@shipfox/api-auth 10.1.0 → 11.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 64 files with swc (496.09ms)
+Successfully compiled: 67 files with swc (446.61ms)

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @shipfox/api-auth
 
+## 11.0.0
+
+### Major Changes
+
+- 25158c8: Carry workspace lifecycle status in JWT membership claims and enforce suspended or inactive access at the stateless workspace gate while keeping access-token verification stateless.
+
+  `getAuthenticatedSessionContext()` now reads refresh-session metadata from verified access-token claims without checking active refresh-session state; revoking a refresh session does not invalidate an already-issued access token.
+
+### Patch Changes
+
+- Updated dependencies [25158c8]
+  - @shipfox/api-auth-context@11.0.0
+  - @shipfox/api-workspaces-dto@11.0.0
+
+## 10.2.0
+
+### Minor Changes
+
+- 95d1456: Add administrator user suspension, reactivation, and all-session revocation commands.
+
+### Patch Changes
+
+- 07e7371: Add idempotent administrator workspace suspension and reactivation commands with atomic redacted administration events.
+- Updated dependencies [95d1456]
+- Updated dependencies [0773b85]
+- Updated dependencies [07e7371]
+  - @shipfox/api-auth-dto@10.2.0
+  - @shipfox/api-workspaces-dto@10.2.0
+  - @shipfox/api-auth-context@10.2.0
+
 ## 10.1.0
 
 ### Minor Changes

package/README.md

@@ -70,6 +70,17 @@ Required environment:
 | `CLIENT_BASE_URL` | `http://localhost:5173` | Base URL used in email verification and password reset links. |
 | `ADMIN_BOOTSTRAP_TOKEN` | none | Deployment secret accepted once to create the first administrator owner. Set it before bootstrap and remove or rotate it after successful bootstrap. |
 
+The recommended access-token lifetime is 15 minutes. Because user JWTs are
+verified from their claims, a token issued before logout, password changes,
+session revocation, or workspace suspension remains usable until its configured
+`exp` time. Logout and session revocation block refresh-session renewal, while
+password changes revoke other refresh sessions and retain the current session
+when its refresh cookie is valid. Workspace suspension is carried into the next
+status-aware snapshot, where the stateless workspace gate rejects member access;
+none of these actions retroactively invalidate an issued access token. Newly
+issued and refreshed tokens carry workspace lifecycle status so the gate can
+return the stable suspended or inactive access result.
+
 Email delivery uses the shared `@shipfox/node-mailer` configuration.
 
 The signup gate is off by default. When it is on, provide at least one non-empty
@@ -99,8 +110,9 @@ itself.
 ### User session token
 
 - **Design:** a stateless session token. It carries the user's identity and
-  current membership list in its claims so protected routes can authorize without
-  a per-request user or membership lookup.
+  workspace membership list, including each workspace's lifecycle status, in
+  its claims so protected routes can authorize without a per-request user or
+  membership lookup.
 - **Audience:** signed-in users on first-party clients (web app, CLI).
 - **Grants:** the user's own account routes and, downstream, any route that
   authorizes against the membership claims. Its scope is "this user, with these
@@ -111,12 +123,12 @@ itself.
     fresh token when it expires.
   - *Store* — held in client memory only, never persisted to disk or local
     storage. Refresh sessions are stored server-side as hashes, never in raw form.
-  - *Discard* — expires on its own (minutes, not hours); the refresh session is
-    revoked on logout and on password change.
+  - *Discard* — expires at the configured `exp` time. Revoking the refresh
+    session blocks renewal but does not invalidate the issued access token.
 - **Tradeoff — stale memberships:** because memberships ride in the claims, a
-  membership change only takes effect on the next refresh. Accepted because the
-  token is short-lived, so the staleness window is bounded and a per-request
-  membership read is avoided.
+  membership or workspace-status change only takes effect on the next token
+  issuance or refresh. Accepted because the recommended lifetime is 15 minutes,
+  so the staleness window is bounded and a per-request membership read is avoided.
 
 ### Runner session token
 
@@ -273,6 +285,20 @@ This app-layer limiter protects semantic auth work such as Argon2 verification a
 
 `GET /admin/auth/admin-grants` also requires `admin-observer`. It returns at most 100 newest-first `AdministratorGrantSummary` rows per page, with an opaque cursor and a safe embedded user identity. It does not return credentials, sessions, provider payloads, OAuth tokens, refresh tokens, or raw authentication metadata.
 
+### Administrator user moderation
+
+All routes are mounted under `/admin/auth/users` and require an authenticated bearer token.
+
+| Method | Path | Required role | Result |
+| --- | --- | --- | --- |
+| `POST` | `/:userId/suspend` | `admin-operator` | Suspends the user, revokes all refresh sessions, and returns the final safe user summary with a correlation ID. Issued access tokens remain valid until `exp`. |
+| `POST` | `/:userId/reactivate` | `admin-operator` | Restores sign-in eligibility without restoring revoked sessions. |
+| `POST` | `/:userId/revoke-sessions` | `admin-operator` | Revokes all refresh sessions without changing account status and returns the number of affected sessions. Issued access tokens remain valid until `exp`. |
+
+Each command requires an `Idempotency-Key`. Suspension requires a bounded reason; reactivation and session revocation accept an optional bounded reason. Repeating a successful command returns its committed result. Reusing a key for a different command or request returns `409 idempotency-key-reused`.
+
+Suspension preserves the user record and rejects the final active administrator owner. State, the command result, and one redacted `administration.action.performed` outbox event commit atomically. The event stores only the idempotency-key fingerprint, never the raw key or session material.
+
 ## API
 
 The package exports a module factory. Pass it the Workspaces inter-module client from the
@@ -297,7 +323,7 @@ It also exports lower-level pieces for tests and advanced integration:
 - `issueJobLeaseToken(claims)` / `verifyJobLeaseToken(token)`: mint and verify job lease tokens.
 - `createEnvironmentSignupPolicy()`: creates the environment-backed signup policy used by default. Pass `signupPolicy` to `createAuthModule` to replace it.
 - `getClientContext(request)`: reads the authenticated user context from a Fastify request.
-- `getAuthenticatedSessionContext(request)`: resolves an authenticated request to its user ID and active refresh-session ID.
+- `getAuthenticatedSessionContext(request)`: reads the user ID and required refresh-session ID from verified access-token claims. It does not check whether the refresh session is still active.
 - `findUserByEmail({email})`: read-only lookup of the current owner of a normalized email; see below.
 - Entity types: `User`, `UserStatus`, `RefreshToken`, `PasswordReset`, and `EmailOwner`.
 
@@ -402,9 +428,9 @@ const session = await getAuthenticatedSessionContext(request);
 ```
 
 The refresh-session ID remains the same when its refresh token rotates. The
-helper verifies that the session is active and belongs to the authenticated user,
-and returns the standard `401 unauthorized` error for a missing, malformed,
-expired, or revoked session. It exposes neither refresh-token material nor
+helper does not query the refresh-session table. It returns the standard `401
+unauthorized` error when the verified request context is missing, inconsistent,
+or has no refresh-session ID. It exposes neither refresh-token material nor
 storage details.
 
 ## Data Model
@@ -427,6 +453,11 @@ Passwords use Argon2id. Password reset tokens and refresh tokens are opaque toke
 - A denied password signup returns `403` with error code `signup-not-allowed`. The policy message is capped at 500 characters.
 - Invitation signup validates the invitation and bypasses the signup policy. Invitations remain a separate authorization path.
 - Login only succeeds for active users with verified email addresses and a password hash.
+- Login and refresh reject suspended or deleted users. Current-state reads such
+  as `/auth/me` still return the persisted suspended-user status. Ordinary JWT
+  verification does not query user or refresh-session rows.
+- Revoking a refresh session blocks renewal. An already-issued access token
+  remains valid until its configured `exp` time.
 - Refresh tokens rotate on each refresh.
 - Password reset tokens and email challenge proofs are consumed once.
