@shipfox/api-auth 10.0.0 → 10.2.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 64 files with swc (349.3ms)
+Successfully compiled: 67 files with swc (347.36ms)

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @shipfox/api-auth
 
+## 10.2.0
+
+### Minor Changes
+
+- 95d1456: Add administrator user suspension, reactivation, and all-session revocation commands.
+
+### Patch Changes
+
+- 07e7371: Add idempotent administrator workspace suspension and reactivation commands with atomic redacted administration events.
+- Updated dependencies [95d1456]
+- Updated dependencies [0773b85]
+- Updated dependencies [07e7371]
+  - @shipfox/api-auth-dto@10.2.0
+  - @shipfox/api-workspaces-dto@10.2.0
+  - @shipfox/api-auth-context@10.2.0
+
+## 10.1.0
+
+### Minor Changes
+
+- fb34b6a: Expose authenticated administrator bootstrap availability through the Auth API.
+
+### Patch Changes
+
+- 3db7189: Treats suspended users as inactive admin owners during bootstrap recovery.
+- Updated dependencies [fb34b6a]
+  - @shipfox/api-auth-dto@10.1.0
+  - @shipfox/api-auth-context@10.1.0
+
 ## 10.0.0
 
 ### Major Changes

package/README.md

@@ -234,7 +234,9 @@ When password login is disabled, the password and email-verification rows in thi
 
 ### Administrator grants
 
-All routes are mounted under `/admin/auth/admin-grants` and require an authenticated bearer token. Administrator role checks are enforced in the core layer, not by route-level middleware.
+`GET /admin/auth/bootstrap-state` requires an authenticated bearer token and returns exactly `{state: 'available' | 'closed'}`. It reports `available` only while no active `admin-owner` exists and never reports deployment-token configuration.
+
+Bootstrap and grant-management routes are mounted under `/admin/auth/admin-grants` and require an authenticated bearer token. Administrator role checks are enforced in the core layer, not by route-level middleware.
 
 | Method | Path | Required role | Result |
 | --- | --- | --- | --- |
@@ -245,6 +247,8 @@ All routes are mounted under `/admin/auth/admin-grants` and require an authentic
 
 `POST` and `DELETE` routes require an `Idempotency-Key` header; a repeated key replays the same result, and reusing a key with a different command returns `409 idempotency-key-reused`. Every mutation writes a redacted `administration.action.performed` outbox event.
 
+Bootstrap remains closed only while an active `admin-owner` exists. An owner is active when its grant is not revoked and its user account has `active` status. A suspended owner does not count as active, so suspending the sole owner intentionally reopens deployment-token bootstrap for recovery. The suspended grant remains stored; reactivating that user closes bootstrap again.
+
 ### Rate limiting
 
 The public auth endpoints include an application-layer abuse baseline for open source installs:
@@ -269,6 +273,20 @@ This app-layer limiter protects semantic auth work such as Argon2 verification a
 
 `GET /admin/auth/admin-grants` also requires `admin-observer`. It returns at most 100 newest-first `AdministratorGrantSummary` rows per page, with an opaque cursor and a safe embedded user identity. It does not return credentials, sessions, provider payloads, OAuth tokens, refresh tokens, or raw authentication metadata.
 
+### Administrator user moderation
+
+All routes are mounted under `/admin/auth/users` and require an authenticated bearer token.
+
+| Method | Path | Required role | Result |
+| --- | --- | --- | --- |
+| `POST` | `/:userId/suspend` | `admin-operator` | Suspends the user, revokes all active sessions, and returns the final safe user summary with a correlation ID. |
+| `POST` | `/:userId/reactivate` | `admin-operator` | Restores sign-in eligibility without restoring revoked sessions. |
+| `POST` | `/:userId/revoke-sessions` | `admin-operator` | Revokes all active sessions without changing account status and returns the number of affected sessions. |
+
+Each command requires an `Idempotency-Key`. Suspension requires a bounded reason; reactivation and session revocation accept an optional bounded reason. Repeating a successful command returns its committed result. Reusing a key for a different command or request returns `409 idempotency-key-reused`.
+
+Suspension preserves the user record and rejects the final active administrator owner. State, the command result, and one redacted `administration.action.performed` outbox event commit atomically. The event stores only the idempotency-key fingerprint, never the raw key or session material.
+
 ## API
 
 The package exports a module factory. Pass it the Workspaces inter-module client from the
@@ -423,6 +441,7 @@ Passwords use Argon2id. Password reset tokens and refresh tokens are opaque toke
 - A denied password signup returns `403` with error code `signup-not-allowed`. The policy message is capped at 500 characters.
 - Invitation signup validates the invitation and bypasses the signup policy. Invitations remain a separate authorization path.
 - Login only succeeds for active users with verified email addresses and a password hash.
+- Authenticated requests reject suspended or deleted users. Session-bound access tokens also reject a revoked refresh session.
 - Refresh tokens rotate on each refresh.
 - Password reset tokens and email challenge proofs are consumed once.
 - Password change revokes other refresh sessions. It keeps the current session when the current refresh cookie is valid.

package/dist/core/administration.d.ts

@@ -3,16 +3,21 @@ import type { TimestampIdCursor } from '@shipfox/node-drizzle';
 import type { AdminGrant } from './entities/admin-grant.js';
 import type { AdministratorGrantSummary, AdministratorUserSummary } from './entities/administrator-read-model.js';
 import { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError } from './errors.js';
-export declare function hashAdministrationValue(value: string): string;
 export declare function administrationCommandFingerprint(command: string, input: unknown): string;
 export interface AdministrationMutationContext {
     actorId: string;
     idempotencyKey: string;
     correlationId: string;
 }
+export interface AdministratorUserMutationResult {
+    user: AdministratorUserSummary;
+    correlationId: string;
+    sessionsRevoked: number;
+}
 export declare function bootstrapFirstAdminOwner(params: AdministrationMutationContext & {
     bootstrapToken: string;
 }): Promise<AdminGrant>;
+export declare function getAdminBootstrapState(): Promise<'available' | 'closed'>;
 export declare function findAdministratorUserSummary(params: {
     actorId: string;
 } & ({
@@ -39,5 +44,17 @@ export declare function revokeAdministratorGrant(params: AdministrationMutationC
     grantId: string;
     reason: string;
 }): Promise<AdminGrant>;
+export declare function suspendAdministratorUser(params: AdministrationMutationContext & {
+    userId: string;
+    reason: string;
+}): Promise<AdministratorUserMutationResult>;
+export declare function reactivateAdministratorUser(params: AdministrationMutationContext & {
+    userId: string;
+    reason?: string;
+}): Promise<AdministratorUserMutationResult>;
+export declare function revokeAdministratorUserSessions(params: AdministrationMutationContext & {
+    userId: string;
+    reason?: string;
+}): Promise<AdministratorUserMutationResult>;
 export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError, };
 //# sourceMappingURL=administration.d.ts.map

