@rudderhq/server 0.6.5 → 0.6.6-canary.1

package/dist/services/local-account-auth.d.ts

@@ -0,0 +1,94 @@
+import type { Db } from "@rudderhq/db";
+import { type OfflineGrantProof } from "@rudderhq/identity-core";
+import type { IncomingHttpHeaders } from "node:http";
+export type VerifiedServerExchange = {
+    issuer: string;
+    subject: string;
+    audience: string;
+    installationId: string;
+    jti: string;
+    expiresAt: Date;
+    email: string;
+    emailVerified: true;
+    name?: string | null;
+};
+export interface ServerExchangeVerifier {
+    verify(exchangeCode: string): Promise<VerifiedServerExchange>;
+}
+export type LocalAccountExchangePolicy = {
+    expectedIssuer: string;
+    audience: string;
+    installationId: string;
+    verifier: ServerExchangeVerifier;
+    /** Better Auth session secret used to sign its session cookie value. */
+    sessionSecret: string;
+    secureCookie?: boolean;
+    now?: () => Date;
+    offline?: {
+        identityKeyId: string;
+        identityPublicKeySpki: string;
+        expectedAccountId: string;
+        expectedDeviceId: string;
+        lastTrustedTimeMs: number;
+        localSignOutEpoch: number;
+    };
+};
+export type LocalSession = {
+    id: string;
+    userId: string;
+    expiresAt: Date;
+    setCookie: string;
+};
+export declare function createIdentityServerExchangeVerifier(options: {
+    identityOrigin: string;
+    expectedAudience: string;
+    expectedInstallationId: string;
+    fetch?: typeof globalThis.fetch;
+}): ServerExchangeVerifier;
+export declare function createLocalAccountSessionResolver(db: Db, options: {
+    sessionSecret: string;
+    secureCookie?: boolean;
+}): (headers: IncomingHttpHeaders) => Promise<{
+    session: {
+        id: string;
+        userId: string;
+    };
+    user: {
+        id: string;
+        email: string;
+        name: string;
+    };
+} | null>;
+export declare function localAccountAuthService(db: Db, policy: LocalAccountExchangePolicy): {
+    redeem: (exchangeCode: string) => Promise<{
+        userId: string;
+        session: LocalSession;
+    }>;
+    redeemOffline: (input: {
+        grant: string;
+        proof: OfflineGrantProof;
+        devicePublicKeySpki: string;
+    }) => Promise<{
+        userId: string;
+        session: LocalSession;
+        nextTrustedTimeMs: number;
+    }>;
+    claimLegacyInstallation: (input: {
+        installationId: string;
+        issuer: string;
+        subject: string;
+        localUserId: string;
+    }) => Promise<{
+        status: "already_claimed";
+        localUserId: string;
+        orgIds: string[];
+    } | {
+        status: "claimed";
+        localUserId: string;
+        orgIds: string[];
+    }>;
+    revokeAllSessions: (localUserId: string) => Promise<{
+        revokedSessionCount: number;
+    }>;
+};
+//# sourceMappingURL=local-account-auth.d.ts.map

package/dist/services/local-account-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-account-auth.d.ts","sourceRoot":"","sources":["../../src/services/local-account-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAWvC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAUjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAMrD,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC/D;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,wEAAwE;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,aAAa,EAAE,MAAM,CAAC;QACtB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,MAAM,CAAC;QACzB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AA4CF,wBAAgB,oCAAoC,CAAC,OAAO,EAAE;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC,GAAG,sBAAsB,CAyCzB;AA8BD,wBAAgB,iCAAiC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,IAIe,SAAS,mBAAmB;;;;;;;;;;UAsB3C;AAiBD,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,0BAA0B;2BAC5C,MAAM,KAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,YAAY,CAAA;KAAE,CAAC;2BA0G3D;QAClC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,iBAAiB,CAAC;QACzB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,KAAG,OAAO,CAAC;QACV,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,YAAY,CAAC;QACtB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;qCA+H4C;QAC5C,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB;;;gBAoBmG,MAAM,EAAE;;;;;;qCAgG9D,MAAM;;;EA8BrD"}

package/dist/services/local-account-auth.js

@@ -0,0 +1,470 @@
+import { activityLog, authSessions, authUsers, externalUserBindings, installationAccountBindings, instanceUserRoles, organizationMemberships, serverExchangeRedemptions, } from "@rudderhq/db";
+import { offlineRequestBodyHash, verifyOfflineGrantAndProof, } from "@rudderhq/identity-core";
+import { and, eq, lt, sql } from "drizzle-orm";
+import { createHash, createHmac, createPublicKey, randomBytes, randomUUID, timingSafeEqual, } from "node:crypto";
+import { conflict, forbidden, unauthorized } from "../errors.js";
+const LOCAL_BOARD_USER_ID = "local-board";
+const LOCAL_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+function normalizeIssuer(value) {
+    return value.trim().replace(/\/+$/, "");
+}
+function assertExchangeClaims(claims, policy, now) {
+    if (normalizeIssuer(claims.issuer) !== normalizeIssuer(policy.expectedIssuer)) {
+        throw unauthorized("Server exchange issuer is not accepted");
+    }
+    if (claims.audience !== policy.audience) {
+        throw unauthorized("Server exchange audience does not match this installation");
+    }
+    if (claims.installationId !== policy.installationId) {
+        throw unauthorized("Server exchange installation does not match this runtime");
+    }
+    if (claims.expiresAt.getTime() <= now.getTime()) {