 - Password change revokes other refresh sessions. It keeps the current session when the current refresh cookie is valid.

package/dist/core/administration.d.ts

@@ -3,13 +3,17 @@ import type { TimestampIdCursor } from '@shipfox/node-drizzle';
 import type { AdminGrant } from './entities/admin-grant.js';
 import type { AdministratorGrantSummary, AdministratorUserSummary } from './entities/administrator-read-model.js';
 import { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError } from './errors.js';
-export declare function hashAdministrationValue(value: string): string;
 export declare function administrationCommandFingerprint(command: string, input: unknown): string;
 export interface AdministrationMutationContext {
     actorId: string;
     idempotencyKey: string;
     correlationId: string;
 }
+export interface AdministratorUserMutationResult {
+    user: AdministratorUserSummary;
+    correlationId: string;
+    sessionsRevoked: number;
+}
 export declare function bootstrapFirstAdminOwner(params: AdministrationMutationContext & {
     bootstrapToken: string;
 }): Promise<AdminGrant>;
@@ -40,5 +44,17 @@ export declare function revokeAdministratorGrant(params: AdministrationMutationC
     grantId: string;
     reason: string;
 }): Promise<AdminGrant>;
+export declare function suspendAdministratorUser(params: AdministrationMutationContext & {
+    userId: string;
+    reason: string;
+}): Promise<AdministratorUserMutationResult>;
+export declare function reactivateAdministratorUser(params: AdministrationMutationContext & {
+    userId: string;
+    reason?: string;
+}): Promise<AdministratorUserMutationResult>;
+export declare function revokeAdministratorUserSessions(params: AdministrationMutationContext & {
+    userId: string;
+    reason?: string;
+}): Promise<AdministratorUserMutationResult>;
 export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError, };
 //# sourceMappingURL=administration.d.ts.map

package/dist/core/administration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"administration.d.ts","sourceRoot":"","sources":["../../src/core/administration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAW7D,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAQrB,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAExF;AAkCD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,GAC/D,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,CAE9E;AAED,wBAAsB,4BAA4B,CAChD,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAG,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC,GACtF,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAS/C;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACtC,CAAC,CAiBD;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACxF,OAAO,CAAC,UAAU,CAAC,CA0BrB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACxE,OAAO,CAAC,UAAU,CAAC,CAwBrB;AAED,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,GAClB,CAAC"}
+{"version":3,"file":"administration.d.ts","sourceRoot":"","sources":["../../src/core/administration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAkB7D,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAYrB,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAExF;AAmCD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB;AAYD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,GAC/D,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,CAE9E;AAED,wBAAsB,4BAA4B,CAChD,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAG,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC,GACtF,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAS/C;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACtC,CAAC,CAiBD;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACxF,OAAO,CAAC,UAAU,CAAC,CA0BrB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACxE,OAAO,CAAC,UAAU,CAAC,CAwBrB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACvE,OAAO,CAAC,+BAA+B,CAAC,CA4B1C;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GACxE,OAAO,CAAC,+BAA+B,CAAC,CA6B1C;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,6BAA6B,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAC,GACxE,OAAO,CAAC,+BAA+B,CAAC,CA6B1C;AAED,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,+BAA+B,EAC/B,mBAAmB,EACnB,iBAAiB,GAClB,CAAC"}

package/dist/core/administration.js

@@ -1,32 +1,35 @@
-import { createHash, timingSafeEqual } from 'node:crypto';
+import { timingSafeEqual } from 'node:crypto';
 import { createAdministrationActionEvent } from '@shipfox/api-common-dto';
+import { hashOpaqueToken } from '@shipfox/node-tokens';
 import { config } from '#config.js';
 import { bootstrapFirstAdminOwner as bootstrapFirstAdminOwnerInDb, grantAdminRoleWithAudit, hasActiveAdminOwner, listAdminGrantSummaries, revokeAdminGrantWithAudit } from '#db/admin-grants.js';
+import { reactivateUserWithAudit, revokeUserSessionsWithAudit, suspendUserWithAudit } from '#db/admin-user-moderation.js';
 import { findAdministratorUser as findAdministratorUserInDb } from '#db/admin-users.js';
 import { requireAdminRole } from './admin-role.js';
 import { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError } from './errors.js';
 const ADMIN_OWNER_ROLE = 'admin-owner';
 const ADMIN_OBSERVER_ROLE = 'admin-observer';
+const ADMIN_OPERATOR_ROLE = 'admin-operator';
 const BOOTSTRAP_COMMAND = 'auth.admin_grant.bootstrap';
 const GRANT_COMMAND = 'auth.admin_grant.grant';
 const REVOKE_COMMAND = 'auth.admin_grant.revoke';
-export function hashAdministrationValue(value) {
-    return createHash('sha256').update(value).digest('hex');
-}
+const SUSPEND_USER_COMMAND = 'auth.user.suspend';
+const REACTIVATE_USER_COMMAND = 'auth.user.reactivate';
+const REVOKE_USER_SESSIONS_COMMAND = 'auth.user.revoke-sessions';
 export function administrationCommandFingerprint(command, input) {
-    return hashAdministrationValue(`${command}:${JSON.stringify(input)}`);
+    return hashOpaqueToken(`${command}:${JSON.stringify(input)}`);
 }
 function bootstrapTokenMatches(candidate, expected) {
     if (!expected) return false;
-    const candidateHash = Buffer.from(hashAdministrationValue(candidate), 'hex');
-    const expectedHash = Buffer.from(hashAdministrationValue(expected), 'hex');
+    const candidateHash = Buffer.from(hashOpaqueToken(candidate), 'hex');
+    const expectedHash = Buffer.from(hashOpaqueToken(expected), 'hex');
     return timingSafeEqual(candidateHash, expectedHash);
 }
 function administrationEvent(params) {
     return createAdministrationActionEvent({
         actorId: params.actorId,
         actorRole: params.actorRole,
-        requiredRole: ADMIN_OWNER_ROLE,
+        requiredRole: params.requiredRole ?? ADMIN_OWNER_ROLE,
         command: params.command,
         targetType: params.targetType,
         targetId: params.targetId,
@@ -37,6 +40,13 @@ function administrationEvent(params) {
         occurredAt: new Date().toISOString()
     });
 }
+function toAdministratorUserMutationResult(result) {
+    return {
+        user: result.user,
+        correlationId: result.correlationId,
+        sessionsRevoked: result.sessionsRevoked
+    };
+}