package/dist/core/administration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"administration.d.ts","sourceRoot":"","sources":["../../src/core/administration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAU7D,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAQrB,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAExF;AAkCD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,GAC/D,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED,wBAAsB,4BAA4B,CAChD,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAG,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC,GACtF,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAS/C;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACtC,CAAC,CAiBD;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACxF,OAAO,CAAC,UAAU,CAAC,CA0BrB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACxE,OAAO,CAAC,UAAU,CAAC,CAwBrB;AAED,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,GAClB,CAAC"}
+{"version":3,"file":"administration.d.ts","sourceRoot":"","sources":["../../src/core/administration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAkB7D,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAYrB,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAExF;AAmCD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB;AAYD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,GAC/D,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,CAE9E;AAED,wBAAsB,4BAA4B,CAChD,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAG,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC,GACtF,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAS/C;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACtC,CAAC,CAiBD;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACxF,OAAO,CAAC,UAAU,CAAC,CA0BrB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACxE,OAAO,CAAC,UAAU,CAAC,CAwBrB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACvE,OAAO,CAAC,+BAA+B,CAAC,CA4B1C;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GACxE,OAAO,CAAC,+BAA+B,CAAC,CA6B1C;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GACxE,OAAO,CAAC,+BAA+B,CAAC,CA6B1C;AAED,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,GAClB,CAAC"}

package/dist/core/administration.js

@@ -1,32 +1,35 @@
-import { createHash, timingSafeEqual } from 'node:crypto';
+import { timingSafeEqual } from 'node:crypto';
 import { createAdministrationActionEvent } from '@shipfox/api-common-dto';
+import { hashOpaqueToken } from '@shipfox/node-tokens';
 import { config } from '#config.js';
-import { bootstrapFirstAdminOwner as bootstrapFirstAdminOwnerInDb, grantAdminRoleWithAudit, listAdminGrantSummaries, revokeAdminGrantWithAudit } from '#db/admin-grants.js';
+import { bootstrapFirstAdminOwner as bootstrapFirstAdminOwnerInDb, grantAdminRoleWithAudit, hasActiveAdminOwner, listAdminGrantSummaries, revokeAdminGrantWithAudit } from '#db/admin-grants.js';
+import { reactivateUserWithAudit, revokeUserSessionsWithAudit, suspendUserWithAudit } from '#db/admin-user-moderation.js';
 import { findAdministratorUser as findAdministratorUserInDb } from '#db/admin-users.js';
 import { requireAdminRole } from './admin-role.js';
 import { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError } from './errors.js';
 const ADMIN_OWNER_ROLE = 'admin-owner';
 const ADMIN_OBSERVER_ROLE = 'admin-observer';
+const ADMIN_OPERATOR_ROLE = 'admin-operator';
 const BOOTSTRAP_COMMAND = 'auth.admin_grant.bootstrap';
 const GRANT_COMMAND = 'auth.admin_grant.grant';
 const REVOKE_COMMAND = 'auth.admin_grant.revoke';
-export function hashAdministrationValue(value) {
-    return createHash('sha256').update(value).digest('hex');
-}
+const SUSPEND_USER_COMMAND = 'auth.user.suspend';
+const REACTIVATE_USER_COMMAND = 'auth.user.reactivate';
+const REVOKE_USER_SESSIONS_COMMAND = 'auth.user.revoke-sessions';
 export function administrationCommandFingerprint(command, input) {
-    return hashAdministrationValue(`${command}:${JSON.stringify(input)}`);
+    return hashOpaqueToken(`${command}:${JSON.stringify(input)}`);
 }
 function bootstrapTokenMatches(candidate, expected) {
     if (!expected) return false;
-    const candidateHash = Buffer.from(hashAdministrationValue(candidate), 'hex');
-    const expectedHash = Buffer.from(hashAdministrationValue(expected), 'hex');
+    const candidateHash = Buffer.from(hashOpaqueToken(candidate), 'hex');
+    const expectedHash = Buffer.from(hashOpaqueToken(expected), 'hex');
     return timingSafeEqual(candidateHash, expectedHash);
 }
 function administrationEvent(params) {
     return createAdministrationActionEvent({
         actorId: params.actorId,
         actorRole: params.actorRole,
-        requiredRole: ADMIN_OWNER_ROLE,
+        requiredRole: params.requiredRole ?? ADMIN_OWNER_ROLE,
         command: params.command,
         targetType: params.targetType,
         targetId: params.targetId,
@@ -37,6 +40,13 @@ function administrationEvent(params) {
         occurredAt: new Date().toISOString()
     });
 }
+function toAdministratorUserMutationResult(result) {
+    return {
+        user: result.user,
+        correlationId: result.correlationId,
+        sessionsRevoked: result.sessionsRevoked
+    };
+}
 export async function bootstrapFirstAdminOwner(params) {
     if (!bootstrapTokenMatches(params.bootstrapToken, config.ADMIN_BOOTSTRAP_TOKEN)) {
         throw new InvalidAdminBootstrapTokenError();
@@ -44,7 +54,7 @@ export async function bootstrapFirstAdminOwner(params) {
     return await bootstrapFirstAdminOwnerInDb({
         userId: params.actorId,
         actorId: params.actorId,
-        idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),
+        idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),
         requestFingerprint: administrationCommandFingerprint(BOOTSTRAP_COMMAND, {
             actorId: params.actorId
         }),
@@ -56,10 +66,13 @@ export async function bootstrapFirstAdminOwner(params) {
             targetId: params.actorId,
             reason: 'Initial administrator owner bootstrap',
             correlationId: params.correlationId,
-            idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey)
+            idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey)
         })
     });
 }
+export async function getAdminBootstrapState() {
+    return await hasActiveAdminOwner() ? 'closed' : 'available';
+}
 export async function findAdministratorUserSummary(params) {
     await requireAdminRole({
         userId: params.actorId,
@@ -104,7 +117,7 @@ export async function grantAdministratorRole(params) {
         userId: params.userId,
         role: params.role,
         actorId: params.actorId,
-        idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),
+        idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),
         requestFingerprint: administrationCommandFingerprint(GRANT_COMMAND, {
             userId: params.userId,
             role: params.role,
@@ -118,7 +131,7 @@ export async function grantAdministratorRole(params) {
             targetId: params.userId,
             reason: params.reason,
             correlationId: params.correlationId,
-            idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey)
+            idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey)
         })
     });
 }
@@ -130,7 +143,7 @@ export async function revokeAdministratorGrant(params) {
     return await revokeAdminGrantWithAudit({
         grantId: params.grantId,
         actorId: params.actorId,
-        idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),
+        idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),
         requestFingerprint: administrationCommandFingerprint(REVOKE_COMMAND, {
             grantId: params.grantId,
             reason: params.reason
@@ -143,9 +156,92 @@ export async function revokeAdministratorGrant(params) {
             targetId: params.grantId,
             reason: params.reason,
             correlationId: params.correlationId,
-            idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey)
+            idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey)
+        })
+    });
+}
+export async function suspendAdministratorUser(params) {
+    const actorRole = await requireAdminRole({
+        userId: params.actorId,
+        minimumRole: ADMIN_OPERATOR_ROLE
+    });
+    const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);
+    return toAdministratorUserMutationResult(await suspendUserWithAudit({
+        actorId: params.actorId,
+        userId: params.userId,
+        idempotencyKeyFingerprint,
+        requestFingerprint: administrationCommandFingerprint(SUSPEND_USER_COMMAND, {
+            userId: params.userId,
+            reason: params.reason
+        }),
+        event: administrationEvent({
+            actorId: params.actorId,
+            actorRole,
+            requiredRole: ADMIN_OPERATOR_ROLE,
+            command: SUSPEND_USER_COMMAND,
+            targetType: 'user',
+            targetId: params.userId,
+            reason: params.reason,
+            correlationId: params.correlationId,
+            idempotencyKeyFingerprint
+        })
+    }));
+}
+export async function reactivateAdministratorUser(params) {
+    const actorRole = await requireAdminRole({
+        userId: params.actorId,
+        minimumRole: ADMIN_OPERATOR_ROLE
+    });
+    const reason = params.reason ?? 'User reactivation requested by an administrator';
+    const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);
+    return toAdministratorUserMutationResult(await reactivateUserWithAudit({
+        actorId: params.actorId,
+        userId: params.userId,
+        idempotencyKeyFingerprint,
+        requestFingerprint: administrationCommandFingerprint(REACTIVATE_USER_COMMAND, {
+            userId: params.userId,
+            reason
+        }),
+        event: administrationEvent({
+            actorId: params.actorId,
+            actorRole,
+            requiredRole: ADMIN_OPERATOR_ROLE,
+            command: REACTIVATE_USER_COMMAND,
+            targetType: 'user',
+            targetId: params.userId,
+            reason,
+            correlationId: params.correlationId,
+            idempotencyKeyFingerprint
         })
+    }));
+}
+export async function revokeAdministratorUserSessions(params) {
+    const actorRole = await requireAdminRole({
+        userId: params.actorId,
+        minimumRole: ADMIN_OPERATOR_ROLE
     });
+    const reason = params.reason ?? 'All active user sessions revoked by an administrator';
+    const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);
+    return toAdministratorUserMutationResult(await revokeUserSessionsWithAudit({
+        actorId: params.actorId,
+        userId: params.userId,
+        idempotencyKeyFingerprint,
+        requestFingerprint: administrationCommandFingerprint(REVOKE_USER_SESSIONS_COMMAND, {
+            userId: params.userId,
+            reason
+        }),
+        event: administrationEvent({
+            actorId: params.actorId,
+            actorRole,
+            requiredRole: ADMIN_OPERATOR_ROLE,
+            command: REVOKE_USER_SESSIONS_COMMAND,
+            targetType: 'user',
+            targetId: params.userId,
+            reason,
+            correlationId: params.correlationId,
+            idempotencyKeyFingerprint
+        })
+    }));
 }
 export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError };
 

