN_SECONDS))\n    return { success: true, retryAfterSeconds: PASSWORD_RESET_COOLDOWN_SECONDS }\n  }\n\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const requestedAt = new Date()\n  const cooldownEligibleExpiresAt = new Date(\n    requestedAt.getTime() + (PASSWORD_RESET_CODE_TTL_SECONDS - PASSWORD_RESET_COOLDOWN_SECONDS) * 1000,\n  )\n  const passwordResetCode = crypto.randomInt(0, 1_000_000).toString().padStart(6, \"0\")\n  const passwordResetCodeExpiresAt = new Date(requestedAt.getTime() + PASSWORD_RESET_CODE_TTL_SECONDS * 1000)\n\n  const user = await User.findOneAndUpdate(\n    {\n      email,\n      $or: [\n        { passwordResetCodeExpiresAt: { $exists: false } },\n        { passwordResetCodeExpiresAt: { $lte: cooldownEligibleExpiresAt } },\n      ],\n    },\n    {\n      $set: {\n        passwordResetCode,\n        passwordResetCodeExpiresAt,\n      },\n      $unset: {\n        passwordResetToken: \"\",\n        passwordResetTokenExpiresAt: \"\",\n      },\n    },\n    { returnDocument: \"after\" },\n  )\n\n  ctx.res.setHeader(\"Retry-After\", String(PASSWORD_RESET_COOLDOWN_SECONDS))\n\n  if (!user) {\n    const existingUser = await User.findOne({ email }, { _id: 1 })\n\n    if (!existingUser) {\n      try {\n        console.info(`sending password reset account notice to email ${maskEmailForLog(email)}`)\n        await sendEmail({\n          to: email,\n          subject: \"Password reset request\",\n          html: `\n            <p>Hello,</p>\n            <p>A password reset code has been requested for this email address, but there doesn't appear to be any account associated with it.</p>\n            <p>If you didn't request this, you can ignore this message.</p>\n            <p>If you're having trouble accessing your account, please contact support.</p>\n          `,\n          text: \"Hello, A password reset code has been requested for this email address, but there doesn't appear to be any account associated with it. If you didn't request this, you can ignore this message. If you're having trouble accessing your account, please contact support.\",\n        })\n      } catch (err) {\n        console.error(\"failed to send password reset account notice email\", err)\n        ctx.res.status(500)\n        return { success: false, error: \"email_delivery_failed\" }\n      }\n    }\n\n    return { success: true, retryAfterSeconds: PASSWORD_RESET_COOLDOWN_SECONDS }\n  }\n\n  try {\n    console.info(`sending password reset to email ${maskEmailForLog(email)}`)\n    await sendEmail({\n      to: email,\n      subject: `Your password reset code: ${passwordResetCode}`,\n      html: `\n        <p>Your password reset code is <strong>${passwordResetCode}</strong>. It expires in 10 minutes.</p>\n        <p>If you didn't request this, you can ignore this message.</p>\n      `,\n      text: `Your password reset code is ${passwordResetCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`,\n    })\n  } catch (err) {\n    console.error(\"failed to send password reset email\", err)\n\n    try {\n      const releaseResult = await User.updateOne(\n        { _id: user._id, passwordResetCode },\n        {\n          $unset: {\n            passwordResetCode: \"\",\n            passwordResetCodeExpiresAt: \"\",\n          },\n        },\n      )\n      if (releaseResult.modifiedCount > 0) {\n        ctx.res.removeHeader(\"Retry-After\")\n      }\n    } catch (releaseErr) {\n      console.error(\"failed to release password reset cooldown\", releaseErr)\n    }\n\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  return { success: true, retryAfterSeconds: PASSWORD_RESET_COOLDOWN_SECONDS }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(RequestPasswordReset.ROUTE, requestPasswordReset)\n}\n"],"mappings":";;;;;;AAGA,IAAa,QAAQ;AAErB,IAAa,gBAAgB,OAAS,EACpC,OAAO,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,EAC/C,CAAC;AAI6B,OAAS;CACrC,SAAS,QAAU;CACnB,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,mBAAmB,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;AAC1D,CAAC;;;ACHD,IAAa,kCAAkC;AAC/C,IAAM,kCAAkC;AAExC,IAAM,mBAAmB,UAAkB;CACzC,MAAM,CAAC,UAAU,YAAY,MAAM,MAAM,MAAM,GAAG;CAClD,MAAM,QAAQ,YAAY;CAC1B,MAAM,SAAS,aAAa;CAC5B,MAAM,cAAc,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,MAAM,MAAM,CAAC;CAC5D,MAAM,YAAY,IAAI,OAAO,KAAK,IAAI,GAAG,MAAM,SAAS,YAAY,MAAM,CAAC;CAE3E,IAAI,CAAC,QACH,OAAO,GAAG,cAAc,UAAS;CAGnC,MAAM,mBAAmB,KAAK,IAAI,GAAG,OAAO,MAAM;CAClD,MAAM,aAAa,OAAO,MAAM,CAAC,gBAAgB;CAGjD,OAAO,GAAG,cAAc,UAAS,GAFd,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,SAAS,gBAAgB,CAErC,IAAa;AACpD;AAGA,IAAa,uBAIT,OACF,SACA,QACkD;CAClD,MAAM,SAAA,cAA4C,UAAU,OAAO;CAEnE,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAE,UAAU,OAAO;CAEzB,IAAI,CAAC,OAAA,GAAM,yBAAA,oBAAA,CAAoB,KAAK,GAAG;EACrC,IAAI,IAAI,UAAU,eAAe,OAAA,EAAsC,CAAC;EACxE,OAAO;GAAE,SAAS;GAAM,mBAAA;EAAmD;CAC7E;CAEA,MAAM,OAAO,MAAM,OAAO,UAAU,UAAU,GAAG;CACjD,MAAM,8BAAc,IAAI,KAAK;CAC7B,MAAM,4BAA4B,IAAI,KACpC,YAAY,QAAQ,IAAA,IACtB;CACA,MAAM,oBAAoB,OAAO,UAAU,GAAG,GAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG;CACnF,MAAM,6BAA6B,IAAI,KAAK,YAAY,QAAQ,IAAI,kCAAkC,GAAI;CAE1G,MAAM,OAAO,MAAM,KAAK,iBACtB;EACE;EACA,KAAK,CACH,EAAE,4BAA4B,EAAE,SAAS,MAAM,EAAE,GACjD,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,EAAE,CAAC;CAEvE,GACA;EACE,MAAM;GACJ;GACA;EACF;EACA,QAAQ;GACN,oBAAoB;GACpB,6BAA6B;EAC/B;CACF,GACA,EAAE,gBAAgB,QAAQ,CAC5B;CAEA,IAAI,IAAI,UAAU,eAAe,OAAA,EAAsC,CAAC;CAExE,IAAI,CAAC,MAAM;EAGT,IAAI,CAAC,MAFsB,KAAK,QAAQ,EAAE,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,GAG3D,IAAI;GACF,QAAQ,KAAK,kDAAkD,gBAAgB,KAAK,GAAG;GACvF,MAAM,UAAU;IACd,IAAI;IACJ,SAAS;IACT,MAAM;;;;;;IAMN,MAAM;GACR,CAAC;EACH,SAAS,KAAK;GACZ,QAAQ,MAAM,sDAAsD,GAAG;GACvE,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,SAAS;IAAO,OAAO;GAAwB;EAC1D;EAGF,OAAO;GAAE,SAAS;GAAM,mBAAA;EAAmD;CAC7E;CAEA,IAAI;EACF,QAAQ,KAAK,mCAAmC,gBAAgB,KAAK,GAAG;EACxE,MAAM,UAAU;GACd,IAAI;GACJ,SAAS,6BAA6B;GACtC,MAAM;iDACqC,kBAAiB;;;GAG5D,MAAM,+BAA+B,kBAAiB;EACxD,CAAC;CACH,SAAS,KAAK;EACZ,QAAQ,MAAM,uCAAuC,GAAG;EAExD,IAAI;GAUF,KAAI,MATwB,KAAK,UAC/B;IAAE,KAAK,KAAK;IAAK;GAAkB,GACnC,EACE,QAAQ;IACN,mBAAmB;IACnB,4BAA4B;GAC9B,EACF,CACF,EAAA,CACkB,gBAAgB,GAChC,IAAI,IAAI,aAAa,aAAa;EAEtC,SAAS,YAAY;GACnB,QAAQ,MAAM,6CAA6C,UAAU;EACvE;EAEA,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAwB;CAC1D;CAEA,OAAO;EAAE,SAAS;EAAM,mBAAA;CAAmD;AAC7E;AAEA,IAAA,mBAAgB,QAA8B;CAC5C,IAAI,KAAK,OAA4B,oBAAoB;AAC3D"}