 export async function bootstrapFirstAdminOwner(params) {
     if (!bootstrapTokenMatches(params.bootstrapToken, config.ADMIN_BOOTSTRAP_TOKEN)) {
         throw new InvalidAdminBootstrapTokenError();
@@ -44,7 +54,7 @@ export async function bootstrapFirstAdminOwner(params) {
     return await bootstrapFirstAdminOwnerInDb({
         userId: params.actorId,
         actorId: params.actorId,
-        idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),
+        idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),
         requestFingerprint: administrationCommandFingerprint(BOOTSTRAP_COMMAND, {
             actorId: params.actorId
         }),
@@ -56,7 +66,7 @@ export async function bootstrapFirstAdminOwner(params) {
             targetId: params.actorId,
             reason: 'Initial administrator owner bootstrap',
             correlationId: params.correlationId,
-            idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey)
+            idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey)
         })
     });
 }
@@ -107,7 +117,7 @@ export async function grantAdministratorRole(params) {
         userId: params.userId,
         role: params.role,
         actorId: params.actorId,
-        idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),
+        idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),
         requestFingerprint: administrationCommandFingerprint(GRANT_COMMAND, {
             userId: params.userId,
             role: params.role,
@@ -121,7 +131,7 @@ export async function grantAdministratorRole(params) {
             targetId: params.userId,
             reason: params.reason,
             correlationId: params.correlationId,
-            idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey)
+            idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey)
         })
     });
 }
@@ -133,7 +143,7 @@ export async function revokeAdministratorGrant(params) {
     return await revokeAdminGrantWithAudit({
         grantId: params.grantId,
         actorId: params.actorId,
-        idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),
+        idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),
         requestFingerprint: administrationCommandFingerprint(REVOKE_COMMAND, {
             grantId: params.grantId,
             reason: params.reason
@@ -146,9 +156,92 @@ export async function revokeAdministratorGrant(params) {
             targetId: params.grantId,
             reason: params.reason,
             correlationId: params.correlationId,
-            idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey)
+            idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey)
+        })
+    });
+}
+export async function suspendAdministratorUser(params) {
+    const actorRole = await requireAdminRole({
+        userId: params.actorId,
+        minimumRole: ADMIN_OPERATOR_ROLE
+    });
+    const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);
+    return toAdministratorUserMutationResult(await suspendUserWithAudit({
+        actorId: params.actorId,
+        userId: params.userId,
+        idempotencyKeyFingerprint,
+        requestFingerprint: administrationCommandFingerprint(SUSPEND_USER_COMMAND, {
+            userId: params.userId,
+            reason: params.reason
+        }),
+        event: administrationEvent({
+            actorId: params.actorId,
+            actorRole,
+            requiredRole: ADMIN_OPERATOR_ROLE,
+            command: SUSPEND_USER_COMMAND,
+            targetType: 'user',
+            targetId: params.userId,
+            reason: params.reason,
+            correlationId: params.correlationId,
+            idempotencyKeyFingerprint
         })
+    }));
+}
+export async function reactivateAdministratorUser(params) {
+    const actorRole = await requireAdminRole({
+        userId: params.actorId,
+        minimumRole: ADMIN_OPERATOR_ROLE
     });
+    const reason = params.reason ?? 'User reactivation requested by an administrator';
+    const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);
+    return toAdministratorUserMutationResult(await reactivateUserWithAudit({
+        actorId: params.actorId,
+        userId: params.userId,
+        idempotencyKeyFingerprint,
+        requestFingerprint: administrationCommandFingerprint(REACTIVATE_USER_COMMAND, {
+            userId: params.userId,
+            reason
+        }),
+        event: administrationEvent({
+            actorId: params.actorId,
+            actorRole,
+            requiredRole: ADMIN_OPERATOR_ROLE,
+            command: REACTIVATE_USER_COMMAND,
+            targetType: 'user',
+            targetId: params.userId,
+            reason,
+            correlationId: params.correlationId,
+            idempotencyKeyFingerprint
+        })
+    }));
+}
+export async function revokeAdministratorUserSessions(params) {
+    const actorRole = await requireAdminRole({
+        userId: params.actorId,
+        minimumRole: ADMIN_OPERATOR_ROLE
+    });
+    const reason = params.reason ?? 'All active user sessions revoked by an administrator';
+    const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);
+    return toAdministratorUserMutationResult(await revokeUserSessionsWithAudit({
+        actorId: params.actorId,
+        userId: params.userId,
+        idempotencyKeyFingerprint,
+        requestFingerprint: administrationCommandFingerprint(REVOKE_USER_SESSIONS_COMMAND, {
+            userId: params.userId,
+            reason
+        }),
+        event: administrationEvent({
+            actorId: params.actorId,
+            actorRole,
+            requiredRole: ADMIN_OPERATOR_ROLE,
+            command: REVOKE_USER_SESSIONS_COMMAND,
+            targetType: 'user',
+            targetId: params.userId,
+            reason,
+            correlationId: params.correlationId,
+            idempotencyKeyFingerprint
+        })
+    }));
 }
 export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError };
 

package/dist/core/administration.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/administration.ts"],"sourcesContent":["import {createHash, timingSafeEqual} from 'node:crypto';\nimport type {AdminRole} from '@shipfox/api-auth-dto';\nimport {createAdministrationActionEvent} from '@shipfox/api-common-dto';\nimport type {TimestampIdCursor} from '@shipfox/node-drizzle';\nimport {config} from '#config.js';\nimport {\n  bootstrapFirstAdminOwner as bootstrapFirstAdminOwnerInDb,\n  grantAdminRoleWithAudit,\n  hasActiveAdminOwner,\n  listAdminGrantSummaries,\n  revokeAdminGrantWithAudit,\n} from '#db/admin-grants.js';\nimport {findAdministratorUser as findAdministratorUserInDb} from '#db/admin-users.js';\nimport {requireAdminRole} from './admin-role.js';\nimport type {AdminGrant} from './entities/admin-grant.js';\nimport type {\n  AdministratorGrantSummary,\n  AdministratorUserSummary,\n} from './entities/administrator-read-model.