package/dist/core/administration.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/administration.ts"],"sourcesContent":["import {createHash, timingSafeEqual} from 'node:crypto';\nimport type {AdminRole} from '@shipfox/api-auth-dto';\nimport {createAdministrationActionEvent} from '@shipfox/api-common-dto';\nimport type {TimestampIdCursor} from '@shipfox/node-drizzle';\nimport {config} from '#config.js';\nimport {\n  bootstrapFirstAdminOwner as bootstrapFirstAdminOwnerInDb,\n  grantAdminRoleWithAudit,\n  listAdminGrantSummaries,\n  revokeAdminGrantWithAudit,\n} from '#db/admin-grants.js';\nimport {findAdministratorUser as findAdministratorUserInDb} from '#db/admin-users.js';\nimport {requireAdminRole} from './admin-role.js';\nimport type {AdminGrant} from './entities/admin-grant.js';\nimport type {\n  AdministratorGrantSummary,\n  AdministratorUserSummary,\n} from './entities/administrator-read-model.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from './errors.js';\n\nconst ADMIN_OWNER_ROLE: AdminRole = 'admin-owner';\nconst ADMIN_OBSERVER_ROLE: AdminRole = 'admin-observer';\nconst BOOTSTRAP_COMMAND = 'auth.admin_grant.bootstrap';\nconst GRANT_COMMAND = 'auth.admin_grant.grant';\nconst REVOKE_COMMAND = 'auth.admin_grant.revoke';\n\nexport function hashAdministrationValue(value: string): string {\n  return createHash('sha256').update(value).digest('hex');\n}\n\nexport function administrationCommandFingerprint(command: string, input: unknown): string {\n  return hashAdministrationValue(`${command}:${JSON.stringify(input)}`);\n}\n\nfunction bootstrapTokenMatches(candidate: string, expected: string | undefined): boolean {\n  if (!expected) return false;\n  const candidateHash = Buffer.from(hashAdministrationValue(candidate), 'hex');\n  const expectedHash = Buffer.from(hashAdministrationValue(expected), 'hex');\n  return timingSafeEqual(candidateHash, expectedHash);\n}\n\nfunction administrationEvent(params: {\n  actorId: string;\n  actorRole: AdminRole;\n  command: string;\n  targetType: string;\n  targetId: string;\n  reason: string;\n  correlationId: string;\n  idempotencyKeyFingerprint: string;\n}) {\n  return createAdministrationActionEvent({\n    actorId: params.actorId,\n    actorRole: params.actorRole,\n    requiredRole: ADMIN_OWNER_ROLE,\n    command: params.command,\n    targetType: params.targetType,\n    targetId: params.targetId,\n    reason: params.reason,\n    result: 'succeeded',\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    occurredAt: new Date().toISOString(),\n  });\n}\n\nexport interface AdministrationMutationContext {\n  actorId: string;\n  idempotencyKey: string;\n  correlationId: string;\n}\n\nexport async function bootstrapFirstAdminOwner(\n  params: AdministrationMutationContext & {bootstrapToken: string},\n): Promise<AdminGrant> {\n  if (!bootstrapTokenMatches(params.bootstrapToken, config.ADMIN_BOOTSTRAP_TOKEN)) {\n    throw new InvalidAdminBootstrapTokenError();\n  }\n\n  return await bootstrapFirstAdminOwnerInDb({\n    userId: params.actorId,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(BOOTSTRAP_COMMAND, {\n      actorId: params.actorId,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole: ADMIN_OWNER_ROLE,\n      command: BOOTSTRAP_COMMAND,\n      targetType: 'user',\n      targetId: params.actorId,\n      reason: 'Initial administrator owner bootstrap',\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function findAdministratorUserSummary(\n  params: {actorId: string} & ({id: string; email?: never} | {email: string; id?: never}),\n): Promise<AdministratorUserSummary | undefined> {\n  await requireAdminRole({userId: params.actorId, minimumRole: ADMIN_OBSERVER_ROLE});\n\n  const user = await findAdministratorUserInDb(\n    'id' in params ? {id: params.id} : {email: params.email},\n  );\n  if (!user) return undefined;\n\n  return user;\n}\n\nexport async function listAdministratorGrantSummaries(params: {\n  actorId: string;\n  limit: number;\n  cursor?: TimestampIdCursor;\n}): Promise<{\n  grants: AdministratorGrantSummary[];\n  nextCursor: TimestampIdCursor | null;\n}> {\n  await requireAdminRole({userId: params.actorId, minimumRole: ADMIN_OBSERVER_ROLE});\n\n  const result = await listAdminGrantSummaries({\n    limit: params.limit,\n    ...(params.cursor ? {cursor: params.cursor} : {}),\n  });\n  return {\n    grants: result.rows.map((row) => ({\n      grantId: row.id,\n      role: row.role,\n      createdAt: row.createdAt,\n      revokedAt: row.revokedAt,\n      user: row.user,\n    })),\n    nextCursor: result.nextCursor,\n  };\n}\n\nexport async function grantAdministratorRole(\n  params: AdministrationMutationContext & {userId: string; role: AdminRole; reason: string},\n): Promise<AdminGrant> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OWNER_ROLE,\n  });\n  return await grantAdminRoleWithAudit({\n    userId: params.userId,\n    role: params.role,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(GRANT_COMMAND, {\n      userId: params.userId,\n      role: params.role,\n      reason: params.reason,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole,\n      command: GRANT_COMMAND,\n      targetType: 'user',\n      targetId: params.userId,\n      reason: params.reason,\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function revokeAdministratorGrant(\n  params: AdministrationMutationContext & {grantId: string; reason: string},\n): Promise<AdminGrant> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OWNER_ROLE,\n  });\n  return await