package/dist/handler-DCk7C1pI.js

@@ -0,0 +1,80 @@
+import { n as pendingRegistrationCondition } from "./registrationStatus-BP6yReMw.js";
+import { ROUTE, requestSchema } from "./api/resend-otp/index.js";
+import { n as issueVerificationCode, t as OTP_RESEND_COOLDOWN_MS } from "./emailVerification-DA9pZ0N_.js";
+import { models } from "@rpcbase/db";
+//#region src/api/resend-otp/handler.ts
+var resendOtp = async (payload, ctx) => {
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	const User = await models.getGlobal("RBUser", ctx);
+	const user = await User.findOne({
+		email: parsed.data.email,
+		...pendingRegistrationCondition()
+	}, { emailVerificationSentAt: 1 });
+	if (!user) {
+		ctx.res.status(404);
+		return {
+			success: false,
+			error: "pending_registration_not_found"
+		};
+	}
+	const lastSentAt = user.get("emailVerificationSentAt");
+	if (lastSentAt instanceof Date) {
+		const remainingMs = OTP_RESEND_COOLDOWN_MS - (Date.now() - lastSentAt.getTime());
+		if (remainingMs > 0) {
+			const retryAfterSeconds = Math.max(1, Math.ceil(remainingMs / 1e3));
+			ctx.res.setHeader("Retry-After", String(retryAfterSeconds));
+			ctx.res.status(429);
+			return {
+				success: false,
+				error: "rate_limited",
+				retryAfterSeconds
+			};
+		}
+	}
+	try {
+		if (!await issueVerificationCode({
+			User,
+			userId: user._id,
+			email: parsed.data.email,
+			locale: parsed.data.locale,
+			enforceCooldown: true
+		})) {
+			const retryAfterSeconds = OTP_RESEND_COOLDOWN_MS / 1e3;
+			ctx.res.setHeader("Retry-After", String(retryAfterSeconds));
+			ctx.res.status(429);
+			return {
+				success: false,
+				error: "rate_limited",
+				retryAfterSeconds
+			};
+		}
+	} catch (error) {
+		console.error("auth::failed_to_resend_verification_email", {
+			userId: user._id.toString(),
+			error
+		});
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "email_delivery_failed"
+		};
+	}
+	return {
+		success: true,
+		retryAfterSeconds: OTP_RESEND_COOLDOWN_MS / 1e3
+	};
+};
+var handler_default = (api) => {
+	api.post(ROUTE, resendOtp);
+};
+//#endregion
+export { handler_default as default, resendOtp };
+
+//# sourceMappingURL=handler-DCk7C1pI.js.map