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from './errors.js';\n\nconst ADMIN_OWNER_ROLE: AdminRole = 'admin-owner';\nconst ADMIN_OBSERVER_ROLE: AdminRole = 'admin-observer';\nconst BOOTSTRAP_COMMAND = 'auth.admin_grant.bootstrap';\nconst GRANT_COMMAND = 'auth.admin_grant.grant';\nconst REVOKE_COMMAND = 'auth.admin_grant.revoke';\n\nexport function hashAdministrationValue(value: string): string {\n  return createHash('sha256').update(value).digest('hex');\n}\n\nexport function administrationCommandFingerprint(command: string, input: unknown): string {\n  return hashAdministrationValue(`${command}:${JSON.stringify(input)}`);\n}\n\nfunction bootstrapTokenMatches(candidate: string, expected: string | undefined): boolean {\n  if (!expected) return false;\n  const candidateHash = Buffer.from(hashAdministrationValue(candidate), 'hex');\n  const expectedHash = Buffer.from(hashAdministrationValue(expected), 'hex');\n  return timingSafeEqual(candidateHash, expectedHash);\n}\n\nfunction administrationEvent(params: {\n  actorId: string;\n  actorRole: AdminRole;\n  command: string;\n  targetType: string;\n  targetId: string;\n  reason: string;\n  correlationId: string;\n  idempotencyKeyFingerprint: string;\n}) {\n  return createAdministrationActionEvent({\n    actorId: params.actorId,\n    actorRole: params.actorRole,\n    requiredRole: ADMIN_OWNER_ROLE,\n    command: params.command,\n    targetType: params.targetType,\n    targetId: params.targetId,\n    reason: params.reason,\n    result: 'succeeded',\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    occurredAt: new Date().toISOString(),\n  });\n}\n\nexport interface AdministrationMutationContext {\n  actorId: string;\n  idempotencyKey: string;\n  correlationId: string;\n}\n\nexport async function bootstrapFirstAdminOwner(\n  params: AdministrationMutationContext & {bootstrapToken: string},\n): Promise<AdminGrant> {\n  if (!bootstrapTokenMatches(params.bootstrapToken, config.ADMIN_BOOTSTRAP_TOKEN)) {\n    throw new InvalidAdminBootstrapTokenError();\n  }\n\n  return await bootstrapFirstAdminOwnerInDb({\n    userId: params.actorId,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(BOOTSTRAP_COMMAND, {\n      actorId: params.actorId,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole: ADMIN_OWNER_ROLE,\n      command: BOOTSTRAP_COMMAND,\n      targetType: 'user',\n      targetId: params.actorId,\n      reason: 'Initial administrator owner bootstrap',\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function getAdminBootstrapState(): Promise<'available' | 'closed'> {\n  return (await hasActiveAdminOwner()) ? 'closed' : 'available';\n}\n\nexport async function findAdministratorUserSummary(\n  params: {actorId: string} & ({id: string; email?: never} | {email: string; id?: never}),\n): Promise<AdministratorUserSummary | undefined> {\n  await requireAdminRole({userId: params.actorId, minimumRole: ADMIN_OBSERVER_ROLE});\n\n  const user = await findAdministratorUserInDb(\n    'id' in params ? {id: params.id} : {email: params.email},\n  );\n  if (!user) return undefined;\n\n  return user;\n}\n\nexport async function listAdministratorGrantSummaries(params: {\n  actorId: string;\n  limit: number;\n  cursor?: TimestampIdCursor;\n}): Promise<{\n  grants: AdministratorGrantSummary[];\n  nextCursor: TimestampIdCursor | null;\n}> {\n  await requireAdminRole({userId: params.actorId, minimumRole: ADMIN_OBSERVER_ROLE});\n\n  const result = await listAdminGrantSummaries({\n    limit: params.limit,\n    ...(params.cursor ? {cursor: params.cursor} : {}),\n  });\n  return {\n    grants: result.rows.map((row) => ({\n      grantId: row.id,\n      role: row.role,\n      createdAt: row.createdAt,\n      revokedAt: row.revokedAt,\n      user: row.user,\n    })),\n    nextCursor: result.nextCursor,\n  };\n}\n\nexport async function grantAdministratorRole(\n  params: AdministrationMutationContext & {userId: string; role: AdminRole; reason: string},\n): Promise<AdminGrant> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OWNER_ROLE,\n  });\n  return await grantAdminRoleWithAudit({\n    userId: params.userId,\n    role: params.role,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(GRANT_COMMAND, {\n      userId: params.userId,\n      role: params.role,\n      reason: params.reason,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole,\n      command: GRANT_COMMAND,\n      targetType: 'user',\n      targetId: params.userId,\n      reason: params.reason,\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function revokeAdministratorGrant(\n  params: AdministrationMutationContext & {grantId: string; reason: string},\n): Promise<AdminGrant> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OWNER_ROLE,\n  });\n  return await revokeAdminGrantWithAudit({\n    grantId: params.grantId,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(REVOKE_COMMAND, {\n      grantId: params.grantId,\n      reason: params.reason,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole,\n      command: REVOKE_COMMAND,\n      targetType: 'admin-grant',\n      targetId: params.grantId,\n      reason: params.reason,\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashAdministrationValue(params.idempotencyKey),\n    }),\n  });\n}\n\nexport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n};\n"],"names":["createHash","timingSafeEqual","createAdministrationActionEvent","config","bootstrapFirstAdminOwner","bootstrapFirstAdminOwnerInDb","grantAdminRoleWithAudit","hasActiveAdminOwner","listAdminGrantSummaries","revokeAdminGrantWithAudit","findAdministratorUser","findAdministratorUserInDb","requireAdminRole","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","InvalidAdminBootstrapTokenError","LastAdminOwnerError","UserNotFoundError","ADMIN_OWNER_ROLE","ADMIN_OBSERVER_ROLE","BOOTSTRAP_COMMAND","GRANT_COMMAND","REVOKE_COMMAND","hashAdministrationValue","value","update","digest","administrationCommandFingerprint","command","input","JSON","stringify","bootstrapTokenMatches","candidate","expected","candidateHash","Buffer","from","expectedHash","administrationEvent","params","actorId","actorRole","requiredRole","targetType","targetId","reason","result","correlationId","idempotencyKeyFingerprint","occurredAt","Date","toISOString","bootstrapToken","ADMIN_BOOTSTRAP_TOKEN","userId","idempotencyKey","requestFingerprint","event","getAdminBootstrapState","findAdministratorUserSummary","minimumRole","user","id","email","undefined","listAdministratorGrantSummaries","limit","cursor","grants","rows","map","row","grantId","role","createdAt","revokedAt","nextCursor","grantAdministratorRole","revokeAdministratorGrant"],"mappings":"AAAA,SAAQA,UAAU,EAAEC,eAAe,QAAO,cAAc;AAExD,SAAQC,+BAA+B,QAAO,0BAA0B;AAExE,SAAQC,MAAM,QAAO,aAAa;AAClC,SACEC,4BAA4BC,4BAA4B,EACxDC,uBAAuB,EACvBC,mBAAmB,EACnBC,uBAAuB,EACvBC,yBAAyB,QACpB,sBAAsB;AAC7B,SAAQC,yBAAyBC,yBAAyB,QAAO,qBAAqB;AACtF,SAAQC,gBAAgB,QAAO,kBAAkB;AAMjD,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,QACZ,cAAc;AAErB,MAAMC,mBAA8B;AACpC,MAAMC,sBAAiC;AACvC,MAAMC,oBAAoB;AAC1B,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB;AAEvB,OAAO,SAASC,wBAAwBC,KAAa;IACnD,OAAO1B,WAAW,UAAU2B,MAAM,CAACD,OAAOE,MAAM,CAAC;AACnD;AAEA,OAAO,SAASC,iCAAiCC,OAAe,EAAEC,KAAc;IAC9E,OAAON,wBAAwB,GAAGK,QAAQ,CAAC,EAAEE,KAAKC,SAAS