revokeAdminGrantWithAudit({\n    grantId: params.grantId,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(REVOKE_COMMAND, {\n      grantId: params.grantId,\n      reason: params.reason,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole,\n      command: REVOKE_COMMAND,\n      targetType: 'admin-grant',\n      targetId: params.grantId,\n      reason: params.reason,\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    }),\n  });\n}\n\nexport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n};\n"],"names":["createHash","timingSafeEqual","createAdministrationActionEvent","config","bootstrapFirstAdminOwner","bootstrapFirstAdminOwnerInDb","grantAdminRoleWithAudit","listAdminGrantSummaries","revokeAdminGrantWithAudit","findAdministratorUser","findAdministratorUserInDb","requireAdminRole","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","InvalidAdminBootstrapTokenError","LastAdminOwnerError","UserNotFoundError","ADMIN_OWNER_ROLE","ADMIN_OBSERVER_ROLE","BOOTSTRAP_COMMAND","GRANT_COMMAND","REVOKE_COMMAND","hashAdministrationValue","value","update","digest","administrationCommandFingerprint","command","input","JSON","stringify","bootstrapTokenMatches","candidate","expected","candidateHash","Buffer","from","expectedHash","administrationEvent","params","actorId","actorRole","requiredRole","targetType","targetId","reason","result","correlationId","idempotencyKeyFingerprint","occurredAt","Date","toISOString","bootstrapToken","ADMIN_BOOTSTRAP_TOKEN","userId","idempotencyKey","requestFingerprint","event","findAdministratorUserSummary","minimumRole","user","id","email","undefined","listAdministratorGrantSummaries","limit","cursor","grants","rows","map","row","grantId","role","createdAt","revokedAt","nextCursor","grantAdministratorRole","revokeAdministratorGrant"],"mappings":"AAAA,SAAQA,UAAU,EAAEC,eAAe,QAAO,cAAc;AAExD,SAAQC,+BAA+B,QAAO,0BAA0B;AAExE,SAAQC,MAAM,QAAO,aAAa;AAClC,SACEC,4BAA4BC,4BAA4B,EACxDC,uBAAuB,EACvBC,uBAAuB,EACvBC,yBAAyB,QACpB,sBAAsB;AAC7B,SAAQC,yBAAyBC,yBAAyB,QAAO,qBAAqB;AACtF,SAAQC,gBAAgB,QAAO,kBAAkB;AAMjD,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,QACZ,cAAc;AAErB,MAAMC,mBAA8B;AACpC,MAAMC,sBAAiC;AACvC,MAAMC,oBAAoB;AAC1B,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB;AAEvB,OAAO,SAASC,wBAAwBC,KAAa;IACnD,OAAOzB,WAAW,UAAU0B,MAAM,CAACD,OAAOE,MAAM,CAAC;AACnD;AAEA,OAAO,SAASC,iCAAiCC,OAAe,EAAEC,KAAc;IAC9E,OAAON,wBAAwB,GAAGK,QAAQ,CAAC,EAAEE,KAAKC,SAAS,CAACF,QAAQ;AACtE;AAEA,SAASG,sBAAsBC,SAAiB,EAAEC,QAA4B;IAC5E,IAAI,CAACA,UAAU,OAAO;IACtB,MAAMC,gBAAgBC,OAAOC,IAAI,CAACd,wBAAwBU,YAAY;IACtE,MAAMK,eAAeF,OAAOC,IAAI,CAACd,wBAAwBW,WAAW;IACpE,OAAOlC,gBAAgBmC,eAAeG;AACxC;AAEA,SAASC,oBAAoBC,MAS5B;IACC,OAAOvC,gCAAgC;QACrCwC,SAASD,OAAOC,OAAO;QACvBC,WAAWF,OAAOE,SAAS;QAC3BC,cAAczB;QACdU,SAASY,OAAOZ,OAAO;QACvBgB,YAAYJ,OAAOI,UAAU;QAC7BC,UAAUL,OAAOK,QAAQ;QACzBC,QAAQN,OAAOM,MAAM;QACrBC,QAAQ;QACRC,eAAeR,OAAOQ,aAAa;QACnCC,2BAA2BT,OAAOS,yBAAyB;QAC3DC,YAAY,IAAIC,OAAOC,WAAW;IACpC;AACF;AAQA,OAAO,eAAejD,yBACpBqC,MAAgE;IAEhE,IAAI,CAACR,sBAAsBQ,OAAOa,cAAc,EAAEnD,OAAOoD,qBAAqB,GAAG;QAC/E,MAAM,IAAIvC;IACZ;IAEA,OAAO,MAAMX,6BAA6B;QACxCmD,QAAQf,OAAOC,OAAO;QACtBA,SAASD,OAAOC,OAAO;QACvBQ,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QACxEC,oBAAoB9B,iCAAiCP,mBAAmB;YACtEqB,SAASD,OAAOC,OAAO;QACzB;QACAiB,OAAOnB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC,WAAWxB;YACXU,SAASR;YACTwB,YAAY;YACZC,UAAUL,OAAOC,OAAO;YACxBK,QAAQ;YACRE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QAC1E;IACF;AACF;AAEA,OAAO,eAAeG,6BACpBnB,MAAuF;IAEvF,MAAM9B,iBAAiB;QAAC6C,QAAQf,OAAOC,OAAO;QAAEmB,aAAazC;IAAmB;IAEhF,MAAM0C,OAAO,MAAMpD,0BACjB,QAAQ+B,SAAS;QAACsB,IAAItB,OAAOsB,EAAE;IAAA,IAAI;QAACC,OAAOvB,OAAOuB,KAAK;IAAA;IAEzD,IAAI,CAACF,MAAM,OAAOG;IAElB,OAAOH;AACT;AAEA,OAAO,eAAeI,gCAAgCzB,MAIrD;IAIC,MAAM9B,iBAAiB;QAAC6C,QAAQf,OAAOC,OAAO;QAAEmB,aAAazC;IAAmB;IAEhF,MAAM4B,SAAS,MAAMzC,wBAAwB;QAC3C4D,OAAO1B,OAAO0B,KAAK;QACnB,GAAI1B,OAAO2B,MAAM,GAAG;YAACA,QAAQ3B,OAAO2B,MAAM;QAAA,IAAI,CAAC,CAAC;IAClD;IACA,OAAO;QACLC,QAAQrB,OAAOsB,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gBAChCC,SAASD,IAAIT,EAAE;gBACfW,MAAMF,IAAIE,IAAI;gBACdC,WAAWH,IAAIG,SAAS;gBACxBC,WAAWJ,IAAII,SAAS;gBACxBd,MAAMU,IAAIV,IAAI;YAChB,CAAA;QACAe,YAAY7B,OAAO6B,UAAU;IAC/B;AACF;AAEA,OAAO,eAAeC,uBACpBrC,MAAyF;IAEzF,MAAME,YAAY,MAAMhC,iBAAiB;QACvC6C,QAAQf,OAAOC,OAAO;QACtBmB,aAAa1C;IACf;IACA,OAAO,MAAMb,wBAAwB;QACnCkD,QAAQf,OAAOe,MAAM;QACrBkB,MAAMjC,OAAOiC,IAAI;QACjBhC,SAASD,OAAOC,OAAO;QACvBQ,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QACxEC,oBAAoB9B,iCAAiCN,eAAe;YAClEkC,QAAQf,OAAOe,MAAM;YACrBkB,MAAMjC,OAAOiC,IAAI;YACjB3B,QAAQN,OAAOM,MAAM;QACvB;QACAY,OAAOnB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAd,SAASP;YACTuB,YAAY;YACZC,UAAUL,OAAOe,MAAM;YACvBT,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QAC1E;IACF;AACF;AAEA,OAAO,eAAesB,yBACpBtC,MAAyE;IAEzE,MAAME,YAAY,MAAMhC,iBAAiB;QACvC6C,QAAQf,OAAOC,OAAO;QACtBmB,aAAa1C;IACf;IACA,OAAO,MAAMX,0BAA0B;QACrCiE,SAAShC,OAAOgC,OAAO;QACvB/B,SAASD,OAAOC,OAAO;QACvBQ,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QACxEC,oBAAoB9B,iCAAiCL,gBAAgB;YACnEkD,SAAShC,OAAOgC,OAAO;YACvB1B,QAAQN,OAAOM,MAAM;QACvB;QACAY,OAAOnB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAd,SAASN;YACTsB,YAAY;YACZC,UAAUL,OAAOgC,OAAO;YACxB1B,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QAC1E;IACF;AACF;AAEA,SACE7C,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,GACjB"}