package/dist/handler-DCk7C1pI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-DCk7C1pI.js","names":[],"sources":["../src/api/resend-otp/handler.ts"],"sourcesContent":["import { Api, type ApiHandler, type Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport {\n  issueVerificationCode,\n  OTP_RESEND_COOLDOWN_MS,\n} from \"../../emailVerification\"\nimport { pendingRegistrationCondition } from \"../../registrationStatus\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as ResendOtp from \"./index\"\n\n\nexport const resendOtp: ApiHandler<ResendOtp.RequestPayload, ResendOtp.ResponsePayload, AuthSessionUser> = async (\n  payload,\n  ctx: Ctx<AuthSessionUser>,\n): Promise<ResendOtp.ResponsePayload> => {\n  const parsed = ResendOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const User = await models.getGlobal(\"RBUser\", ctx)\n  const user = await User.findOne(\n    { email: parsed.data.email, ...pendingRegistrationCondition() },\n    { emailVerificationSentAt: 1 },\n  )\n\n  if (!user) {\n    ctx.res.status(404)\n    return { success: false, error: \"pending_registration_not_found\" }\n  }\n\n  const lastSentAt = user.get(\"emailVerificationSentAt\")\n  if (lastSentAt instanceof Date) {\n    const remainingMs = OTP_RESEND_COOLDOWN_MS - (Date.now() - lastSentAt.getTime())\n    if (remainingMs > 0) {\n      const retryAfterSeconds = Math.max(1, Math.ceil(remainingMs / 1000))\n      ctx.res.setHeader(\"Retry-After\", String(retryAfterSeconds))\n      ctx.res.status(429)\n      return { success: false, error: \"rate_limited\", retryAfterSeconds }\n    }\n  }\n\n  try {\n    const issued = await issueVerificationCode({\n      User,\n      userId: user._id,\n      email: parsed.data.email,\n      locale: parsed.data.locale,\n      enforceCooldown: true,\n    })\n\n    if (!issued) {\n      const retryAfterSeconds = OTP_RESEND_COOLDOWN_MS / 1000\n      ctx.res.setHeader(\"Retry-After\", String(retryAfterSeconds))\n      ctx.res.status(429)\n      return { success: false, error: \"rate_limited\", retryAfterSeconds }\n    }\n  } catch (error) {\n    console.error(\"auth::failed_to_resend_verification_email\", {\n      userId: user._id.toString(),\n      error,\n    })\n    ctx.res.status(500)\n    return { success: false, error: \"email_delivery_failed\" }\n  }\n\n  return { success: true, retryAfterSeconds: OTP_RESEND_COOLDOWN_MS / 1000 }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(ResendOtp.ROUTE, resendOtp)\n}\n"],"mappings":";;;;;AAaA,IAAa,YAA8F,OACzG,SACA,QACuC;CACvC,MAAM,SAAA,cAAiC,UAAU,OAAO;CAExD,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,MAAM,OAAO,MAAM,OAAO,UAAU,UAAU,GAAG;CACjD,MAAM,OAAO,MAAM,KAAK,QACtB;EAAE,OAAO,OAAO,KAAK;EAAO,GAAG,6BAA6B;CAAE,GAC9D,EAAE,yBAAyB,EAAE,CAC/B;CAEA,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAiC;CACnE;CAEA,MAAM,aAAa,KAAK,IAAI,yBAAyB;CACrD,IAAI,sBAAsB,MAAM;EAC9B,MAAM,cAAc,0BAA0B,KAAK,IAAI,IAAI,WAAW,QAAQ;EAC9E,IAAI,cAAc,GAAG;GACnB,MAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,KAAK,cAAc,GAAI,CAAC;GACnE,IAAI,IAAI,UAAU,eAAe,OAAO,iBAAiB,CAAC;GAC1D,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,SAAS;IAAO,OAAO;IAAgB;GAAkB;EACpE;CACF;CAEA,IAAI;EASF,IAAI,CAAC,MARgB,sBAAsB;GACzC;GACA,QAAQ,KAAK;GACb,OAAO,OAAO,KAAK;GACnB,QAAQ,OAAO,KAAK;GACpB,iBAAiB;EACnB,CAAC,GAEY;GACX,MAAM,oBAAoB,yBAAyB;GACnD,IAAI,IAAI,UAAU,eAAe,OAAO,iBAAiB,CAAC;GAC1D,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,SAAS;IAAO,OAAO;IAAgB;GAAkB;EACpE;CACF,SAAS,OAAO;EACd,QAAQ,MAAM,6CAA6C;GACzD,QAAQ,KAAK,IAAI,SAAS;GAC1B;EACF,CAAC;EACD,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAwB;CAC1D;CAEA,OAAO;EAAE,SAAS;EAAM,mBAAmB,yBAAyB;CAAK;AAC3E;AAEA,IAAA,mBAAgB,QAA8B;CAC5C,IAAI,KAAK,OAAiB,SAAS;AACrC"}

package/dist/{handler-iT2eSHpE.js → handler-DCljRBBf.js}

@@ -1,10 +1,10 @@
-import { a as string, i as object, n as boolean } from "./schemas-CMgO_xn9.js";
+import { a as object, o as string, r as boolean } from "./schemas-DABNKHVA.js";
 import crypto from "crypto";
 import { models } from "@rpcbase/db";
 //#region src/api/verify-password-reset-otp/index.ts
 var ROUTE = "/api/rb/auth/verify-password-reset-otp";
 var requestSchema = object({
-	email: string().email(),
+	email: string().trim().toLowerCase().email(),
 	code: string().length(6, "Code must be 6 digits")
 });
 object({
@@ -53,4 +53,4 @@ var handler_default = (api) => {
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-iT2eSHpE.js.map
+//# sourceMappingURL=handler-DCljRBBf.js.map