+        throw unauthorized("Server exchange code has expired");
+    }
+    if (!claims.jti.trim() || !claims.subject.trim() || !claims.emailVerified) {
+        throw unauthorized("Server exchange claims are incomplete");
+    }
+}
+function allowedIdentityOrigin(value) {
+    const url = new URL(value);
+    const isLoopback = url.protocol === "http:"
+        && (url.hostname === "127.0.0.1" || url.hostname === "localhost");
+    if (url.protocol !== "https:" && !isLoopback) {
+        throw new Error("Rudder Identity verifier requires HTTPS or an explicit loopback development origin");
+    }
+    if (url.username || url.password)
+        throw new Error("Rudder Identity origin cannot contain credentials");
+    return url.origin;
+}
+function requiredString(record, key, max = 512) {
+    const value = record[key];
+    if (typeof value !== "string" || !value.trim() || value.length > max) {
+        throw unauthorized("Rudder Identity returned invalid server exchange claims");
+    }
+    return value;
+}
+export function createIdentityServerExchangeVerifier(options) {
+    const identityOrigin = allowedIdentityOrigin(options.identityOrigin);
+    const request = options.fetch ?? globalThis.fetch;
+    return {
+        async verify(exchangeCode) {
+            const response = await request(new URL("/api/server/exchange/verify", identityOrigin), {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({
+                    code: exchangeCode,
+                    expected_audience: options.expectedAudience,
+                    expected_installation_id: options.expectedInstallationId,
+                }),
+            });
+            if (!response.ok)
+                throw unauthorized("Rudder Identity rejected the server exchange");
+            const value = await response.json();
+            if (!value || typeof value !== "object" || Array.isArray(value)) {
+                throw unauthorized("Rudder Identity returned invalid server exchange claims");
+            }
+            const record = value;
+            const expiresAt = new Date(requiredString(record, "expiresAt"));
+            const email = requiredString(record, "email", 320).trim().toLowerCase();
+            if (Number.isNaN(expiresAt.getTime()) || !email.includes("@")) {
+                throw unauthorized("Rudder Identity returned invalid server exchange claims");
+            }
+            // The exchange endpoint only emits users whose email was verified by
+            // Rudder Identity. The local runtime accepts that assertion exclusively
+            // from its pinned HTTPS (or explicit loopback-dev) issuer.
+            return {
+                issuer: requiredString(record, "issuer"),
+                subject: requiredString(record, "subject"),
+                audience: requiredString(record, "audience"),
+                installationId: requiredString(record, "installationId"),
+                jti: requiredString(record, "jti"),
+                expiresAt,
+                email,
+                emailVerified: true,
+                name: typeof record.name === "string" ? record.name : null,
+            };
+        },
+    };
+}
+function cookieValue(headers, name) {
+    const raw = Array.isArray(headers.cookie) ? headers.cookie.join(";") : headers.cookie;
+    if (!raw)
+        return null;
+    for (const part of raw.split(";")) {
+        const separator = part.indexOf("=");
+        if (separator < 0 || part.slice(0, separator).trim() !== name)
+            continue;
+        try {
+            return decodeURIComponent(part.slice(separator + 1).trim());
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+function verifySignedSessionToken(value, secret) {
+    const separator = value.lastIndexOf(".");
+    if (separator <= 0)
+        return null;
+    const token = value.slice(0, separator);
+    const supplied = Buffer.from(value.slice(separator + 1), "utf8");
+    const expected = Buffer.from(createHmac("sha256", secret).update(token).digest("base64"), "utf8");
+    if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected))
+        return null;
+    return token;
+}
+export function createLocalAccountSessionResolver(db, options) {
+    const cookieName = options.secureCookie
+        ? "__Secure-better-auth.session_token"
+        : "better-auth.session_token";
+    return async (headers) => {
+        const signed = cookieValue(headers, cookieName);
+        const token = signed ? verifySignedSessionToken(signed, options.sessionSecret) : null;
+        if (!token)
+            return null;
+        const row = await db
+            .select({
+            sessionId: authSessions.id,
+            userId: authUsers.id,
+            email: authUsers.email,
+            name: authUsers.name,
+            expiresAt: authSessions.expiresAt,
+        })
+            .from(authSessions)
+            .innerJoin(authUsers, eq(authSessions.userId, authUsers.id))
+            .where(eq(authSessions.token, token))
+            .then((rows) => rows[0] ?? null);
+        if (!row || row.expiresAt.getTime() <= Date.now())
+            return null;
+        return {
+            session: { id: row.sessionId, userId: row.userId },
+            user: { id: row.userId, email: row.email, name: row.name },
+        };
+    };
+}
+function localSessionCookie(token, expiresAt, secure, secret) {
+    const signature = createHmac("sha256", secret).update(token).digest("base64");
+    const signedToken = `${token}.${signature}`;
+    const cookieName = secure ? "__Secure-better-auth.session_token" : "better-auth.session_token";
+    const parts = [