+{"version":3,"sources":["../../src/core/administration.ts"],"sourcesContent":["import {timingSafeEqual} from 'node:crypto';\nimport type {AdminRole} from '@shipfox/api-auth-dto';\nimport {createAdministrationActionEvent} from '@shipfox/api-common-dto';\nimport type {TimestampIdCursor} from '@shipfox/node-drizzle';\nimport {hashOpaqueToken} from '@shipfox/node-tokens';\nimport {config} from '#config.js';\nimport {\n  bootstrapFirstAdminOwner as bootstrapFirstAdminOwnerInDb,\n  grantAdminRoleWithAudit,\n  hasActiveAdminOwner,\n  listAdminGrantSummaries,\n  revokeAdminGrantWithAudit,\n} from '#db/admin-grants.js';\nimport {\n  reactivateUserWithAudit,\n  revokeUserSessionsWithAudit,\n  suspendUserWithAudit,\n  type UserModerationResult,\n} from '#db/admin-user-moderation.js';\nimport {findAdministratorUser as findAdministratorUserInDb} from '#db/admin-users.js';\nimport {requireAdminRole} from './admin-role.js';\nimport type {AdminGrant} from './entities/admin-grant.js';\nimport type {\n  AdministratorGrantSummary,\n  AdministratorUserSummary,\n} from './entities/administrator-read-model.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from './errors.js';\n\nconst ADMIN_OWNER_ROLE: AdminRole = 'admin-owner';\nconst ADMIN_OBSERVER_ROLE: AdminRole = 'admin-observer';\nconst ADMIN_OPERATOR_ROLE: AdminRole = 'admin-operator';\nconst BOOTSTRAP_COMMAND = 'auth.admin_grant.bootstrap';\nconst GRANT_COMMAND = 'auth.admin_grant.grant';\nconst REVOKE_COMMAND = 'auth.admin_grant.revoke';\nconst SUSPEND_USER_COMMAND = 'auth.user.suspend';\nconst REACTIVATE_USER_COMMAND = 'auth.user.reactivate';\nconst REVOKE_USER_SESSIONS_COMMAND = 'auth.user.revoke-sessions';\n\nexport function administrationCommandFingerprint(command: string, input: unknown): string {\n  return hashOpaqueToken(`${command}:${JSON.stringify(input)}`);\n}\n\nfunction bootstrapTokenMatches(candidate: string, expected: string | undefined): boolean {\n  if (!expected) return false;\n  const candidateHash = Buffer.from(hashOpaqueToken(candidate), 'hex');\n  const expectedHash = Buffer.from(hashOpaqueToken(expected), 'hex');\n  return timingSafeEqual(candidateHash, expectedHash);\n}\n\nfunction administrationEvent(params: {\n  actorId: string;\n  actorRole: AdminRole;\n  command: string;\n  targetType: string;\n  targetId: string;\n  reason: string;\n  requiredRole?: AdminRole;\n  correlationId: string;\n  idempotencyKeyFingerprint: string;\n}) {\n  return createAdministrationActionEvent({\n    actorId: params.actorId,\n    actorRole: params.actorRole,\n    requiredRole: params.requiredRole ?? ADMIN_OWNER_ROLE,\n    command: params.command,\n    targetType: params.targetType,\n    targetId: params.targetId,\n    reason: params.reason,\n    result: 'succeeded',\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    occurredAt: new Date().toISOString(),\n  });\n}\n\nexport interface AdministrationMutationContext {\n  actorId: string;\n  idempotencyKey: string;\n  correlationId: string;\n}\n\nexport interface AdministratorUserMutationResult {\n  user: AdministratorUserSummary;\n  correlationId: string;\n  sessionsRevoked: number;\n}\n\nfunction toAdministratorUserMutationResult(\n  result: UserModerationResult,\n): AdministratorUserMutationResult {\n  return {\n    user: result.user,\n    correlationId: result.correlationId,\n    sessionsRevoked: result.sessionsRevoked,\n  };\n}\n\nexport async function bootstrapFirstAdminOwner(\n  params: AdministrationMutationContext & {bootstrapToken: string},\n): Promise<AdminGrant> {\n  if (!bootstrapTokenMatches(params.bootstrapToken, config.ADMIN_BOOTSTRAP_TOKEN)) {\n    throw new InvalidAdminBootstrapTokenError();\n  }\n\n  return await bootstrapFirstAdminOwnerInDb({\n    userId: params.actorId,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(BOOTSTRAP_COMMAND, {\n      actorId: params.actorId,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole: ADMIN_OWNER_ROLE,\n      command: BOOTSTRAP_COMMAND,\n      targetType: 'user',\n      targetId: params.actorId,\n      reason: 'Initial administrator owner bootstrap',\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function getAdminBootstrapState(): Promise<'available' | 'closed'> {\n  return (await hasActiveAdminOwner()) ? 'closed' : 'available';\n}\n\nexport async function findAdministratorUserSummary(\n  params: {actorId: string} & ({id: string; email?: never} | {email: string; id?: never}),\n): Promise<AdministratorUserSummary | undefined> {\n  await requireAdminRole({userId: params.actorId, minimumRole: ADMIN_OBSERVER_ROLE});\n\n  const user = await findAdministratorUserInDb(\n    'id' in params ? {id: params.id} : {email: params.email},\n  );\n  if (!user) return undefined;\n\n  return user;\n}\n\nexport async function listAdministratorGrantSummaries(params: {\n  actorId: string;\n  limit: number;\n  cursor?: TimestampIdCursor;\n}): Promise<{\n  grants: AdministratorGrantSummary[];\n  nextCursor: TimestampIdCursor | null;\n}> {\n  await requireAdminRole({userId: params.actorId, minimumRole: ADMIN_OBSERVER_ROLE});\n\n  const result = await listAdminGrantSummaries({\n    limit: params.limit,\n    ...