package/dist/handler-DCljRBBf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-DCljRBBf.js","names":[],"sources":["../src/api/verify-password-reset-otp/index.ts","../src/api/verify-password-reset-otp/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/verify-password-reset-otp\"\n\nexport const requestSchema = z.object({\n  email: z.string().trim().toLowerCase().email(),\n  code: z.string().length(6, \"Code must be 6 digits\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  resetToken: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import crypto from \"crypto\"\n\nimport { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as VerifyPasswordResetOtp from \"./index\"\n\n\nconst verifyPasswordResetOtp: ApiHandler<\n  VerifyPasswordResetOtp.RequestPayload,\n  VerifyPasswordResetOtp.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<VerifyPasswordResetOtp.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = VerifyPasswordResetOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, code } = parsed.data\n  const user = await User.findOne({ email })\n\n  const storedCode = user?.passwordResetCode\n  const expiresAt = user?.passwordResetCodeExpiresAt\n  const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now()\n\n  if (!user || !storedCode || storedCode !== code || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_code\" }\n  }\n\n  const resetToken = crypto.randomBytes(24).toString(\"hex\")\n\n  user.passwordResetCode = undefined\n  user.passwordResetCodeExpiresAt = undefined\n  user.passwordResetToken = resetToken\n  user.passwordResetTokenExpiresAt = new Date(Date.now() + 15 * 60 * 1000)\n  await user.save()\n\n  return { success: true, resetToken }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(VerifyPasswordResetOtp.ROUTE, verifyPasswordResetOtp)\n}\n"],"mappings":";;;;AAGA,IAAa,QAAQ;AAErB,IAAa,gBAAgB,OAAS;CACpC,OAAO,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM;CAC7C,MAAM,OAAS,CAAC,CAAC,OAAO,GAAG,uBAAuB;AACpD,CAAC;AAI6B,OAAS;CACrC,SAAS,QAAU;CACnB,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,YAAY,OAAS,CAAC,CAAC,SAAS;AAClC,CAAC;;;ACND,IAAM,yBAIF,OACF,SACA,QACoD;CACpD,MAAM,OAAO,MAAM,OAAO,UAAU,UAAU,GAAG;CAEjD,MAAM,SAAA,cAA8C,UAAU,OAAO;CAErE,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAE,OAAO,SAAS,OAAO;CAC/B,MAAM,OAAO,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC;CAEzC,MAAM,aAAa,MAAM;CACzB,MAAM,YAAY,MAAM;CACxB,MAAM,YAAY,qBAAqB,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI;CAE9E,IAAI,CAAC,QAAQ,CAAC,cAAc,eAAe,QAAQ,WAAW;EAC5D,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAe;CACjD;CAEA,MAAM,aAAa,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;CAExD,KAAK,oBAAoB,KAAA;CACzB,KAAK,6BAA6B,KAAA;CAClC,KAAK,qBAAqB;CAC1B,KAAK,8BAA8B,IAAI,KAAK,KAAK,IAAI,IAAI,GAAc;CACvE,MAAM,KAAK,KAAK;CAEhB,OAAO;EAAE,SAAS;EAAM;CAAW;AACrC;AAEA,IAAA,mBAAgB,QAA8B;CAC5C,IAAI,KAAK,OAA8B,sBAAsB;AAC/D"}

package/dist/{handler-CF3fSh8e.js → handler-JKQLI2iL.js}

@@ -1,4 +1,4 @@
-import { a as string, i as object, n as boolean } from "./schemas-CMgO_xn9.js";
+import { a as object, o as string, r as boolean } from "./schemas-DABNKHVA.js";
 import { r as restrictSessionMiddleware } from "./middleware-BT3Uput1.js";
 import { t as AUTHENTICATED_TENANT_ID_HEADER } from "./session-BQ06Yo3C.js";
 //#region src/api/set-active-account/index.ts
@@ -64,4 +64,4 @@ var handler_default = (api) => {
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-CF3fSh8e.js.map
+//# sourceMappingURL=handler-JKQLI2iL.js.map