+        `${cookieName}=${encodeURIComponent(signedToken)}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        `Expires=${expiresAt.toUTCString()}`,
+    ];
+    if (secure)
+        parts.push("Secure");
+    return parts.join("; ");
+}
+export function localAccountAuthService(db, policy) {
+    async function redeem(exchangeCode) {
+        const claims = await policy.verifier.verify(exchangeCode);
+        const now = policy.now?.() ?? new Date();
+        assertExchangeClaims(claims, policy, now);
+        const result = await db.transaction(async (tx) => {
+            const redemption = await tx
+                .insert(serverExchangeRedemptions)
+                .values({
+                issuer: normalizeIssuer(claims.issuer),
+                jti: claims.jti,
+                audience: claims.audience,
+                subject: claims.subject,
+                expiresAt: claims.expiresAt,
+            })
+                .onConflictDoNothing({
+                target: [serverExchangeRedemptions.issuer, serverExchangeRedemptions.jti],
+            })
+                .returning({ id: serverExchangeRedemptions.id })
+                .then((rows) => rows[0] ?? null);
+            if (!redemption)
+                throw conflict("Server exchange code has already been redeemed");
+            await tx.execute(sql `
+        select pg_advisory_xact_lock(
+          hashtext(${normalizeIssuer(claims.issuer)}),
+          hashtext(${claims.subject})
+        )
+      `);
+            let binding = await tx
+                .select({ localUserId: externalUserBindings.localUserId })
+                .from(externalUserBindings)
+                .where(and(eq(externalUserBindings.issuer, normalizeIssuer(claims.issuer)), eq(externalUserBindings.subject, claims.subject)))
+                .then((rows) => rows[0] ?? null);
+            if (!binding) {
+                const userId = randomUUID();
+                await tx.insert(authUsers).values({
+                    id: userId,
+                    name: claims.name?.trim() || claims.email,
+                    email: claims.email,
+                    emailVerified: true,
+                    createdAt: now,
+                    updatedAt: now,
+                });
+                binding = await tx
+                    .insert(externalUserBindings)
+                    .values({
+                    issuer: normalizeIssuer(claims.issuer),
+                    subject: claims.subject,
+                    localUserId: userId,
+                    lastVerifiedAt: now,
+                })
+                    .returning({ localUserId: externalUserBindings.localUserId })
+                    .then((rows) => rows[0]);
+            }
+            else {
+                await tx
+                    .update(externalUserBindings)
+                    .set({ lastVerifiedAt: now })
+                    .where(and(eq(externalUserBindings.issuer, normalizeIssuer(claims.issuer)), eq(externalUserBindings.subject, claims.subject)));
+            }
+            const sessionId = randomUUID();
+            const token = randomBytes(32).toString("base64url");
+            const expiresAt = new Date(now.getTime() + LOCAL_SESSION_TTL_MS);
+            await tx.insert(authSessions).values({
+                id: sessionId,
+                token,
+                userId: binding.localUserId,
+                expiresAt,
+                createdAt: now,
+                updatedAt: now,
+            });
+            await tx
+                .update(serverExchangeRedemptions)
+                .set({ localUserId: binding.localUserId })
+                .where(eq(serverExchangeRedemptions.id, redemption.id));
+            return {
+                userId: binding.localUserId,
+                session: {
+                    id: sessionId,
+                    userId: binding.localUserId,
+                    expiresAt,
+                    setCookie: localSessionCookie(token, expiresAt, policy.secureCookie ?? true, policy.sessionSecret),
+                },
+            };
+        });
+        return result;
+    }
+    async function redeemOffline(input) {
+        const offline = policy.offline;
+        if (!offline)
+            throw unauthorized("Offline Grant authentication is unavailable");
+        const now = policy.now?.() ?? new Date();
+        let verified;
+        try {
+            verified = verifyOfflineGrantAndProof({
+                grant: input.grant,
+                proof: input.proof,
+                identityPublicKey: createPublicKey({
+                    key: Buffer.from(offline.identityPublicKeySpki, "base64url"),
+                    format: "der",
+                    type: "spki",
+                }),
+                expectedKeyId: offline.identityKeyId,
+                devicePublicKey: createPublicKey({
+                    key: Buffer.from(input.devicePublicKeySpki, "base64url"),
+                    format: "der",
+                    type: "spki",
+                }),
+                expectedIssuer: policy.expectedIssuer,
+                expectedInstallationId: policy.installationId,
+                expectedDeviceId: offline.expectedDeviceId,
+                expectedAccountId: offline.expectedAccountId,
+                expectedMethod: "POST",
+                expectedPath: "/api/auth/local-offline",
+                expectedBodyHash: offlineRequestBodyHash(""),
+                nowMs: now.getTime(),
+                lastTrustedTimeMs: offline.lastTrustedTimeMs,
+                localSignOutEpoch: offline.localSignOutEpoch,
+                // Durable consumption happens in the transaction below, after all
+                // cryptographic and binding checks have passed.