(params.cursor ? {cursor: params.cursor} : {}),\n  });\n  return {\n    grants: result.rows.map((row) => ({\n      grantId: row.id,\n      role: row.role,\n      createdAt: row.createdAt,\n      revokedAt: row.revokedAt,\n      user: row.user,\n    })),\n    nextCursor: result.nextCursor,\n  };\n}\n\nexport async function grantAdministratorRole(\n  params: AdministrationMutationContext & {userId: string; role: AdminRole; reason: string},\n): Promise<AdminGrant> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OWNER_ROLE,\n  });\n  return await grantAdminRoleWithAudit({\n    userId: params.userId,\n    role: params.role,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(GRANT_COMMAND, {\n      userId: params.userId,\n      role: params.role,\n      reason: params.reason,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole,\n      command: GRANT_COMMAND,\n      targetType: 'user',\n      targetId: params.userId,\n      reason: params.reason,\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function revokeAdministratorGrant(\n  params: AdministrationMutationContext & {grantId: string; reason: string},\n): Promise<AdminGrant> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OWNER_ROLE,\n  });\n  return await revokeAdminGrantWithAudit({\n    grantId: params.grantId,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(REVOKE_COMMAND, {\n      grantId: params.grantId,\n      reason: params.reason,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole,\n      command: REVOKE_COMMAND,\n      targetType: 'admin-grant',\n      targetId: params.grantId,\n      reason: params.reason,\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function suspendAdministratorUser(\n  params: AdministrationMutationContext & {userId: string; reason: string},\n): Promise<AdministratorUserMutationResult> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OPERATOR_ROLE,\n  });\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  return toAdministratorUserMutationResult(\n    await suspendUserWithAudit({\n      actorId: params.actorId,\n      userId: params.userId,\n      idempotencyKeyFingerprint,\n      requestFingerprint: administrationCommandFingerprint(SUSPEND_USER_COMMAND, {\n        userId: params.userId,\n        reason: params.reason,\n      }),\n      event: administrationEvent({\n        actorId: params.actorId,\n        actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: SUSPEND_USER_COMMAND,\n        targetType: 'user',\n        targetId: params.userId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n    }),\n  );\n}\n\nexport async function reactivateAdministratorUser(\n  params: AdministrationMutationContext & {userId: string; reason?: string},\n): Promise<AdministratorUserMutationResult> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OPERATOR_ROLE,\n  });\n  const reason = params.reason ?? 'User reactivation requested by an administrator';\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  return toAdministratorUserMutationResult(\n    await reactivateUserWithAudit({\n      actorId: params.actorId,\n      userId: params.userId,\n      idempotencyKeyFingerprint,\n      requestFingerprint: administrationCommandFingerprint(REACTIVATE_USER_COMMAND, {\n        userId: params.userId,\n        reason,\n      }),\n      event: administrationEvent({\n        actorId: params.actorId,\n        actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: REACTIVATE_USER_COMMAND,\n        targetType: 'user',\n        targetId: params.userId,\n        reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n    }),\n  );\n}\n\nexport async function revokeAdministratorUserSessions(\n  params: AdministrationMutationContext & {userId: string; reason?: string},\n): Promise<AdministratorUserMutationResult> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OPERATOR_ROLE,\n  });\n  const reason = params.reason ?? 'All active user sessions revoked by an administrator';\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  return toAdministratorUserMutationResult(\n    await revokeUserSessionsWithAudit({\n      actorId: params.actorId,\n      userId: params.userId,\n      idempotencyKeyFingerprint,\n      requestFingerprint: administrationCommandFingerprint(REVOKE_USER_SESSIONS_COMMAND, {\n        userId: params.userId,\n        reason,\n      }),\n      event: administrationEvent({\n        actorId: params.actorId,\n        actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: REVOKE_USER_SESSIONS_COMMAND,\n        targetType: 'user',\n        targetId: params.userId,\n        reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n    }),\n  );\n}\n\nexport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n};\n"],"names":["timingSafeEqual","createAdministrationActionEvent","hashOpaqueToken","config","bootstrapFirstAdminOwner","bootstrapFirstAdminOwnerInDb","grantAdminRoleWithAudit","hasActiveAdminOwner","listAdminGrantSummaries","revokeAdminGrantWithAudit","reactivateUserWithAudit","revokeUserSessionsWithAudit","suspendUserWithAudit","findAdministratorUser","findAdministratorUserInDb","requireAdminRole","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","InvalidAdminBootstrapTokenError","LastAdminOwnerError","UserNotFoundError","ADMIN_OWNER_ROLE","ADMIN_OBSERVER_ROLE","ADMIN_OPERATOR_ROLE","BOOTSTRAP_COMMAND","GRANT_COMMAND","REVOKE_COMMAND","SUSPEND_USER_COMMAND","REACTIVATE_USER_COMMAND","REVOKE_USER_SESSIONS_COMMAND","administrationCommandFingerprint","command","input","JSON","stringify","bootstrapTokenMatches","candidate","expected","candidateHash","Buffer","from","expectedHash","administrationEvent","params","actorId","actorRole","requiredRole","targetType","targetId","reason","result","correlationId","idempotencyKeyFingerprint","occurredAt","Date","toISOString","toAdministratorUserMutationResult","user","sessionsRevoked","bootstrapToken","ADMIN_BOOTSTRAP_TOKEN","userId","idempotencyKey","requestFingerprint","event","getAdminBootstrapState","findAdministratorUserSummary","minimumRole","id","email","undefined","listAdministratorGrantSummaries","limit","cursor","grants","rows","map","row","grantId","role","createdAt","revokedAt","nextCursor","grantAdministratorRole","revokeAdministratorGrant","suspendAdministratorUser","reactivateAdministratorUser","revokeAdministratorUserSessions"],"mappings":"AAAA,SAAQA,eAAe,QAAO,cAAc;AAE5C,SAAQC,+BAA+B,QAAO,0BAA0B;AAExE,SAAQC,eAAe,QAAO,uBAAuB;AACrD,SAAQC,MAAM,QAAO,aAAa;AAClC,SACEC,4BAA4BC,4BAA4B,EACxDC,uBAAuB,EACvBC,mBAAmB,EACnBC,uBAAuB,EACvBC,yBAAyB,QACpB,sBAAsB;AAC7B,SACEC,uBAAuB,EACvBC,2BAA2B,EAC3BC,oBAAoB,QAEf,+BAA+B;AACtC,SAAQC,yBAAyBC,yBAAyB,QAAO,qBAAqB;AACtF,SAAQC,gBAAgB,QAAO,kBAAkB;AAMjD,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,QACZ,cAAc;AAErB,MAAMC,mBAA8B;AACpC,MAAMC,sBAAiC;AACvC,MAAMC,sBAAiC;AACvC,MAAMC,oBAAoB;AAC1B,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB;AACvB,MAAMC,uBAAuB;AAC7B,MAAMC,0BAA0B;AAChC,MAAMC,+BAA+B;AAErC,OAAO,SAASC,iCAAiCC,OAAe,EAAEC,KAAc;IAC9E,OAAOhC,gBAAgB,GAAG+B,QAAQ,CAAC,EAAEE,KAAKC,SAAS,CAACF,QAAQ;AAC9D;AAEA,SAASG,sBAAsBC,SAAiB,EAAEC,QAA4B;IAC5E,IAAI,CAACA,UAAU,OAAO;IACtB,MAAMC,gBAAgBC,OAAOC,IAAI,CAACxC,gBAAgBoC,YAAY;IAC9D,MAAMK,eAAeF,OAAOC,IAAI,CAACxC,gBAAgBqC,WAAW;IAC5D,OAAOvC,gBAAgBwC,eAAeG;AACxC;AAEA,SAASC,oBAAoBC,MAU5B;IACC,OAAO5C,gCAAgC;QACrC6C,SAASD,OAAOC,OAAO;QACvBC,WAAWF,OAAOE,SAAS;QAC3BC,cAAcH,OAAOG,YAAY,IAAIzB;QACrCU,SAASY,OAAOZ,OAAO;QACvBgB,YAAYJ,OAAOI,UAAU;QAC7BC,UAAUL,OAAOK,QAAQ;QACzBC,QAAQN,OAAOM,MAAM;QACrBC,QAAQ;QACRC,eAAeR,OAAOQ,aAAa;QACnCC,2BAA2BT,OAAOS,yBAAyB;QAC3DC,YAAY,IAAIC,OAAOC,WAAW;IACpC;AACF;AAcA,SAASC,kCACPN,MAA4B;IAE5B,OAAO;QACLO,MAAMP,OAAOO,IAAI;QACjBN,eAAeD,OAAOC,aAAa;QACnCO,iBAAiBR,OAAOQ,eAAe;IACzC;AACF;AAEA,OAAO,eAAexD,yBACpByC,MAAgE;IAEhE,IAAI,CAACR,sBAAsBQ,OAAOgB,cAAc,EAAE1D,OAAO2D,qBAAqB,GAAG;QAC/E,MAAM,IAAI1C;IACZ;IAEA,OAAO,MAAMf,6BAA6B;QACxC0D,QAAQlB,OAAOC,OAAO;QACtBA,SAASD,OAAOC,OAAO;QACvBQ,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAChEC,oBAAoBjC,iCAAiCN,mBAAmB;YACtEoB,SAASD,OAAOC,OAAO;QACzB;QACAoB,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC,WAAWxB;YACXU,SAASP;YACTuB,YAAY;YACZC,UAAUL,OAAOC,OAAO;YACxBK,QAAQ;YACRE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAClE;IACF;AACF;AAEA,OAAO,eAAeG;IACpB,OAAO,AAAC,MAAM5D,wBAAyB,WAAW;AACpD;AAEA,OAAO,eAAe6D,6BACpBvB,MAAuF;IAEvF,MAAM9B,iBAAiB;QAACgD,QAAQlB,OAAOC,OAAO;QAAEuB,aAAa7C;IAAmB;IAEhF,MAAMmC,OAAO,MAAM7C,0BACjB,QAAQ+B,SAAS;QAACyB,IAAIzB,OAAOyB,EAAE;IAAA,IAAI;QAACC,OAAO1B,OAAO0B,KAAK;IAAA;IAEzD,IAAI,CAACZ,MAAM,OAAOa;IAElB,OAAOb;AACT;AAEA,OAAO,eAAec,gCAAgC5B,MAIrD;IAIC,MAAM9B,iBAAiB;QAACgD,QAAQlB,OAAOC,OAAO;QAAEuB,aAAa7C;IAAmB;IAEhF,MAAM4B,SAAS,MAAM5C,wBAAwB;QAC3CkE,OAAO7B,OAAO6B,KAAK;QACnB,GAAI7B,OAAO8B,MAAM,GAAG;YAACA,QAAQ9B,OAAO8B,MAAM;QAAA,IAAI,CAAC,CAAC;IAClD;IACA,OAAO;QACLC,QAAQxB,OAAOyB,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gBAChCC,SAASD,IAAIT,EAAE;gBACfW,MAAMF,IAAIE,IAAI;gBACdC,WAAWH,IAAIG,SAAS;gBACxBC,WAAWJ,IAAII,SAAS;gBACxBxB,MAAMoB,IAAIpB,IAAI;YAChB,CAAA;QACAyB,YAAYhC,OAAOgC,UAAU;IAC/B;AACF;AAEA,OAAO,eAAeC,uBACpBxC,MAAyF;IAEzF,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa9C;IACf;IACA,OAAO,MAAMjB,wBAAwB;QACnCyD,QAAQlB,OAAOkB,MAAM;QACrBkB,MAAMpC,OAAOoC,IAAI;QACjBnC,SAASD,OAAOC,OAAO;QACvBQ,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAChEC,oBAAoBjC,iCAAiCL,eAAe;YAClEoC,QAAQlB,OAAOkB,MAAM;YACrBkB,MAAMpC,OAAOoC,IAAI;YACjB9B,QAAQN,OAAOM,MAAM;QACvB;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAd,SAASN;YACTsB,YAAY;YACZC,UAAUL,OAAOkB,MAAM;YACvBZ,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAClE;IACF;AACF;AAEA,OAAO,eAAesB,yBACpBzC,MAAyE;IAEzE,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa9C;IACf;IACA,OAAO,MAAMd,0BAA0B;QACrCuE,SAASnC,OAAOmC,OAAO;QACvBlC,SAASD,OAAOC,OAAO;QACvBQ,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAChEC,oBAAoBjC,iCAAiCJ,gBAAgB;YACnEoD,SAASnC,OAAOmC,OAAO;YACvB7B,QAAQN,OAAOM,MAAM;QACvB;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAd,SAASL;YACTqB,YAAY;YACZC,UAAUL,OAAOmC,OAAO;YACxB7B,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAClE;IACF;AACF;AAEA,OAAO,eAAeuB,yBACpB1C,MAAwE;IAExE,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa5C;IACf;IACA,MAAM6B,4BAA4BpD,gBAAgB2C,OAAOmB,cAAc;IACvE,OAAON,kCACL,MAAM9C,qBAAqB;QACzBkC,SAASD,OAAOC,OAAO;QACvBiB,QAAQlB,OAAOkB,MAAM;QACrBT;QACAW,oBAAoBjC,iCAAiCH,sBAAsB;YACzEkC,QAAQlB,OAAOkB,MAAM;YACrBZ,QAAQN,OAAOM,MAAM;QACvB;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAC,cAAcvB;YACdQ,SAASJ;YACToB,YAAY;YACZC,UAAUL,OAAOkB,MAAM;YACvBZ,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC;QACF;IACF;AAEJ;AAEA,OAAO,eAAekC,4BACpB3C,MAAyE;IAEzE,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa5C;IACf;IACA,MAAM0B,SAASN,OAAOM,MAAM,IAAI;IAChC,MAAMG,4BAA4BpD,gBAAgB2C,OAAOmB,cAAc;IACvE,OAAON,kCACL,MAAMhD,wBAAwB;QAC5BoC,SAASD,OAAOC,OAAO;QACvBiB,QAAQlB,OAAOkB,MAAM;QACrBT;QACAW,oBAAoBjC,iCAAiCF,yBAAyB;YAC5EiC,QAAQlB,OAAOkB,MAAM;YACrBZ;QACF;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAC,cAAcvB;YACdQ,SAASH;YACTmB,YAAY;YACZC,UAAUL,OAAOkB,MAAM;YACvBZ;YACAE,eAAeR,OAAOQ,aAAa;YACnCC;QACF;IACF;AAEJ;AAEA,OAAO,eAAemC,gCACpB5C,MAAyE;IAEzE,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa5C;IACf;IACA,MAAM0B,SAASN,OAAOM,MAAM,IAAI;IAChC,MAAMG,4BAA4BpD,gBAAgB2C,OAAOmB,cAAc;IACvE,OAAON,kCACL,MAAM/C,4BAA4B;QAChCmC,SAASD,OAAOC,OAAO;QACvBiB,QAAQlB,OAAOkB,MAAM;QACrBT;QACAW,oBAAoBjC,iCAAiCD,8BAA8B;YACjFgC,QAAQlB,OAAOkB,MAAM;YACrBZ;QACF;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAC,cAAcvB;YACdQ,SAASF;YACTkB,YAAY;YACZC,UAAUL,OAAOkB,MAAM;YACvBZ;YACAE,eAAeR,OAAOQ,aAAa;YACnCC;QACF;IACF;AAEJ;AAEA,SACEtC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,GACjB"}