package/dist/{handler-CF3fSh8e.js.map → handler-JKQLI2iL.js.map}

@@ -1 +1 @@
-{"version":3,"file":"handler-CF3fSh8e.js","names":[],"sources":["../src/api/set-active-account/index.ts","../src/api/set-active-account/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/set-active-account\"\n\nexport const requestSchema = z.object({\n  tenantId: z.string().min(1, \"Tenant is required\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\n\nimport { restrictSessionMiddleware } from \"../../middleware\"\nimport { AUTHENTICATED_TENANT_ID_HEADER } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetActiveAccount from \"./index\"\n\n\nconst setActiveAccount: ApiHandler<\n  SetActiveAccount.RequestPayload,\n  SetActiveAccount.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetActiveAccount.ResponsePayload> => {\n  const parsed = SetActiveAccount.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const sessionUser = ctx.req.session?.user\n  if (!sessionUser?.id) {\n    ctx.res.status(401)\n    return { success: false, error: \"unauthorized\" }\n  }\n\n  const tenantId = parsed.data.tenantId.trim()\n  const signedInTenants = Array.isArray(sessionUser.signedInTenants)\n    ? sessionUser.signedInTenants.map(String)\n    : []\n\n  if (signedInTenants.length > 0 && !signedInTenants.includes(tenantId)) {\n    ctx.res.status(403)\n    return { success: false, error: \"invalid_account\" }\n  }\n\n  if (signedInTenants.length === 0) {\n    const currentTenantId = typeof sessionUser.currentTenantId === \"string\" ? sessionUser.currentTenantId.trim() : \"\"\n    if (!currentTenantId || currentTenantId !== tenantId) {\n      ctx.res.status(403)\n      return { success: false, error: \"invalid_account\" }\n    }\n  }\n\n  ctx.req.session.user = {\n    ...sessionUser,\n    currentTenantId: tenantId,\n  }\n  ctx.res.setHeader(AUTHENTICATED_TENANT_ID_HEADER, tenantId)\n\n  return { success: true, tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.use(SetActiveAccount.ROUTE, restrictSessionMiddleware)\n  api.post(SetActiveAccount.ROUTE, setActiveAccount)\n}\n"],"mappings":";;;;AAGA,IAAa,QAAQ;AAErB,IAAa,gBAAgB,OAAS,EACpC,UAAU,OAAS,CAAC,CAAC,IAAI,GAAG,oBAAoB,EAClD,CAAC;AAI6B,OAAS;CACrC,SAAS,QAAU;CACnB,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,UAAU,OAAS,CAAC,CAAC,SAAS;AAChC,CAAC;;;ACND,IAAM,mBAIF,OACF,SACA,QAC8C;CAC9C,MAAM,SAAA,cAAwC,UAAU,OAAO;CAE/D,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,MAAM,cAAc,IAAI,IAAI,SAAS;CACrC,IAAI,CAAC,aAAa,IAAI;EACpB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAe;CACjD;CAEA,MAAM,WAAW,OAAO,KAAK,SAAS,KAAK;CAC3C,MAAM,kBAAkB,MAAM,QAAQ,YAAY,eAAe,IAC7D,YAAY,gBAAgB,IAAI,MAAM,IACtC,CAAA;CAEJ,IAAI,gBAAgB,SAAS,KAAK,CAAC,gBAAgB,SAAS,QAAQ,GAAG;EACrE,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,IAAI,gBAAgB,WAAW,GAAG;EAChC,MAAM,kBAAkB,OAAO,YAAY,oBAAoB,WAAW,YAAY,gBAAgB,KAAK,IAAI;EAC/G,IAAI,CAAC,mBAAmB,oBAAoB,UAAU;GACpD,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,SAAS;IAAO,OAAO;GAAkB;EACpD;CACF;CAEA,IAAI,IAAI,QAAQ,OAAO;EACrB,GAAG;EACH,iBAAiB;CACnB;CACA,IAAI,IAAI,UAAU,gCAAgC,QAAQ;CAE1D,OAAO;EAAE,SAAS;EAAM;CAAS;AACnC;AAEA,IAAA,mBAAgB,QAA8B;CAC5C,IAAI,IAAI,OAAwB,yBAAyB;CACzD,IAAI,KAAK,OAAwB,gBAAgB;AACnD"}
+{"version":3,"file":"handler-JKQLI2iL.js","names":[],"sources":["../src/api/set-active-account/index.ts","../src/api/set-active-account/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/set-active-account\"\n\nexport const requestSchema = z.object({\n  tenantId: z.string().min(1, \"Tenant is required\"),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n  tenantId: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\n\nimport { restrictSessionMiddleware } from \"../../middleware\"\nimport { AUTHENTICATED_TENANT_ID_HEADER } from \"../../session\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetActiveAccount from \"./index\"\n\n\nconst setActiveAccount: ApiHandler<\n  SetActiveAccount.RequestPayload,\n  SetActiveAccount.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetActiveAccount.ResponsePayload> => {\n  const parsed = SetActiveAccount.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const sessionUser = ctx.req.session?.user\n  if (!sessionUser?.id) {\n    ctx.res.status(401)\n    return { success: false, error: \"unauthorized\" }\n  }\n\n  const tenantId = parsed.data.tenantId.trim()\n  const signedInTenants = Array.isArray(sessionUser.signedInTenants)\n    ? sessionUser.signedInTenants.map(String)\n    : []\n\n  if (signedInTenants.length > 0 && !signedInTenants.includes(tenantId)) {\n    ctx.res.status(403)\n    return { success: false, error: \"invalid_account\" }\n  }\n\n  if (signedInTenants.length === 0) {\n    const currentTenantId = typeof sessionUser.currentTenantId === \"string\" ? sessionUser.currentTenantId.trim() : \"\"\n    if (!currentTenantId || currentTenantId !== tenantId) {\n      ctx.res.status(403)\n      return { success: false, error: \"invalid_account\" }\n    }\n  }\n\n  ctx.req.session.user = {\n    ...sessionUser,\n    currentTenantId: tenantId,\n  }\n  ctx.res.setHeader(AUTHENTICATED_TENANT_ID_HEADER, tenantId)\n\n  return { success: true, tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.use(SetActiveAccount.ROUTE, restrictSessionMiddleware)\n  api.post(SetActiveAccount.ROUTE, setActiveAccount)\n}\n"],"mappings":";;;;AAGA,IAAa,QAAQ;AAErB,IAAa,gBAAgB,OAAS,EACpC,UAAU,OAAS,CAAC,CAAC,IAAI,GAAG,oBAAoB,EAClD,CAAC;AAI6B,OAAS;CACrC,SAAS,QAAU;CACnB,OAAO,OAAS,CAAC,CAAC,SAAS;CAC3B,UAAU,OAAS,CAAC,CAAC,SAAS;AAChC,CAAC;;;ACND,IAAM,mBAIF,OACF,SACA,QAC8C;CAC9C,MAAM,SAAA,cAAwC,UAAU,OAAO;CAE/D,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,MAAM,cAAc,IAAI,IAAI,SAAS;CACrC,IAAI,CAAC,aAAa,IAAI;EACpB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAe;CACjD;CAEA,MAAM,WAAW,OAAO,KAAK,SAAS,KAAK;CAC3C,MAAM,kBAAkB,MAAM,QAAQ,YAAY,eAAe,IAC7D,YAAY,gBAAgB,IAAI,MAAM,IACtC,CAAA;CAEJ,IAAI,gBAAgB,SAAS,KAAK,CAAC,gBAAgB,SAAS,QAAQ,GAAG;EACrE,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,IAAI,gBAAgB,WAAW,GAAG;EAChC,MAAM,kBAAkB,OAAO,YAAY,oBAAoB,WAAW,YAAY,gBAAgB,KAAK,IAAI;EAC/G,IAAI,CAAC,mBAAmB,oBAAoB,UAAU;GACpD,IAAI,IAAI,OAAO,GAAG;GAClB,OAAO;IAAE,SAAS;IAAO,OAAO;GAAkB;EACpD;CACF;CAEA,IAAI,IAAI,QAAQ,OAAO;EACrB,GAAG;EACH,iBAAiB;CACnB;CACA,IAAI,IAAI,UAAU,gCAAgC,QAAQ;CAE1D,OAAO;EAAE,SAAS;EAAM;CAAS;AACnC;AAEA,IAAA,mBAAgB,QAA8B;CAC5C,IAAI,IAAI,OAAwB,yBAAyB;CACzD,IAAI,KAAK,OAAwB,gBAAgB;AACnD"}

package/dist/{handler-DgIcxthg.js → handler-b6PvhATs.js}

@@ -1,10 +1,10 @@
-import { a as string, i as object, n as boolean } from "./schemas-CMgO_xn9.js";
+import { a as object, o as string, r as boolean } from "./schemas-DABNKHVA.js";
 import { models } from "@rpcbase/db";
 import { hashPasswordForStorage } from "@rpcbase/server";
 //#region src/api/set-new-password/index.ts
 var ROUTE = "/api/rb/auth/set-new-password";
 var requestSchema = object({
-	email: string().email(),
+	email: string().trim().toLowerCase().email(),
 	resetToken: string().min(1),
 	password: string().min(8, { message: "Password must be at least 8 characters long." })
 });
@@ -48,4 +48,4 @@ var handler_default = (api) => {
 //#endregion
 export { handler_default as default };
 