+                consumeNonce: () => true,
+            });
+        }
+        catch {
+            throw unauthorized("Offline Grant proof was rejected");
+        }
+        const result = await db.transaction(async (tx) => {
+            await tx
+                .delete(serverExchangeRedemptions)
+                .where(lt(serverExchangeRedemptions.expiresAt, now));
+            const nonceHash = createHash("sha256")
+                .update(input.proof.payload.nonce)
+                .digest("base64url");
+            const consumed = await tx
+                .insert(serverExchangeRedemptions)
+                .values({
+                issuer: normalizeIssuer(verified.claims.issuer),
+                jti: `offline:${verified.claims.jti}:${nonceHash}`,
+                audience: verified.claims.audience,
+                subject: verified.claims.accountId,
+                expiresAt: new Date(verified.claims.expiresAtMs),
+            })
+                .onConflictDoNothing({
+                target: [serverExchangeRedemptions.issuer, serverExchangeRedemptions.jti],
+            })
+                .returning({ id: serverExchangeRedemptions.id })
+                .then((rows) => rows[0] ?? null);
+            if (!consumed)
+                throw conflict("Offline Grant proof has already been redeemed");
+            const binding = await tx
+                .select({ localUserId: externalUserBindings.localUserId })
+                .from(externalUserBindings)
+                .where(and(eq(externalUserBindings.issuer, normalizeIssuer(verified.claims.issuer)), eq(externalUserBindings.subject, verified.claims.accountId)))
+                .then((rows) => rows[0] ?? null);
+            if (!binding)
+                throw forbidden("Offline Grant account is not bound to this Local Workspace");
+            const installation = await tx
+                .select({ localUserId: installationAccountBindings.localUserId })
+                .from(installationAccountBindings)
+                .where(and(eq(installationAccountBindings.installationId, policy.installationId), eq(installationAccountBindings.issuer, normalizeIssuer(verified.claims.issuer)), eq(installationAccountBindings.subject, verified.claims.accountId), eq(installationAccountBindings.localUserId, binding.localUserId)))
+                .then((rows) => rows[0] ?? null);
+            if (!installation)
+                throw forbidden("Offline Grant does not match the claimed Local Workspace");
+            const sessionId = randomUUID();
+            const token = randomBytes(32).toString("base64url");
+            const expiresAt = new Date(Math.min(now.getTime() + LOCAL_SESSION_TTL_MS, verified.claims.expiresAtMs));
+            await tx.insert(authSessions).values({
+                id: sessionId,
+                token,
+                userId: binding.localUserId,
+                expiresAt,
+                createdAt: now,
+                updatedAt: now,
+            });
+            await tx
+                .update(serverExchangeRedemptions)
+                .set({ localUserId: binding.localUserId })
+                .where(eq(serverExchangeRedemptions.id, consumed.id));
+            return {
+                userId: binding.localUserId,
+                nextTrustedTimeMs: verified.nextTrustedTimeMs,
+                session: {
+                    id: sessionId,
+                    userId: binding.localUserId,
+                    expiresAt,
+                    setCookie: localSessionCookie(token, expiresAt, policy.secureCookie ?? true, policy.sessionSecret),
+                },
+            };
+        });
+        // The server process must advance its own trusted-time floor immediately;
+        // Desktop persists the same returned value for the next process start.