package/dist/core/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,SAAS,EAAc,MAAM,uBAAuB,CAAC;AAOlE,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,0CAA0C,CAAC;AAyBlD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EAErB,uBAAuB,EAMvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,YAAY,CAAC;AAkI7C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9E;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAChC,cAAc,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,IAAI,CAAA;KAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CA8C9F;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA2B,SAAQ,WAAW;IAC7D,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IACrE,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAiErC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAwBrE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAoBrC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoDpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAqB1C;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBtC;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAO5F"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,SAAS,EAAc,MAAM,uBAAuB,CAAC;AAOlE,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,0CAA0C,CAAC;AAyBlD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EAErB,uBAAuB,EAMvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,YAAY,CAAC;AAmI7C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9E;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAChC,cAAc,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,IAAI,CAAA;KAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CA8C9F;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA2B,SAAQ,WAAW;IAC7D,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IACrE,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAiErC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAwBrE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAoBrC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA0DpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAqB1C;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBtC;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAO5F"}

package/dist/core/auth.js

@@ -6,7 +6,7 @@ import { userAccessTokenKey } from '@shipfox/node-auth-root-key';
 import { generateOpaqueToken, hashOpaqueToken } from '@shipfox/node-tokens';
 import { config } from '#config.js';
 import { consumePasswordReset, createPasswordReset } from '#db/password-resets.js';
-import { createRefreshToken, findActiveRefreshTokenByHash, findRefreshTokenByHash, revokeRefreshSession, revokeRefreshTokensForUser, rotateRefreshToken } from '#db/refresh-tokens.js';
+import { createRefreshTokenForActiveUser, findActiveRefreshTokenByHash, findRefreshTokenByHash, revokeRefreshSession, revokeRefreshTokensForUser, rotateRefreshToken } from '#db/refresh-tokens.js';
 import { createUser as createDbUser, findUserByEmail, findUserById, markEmailVerified, provisionUser as provisionDbUser, updateUserPassword } from '#db/users.js';
 import { recordTokenRefreshed } from '#metrics/index.js';
 import { getCurrentAdminRole } from './admin-role.js';
@@ -69,12 +69,13 @@ function isWithinRotationGrace(refreshToken) {
 }
 async function createRefreshSession(user, refreshSessionId) {
     const refreshToken = generateOpaqueToken('refreshToken');
-    const session = await createRefreshToken({
+    const session = await createRefreshTokenForActiveUser({
         sessionId: refreshSessionId,
         userId: user.id,
         hashedToken: hashOpaqueToken(refreshToken),
         expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS)
     });
+    if (!session) throw new InvalidCredentialsError();
     return {
         refreshToken,
         refreshSessionId: session.sessionId
@@ -385,12 +386,20 @@ export async function refreshAccessToken(params) {
     // revoked, or expired the token before this refresh could claim it.
     const nextRefreshToken = generateOpaqueToken('refreshToken');
     const rotated = await rotateRefreshToken({
+        userId: current.userId,
         id: current.id,
         currentHashedToken,
         nextHashedToken: hashOpaqueToken(nextRefreshToken),
         expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS)
     });
     if (!rotated) {
+        const latestUser = await findUserById({
+            id: current.userId
+        });
+        if (latestUser?.status !== 'active') {
+            recordRefreshOutcome('rejected');
+            throw new TokenInvalidError('Refresh token is invalid or expired');
+        }
         const latest = await findRefreshTokenByHash({
             hashedToken: currentHashedToken
         });