@shipfox/api-auth 10.1.0 → 11.0.0

package/dist/db/admin-user-moderation.js

@@ -0,0 +1,156 @@
+import { and, eq, gt, isNull, sql } from 'drizzle-orm';
+import { hasMinimumAdminRole, highestAdminRole } from '#core/admin-role-model.js';
+import { AdminRoleRequiredError, LastAdminOwnerError, UserNotFoundError } from '#core/errors.js';
+import { findAdminCommandResult, lockAdminCommand, lockAdminOwnerGrants, storeAdminCommandResult, writeAdminAction } from './admin-command.js';
+import { findAdministratorUserSummary } from './admin-user-summary.js';
+import { db } from './db.js';
+import { lockUserSessionMutations } from './refresh-tokens.js';
+import { adminGrants } from './schema/admin-grants.js';
+import { refreshTokens } from './schema/refresh-tokens.js';
+import { users } from './schema/users.js';
+function toStoredUserSummary(user) {
+    return {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        emailVerifiedAt: user.emailVerifiedAt?.toISOString() ?? null,
+        status: user.status,
+        createdAt: user.createdAt.toISOString(),
+        adminRole: user.adminRole
+    };
+}
+async function findUserSummary(tx, userId) {
+    const user = await findAdministratorUserSummary(tx, {
+        id: userId
+    });
+    if (!user) throw new Error('User summary query returned no rows');
+    return toStoredUserSummary(user);
+}
+function fromStoredResult(result) {
+    return {
+        user: {
+            id: result.user.id,
+            email: result.user.email,
+            name: result.user.name,
+            emailVerifiedAt: result.user.emailVerifiedAt ? new Date(result.user.emailVerifiedAt) : null,
+            status: result.user.status,
+            createdAt: new Date(result.user.createdAt),
+            adminRole: result.user.adminRole
+        },
+        correlationId: result.correlationId,
+        sessionsRevoked: result.sessionsRevoked
+    };
+}
+async function findCommandResult(tx, params) {
+    const result = await findAdminCommandResult(tx, params);
+    if (!result) return undefined;
+    if (!('userModeration' in result.result)) {
+        throw new Error('Administrator command result has an unexpected shape');
+    }
+    return fromStoredResult(result.result.userModeration);
+}
+async function storeCommandResult(tx, params, result) {
+    await storeAdminCommandResult(tx, params, {
+        userModeration: result
+    });
+}
+async function readTargetUserForUpdate(tx, userId) {
+    const rows = await tx.select({
+        id: users.id,
+        status: users.status
+    }).from(users).where(eq(users.id, userId)).limit(1).for('update');
+    const user = rows[0];
+    if (!user || user.status === 'deleted') throw new UserNotFoundError(userId);
+    return user;
+}
+async function requireActiveAdminOperator(tx, actorId) {
+    const actorRows = await tx.select({
+        status: users.status
+    }).from(users).where(eq(users.id, actorId)).limit(1);
+    const actor = actorRows[0];
+    const grants = await tx.select({
+        role: adminGrants.role
+    }).from(adminGrants).where(and(eq(adminGrants.userId, actorId), isNull(adminGrants.revokedAt)));
+    const role = highestAdminRole(grants.map(({ role })=>role));
+    if (actor?.status !== 'active' || !role || !hasMinimumAdminRole(role, 'admin-operator')) {
+        throw new AdminRoleRequiredError('admin-operator');
+    }
+}
+async function revokeActiveSessions(tx, userId) {
+    const revoked = await tx.update(refreshTokens).set({
+        revokedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(refreshTokens.userId, userId), isNull(refreshTokens.revokedAt), gt(refreshTokens.expiresAt, sql`now()`))).returning({