-//# sourceMappingURL=handler-DgIcxthg.js.map
+//# sourceMappingURL=handler-b6PvhATs.js.map

package/dist/handler-b6PvhATs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-b6PvhATs.js","names":[],"sources":["../src/api/set-new-password/index.ts","../src/api/set-new-password/handler.ts"],"sourcesContent":["import { z } from \"zod\"\n\n\nexport const ROUTE = \"/api/rb/auth/set-new-password\"\n\nexport const requestSchema = z.object({\n  email: z.string().trim().toLowerCase().email(),\n  resetToken: z.string().min(1),\n  password: z.string().min(8, { message: \"Password must be at least 8 characters long.\" }),\n})\n\nexport type RequestPayload = z.infer<typeof requestSchema>\n\nexport const responseSchema = z.object({\n  success: z.boolean(),\n  error: z.string().optional(),\n})\n\nexport type ResponsePayload = z.infer<typeof responseSchema>\n","import { Api, ApiHandler, Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { hashPasswordForStorage } from \"@rpcbase/server\"\n\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as SetNewPassword from \"./index\"\n\n\nconst setNewPassword: ApiHandler<\n  SetNewPassword.RequestPayload,\n  SetNewPassword.ResponsePayload,\n  AuthSessionUser\n> = async(\n  payload,\n  ctx: Ctx<AuthSessionUser>\n): Promise<SetNewPassword.ResponsePayload> => {\n  const User = await models.getGlobal(\"RBUser\", ctx)\n\n  const parsed = SetNewPassword.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  const { email, resetToken, password } = parsed.data\n\n  const user = await User.findOne({ email })\n  const storedToken = user?.passwordResetToken\n  const tokenExpiresAt = user?.passwordResetTokenExpiresAt\n  const isExpired = tokenExpiresAt instanceof Date && tokenExpiresAt.getTime() < Date.now()\n\n  if (!user || !storedToken || storedToken !== resetToken || isExpired) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_token\" }\n  }\n\n  const hashedPassword = await hashPasswordForStorage(password)\n  user.password = hashedPassword\n  user.passwordResetToken = undefined\n  user.passwordResetTokenExpiresAt = undefined\n  await user.save()\n\n  return { success: true }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(SetNewPassword.ROUTE, setNewPassword)\n}\n"],"mappings":";;;;AAGA,IAAa,QAAQ;AAErB,IAAa,gBAAgB,OAAS;CACpC,OAAO,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM;CAC7C,YAAY,OAAS,CAAC,CAAC,IAAI,CAAC;CAC5B,UAAU,OAAS,CAAC,CAAC,IAAI,GAAG,EAAE,SAAS,+CAA+C,CAAC;AACzF,CAAC;AAI6B,OAAS;CACrC,SAAS,QAAU;CACnB,OAAO,OAAS,CAAC,CAAC,SAAS;AAC7B,CAAC;;;ACPD,IAAM,iBAIF,OACF,SACA,QAC4C;CAC5C,MAAM,OAAO,MAAM,OAAO,UAAU,UAAU,GAAG;CAEjD,MAAM,SAAA,cAAsC,UAAU,OAAO;CAE7D,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,MAAM,EAAE,OAAO,YAAY,aAAa,OAAO;CAE/C,MAAM,OAAO,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC;CACzC,MAAM,cAAc,MAAM;CAC1B,MAAM,iBAAiB,MAAM;CAC7B,MAAM,YAAY,0BAA0B,QAAQ,eAAe,QAAQ,IAAI,KAAK,IAAI;CAExF,IAAI,CAAC,QAAQ,CAAC,eAAe,gBAAgB,cAAc,WAAW;EACpE,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAgB;CAClD;CAGA,KAAK,WAAW,MADa,uBAAuB,QAAQ;CAE5D,KAAK,qBAAqB,KAAA;CAC1B,KAAK,8BAA8B,KAAA;CACnC,MAAM,KAAK,KAAK;CAEhB,OAAO,EAAE,SAAS,KAAK;AACzB;AAEA,IAAA,mBAAgB,QAA8B;CAC5C,IAAI,KAAK,OAAsB,cAAc;AAC/C"}