+        offline.lastTrustedTimeMs = Math.max(offline.lastTrustedTimeMs, result.nextTrustedTimeMs);
+        return result;
+    }
+    async function claimLegacyInstallation(input) {
+        return db.transaction(async (tx) => {
+            await tx.execute(sql `select pg_advisory_xact_lock(hashtext(${input.installationId}))`);
+            const existing = await tx
+                .select()
+                .from(installationAccountBindings)
+                .where(eq(installationAccountBindings.installationId, input.installationId))
+                .then((rows) => rows[0] ?? null);
+            if (existing &&
+                (normalizeIssuer(existing.issuer) !== normalizeIssuer(input.issuer) ||
+                    existing.subject !== input.subject ||
+                    existing.localUserId !== input.localUserId)) {
+                throw forbidden("This Rudder installation is already claimed by another account");
+            }
+            if (existing) {
+                return { status: "already_claimed", localUserId: existing.localUserId, orgIds: [] };
+            }
+            const externalBinding = await tx
+                .select({ localUserId: externalUserBindings.localUserId })
+                .from(externalUserBindings)
+                .where(and(eq(externalUserBindings.issuer, normalizeIssuer(input.issuer)), eq(externalUserBindings.subject, input.subject), eq(externalUserBindings.localUserId, input.localUserId)))
+                .then((rows) => rows[0] ?? null);
+            if (!externalBinding)
+                throw forbidden("The local user does not match the authenticated Rudder Account");
+            const legacyMemberships = await tx
+                .select()
+                .from(organizationMemberships)
+                .where(and(eq(organizationMemberships.principalType, "user"), eq(organizationMemberships.principalId, LOCAL_BOARD_USER_ID), eq(organizationMemberships.status, "active")));
+            await tx.insert(installationAccountBindings).values({
+                installationId: input.installationId,
+                issuer: normalizeIssuer(input.issuer),
+                subject: input.subject,
+                localUserId: input.localUserId,
+            });
+            await tx
+                .insert(instanceUserRoles)
+                .values({ userId: input.localUserId, role: "instance_admin" })
+                .onConflictDoNothing({
+                target: [instanceUserRoles.userId, instanceUserRoles.role],
+            });
+            await tx
+                .delete(instanceUserRoles)
+                .where(and(eq(instanceUserRoles.userId, LOCAL_BOARD_USER_ID), eq(instanceUserRoles.role, "instance_admin")));
+            for (const membership of legacyMemberships) {
+                await tx
+                    .insert(organizationMemberships)
+                    .values({
+                    orgId: membership.orgId,
+                    principalType: "user",
+                    principalId: input.localUserId,
+                    status: "active",
+                    membershipRole: membership.membershipRole,
+                })
+                    .onConflictDoUpdate({
+                    target: [
+                        organizationMemberships.orgId,
+                        organizationMemberships.principalType,
+                        organizationMemberships.principalId,
+                    ],
+                    set: {
+                        status: "active",
+                        membershipRole: membership.membershipRole,
+                        updatedAt: new Date(),
+                    },
+                });
+                await tx
+                    .update(organizationMemberships)
+                    .set({ status: "revoked", updatedAt: new Date() })
+                    .where(eq(organizationMemberships.id, membership.id));
+                await tx.insert(activityLog).values({
+                    orgId: membership.orgId,
+                    actorType: "user",
+                    actorId: input.localUserId,
+                    action: "installation.legacy_local_claimed",
+                    entityType: "installation",
+                    entityId: input.installationId,
+                    details: {
+                        priorPrincipalId: LOCAL_BOARD_USER_ID,
+                        issuer: normalizeIssuer(input.issuer),
+                    },
+                });
+            }
+            return {
+                status: "claimed",
+                localUserId: input.localUserId,
+                orgIds: legacyMemberships.map((membership) => membership.orgId),
+            };
+        });
+    }
+    async function revokeAllSessions(localUserId) {
+        return db.transaction(async (tx) => {
+            const revoked = await tx
+                .delete(authSessions)
+                .where(eq(authSessions.userId, localUserId))
+                .returning({ id: authSessions.id });
+            const memberships = await tx
+                .select({ orgId: organizationMemberships.orgId })
+                .from(organizationMemberships)
+                .where(and(eq(organizationMemberships.principalType, "user"), eq(organizationMemberships.principalId, localUserId), eq(organizationMemberships.status, "active")));
+            if (memberships.length > 0) {
+                await tx.insert(activityLog).values(memberships.map(({ orgId }) => ({
+                    orgId,
+                    actorType: "user",
+                    actorId: localUserId,