,CAACF,QAAQ;AACtE;AAEA,SAASG,sBAAsBC,SAAiB,EAAEC,QAA4B;IAC5E,IAAI,CAACA,UAAU,OAAO;IACtB,MAAMC,gBAAgBC,OAAOC,IAAI,CAACd,wBAAwBU,YAAY;IACtE,MAAMK,eAAeF,OAAOC,IAAI,CAACd,wBAAwBW,WAAW;IACpE,OAAOnC,gBAAgBoC,eAAeG;AACxC;AAEA,SAASC,oBAAoBC,MAS5B;IACC,OAAOxC,gCAAgC;QACrCyC,SAASD,OAAOC,OAAO;QACvBC,WAAWF,OAAOE,SAAS;QAC3BC,cAAczB;QACdU,SAASY,OAAOZ,OAAO;QACvBgB,YAAYJ,OAAOI,UAAU;QAC7BC,UAAUL,OAAOK,QAAQ;QACzBC,QAAQN,OAAOM,MAAM;QACrBC,QAAQ;QACRC,eAAeR,OAAOQ,aAAa;QACnCC,2BAA2BT,OAAOS,yBAAyB;QAC3DC,YAAY,IAAIC,OAAOC,WAAW;IACpC;AACF;AAQA,OAAO,eAAelD,yBACpBsC,MAAgE;IAEhE,IAAI,CAACR,sBAAsBQ,OAAOa,cAAc,EAAEpD,OAAOqD,qBAAqB,GAAG;QAC/E,MAAM,IAAIvC;IACZ;IAEA,OAAO,MAAMZ,6BAA6B;QACxCoD,QAAQf,OAAOC,OAAO;QACtBA,SAASD,OAAOC,OAAO;QACvBQ,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QACxEC,oBAAoB9B,iCAAiCP,mBAAmB;YACtEqB,SAASD,OAAOC,OAAO;QACzB;QACAiB,OAAOnB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC,WAAWxB;YACXU,SAASR;YACTwB,YAAY;YACZC,UAAUL,OAAOC,OAAO;YACxBK,QAAQ;YACRE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QAC1E;IACF;AACF;AAEA,OAAO,eAAeG;IACpB,OAAO,AAAC,MAAMtD,wBAAyB,WAAW;AACpD;AAEA,OAAO,eAAeuD,6BACpBpB,MAAuF;IAEvF,MAAM9B,iBAAiB;QAAC6C,QAAQf,OAAOC,OAAO;QAAEoB,aAAa1C;IAAmB;IAEhF,MAAM2C,OAAO,MAAMrD,0BACjB,QAAQ+B,SAAS;QAACuB,IAAIvB,OAAOuB,EAAE;IAAA,IAAI;QAACC,OAAOxB,OAAOwB,KAAK;IAAA;IAEzD,IAAI,CAACF,MAAM,OAAOG;IAElB,OAAOH;AACT;AAEA,OAAO,eAAeI,gCAAgC1B,MAIrD;IAIC,MAAM9B,iBAAiB;QAAC6C,QAAQf,OAAOC,OAAO;QAAEoB,aAAa1C;IAAmB;IAEhF,MAAM4B,SAAS,MAAMzC,wBAAwB;QAC3C6D,OAAO3B,OAAO2B,KAAK;QACnB,GAAI3B,OAAO4B,MAAM,GAAG;YAACA,QAAQ5B,OAAO4B,MAAM;QAAA,IAAI,CAAC,CAAC;IAClD;IACA,OAAO;QACLC,QAAQtB,OAAOuB,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gBAChCC,SAASD,IAAIT,EAAE;gBACfW,MAAMF,IAAIE,IAAI;gBACdC,WAAWH,IAAIG,SAAS;gBACxBC,WAAWJ,IAAII,SAAS;gBACxBd,MAAMU,IAAIV,IAAI;YAChB,CAAA;QACAe,YAAY9B,OAAO8B,UAAU;IAC/B;AACF;AAEA,OAAO,eAAeC,uBACpBtC,MAAyF;IAEzF,MAAME,YAAY,MAAMhC,iBAAiB;QACvC6C,QAAQf,OAAOC,OAAO;QACtBoB,aAAa3C;IACf;IACA,OAAO,MAAMd,wBAAwB;QACnCmD,QAAQf,OAAOe,MAAM;QACrBmB,MAAMlC,OAAOkC,IAAI;QACjBjC,SAASD,OAAOC,OAAO;QACvBQ,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QACxEC,oBAAoB9B,iCAAiCN,eAAe;YAClEkC,QAAQf,OAAOe,MAAM;YACrBmB,MAAMlC,OAAOkC,IAAI;YACjB5B,QAAQN,OAAOM,MAAM;QACvB;QACAY,OAAOnB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAd,SAASP;YACTuB,YAAY;YACZC,UAAUL,OAAOe,MAAM;YACvBT,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QAC1E;IACF;AACF;AAEA,OAAO,eAAeuB,yBACpBvC,MAAyE;IAEzE,MAAME,YAAY,MAAMhC,iBAAiB;QACvC6C,QAAQf,OAAOC,OAAO;QACtBoB,aAAa3C;IACf;IACA,OAAO,MAAMX,0BAA0B;QACrCkE,SAASjC,OAAOiC,OAAO;QACvBhC,SAASD,OAAOC,OAAO;QACvBQ,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QACxEC,oBAAoB9B,iCAAiCL,gBAAgB;YACnEmD,SAASjC,OAAOiC,OAAO;YACvB3B,QAAQN,OAAOM,MAAM;QACvB;QACAY,OAAOnB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAd,SAASN;YACTsB,YAAY;YACZC,UAAUL,OAAOiC,OAAO;YACxB3B,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2B1B,wBAAwBiB,OAAOgB,cAAc;QAC1E;IACF;AACF;AAEA,SACE7C,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,GACjB"}
+{"version":3,"sources":["../../src/core/administration.ts"],"sourcesContent":["import {timingSafeEqual} from 'node:crypto';\nimport type {AdminRole} from '@shipfox/api-auth-dto';\nimport {createAdministrationActionEvent} from '@shipfox/api-common-dto';\nimport type {TimestampIdCursor} from '@shipfox/node-drizzle';\nimport {hashOpaqueToken} from '@shipfox/node-tokens';\nimport {config} from '#config.js';\nimport {\n  bootstrapFirstAdminOwner as bootstrapFirstAdminOwnerInDb,\n  grantAdminRoleWithAudit,\n  hasActiveAdminOwner,\n  listAdminGrantSummaries,\n  revokeAdminGrantWithAudit,\n} from '#db/admin-grants.js';\nimport {\n  reactivateUserWithAudit,\n  revokeUserSessionsWithAudit,\n  suspendUserWithAudit,\n  type UserModerationResult,\n} from '#db/admin-user-moderation.js';\nimport {findAdministratorUser as findAdministratorUserInDb} from '#db/admin-users.js';\nimport {requireAdminRole} from './admin-role.js';\nimport type {AdminGrant} from './entities/admin-grant.js';\nimport type {\n  AdministratorGrantSummary,\n  AdministratorUserSummary,\n} from './entities/administrator-read-model.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from './errors.js';\n\nconst ADMIN_OWNER_ROLE: AdminRole = 'admin-owner';\nconst ADMIN_OBSERVER_ROLE: AdminRole = 'admin-observer';\nconst ADMIN_OPERATOR_ROLE: AdminRole = 'admin-operator';\nconst BOOTSTRAP_COMMAND = 'auth.admin_grant.bootstrap';\nconst GRANT_COMMAND = 'auth.admin_grant.grant';\nconst REVOKE_COMMAND = 'auth.admin_grant.revoke';\nconst SUSPEND_USER_COMMAND = 'auth.user.suspend';\nconst REACTIVATE_USER_COMMAND = 'auth.user.reactivate';\nconst REVOKE_USER_SESSIONS_COMMAND = 'auth.user.revoke-sessions';\n\nexport function administrationCommandFingerprint(command: string, input: unknown): string {\n  return hashOpaqueToken(`${command}:${JSON.stringify(input)}`);\n}\n\nfunction bootstrapTokenMatches(candidate: string, expected: string | undefined): boolean {\n  if (!expected) return false;\n  const candidateHash = Buffer.from(hashOpaqueToken(candidate), 'hex');\n  const expectedHash = Buffer.from(hashOpaqueToken(expected), 'hex');\n  return timingSafeEqual(candidateHash, expectedHash);\n}\n\nfunction administrationEvent(params: {\n  actorId: string;\n  actorRole: AdminRole;\n  command: string;\n  targetType: string;\n  targetId: string;\n  reason: string;\n  requiredRole?: AdminRole;\n  correlationId: string;\n  idempotencyKeyFingerprint: string;\n}) {\n  return createAdministrationActionEvent({\n    actorId: params.actorId,\n    actorRole: params.actorRole,\n    requiredRole: params.requiredRole ?? ADMIN_OWNER_ROLE,\n    command: params.command,\n    targetType: params.targetType,\n    targetId: params.targetId,\n    reason: params.reason,\n    result: 'succeeded',\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    occurredAt: new Date().toISOString(),\n  });\n}\n\nexport interface AdministrationMutationContext {\n  actorId: string;\n  idempotencyKey: string;\n  correlationId: string;\n}\n\nexport interface AdministratorUserMutationResult {\n  user: AdministratorUserSummary;\n  correlationId: string;\n  sessionsRevoked: number;\n}\n\nfunction toAdministratorUserMutationResult(\n  result: UserModerationResult,\n): AdministratorUserMutationResult {\n  return {\n    user: result.user,\n    correlationId: result.correlationId,\n    sessionsRevoked: result.sessionsRevoked,\n  };\n}\n\nexport async function bootstrapFirstAdminOwner(\n  params: AdministrationMutationContext & {bootstrapToken: string},\n): Promise<AdminGrant> {\n  if (!bootstrapTokenMatches(params.bootstrapToken, config.ADMIN_BOOTSTRAP_TOKEN)) {\n    throw new InvalidAdminBootstrapTokenError();\n  }\n\n  return await bootstrapFirstAdminOwnerInDb({\n    userId: params.actorId,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(BOOTSTRAP_COMMAND, {\n      actorId: params.actorId,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole: ADMIN_OWNER_ROLE,\n      command: BOOTSTRAP_COMMAND,\n      targetType: 'user',\n      targetId: params.actorId,\n      reason: 'Initial administrator owner bootstrap',\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function getAdminBootstrapState(): Promise<'available' | 'closed'> {\n  return (await hasActiveAdminOwner()) ? 