+        sessionId: refreshTokens.sessionId
+    });
+    return new Set(revoked.map(({ sessionId })=>sessionId)).size;
+}
+async function executeUserModerationCommand(params) {
+    return await db().transaction(async (tx)=>{
+        await lockAdminCommand(tx, params);
+        if (params.operation === 'suspend') await lockAdminOwnerGrants(tx);
+        const existing = await findCommandResult(tx, {
+            ...params,
+            command: params.event.command
+        });
+        if (existing) return existing;
+        await lockUserSessionMutations(tx, params.userId);
+        const user = await readTargetUserForUpdate(tx, params.userId);
+        await requireActiveAdminOperator(tx, params.actorId);
+        let sessionsRevoked = 0;
+        if (params.operation === 'suspend') {
+            if (user.status === 'active') {
+                const activeOwners = await tx.select({
+                    id: adminGrants.id
+                }).from(adminGrants).innerJoin(users, eq(adminGrants.userId, users.id)).where(and(eq(adminGrants.role, 'admin-owner'), isNull(adminGrants.revokedAt), eq(users.status, 'active'))).limit(2);
+                const targetIsActiveOwner = await tx.select({
+                    id: adminGrants.id
+                }).from(adminGrants).where(and(eq(adminGrants.userId, user.id), eq(adminGrants.role, 'admin-owner'), isNull(adminGrants.revokedAt))).limit(1);
+                if (targetIsActiveOwner.length > 0 && activeOwners.length <= 1) {
+                    throw new LastAdminOwnerError();
+                }
+                await tx.update(users).set({
+                    status: 'suspended',
+                    updatedAt: sql`now()`
+                }).where(eq(users.id, user.id));
+            }
+            sessionsRevoked = await revokeActiveSessions(tx, user.id);
+        } else if (params.operation === 'reactivate' && user.status === 'suspended') {
+            await tx.update(users).set({
+                status: 'active',
+                updatedAt: sql`now()`
+            }).where(eq(users.id, user.id));
+        } else if (params.operation === 'revoke-sessions') {
+            sessionsRevoked = await revokeActiveSessions(tx, user.id);
+        }
+        const summary = await findUserSummary(tx, user.id);
+        const result = {
+            user: summary,
+            correlationId: params.event.correlationId,
+            sessionsRevoked
+        };
+        await writeAdminAction(tx, params.event);
+        await storeCommandResult(tx, params, result);
+        return fromStoredResult(result);
+    });
+}
+export async function suspendUserWithAudit(params) {
+    return await executeUserModerationCommand({
+        ...params,
+        operation: 'suspend'
+    });
+}
+export async function reactivateUserWithAudit(params) {
+    return await executeUserModerationCommand({
+        ...params,
+        operation: 'reactivate'
+    });
+}
+export async function revokeUserSessionsWithAudit(params) {
+    return await executeUserModerationCommand({
+        ...params,
+        operation: 'revoke-sessions'
+    });
+}
+
+//# sourceMappingURL=admin-user-moderation.js.map