+                    action: "account.local_sessions_revoked",
+                    entityType: "user",
+                    entityId: localUserId,
+                    details: { revokedSessionCount: revoked.length },
+                })));
+            }
+            return { revokedSessionCount: revoked.length };
+        });
+    }
+    return { redeem, redeemOffline, claimLegacyInstallation, revokeAllSessions };
+}
+//# sourceMappingURL=local-account-auth.js.map

package/dist/services/local-account-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-account-auth.js","sourceRoot":"","sources":["../../src/services/local-account-auth.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,2BAA2B,EAC3B,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,UAAU,EACV,UAAU,EACV,eAAe,EACf,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4CtD,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA8B,EAAE,MAAkC,EAAE,GAAS;IACzG,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9E,MAAM,YAAY,CAAC,wCAAwC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,YAAY,CAAC,2DAA2D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,YAAY,CAAC,0DAA0D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,YAAY,CAAC,kCAAkC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1E,MAAM,YAAY,CAAC,uCAAuC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GACd,GAAG,CAAC,QAAQ,KAAK,OAAO;WACrB,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvG,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B,EAAE,GAAW,EAAE,GAAG,GAAG,GAAG;IAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrE,MAAM,YAAY,CAAC,yDAAyD,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,OAKpD;IACC,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,YAAoB;YAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,6BAA6B,EAAE,cAAc,CAAC,EAAE;gBACrF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,YAAY;oBAClB,iBAAiB,EAAE,OAAO,CAAC,gBAAgB;oBAC3C,wBAAwB,EAAE,OAAO,CAAC,sBAAsB;iBACzD,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,YAAY,CAAC,8CAA8C,CAAC,CAAC;YACrF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,YAAY,CAAC,yDAAyD,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACxE,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,MAAM,YAAY,CAAC,yDAAyD,CAAC,CAAC;YAChF,CAAC;YACD,qEAAqE;YACrE,wEAAwE;YACxE,2DAA2D;YAC3D,OAAO;gBACL,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC;gBACxC,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC;gBAC1C,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC;gBAC5C,cAAc,EAAE,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC;gBACxD,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC;gBAClC,SAAS;gBACT,KAAK;gBACL,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aAC3D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B,EAAE,IAAY;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACtF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QACxE,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,MAAc;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3D,MAAM,CACP,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,EAAM,EAAE,OAGzD;IACC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY;QACrC,CAAC,CAAC,oCAAoC;QACtC,CAAC,CAAC,2BAA2B,CAAC;IAChC,OAAO,KAAK,EAAE,OAA4B,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,MAAM,CAAC;YACN,SAAS,EAAE,YAAY,CAAC,EAAE;YAC1B,MAAM,EAAE,SAAS,CAAC,EAAE;YACpB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC,CAAC;aACD,IAAI,CAAC,YAAY,CAAC;aAClB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC3D,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACpC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO;YACL,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;YAClD,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SAC3D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,SAAe,EAAE,MAAe,EAAE,MAAc;IACzF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,2BAA2B,CAAC;IAC/F,MAAM,KAAK,GAAG;QACZ,GAAG,UAAU,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE;QAClD,QAAQ;QACR,UAAU;QACV,cAAc;QACd,WAAW,SAAS,CAAC,WAAW,EAAE,EAAE;KACrC,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAM,EAAE,MAAkC;IAChF,KAAK,UAAU,MAAM,CAAC,YAAoB;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;QACzC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC/C,MAAM,UAAU,GAAG,MAAM,EAAE;iBACxB,MAAM,CAAC,yBAAyB,CAAC;iBACjC,MAAM,CAAC;gBACN,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtC,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;iBACD,mBAAmB,CAAC;gBACnB,MAAM,EAAE,CAAC,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,CAAC;aAC1E,CAAC;iBACD,SAAS,CAAC,EAAE,EAAE,EAAE,yBAAyB,CAAC,EAAE,EAAE,CAAC;iBAC/C,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU;gBAAE,MAAM,QAAQ,CAAC,gDAAgD,CAAC,CAAC;YAElF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;qBAEL,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;qBAC9B,MAAM,CAAC,OAAO;;OAE5B,CAAC,CAAC;YACH,IAAI,OAAO,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,WAAW,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;iBACzD,IAAI,CAAC,oBAAoB,CAAC;iBAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAC/D,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CACjD,CACF;iBACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;gBAC5B,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;oBAChC,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK;oBACzC,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,aAAa,EAAE,IAAI;oBACnB,SAAS,EAAE,GAAG;oBACd,SAAS,EAAE,GAAG;iBACf,CAAC,CAAC;gBACH,OAAO,GAAG,MAAM,EAAE;qBACf,MAAM,CAAC,oBAAoB,CAAC;qBAC5B,MAAM,CAAC;oBACN,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;oBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,WAAW,EAAE,MAAM;oBACnB,cAAc,EAAE,GAAG;iBACpB,CAAC;qBACD,SAAS,CAAC,EAAE,WAAW,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;qBAC5D,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE;qBACL,MAAM,CAAC,oBAAoB,CAAC;qBAC5B,GAAG,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;qBAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAC/D,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CACjD,CACF,CAAC;YACN,CAAC;YAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,oBAAoB,CAAC,CAAC;YACjE,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;gBACnC,EAAE,EAAE,SAAS;gBACb,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,WAAW;gBAC3B,SAAS;gBACT,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YACH,MAAM,EAAE;iBACL,MAAM,CAAC,yBAAyB,CAAC;iBACjC,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;iBACzC,KAAK,CAAC,EAAE,CAAC,yBAAyB,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YAE1D,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,WAAW;gBAC3B,OAAO,EAAE;oBACP,EAAE,EAAE,SAAS;oBACb,MAAM,EAAE,OAAO,CAAC,WAAW;oBAC3B,SAAS;oBACT,SAAS,EAAE,kBAAkB,CAC3B,KAAK,EACL,SAAS,EACT,MAAM,CAAC,YAAY,IAAI,IAAI,EAC3B,MAAM,CAAC,aAAa,CACrB;iBACF;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,KAI5B;QAKC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,MAAM,YAAY,CAAC,6CAA6C,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;QACzC,IAAI,QAAuD,CAAC;QAC5D,IAAI,CAAC;YACH,QAAQ,GAAG,0BAA0B,CAAC;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,iBAAiB,EAAE,eAAe,CAAC;oBACjC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,WAAW,CAAC;oBAC5D,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM;iBACb,CAAC;gBACF,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,eAAe,EAAE,eAAe,CAAC;oBAC/B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,WAAW,CAAC;oBACxD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM;iBACb,CAAC;gBACF,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,sBAAsB,EAAE,MAAM,CAAC,cAAc;gBAC7C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,cAAc,EAAE,MAAM;gBACtB,YAAY,EAAE,yBAAyB;gBACvC,gBAAgB,EAAE,sBAAsB,CAAC,EAAE,CAAC;gBAC5C,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE;gBACpB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,kEAAkE;gBAClE,gDAAgD;gBAChD,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,YAAY,CAAC,kCAAkC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC/C,MAAM,EAAE;iBACL,MAAM,CAAC,yBAAyB,CAAC;iBACjC,KAAK,CAAC,EAAE,CAAC,yBAAyB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;iBACnC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;iBACjC,MAAM,CAAC,WAAW,CAAC,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,yBAAyB,CAAC;iBACjC,MAAM,CAAC;gBACN,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC/C,GAAG,EAAE,WAAW,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE;gBAClD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAClC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBAClC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;aACjD,CAAC;iBACD,mBAAmB,CAAC;gBACnB,MAAM,EAAE,CAAC,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,CAAC;aAC1E,CAAC;iBACD,SAAS,CAAC,EAAE,EAAE,EAAE,yBAAyB,CAAC,EAAE,EAAE,CAAC;iBAC/C,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ;gBAAE,MAAM,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAE/E,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,EAAE,WAAW,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;iBACzD,IAAI,CAAC,oBAAoB,CAAC;iBAC1B,KAAK,CAAC,GAAG,CACR,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EACxE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAC5D,CAAC;iBACD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,4DAA4D,CAAC,CAAC;YAE5F,MAAM,YAAY,GAAG,MAAM,EAAE;iBAC1B,MAAM,CAAC,EAAE,WAAW,EAAE,2BAA2B,CAAC,WAAW,EAAE,CAAC;iBAChE,IAAI,CAAC,2BAA2B,CAAC;iBACjC,KAAK,CAAC,GAAG,CACR,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,EACrE,EAAE,CAAC,2BAA2B,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAC/E,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAClE,EAAE,CAAC,2BAA2B,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CACjE,CAAC;iBACD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,YAAY;gBAAE,MAAM,SAAS,CAAC,0DAA0D,CAAC,CAAC;YAE/F,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CACjC,GAAG,CAAC,OAAO,EAAE,GAAG,oBAAoB,EACpC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAC5B,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;gBACnC,EAAE,EAAE,SAAS;gBACb,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,WAAW;gBAC3B,SAAS;gBACT,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YACH,MAAM,EAAE;iBACL,MAAM,CAAC,yBAAyB,CAAC;iBACjC,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;iBACzC,KAAK,CAAC,EAAE,CAAC,yBAAyB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAExD,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,WAAW;gBAC3B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;gBAC7C,OAAO,EAAE;oBACP,EAAE,EAAE,SAAS;oBACb,MAAM,EAAE,OAAO,CAAC,WAAW;oBAC3B,SAAS;oBACT,SAAS,EAAE,kBAAkB,CAC3B,KAAK,EACL,SAAS,EACT,MAAM,CAAC,YAAY,IAAI,IAAI,EAC3B,MAAM,CAAC,aAAa,CACrB;iBACF;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAClC,OAAO,CAAC,iBAAiB,EACzB,MAAM,CAAC,iBAAiB,CACzB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,uBAAuB,CAAC,KAKtC;QACC,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,yCAAyC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;YAEvF,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,MAAM,EAAE;iBACR,IAAI,CAAC,2BAA2B,CAAC;iBACjC,KAAK,CAAC,EAAE,CAAC,2BAA2B,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