'closed' : 'available';\n}\n\nexport async function findAdministratorUserSummary(\n  params: {actorId: string} & ({id: string; email?: never} | {email: string; id?: never}),\n): Promise<AdministratorUserSummary | undefined> {\n  await requireAdminRole({userId: params.actorId, minimumRole: ADMIN_OBSERVER_ROLE});\n\n  const user = await findAdministratorUserInDb(\n    'id' in params ? {id: params.id} : {email: params.email},\n  );\n  if (!user) return undefined;\n\n  return user;\n}\n\nexport async function listAdministratorGrantSummaries(params: {\n  actorId: string;\n  limit: number;\n  cursor?: TimestampIdCursor;\n}): Promise<{\n  grants: AdministratorGrantSummary[];\n  nextCursor: TimestampIdCursor | null;\n}> {\n  await requireAdminRole({userId: params.actorId, minimumRole: ADMIN_OBSERVER_ROLE});\n\n  const result = await listAdminGrantSummaries({\n    limit: params.limit,\n    ...(params.cursor ? {cursor: params.cursor} : {}),\n  });\n  return {\n    grants: result.rows.map((row) => ({\n      grantId: row.id,\n      role: row.role,\n      createdAt: row.createdAt,\n      revokedAt: row.revokedAt,\n      user: row.user,\n    })),\n    nextCursor: result.nextCursor,\n  };\n}\n\nexport async function grantAdministratorRole(\n  params: AdministrationMutationContext & {userId: string; role: AdminRole; reason: string},\n): Promise<AdminGrant> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OWNER_ROLE,\n  });\n  return await grantAdminRoleWithAudit({\n    userId: params.userId,\n    role: params.role,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(GRANT_COMMAND, {\n      userId: params.userId,\n      role: params.role,\n      reason: params.reason,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole,\n      command: GRANT_COMMAND,\n      targetType: 'user',\n      targetId: params.userId,\n      reason: params.reason,\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function revokeAdministratorGrant(\n  params: AdministrationMutationContext & {grantId: string; reason: string},\n): Promise<AdminGrant> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OWNER_ROLE,\n  });\n  return await revokeAdminGrantWithAudit({\n    grantId: params.grantId,\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    requestFingerprint: administrationCommandFingerprint(REVOKE_COMMAND, {\n      grantId: params.grantId,\n      reason: params.reason,\n    }),\n    event: administrationEvent({\n      actorId: params.actorId,\n      actorRole,\n      command: REVOKE_COMMAND,\n      targetType: 'admin-grant',\n      targetId: params.grantId,\n      reason: params.reason,\n      correlationId: params.correlationId,\n      idempotencyKeyFingerprint: hashOpaqueToken(params.idempotencyKey),\n    }),\n  });\n}\n\nexport async function suspendAdministratorUser(\n  params: AdministrationMutationContext & {userId: string; reason: string},\n): Promise<AdministratorUserMutationResult> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OPERATOR_ROLE,\n  });\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  return toAdministratorUserMutationResult(\n    await suspendUserWithAudit({\n      actorId: params.actorId,\n      userId: params.userId,\n      idempotencyKeyFingerprint,\n      requestFingerprint: administrationCommandFingerprint(SUSPEND_USER_COMMAND, {\n        userId: params.userId,\n        reason: params.reason,\n      }),\n      event: administrationEvent({\n        actorId: params.actorId,\n        actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: SUSPEND_USER_COMMAND,\n        targetType: 'user',\n        targetId: params.userId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n    }),\n  );\n}\n\nexport async function reactivateAdministratorUser(\n  params: AdministrationMutationContext & {userId: string; reason?: string},\n): Promise<AdministratorUserMutationResult> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OPERATOR_ROLE,\n  });\n  const reason = params.reason ?? 'User reactivation requested by an administrator';\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  return toAdministratorUserMutationResult(\n    await reactivateUserWithAudit({\n      actorId: params.actorId,\n      userId: params.userId,\n      idempotencyKeyFingerprint,\n      requestFingerprint: administrationCommandFingerprint(REACTIVATE_USER_COMMAND, {\n        userId: params.userId,\n        reason,\n      }),\n      event: administrationEvent({\n        actorId: params.actorId,\n        actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: REACTIVATE_USER_COMMAND,\n        targetType: 'user',\n        targetId: params.userId,\n        reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n    }),\n  );\n}\n\nexport async function revokeAdministratorUserSessions(\n  params: AdministrationMutationContext & {userId: string; reason?: string},\n): Promise<AdministratorUserMutationResult> {\n  const actorRole = await requireAdminRole({\n    userId: params.actorId,\n    minimumRole: ADMIN_OPERATOR_ROLE,\n  });\n  const reason = params.reason ?? 'All active user sessions revoked by an administrator';\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  return toAdministratorUserMutationResult(\n    await revokeUserSessionsWithAudit({\n      actorId: params.actorId,\n      userId: params.userId,\n      idempotencyKeyFingerprint,\n      requestFingerprint: administrationCommandFingerprint(REVOKE_USER_SESSIONS_COMMAND, {\n        userId: params.userId,\n        reason,\n      }),\n      event: administrationEvent({\n        actorId: params.actorId,\n        actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: REVOKE_USER_SESSIONS_COMMAND,\n        targetType: 'user',\n        targetId: params.userId,\n        reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n    }),\n  );\n}\n\nexport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n};\n"],"names":["timingSafeEqual","createAdministrationActionEvent","hashOpaqueToken","config","bootstrapFirstAdminOwner","bootstrapFirstAdminOwnerInDb","grantAdminRoleWithAudit","hasActiveAdminOwner","listAdminGrantSummaries","revokeAdminGrantWithAudit","reactivateUserWithAudit","revokeUserSessionsWithAudit","suspendUserWithAudit","findAdministratorUser","findAdministratorUserInDb","requireAdminRole","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","InvalidAdminBootstrapTokenError","LastAdminOwnerError","UserNotFoundError","ADMIN_OWNER_ROLE","ADMIN_OBSERVER_ROLE","ADMIN_OPERATOR_ROLE","BOOTSTRAP_COMMAND","GRANT_COMMAND","REVOKE_COMMAND","SUSPEND_USER_COMMAND","REACTIVATE_USER_COMMAND","REVOKE_USER_SESSIONS_COMMAND","administrationCommandFingerprint","command","input","JSON","stringify","bootstrapTokenMatches","candidate","expected","candidateHash","Buffer","from","expectedHash","administrationEvent","params","actorId","actorRole","requiredRole","targetType","targetId","reason","result","correlationId","idempotencyKeyFingerprint","occurredAt","Date","toISOString","toAdministratorUserMutationResult","user","sessionsRevoked","bootstrapToken","ADMIN_BOOTSTRAP_TOKEN","userId","idempotencyKey","requestFingerprint","event","getAdminBootstrapState","findAdministratorUserSummary","minimumRole","id","email","undefined","listAdministratorGrantSummaries","limit","cursor","grants","rows","map","row","grantId","role","createdAt","revokedAt","nextCursor","grantAdministratorRole","revokeAdministratorGrant","suspendAdministratorUser","reactivateAdministratorUser","revokeAdministratorUserSessions"],"mappings":"AAAA,SAAQA,eAAe,QAAO,cAAc;AAE5C,SAAQC,+BAA+B,QAAO,0BAA0B;AAExE,SAAQC,eAAe,QAAO,uBAAuB;AACrD,SAAQC,MAAM,QAAO,aAAa;AAClC,SACEC,4BAA4BC,4BAA4B,EACxDC,uBAAuB,EACvBC,mBAAmB,EACnBC,uBAAuB,EACvBC,yBAAyB,QACpB,sBAAsB;AAC7B,SACEC,uBAAuB,EACvBC,2BAA2B,EAC3BC,oBAAoB,QAEf,+BAA+B;AACtC,SAAQC,yBAAyBC,yBAAyB,QAAO,qBAAqB;AACtF,SAAQC,gBAAgB,QAAO,kBAAkB;AAMjD,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,QACZ,cAAc;AAErB,MAAMC,mBAA8B;AACpC,MAAMC,sBAAiC;AACvC,MAAMC,sBAAiC;AACvC,MAAMC,oBAAoB;AAC1B,MAAMC,gBAAgB;AACtB,MAAMC,iBAAiB;AACvB,MAAMC,uBAAuB;AAC7B,MAAMC,0BAA0B;AAChC,MAAMC,+BAA+B;AAErC,OAAO,SAASC,iCAAiCC,OAAe,EAAEC,KAAc;IAC9E,OAAOhC,gBAAgB,GAAG+B,QAAQ,CAAC,EAAEE,KAAKC,SAAS,CAACF,QAAQ;AAC9D;AAEA,SAASG,sBAAsBC,SAAiB,EAAEC,QAA4B;IAC5E,IAAI,CAACA,UAAU,OAAO;IACtB,MAAMC,gBAAgBC,OAAOC,IAAI,CAACxC,gBAAgBoC,YAAY;IAC9D,MAAMK,eAAeF,OAAOC,IAAI,CAACxC,gBAAgBqC,WAAW;IAC5D,OAAOvC,gBAAgBwC,eAAeG;AACxC;AAEA,SAASC,oBAAoBC,MAU5B;IACC,OAAO5C,gCAAgC;QACrC6C,SAASD,OAAOC,OAAO;QACvBC,WAAWF,OAAOE,SAAS;QAC3BC,cAAcH,OAAOG,YAAY,IAAIzB;QACrCU,SAASY,OAAOZ,OAAO;QACvBgB,YAAYJ,OAAOI,UAAU;QAC7BC,UAAUL,OAAOK,QAAQ;QACzBC,QAAQN,OAAOM,MAAM;QACrBC,QAAQ;QACRC,eAAeR,OAAOQ,aAAa;QACnCC,2BAA2BT,OAAOS,yBAAyB;QAC3DC,YAAY,IAAIC,OAAOC,WAAW;IACpC;AACF;AAcA,SAASC,kCACPN,MAA4B;IAE5B,OAAO;QACLO,MAAMP,OAAOO,IAAI;QACjBN,eAAeD,OAAOC,aAAa;QACnCO,iBAAiBR,OAAOQ,eAAe;IACzC;AACF;AAEA,OAAO,eAAexD,yBACpByC,MAAgE;IAEhE,IAAI,CAACR,sBAAsBQ,OAAOgB,cAAc,EAAE1D,OAAO2D,qBAAqB,GAAG;QAC/E,MAAM,IAAI1C;IACZ;IAEA,OAAO,MAAMf,6BAA6B;QACxC0D,QAAQlB,OAAOC,OAAO;QACtBA,SAASD,OAAOC,OAAO;QACvBQ,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAChEC,oBAAoBjC,iCAAiCN,mBAAmB;YACtEoB,SAASD,OAAOC,OAAO;QACzB;QACAoB,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC,WAAWxB;YACXU,SAASP;YACTuB,YAAY;YACZC,UAAUL,OAAOC,OAAO;YACxBK,QAAQ;YACRE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAClE;IACF;AACF;AAEA,OAAO,eAAeG;IACpB,OAAO,AAAC,MAAM5D,wBAAyB,WAAW;AACpD;AAEA,OAAO,eAAe6D,6BACpBvB,MAAuF;IAEvF,MAAM9B,iBAAiB;QAACgD,QAAQlB,OAAOC,OAAO;QAAEuB,aAAa7C;IAAmB;IAEhF,MAAMmC,OAAO,MAAM7C,0BACjB,QAAQ+B,SAAS;QAACyB,IAAIzB,OAAOyB,EAAE;IAAA,IAAI;QAACC,OAAO1B,OAAO0B,KAAK;IAAA;IAEzD,IAAI,CAACZ,MAAM,OAAOa;IAElB,OAAOb;AACT;AAEA,OAAO,eAAec,gCAAgC5B,MAIrD;IAIC,MAAM9B,iBAAiB;QAACgD,QAAQlB,OAAOC,OAAO;QAAEuB,aAAa7C;IAAmB;IAEhF,MAAM4B,SAAS,MAAM5C,wBAAwB;QAC3CkE,OAAO7B,OAAO6B,KAAK;QACnB,GAAI7B,OAAO8B,MAAM,GAAG;YAACA,QAAQ9B,OAAO8B,MAAM;QAAA,IAAI,CAAC,CAAC;IAClD;IACA,OAAO;QACLC,QAAQxB,OAAOyB,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gBAChCC,SAASD,IAAIT,EAAE;gBACfW,MAAMF,IAAIE,IAAI;gBACdC,WAAWH,IAAIG,SAAS;gBACxBC,WAAWJ,IAAII,SAAS;gBACxBxB,MAAMoB,IAAIpB,IAAI;YAChB,CAAA;QACAyB,YAAYhC,OAAOgC,UAAU;IAC/B;AACF;AAEA,OAAO,eAAeC,uBACpBxC,MAAyF;IAEzF,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa9C;IACf;IACA,OAAO,MAAMjB,wBAAwB;QACnCyD,QAAQlB,OAAOkB,MAAM;QACrBkB,MAAMpC,OAAOoC,IAAI;QACjBnC,SAASD,OAAOC,OAAO;QACvBQ,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAChEC,oBAAoBjC,iCAAiCL,eAAe;YAClEoC,QAAQlB,OAAOkB,MAAM;YACrBkB,MAAMpC,OAAOoC,IAAI;YACjB9B,QAAQN,OAAOM,MAAM;QACvB;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAd,SAASN;YACTsB,YAAY;YACZC,UAAUL,OAAOkB,MAAM;YACvBZ,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAClE;IACF;AACF;AAEA,OAAO,eAAesB,yBACpBzC,MAAyE;IAEzE,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa9C;IACf;IACA,OAAO,MAAMd,0BAA0B;QACrCuE,SAASnC,OAAOmC,OAAO;QACvBlC,SAASD,OAAOC,OAAO;QACvBQ,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAChEC,oBAAoBjC,iCAAiCJ,gBAAgB;YACnEoD,SAASnC,OAAOmC,OAAO;YACvB7B,QAAQN,OAAOM,MAAM;QACvB;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAd,SAASL;YACTqB,YAAY;YACZC,UAAUL,OAAOmC,OAAO;YACxB7B,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC,2BAA2BpD,gBAAgB2C,OAAOmB,cAAc;QAClE;IACF;AACF;AAEA,OAAO,eAAeuB,yBACpB1C,MAAwE;IAExE,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa5C;IACf;IACA,MAAM6B,4BAA4BpD,gBAAgB2C,OAAOmB,cAAc;IACvE,OAAON,kCACL,MAAM9C,qBAAqB;QACzBkC,SAASD,OAAOC,OAAO;QACvBiB,QAAQlB,OAAOkB,MAAM;QACrBT;QACAW,oBAAoBjC,iCAAiCH,sBAAsB;YACzEkC,QAAQlB,OAAOkB,MAAM;YACrBZ,QAAQN,OAAOM,MAAM;QACvB;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAC,cAAcvB;YACdQ,SAASJ;YACToB,YAAY;YACZC,UAAUL,OAAOkB,MAAM;YACvBZ,QAAQN,OAAOM,MAAM;YACrBE,eAAeR,OAAOQ,aAAa;YACnCC;QACF;IACF;AAEJ;AAEA,OAAO,eAAekC,4BACpB3C,MAAyE;IAEzE,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa5C;IACf;IACA,MAAM0B,SAASN,OAAOM,MAAM,IAAI;IAChC,MAAMG,4BAA4BpD,gBAAgB2C,OAAOmB,cAAc;IACvE,OAAON,kCACL,MAAMhD,wBAAwB;QAC5BoC,SAASD,OAAOC,OAAO;QACvBiB,QAAQlB,OAAOkB,MAAM;QACrBT;QACAW,oBAAoBjC,iCAAiCF,yBAAyB;YAC5EiC,QAAQlB,OAAOkB,MAAM;YACrBZ;QACF;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAC,cAAcvB;YACdQ,SAASH;YACTmB,YAAY;YACZC,UAAUL,OAAOkB,MAAM;YACvBZ;YACAE,eAAeR,OAAOQ,aAAa;YACnCC;QACF;IACF;AAEJ;AAEA,OAAO,eAAemC,gCACpB5C,MAAyE;IAEzE,MAAME,YAAY,MAAMhC,iBAAiB;QACvCgD,QAAQlB,OAAOC,OAAO;QACtBuB,aAAa5C;IACf;IACA,MAAM0B,SAASN,OAAOM,MAAM,IAAI;IAChC,MAAMG,4BAA4BpD,gBAAgB2C,OAAOmB,cAAc;IACvE,OAAON,kCACL,MAAM/C,4BAA4B;QAChCmC,SAASD,OAAOC,OAAO;QACvBiB,QAAQlB,OAAOkB,MAAM;QACrBT;QACAW,oBAAoBjC,iCAAiCD,8BAA8B;YACjFgC,QAAQlB,OAAOkB,MAAM;YACrBZ;QACF;QACAe,OAAOtB,oBAAoB;YACzBE,SAASD,OAAOC,OAAO;YACvBC;YACAC,cAAcvB;YACdQ,SAASF;YACTkB,YAAY;YACZC,UAAUL,OAAOkB,MAAM;YACvBZ;YACAE,eAAeR,OAAOQ,aAAa;YACnCC;QACF;IACF;AAEJ;AAEA,SACEtC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,GACjB"}

package/dist/core/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,SAAS,EAAc,MAAM,uBAAuB,CAAC;AAOlE,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,0CAA0C,CAAC;AAyBlD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EAErB,uBAAuB,EAMvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,YAAY,CAAC;AAkI7C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9E;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAChC,cAAc,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,IAAI,CAAA;KAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CA8C9F;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA2B,SAAQ,WAAW;IAC7D,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IACrE,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAiErC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAwBrE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAoBrC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoDpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAqB1C;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBtC;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAO5F"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,SAAS,EAAc,MAAM,uBAAuB,CAAC;AAOlE,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,0CAA0C,CAAC;AAyBlD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EAErB,uBAAuB,EAMvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,YAAY,CAAC;AA6I7C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9E;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAChC,cAAc,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,IAAI,CAAA;KAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CA8C9F;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA2B,SAAQ,WAAW;IAC7D,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IACrE,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAiErC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAwBrE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAoBrC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA+DpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAqB1C;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBtC;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAO5F"}