package/dist/db/admin-user-moderation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/admin-user-moderation.ts"],"sourcesContent":["import type {AdministrationActionEvent} from '@shipfox/api-common-dto';\nimport {and, eq, gt, isNull, sql} from 'drizzle-orm';\nimport {hasMinimumAdminRole, highestAdminRole} from '#core/admin-role-model.js';\nimport type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';\nimport {AdminRoleRequiredError, LastAdminOwnerError, UserNotFoundError} from '#core/errors.js';\nimport {\n  findAdminCommandResult,\n  lockAdminCommand,\n  lockAdminOwnerGrants,\n  storeAdminCommandResult,\n  type Tx,\n  writeAdminAction,\n} from './admin-command.js';\nimport {findAdministratorUserSummary} from './admin-user-summary.js';\nimport {db} from './db.js';\nimport {lockUserSessionMutations} from './refresh-tokens.js';\nimport type {\n  StoredAdministratorUserSummary,\n  StoredAdminUserModerationResult,\n} from './schema/admin-command-results.js';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\ninterface UserModerationCommandParams {\n  actorId: string;\n  userId: string;\n  idempotencyKeyFingerprint: string;\n  requestFingerprint: string;\n  event: AdministrationActionEvent;\n}\n\nfunction toStoredUserSummary(user: AdministratorUserSummary): StoredAdministratorUserSummary {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    emailVerifiedAt: user.emailVerifiedAt?.toISOString() ?? null,\n    status: user.status,\n    createdAt: user.createdAt.toISOString(),\n    adminRole: user.adminRole,\n  };\n}\n\nasync function findUserSummary(tx: Tx, userId: string): Promise<StoredAdministratorUserSummary> {\n  const user = await findAdministratorUserSummary(tx, {id: userId});\n  if (!user) throw new Error('User summary query returned no rows');\n  return toStoredUserSummary(user);\n}\n\nfunction fromStoredResult(result: StoredAdminUserModerationResult) {\n  return {\n    user: {\n      id: result.user.id,\n      email: result.user.email,\n      name: result.user.name,\n      emailVerifiedAt: result.user.emailVerifiedAt ? new Date(result.user.emailVerifiedAt) : null,\n      status: result.user.status,\n      createdAt: new Date(result.user.createdAt),\n      adminRole: result.user.adminRole,\n    },\n    correlationId: result.correlationId,\n    sessionsRevoked: result.sessionsRevoked,\n  };\n}\n\nasync function findCommandResult(\n  tx: Tx,\n  params: Pick<\n    UserModerationCommandParams,\n    'actorId' | 'idempotencyKeyFingerprint' | 'requestFingerprint'\n  > & {command: string},\n) {\n  const result = await findAdminCommandResult(tx, params);\n  if (!result) return undefined;\n  if (!('userModeration' in result.result)) {\n    throw new Error('Administrator command result has an unexpected shape');\n  }\n  return fromStoredResult(result.result.userModeration);\n}\n\nasync function storeCommandResult(\n  tx: Tx,\n  params: UserModerationCommandParams,\n  result: StoredAdminUserModerationResult,\n): Promise<void> {\n  await storeAdminCommandResult(tx, params, {userModeration: result});\n}\n\nasync function readTargetUserForUpdate(tx: Tx, userId: string) {\n  const rows = await tx\n    .select({id: users.id, status: users.status})\n    .from(users)\n    .where(eq(users.id, userId))\n    .limit(1)\n    .for('update');\n  const user = rows[0];\n  if (!user || user.status === 'deleted') throw new UserNotFoundError(userId);\n  return user;\n}\n\nasync function requireActiveAdminOperator(tx: Tx, actorId: string): Promise<void> {\n  const actorRows = await tx\n    .select({status: users.status})\n    .from(users)\n    .where(eq(users.id, actorId))\n    .limit(1);\n  const actor = actorRows[0];\n  const grants = await tx\n    .select({role: adminGrants.role})\n    .from(adminGrants)\n    .where(and(eq(adminGrants.userId, actorId), isNull(adminGrants.revokedAt)));\n  const role = highestAdminRole(grants.map(({role}) => role));\n\n  if (actor?.status !