package/dist/handler-cj7IkJB-.js

@@ -0,0 +1,98 @@
+import { n as pendingRegistrationCondition } from "./registrationStatus-BP6yReMw.js";
+import { n as completeAuthSignIn } from "./session-BQ06Yo3C.js";
+import { ROUTE, requestSchema } from "./api/verify-otp/index.js";
+import { models } from "@rpcbase/db";
+//#region src/api/verify-otp/handler.ts
+var verifyOtp = async (payload, ctx) => {
+	const parsed = requestSchema.safeParse(payload);
+	if (!parsed.success) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_payload"
+		};
+	}
+	if (!ctx.req.session) {
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "session_unavailable"
+		};
+	}
+	const [User, Tenant] = await Promise.all([models.getGlobal("RBUser", ctx), models.getGlobal("RBTenant", ctx)]);
+	const user = await User.findOne({
+		email: parsed.data.email,
+		...pendingRegistrationCondition()
+	}, {
+		tenants: 1,
+		tenantRoles: 1,
+		emailVerificationCode: 1,
+		emailVerificationExpiresAt: 1
+	});
+	const expiresAt = user?.emailVerificationExpiresAt;
+	const codeMatches = user?.emailVerificationCode === parsed.data.code;
+	const codeIsCurrent = expiresAt instanceof Date && expiresAt.getTime() > Date.now();
+	if (!user || !codeMatches || !codeIsCurrent) {
+		ctx.res.status(400);
+		return {
+			success: false,
+			error: "invalid_code"
+		};
+	}
+	const signedInTenants = Array.isArray(user.tenants) ? user.tenants.map(String) : [];
+	const tenantId = signedInTenants[0]?.trim() ?? "";
+	const tenant = tenantId ? await Tenant.findOne({ tenantId }, { provisioningStatus: 1 }).lean() : null;
+	if (!tenantId || tenant?.provisioningStatus !== "active") {
+		ctx.res.status(503);
+		return {
+			success: false,
+			error: "tenant_unavailable"
+		};
+	}
+	if ((await User.updateOne({
+		_id: user._id,
+		...pendingRegistrationCondition(),
+		emailVerificationCode: parsed.data.code,
+		emailVerificationExpiresAt: { $gt: /* @__PURE__ */ new Date() }
+	}, {
+		$set: { registrationStatus: "active" },
+		$unset: {
+			emailVerificationCode: "",
+			emailVerificationExpiresAt: "",
+			emailVerificationSentAt: ""
+		}
+	})).matchedCount !== 1) {
+		ctx.res.status(409);
+		return {
+			success: false,
+			error: "code_already_used"
+		};
+	}
+	const tenantRolesMap = user.get("tenantRoles");
+	const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : void 0;
+	const userId = user._id.toString();
+	if (!completeAuthSignIn(ctx, {
+		userId,
+		currentTenantId: tenantId,
+		signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],
+		tenantRoles
+	})) {
+		ctx.res.status(500);
+		return {
+			success: false,
+			error: "session_unavailable"
+		};
+	}
+	return {
+		success: true,
+		userId,
+		tenantId
+	};
+};
+var handler_default = (api) => {
+	api.post(ROUTE, verifyOtp);
+};
+//#endregion
+export { handler_default as default, verifyOtp };
+
+//# sourceMappingURL=handler-cj7IkJB-.js.map

package/dist/handler-cj7IkJB-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler-cj7IkJB-.js","names":[],"sources":["../src/api/verify-otp/handler.ts"],"sourcesContent":["import { Api, type ApiHandler, type Ctx } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\n\nimport { completeAuthSignIn } from \"../../session\"\nimport { pendingRegistrationCondition } from \"../../registrationStatus\"\nimport type { AuthSessionUser } from \"../../types\"\n\nimport * as VerifyOtp from \"./index\"\n\n\nexport const verifyOtp: ApiHandler<VerifyOtp.RequestPayload, VerifyOtp.ResponsePayload, AuthSessionUser> = async (\n  payload,\n  ctx: Ctx<AuthSessionUser>,\n): Promise<VerifyOtp.ResponsePayload> => {\n  const parsed = VerifyOtp.requestSchema.safeParse(payload)\n\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_payload\" }\n  }\n\n  if (!ctx.req.session) {\n    ctx.res.status(500)\n    return { success: false, error: \"session_unavailable\" }\n  }\n\n  const [User, Tenant] = await Promise.all([\n    models.getGlobal(\"RBUser\", ctx),\n    models.getGlobal(\"RBTenant\", ctx),\n  ])\n  const user = await User.findOne(\n    { email: parsed.data.email, ...pendingRegistrationCondition() },\n    {\n      tenants: 1,\n      tenantRoles: 1,\n      emailVerificationCode: 1,\n      emailVerificationExpiresAt: 1,\n    },\n  )\n\n  const expiresAt = user?.emailVerificationExpiresAt\n  const codeMatches = user?.emailVerificationCode === parsed.data.code\n  const codeIsCurrent = expiresAt instanceof Date && expiresAt.getTime() > Date.now()\n\n  if (!user || !codeMatches || !codeIsCurrent) {\n    ctx.res.status(400)\n    return { success: false, error: \"invalid_code\" }\n  }\n\n  const signedInTenants = Array.isArray(user.tenants) ? user.tenants.map(String) : []\n  const tenantId = signedInTenants[0]?.trim() ?? \"\"\n  const tenant = tenantId\n    ? await Tenant.findOne({ tenantId }, { provisioningStatus: 1 }).lean() as {\n      provisioningStatus?: unknown\n    } | null\n    : null\n\n  if (!tenantId || tenant?.provisioningStatus !== \"active\") {\n    ctx.res.status(503)\n    return { success: false, error: \"tenant_unavailable\" }\n  }\n\n  const activation = await User.updateOne(\n    {\n      _id: user._id,\n      ...pendingRegistrationCondition(),\n      emailVerificationCode: parsed.data.code,\n      emailVerificationExpiresAt: { $gt: new Date() },\n    },\n    {\n      $set: { registrationStatus: \"active\" },\n      $unset: {\n        emailVerificationCode: \"\",\n        emailVerificationExpiresAt: \"\",\n        emailVerificationSentAt: \"\",\n      },\n    },\n  )\n\n  if (activation.matchedCount !== 1) {\n    ctx.res.status(409)\n    return { success: false, error: \"code_already_used\" }\n  }\n\n  const tenantRolesMap = user.get(\"tenantRoles\") as Map<string, string[]> | undefined\n  const tenantRoles = tenantRolesMap ? Object.fromEntries(tenantRolesMap.entries()) : undefined\n  const userId = user._id.toString()\n\n  if (!completeAuthSignIn(ctx, {\n    userId,\n    currentTenantId: tenantId,\n    signedInTenants: signedInTenants.length ? signedInTenants : [tenantId],\n    tenantRoles,\n  })) {\n    ctx.res.status(500)\n    return { success: false, error: \"session_unavailable\" }\n  }\n\n  return { success: true, userId, tenantId }\n}\n\nexport default (api: Api<AuthSessionUser>) => {\n  api.post(VerifyOtp.ROUTE, verifyOtp)\n}\n"],"mappings":";;;;;AAUA,IAAa,YAA8F,OACzG,SACA,QACuC;CACvC,MAAM,SAAA,cAAiC,UAAU,OAAO;CAExD,IAAI,CAAC,OAAO,SAAS;EACnB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAkB;CACpD;CAEA,IAAI,CAAC,IAAI,IAAI,SAAS;EACpB,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAsB;CACxD;CAEA,MAAM,CAAC,MAAM,UAAU,MAAM,QAAQ,IAAI,CACvC,OAAO,UAAU,UAAU,GAAG,GAC9B,OAAO,UAAU,YAAY,GAAG,CAAC,CAClC;CACD,MAAM,OAAO,MAAM,KAAK,QACtB;EAAE,OAAO,OAAO,KAAK;EAAO,GAAG,6BAA6B;CAAE,GAC9D;EACE,SAAS;EACT,aAAa;EACb,uBAAuB;EACvB,4BAA4B;CAC9B,CACF;CAEA,MAAM,YAAY,MAAM;CACxB,MAAM,cAAc,MAAM,0BAA0B,OAAO,KAAK;CAChE,MAAM,gBAAgB,qBAAqB,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI;CAElF,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,eAAe;EAC3C,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAe;CACjD;CAEA,MAAM,kBAAkB,MAAM,QAAQ,KAAK,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAA;CACjF,MAAM,WAAW,gBAAgB,EAAE,EAAE,KAAK,KAAK;CAC/C,MAAM,SAAS,WACX,MAAM,OAAO,QAAQ,EAAE,SAAS,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,KAAK,IAGnE;CAEJ,IAAI,CAAC,YAAY,QAAQ,uBAAuB,UAAU;EACxD,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAqB;CACvD;CAmBA,KAAI,MAjBqB,KAAK,UAC5B;EACE,KAAK,KAAK;EACV,GAAG,6BAA6B;EAChC,uBAAuB,OAAO,KAAK;EACnC,4BAA4B,EAAE,qBAAK,IAAI,KAAK,EAAE;CAChD,GACA;EACE,MAAM,EAAE,oBAAoB,SAAS;EACrC,QAAQ;GACN,uBAAuB;GACvB,4BAA4B;GAC5B,yBAAyB;EAC3B;CACF,CACF,EAAA,CAEe,iBAAiB,GAAG;EACjC,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAoB;CACtD;CAEA,MAAM,iBAAiB,KAAK,IAAI,aAAa;CAC7C,MAAM,cAAc,iBAAiB,OAAO,YAAY,eAAe,QAAQ,CAAC,IAAI,KAAA;CACpF,MAAM,SAAS,KAAK,IAAI,SAAS;CAEjC,IAAI,CAAC,mBAAmB,KAAK;EAC3B;EACA,iBAAiB;EACjB,iBAAiB,gBAAgB,SAAS,kBAAkB,CAAC,QAAQ;EACrE;CACF,CAAC,GAAG;EACF,IAAI,IAAI,OAAO,GAAG;EAClB,OAAO;GAAE,SAAS;GAAO,OAAO;EAAsB;CACxD;CAEA,OAAO;EAAE,SAAS;EAAM;EAAQ;CAAS;AAC3C;AAEA,IAAA,mBAAgB,QAA8B;CAC5C,IAAI,KAAK,OAAiB,SAAS;AACrC"}