package/dist/core/auth.js

@@ -6,7 +6,7 @@ import { userAccessTokenKey } from '@shipfox/node-auth-root-key';
 import { generateOpaqueToken, hashOpaqueToken } from '@shipfox/node-tokens';
 import { config } from '#config.js';
 import { consumePasswordReset, createPasswordReset } from '#db/password-resets.js';
-import { createRefreshToken, findActiveRefreshTokenByHash, findRefreshTokenByHash, revokeRefreshSession, revokeRefreshTokensForUser, rotateRefreshToken } from '#db/refresh-tokens.js';
+import { createRefreshTokenForActiveUser, findActiveRefreshTokenByHash, findRefreshTokenByHash, revokeRefreshSession, revokeRefreshTokensForUser, rotateRefreshToken } from '#db/refresh-tokens.js';
 import { createUser as createDbUser, findUserByEmail, findUserById, markEmailVerified, provisionUser as provisionDbUser, updateUserPassword } from '#db/users.js';
 import { recordTokenRefreshed } from '#metrics/index.js';
 import { getCurrentAdminRole } from './admin-role.js';
@@ -46,17 +46,20 @@ function daysFromNow(days) {
 function recordRefreshOutcome(outcome) {
     recordTokenRefreshed(outcome);
 }
-async function signAccessToken(user, workspaces, refreshSessionId) {
+async function loadTokenMemberships(userId, workspaces) {
     const memberships = await workspaces.listMembershipsForTokenClaims({
-        userId: user.id
+        userId
     }).catch((error)=>{
         throw new AuthDependencyUnavailableError('workspaces', error);
     });
+    return memberships.memberships;
+}
+async function signAccessToken(user, memberships, refreshSessionId) {
     return await signUserToken({
         userId: user.id,
         email: user.email,
         name: user.name,
-        memberships: memberships.memberships,
+        memberships,
         refreshSessionId,
         secret: userAccessTokenKey(),
         expiresIn: config.AUTH_JWT_EXPIRES_IN
@@ -69,12 +72,13 @@ function isWithinRotationGrace(refreshToken) {
 }
 async function createRefreshSession(user, refreshSessionId) {
     const refreshToken = generateOpaqueToken('refreshToken');
-    const session = await createRefreshToken({
+    const session = await createRefreshTokenForActiveUser({
         sessionId: refreshSessionId,
         userId: user.id,
         hashedToken: hashOpaqueToken(refreshToken),
         expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS)
     });
+    if (!session) throw new InvalidCredentialsError();
     return {
         refreshToken,
         refreshSessionId: session.sessionId
@@ -82,7 +86,8 @@ async function createRefreshSession(user, refreshSessionId) {
 }
 async function createSessionTokens(user, workspaces) {
     const refreshSessionId = crypto.randomUUID();
-    const token = await signAccessToken(user, workspaces, refreshSessionId);
+    const memberships = await loadTokenMemberships(user.id, workspaces);
+    const token = await signAccessToken(user, memberships, refreshSessionId);
     const adminRole = await getCurrentAdminRole({
         userId: user.id
     });
@@ -247,7 +252,7 @@ export async function signupWithInvitation(params) {
             };
         }
     }
-    // Step 4: Issue session. signAccessToken reads memberships through the
+    // Step 4: Issue session. createSessionTokens reads memberships through the
     // workspaces module API, so a successful accept is reflected in the JWT.
     const { token, refreshToken, adminRole } = await createSessionTokens(user, params.workspaces);
     if (acceptError) {
@@ -366,7 +371,8 @@ export async function refreshAccessToken(params) {
     // second tab); past it, reuse of a retired token means a compromised session.
     if (current.rotatedAt) {
         if (isWithinRotationGrace(current)) {
-            const token = await signAccessToken(user, params.workspaces, current.sessionId);
+            const memberships = await loadTokenMemberships(user.id, params.workspaces);
+            const token = await signAccessToken(user, memberships, current.sessionId);
             recordRefreshOutcome('grace');
             return {
                 token,
@@ -381,16 +387,27 @@ export async function refreshAccessToken(params) {
         recordRefreshOutcome('rejected');
         throw new TokenInvalidError('Refresh token reused after rotation');
     }
+    // Keep the external membership snapshot ahead of rotation so an outage
+    // cannot retire a refresh token that the caller can still retry.
+    const memberships = await loadTokenMemberships(user.id, params.workspaces);
     // Losing the CAS requires a state check: another request may have rotated,
     // revoked, or expired the token before this refresh could claim it.
     const nextRefreshToken = generateOpaqueToken('refreshToken');
     const rotated = await rotateRefreshToken({
+        userId: current.userId,
         id: current.id,
         currentHashedToken,
         nextHashedToken: hashOpaqueToken(nextRefreshToken),
         expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS)
     });
     if (!rotated) {
+        const latestUser = await findUserById({
+            id: current.userId
+        });
+        if (latestUser?.status !== 'active') {
+            recordRefreshOutcome('rejected');
+            throw new TokenInvalidError('Refresh token is invalid or expired');
+        }
         const latest = await findRefreshTokenByHash({
             hashedToken: currentHashedToken
         });
@@ -398,7 +415,7 @@ export async function refreshAccessToken(params) {
             recordRefreshOutcome('rejected');
             throw new TokenInvalidError('Refresh token is invalid or expired');
         }
-        const token = await signAccessToken(user, params.workspaces, latest.sessionId);
+        const token = await signAccessToken(user, memberships, latest.sessionId);
         recordRefreshOutcome('grace');
         return {
             token,
@@ -407,7 +424,7 @@ export async function refreshAccessToken(params) {
             adminRole
         };
     }
-    const token = await signAccessToken(user, params.workspaces, current.sessionId);
+    const token = await signAccessToken(user, memberships, current.sessionId);
     recordRefreshOutcome('rotated');
     return {
         token,