IACE,QAAQ;gBACR,CACE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;oBAClE,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;oBAClC,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC3C,EACD,CAAC;gBACD,MAAM,SAAS,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,iBAA0B,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,EAAc,EAAE,CAAC;YAC3G,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,EAAE;iBAC7B,MAAM,CAAC,EAAE,WAAW,EAAE,oBAAoB,CAAC,WAAW,EAAE,CAAC;iBACzD,IAAI,CAAC,oBAAoB,CAAC;iBAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAC9D,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAC/C,EAAE,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CACxD,CACF;iBACA,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,eAAe;gBAAE,MAAM,SAAS,CAAC,gEAAgE,CAAC,CAAC;YAExG,MAAM,iBAAiB,GAAG,MAAM,EAAE;iBAC/B,MAAM,EAAE;iBACR,IAAI,CAAC,uBAAuB,CAAC;iBAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,aAAa,EAAE,MAAM,CAAC,EACjD,EAAE,CAAC,uBAAuB,CAAC,WAAW,EAAE,mBAAmB,CAAC,EAC5D,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC7C,CACF,CAAC;YAEJ,MAAM,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC;gBAClD,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;gBACrC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;YACH,MAAM,EAAE;iBACL,MAAM,CAAC,iBAAiB,CAAC;iBACzB,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;iBAC7D,mBAAmB,CAAC;gBACnB,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC;aAC3D,CAAC,CAAC;YACL,MAAM,EAAE;iBACL,MAAM,CAAC,iBAAiB,CAAC;iBACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACjD,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAC7C,CACF,CAAC;YAEJ,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,EAAE;qBACL,MAAM,CAAC,uBAAuB,CAAC;qBAC/B,MAAM,CAAC;oBACN,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,aAAa,EAAE,MAAM;oBACrB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,MAAM,EAAE,QAAQ;oBAChB,cAAc,EAAE,UAAU,CAAC,cAAc;iBAC1C,CAAC;qBACD,kBAAkB,CAAC;oBAClB,MAAM,EAAE;wBACN,uBAAuB,CAAC,KAAK;wBAC7B,uBAAuB,CAAC,aAAa;wBACrC,uBAAuB,CAAC,WAAW;qBACpC;oBACD,GAAG,EAAE;wBACH,MAAM,EAAE,QAAQ;wBAChB,cAAc,EAAE,UAAU,CAAC,cAAc;wBACzC,SAAS,EAAE,IAAI,IAAI,EAAE;qBACtB;iBACF,CAAC,CAAC;gBACL,MAAM,EAAE;qBACL,MAAM,CAAC,uBAAuB,CAAC;qBAC/B,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACjD,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACxD,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;oBAClC,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,SAAS,EAAE,MAAM;oBACjB,OAAO,EAAE,KAAK,CAAC,WAAW;oBAC1B,MAAM,EAAE,mCAAmC;oBAC3C,UAAU,EAAE,cAAc;oBAC1B,QAAQ,EAAE,KAAK,CAAC,cAAc;oBAC9B,OAAO,EAAE;wBACP,gBAAgB,EAAE,mBAAmB;wBACrC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;qBACtC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,SAAkB;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;aAChE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,WAAmB;QAClD,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,YAAY,CAAC;iBACpB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;iBAC3C,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,WAAW,GAAG,MAAM,EAAE;iBACzB,MAAM,CAAC,EAAE,KAAK,EAAE,uBAAuB,CAAC,KAAK,EAAE,CAAC;iBAChD,IAAI,CAAC,uBAAuB,CAAC;iBAC7B,KAAK,CAAC,GAAG,CACR,EAAE,CAAC,uBAAuB,CAAC,aAAa,EAAE,MAAM,CAAC,EACjD,EAAE,CAAC,uBAAuB,CAAC,WAAW,EAAE,WAAW,CAAC,EACpD,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC7C,CAAC,CAAC;YACL,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;oBAClE,KAAK;oBACL,SAAS,EAAE,MAAe;oBAC1B,OAAO,EAAE,WAAW;oBACpB,MAAM,EAAE,gCAAgC;oBACxC,UAAU,EAAE,MAAM;oBAClB,QAAQ,EAAE,WAAW;oBACrB,OAAO,EAAE,EAAE,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE;iBACjD,CAAC,CAAC,CAAC,CAAC;YACP,CAAC;YACD,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,CAAC;AAC/E,CAAC"}

package/dist/services/local-account-session-revocation.d.ts

@@ -0,0 +1,7 @@
+export interface LocalAccountSessionRevocation {
+    publish(userId: string): void;
+    subscribe(listener: (userId: string) => void): () => void;
+    generation(): number;
+}
+export declare function createLocalAccountSessionRevocation(): LocalAccountSessionRevocation;
+//# sourceMappingURL=local-account-session-revocation.d.ts.map

package/dist/services/local-account-session-revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-account-session-revocation.d.ts","sourceRoot":"","sources":["../../src/services/local-account-session-revocation.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC1D,UAAU,IAAI,MAAM,CAAC;CACtB;AAED,wBAAgB,mCAAmC,IAAI,6BAA6B,CAiBnF"}

package/dist/services/local-account-session-revocation.js

@@ -0,0 +1,19 @@
+export function createLocalAccountSessionRevocation() {
+    const listeners = new Set();
+    let generation = 0;
+    return {
+        publish(userId) {
+            generation += 1;
+            for (const listener of listeners)
+                listener(userId);
+        },
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        generation() {
+            return generation;
+        },
+    };
+}
+//# sourceMappingURL=local-account-session-revocation.js.map

package/dist/services/local-account-session-revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-account-session-revocation.js","sourceRoot":"","sources":["../../src/services/local-account-session-revocation.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,mCAAmC;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,OAAO;QACL,OAAO,CAAC,MAAM;YACZ,UAAU,IAAI,CAAC,CAAC;YAChB,KAAK,MAAM,QAAQ,IAAI,SAAS;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,UAAU;YACR,OAAO,UAAU,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}