package/dist/index.js

@@ -1,5 +1,5 @@
-import { n as requestSchema } from "./sign-in-DYq3bJeH.js";
-import { n as requestSchema$1 } from "./sign-up-CYGadNUe.js";
+import { requestSchema } from "./api/sign-in/index.js";
+import { requestSchema as requestSchema$1 } from "./api/sign-up/index.js";
 import { n as requireSession, r as restrictSessionMiddleware, t as redirectAuthMiddleware } from "./middleware-BT3Uput1.js";
 import { createContext, createElement, forwardRef, useContext, useEffect, useRef, useState } from "react";
 import { Link, useLocation, useNavigate, useSearchParams } from "@rpcbase/router";
@@ -187,6 +187,13 @@ var SignInForm = ({ children, className }) => {
 			});
 			const json = await res.json().catch(() => null);
 			if (!res.ok || !json?.success) {
+				if (json?.error === "email_verification_required") {
+					const nextPath = sanitizeNextPath(searchParams.get("next")) ?? "/";
+					const search = new URLSearchParams({ email: data.email.trim().toLowerCase() });
+					search.set("next", nextPath);
+					navigate(`/auth/sign-up-otp?${search.toString()}`);
+					return;
+				}
 				const message = json?.error === "invalid_credentials" ? "Invalid email or password." : "Sign-in failed. Please try again.";
 				methods.setError("root", {
 					type: "server",
@@ -194,8 +201,8 @@ var SignInForm = ({ children, className }) => {
 				});
 				return;
 			}
-			const nextPath = sanitizeNextPath(searchParams.get("next")) ?? "/";
-			navigate(nextPath, { replace: true });
+			const nextPath_0 = sanitizeNextPath(searchParams.get("next")) ?? "/";
+			navigate(nextPath_0, { replace: true });
 		} catch (err) {
 			methods.setError("root", {
 				type: "server",
@@ -258,7 +265,7 @@ var SignUpForm = ({ children, className, otpNextPath }) => {
 				});
 				return;
 			}
-			const search = new URLSearchParams({ email: data.email });
+			const search = new URLSearchParams({ email: data.email.trim().toLowerCase() });
 			if (otpNextPath) search.set("next", otpNextPath);
 			navigate(`/auth/sign-up-otp?${search.toString()}`);
 			setServerMessage("Account created. Check your inbox to verify your email.");
@@ -486,6 +493,7 @@ var PasswordInput = ({ id, name = "password", className, placeholder, autoComple
 			...register(name)
 		}), /* @__PURE__ */ jsx("button", {
 			type: "button",
+			tabIndex: -1,
 			className: "absolute inset-y-0 right-0 flex items-center pr-3 text-gray-500",
 			onClick: () => setShowPassword((prev) => !prev),
 			"aria-label": showPassword ? "Hide characters" : "Show characters",