== 'active' || !role || !hasMinimumAdminRole(role, 'admin-operator')) {\n    throw new AdminRoleRequiredError('admin-operator');\n  }\n}\n\nasync function revokeActiveSessions(tx: Tx, userId: string): Promise<number> {\n  const revoked = await tx\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.userId, userId),\n        isNull(refreshTokens.revokedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .returning({sessionId: refreshTokens.sessionId});\n\n  return new Set(revoked.map(({sessionId}) => sessionId)).size;\n}\n\nasync function executeUserModerationCommand(\n  params: UserModerationCommandParams & {\n    operation: 'suspend' | 'reactivate' | 'revoke-sessions';\n  },\n) {\n  return await db().transaction(async (tx) => {\n    await lockAdminCommand(tx, params);\n    if (params.operation === 'suspend') await lockAdminOwnerGrants(tx);\n\n    const existing = await findCommandResult(tx, {\n      ...params,\n      command: params.event.command,\n    });\n    if (existing) return existing;\n\n    await lockUserSessionMutations(tx, params.userId);\n    const user = await readTargetUserForUpdate(tx, params.userId);\n    await requireActiveAdminOperator(tx, params.actorId);\n    let sessionsRevoked = 0;\n\n    if (params.operation === 'suspend') {\n      if (user.status === 'active') {\n        const activeOwners = await tx\n          .select({id: adminGrants.id})\n          .from(adminGrants)\n          .innerJoin(users, eq(adminGrants.userId, users.id))\n          .where(\n            and(\n              eq(adminGrants.role, 'admin-owner'),\n              isNull(adminGrants.revokedAt),\n              eq(users.status, 'active'),\n            ),\n          )\n          .limit(2);\n        const targetIsActiveOwner = await tx\n          .select({id: adminGrants.id})\n          .from(adminGrants)\n          .where(\n            and(\n              eq(adminGrants.userId, user.id),\n              eq(adminGrants.role, 'admin-owner'),\n              isNull(adminGrants.revokedAt),\n            ),\n          )\n          .limit(1);\n        if (targetIsActiveOwner.length > 0 && activeOwners.length <= 1) {\n          throw new LastAdminOwnerError();\n        }\n\n        await tx\n          .update(users)\n          .set({status: 'suspended', updatedAt: sql`now()`})\n          .where(eq(users.id, user.id));\n      }\n      sessionsRevoked = await revokeActiveSessions(tx, user.id);\n    } else if (params.operation === 'reactivate' && user.status === 'suspended') {\n      await tx\n        .update(users)\n        .set({status: 'active', updatedAt: sql`now()`})\n        .where(eq(users.id, user.id));\n    } else if (params.operation === 'revoke-sessions') {\n      sessionsRevoked = await revokeActiveSessions(tx, user.id);\n    }\n\n    const summary = await findUserSummary(tx, user.id);\n    const result: StoredAdminUserModerationResult = {\n      user: summary,\n      correlationId: params.event.correlationId,\n      sessionsRevoked,\n    };\n    await writeAdminAction(tx, params.event);\n    await storeCommandResult(tx, params, result);\n    return fromStoredResult(result);\n  });\n}\n\nexport type UserModerationResult = Awaited<ReturnType<typeof executeUserModerationCommand>>;\n\nexport async function suspendUserWithAudit(\n  params: UserModerationCommandParams,\n): Promise<UserModerationResult> {\n  return await executeUserModerationCommand({...params, operation: 'suspend'});\n}\n\nexport async function reactivateUserWithAudit(\n  params: UserModerationCommandParams,\n): Promise<UserModerationResult> {\n  return await executeUserModerationCommand({...params, operation: 'reactivate'});\n}\n\nexport async function revokeUserSessionsWithAudit(\n  params: UserModerationCommandParams,\n): Promise<UserModerationResult> {\n  return await executeUserModerationCommand({...params, operation: 'revoke-sessions'});\n}\n"],"names":["and","eq","gt","isNull","sql","hasMinimumAdminRole","highestAdminRole","AdminRoleRequiredError","LastAdminOwnerError","UserNotFoundError","findAdminCommandResult","lockAdminCommand","lockAdminOwnerGrants","storeAdminCommandResult","writeAdminAction","findAdministratorUserSummary","db","lockUserSessionMutations","adminGrants","refreshTokens","users","toStoredUserSummary","user","id","email","name","emailVerifiedAt","toISOString","status","createdAt","adminRole","findUserSummary","tx","userId","Error","fromStoredResult","result","Date","correlationId","sessionsRevoked","findCommandResult","params","undefined","userModeration","storeCommandResult","readTargetUserForUpdate","rows","select","from","where","limit","for","requireActiveAdminOperator","actorId","actorRows","actor","grants","role","revokedAt","map","revokeActiveSessions","revoked","update","set","updatedAt","expiresAt","returning","sessionId","Set","size","executeUserModerationCommand","transaction","operation","existing","command","event","activeOwners","innerJoin","targetIsActiveOwner","length","summary","suspendUserWithAudit","reactivateUserWithAudit","revokeUserSessionsWithAudit"],"mappings":"AACA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AACrD,SAAQC,mBAAmB,EAAEC,gBAAgB,QAAO,4BAA4B;AAEhF,SAAQC,sBAAsB,EAAEC,mBAAmB,EAAEC,iBAAiB,QAAO,kBAAkB;AAC/F,SACEC,sBAAsB,EACtBC,gBAAgB,EAChBC,oBAAoB,EACpBC,uBAAuB,EAEvBC,gBAAgB,QACX,qBAAqB;AAC5B,SAAQC,4BAA4B,QAAO,0BAA0B;AACrE,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,wBAAwB,QAAO,sBAAsB;AAK7D,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAUxC,SAASC,oBAAoBC,IAA8B;IACzD,OAAO;QACLC,IAAID,KAAKC,EAAE;QACXC,OAAOF,KAAKE,KAAK;QACjBC,MAAMH,KAAKG,IAAI;QACfC,iBAAiBJ,KAAKI,eAAe,EAAEC,iBAAiB;QACxDC,QAAQN,KAAKM,MAAM;QACnBC,WAAWP,KAAKO,SAAS,CAACF,WAAW;QACrCG,WAAWR,KAAKQ,SAAS;IAC3B;AACF;AAEA,eAAeC,gBAAgBC,EAAM,EAAEC,MAAc;IACnD,MAAMX,OAAO,MAAMP,6BAA6BiB,IAAI;QAACT,IAAIU;IAAM;IAC/D,IAAI,CAACX,MAAM,MAAM,IAAIY,MAAM;IAC3B,OAAOb,oBAAoBC;AAC7B;AAEA,SAASa,iBAAiBC,MAAuC;IAC/D,OAAO;QACLd,MAAM;YACJC,IAAIa,OAAOd,IAAI,CAACC,EAAE;YAClBC,OAAOY,OAAOd,IAAI,CAACE,KAAK;YACxBC,MAAMW,OAAOd,IAAI,CAACG,IAAI;YACtBC,iBAAiBU,OAAOd,IAAI,CAACI,eAAe,GAAG,IAAIW,KAAKD,OAAOd,IAAI,CAACI,eAAe,IAAI;YACvFE,QAAQQ,OAAOd,IAAI,CAACM,MAAM;YAC1BC,WAAW,IAAIQ,KAAKD,OAAOd,IAAI,CAACO,SAAS;YACzCC,WAAWM,OAAOd,IAAI,CAACQ,SAAS;QAClC;QACAQ,eAAeF,OAAOE,aAAa;QACnCC,iBAAiBH,OAAOG,eAAe;IACzC;AACF;AAEA,eAAeC,kBACbR,EAAM,EACNS,MAGqB;IAErB,MAAML,SAAS,MAAM1B,uBAAuBsB,IAAIS;IAChD,IAAI,CAACL,QAAQ,OAAOM;IACpB,IAAI,CAAE,CAAA,oBAAoBN,OAAOA,MAAM,AAAD,GAAI;QACxC,MAAM,IAAIF,MAAM;IAClB;IACA,OAAOC,iBAAiBC,OAAOA,MAAM,CAACO,cAAc;AACtD;AAEA,eAAeC,mBACbZ,EAAM,EACNS,MAAmC,EACnCL,MAAuC;IAEvC,MAAMvB,wBAAwBmB,IAAIS,QAAQ;QAACE,gBAAgBP;IAAM;AACnE;AAEA,eAAeS,wBAAwBb,EAAM,EAAEC,MAAc;IAC3D,MAAMa,OAAO,MAAMd,GAChBe,MAAM,CAAC;QAACxB,IAAIH,MAAMG,EAAE;QAAEK,QAAQR,MAAMQ,MAAM;IAAA,GAC1CoB,IAAI,CAAC5B,OACL6B,KAAK,CAAChD,GAAGmB,MAAMG,EAAE,EAAEU,SACnBiB,KAAK,CAAC,GACNC,GAAG,CAAC;IACP,MAAM7B,OAAOwB,IAAI,CAAC,EAAE;IACpB,IAAI,CAACxB,QAAQA,KAAKM,MAAM,KAAK,WAAW,MAAM,IAAInB,kBAAkBwB;IACpE,OAAOX;AACT;AAEA,eAAe8B,2BAA2BpB,EAAM,EAAEqB,OAAe;IAC/D,MAAMC,YAAY,MAAMtB,GACrBe,MAAM,CAAC;QAACnB,QAAQR,MAAMQ,MAAM;IAAA,GAC5BoB,IAAI,CAAC5B,OACL6B,KAAK,CAAChD,GAAGmB,MAAMG,EAAE,EAAE8B,UACnBH,KAAK,CAAC;IACT,MAAMK,QAAQD,SAAS,CAAC,EAAE;IAC1B,MAAME,SAAS,MAAMxB,GAClBe,MAAM,CAAC;QAACU,MAAMvC,YAAYuC,IAAI;IAAA,GAC9BT,IAAI,CAAC9B,aACL+B,KAAK,CAACjD,IAAIC,GAAGiB,YAAYe,MAAM,EAAEoB,UAAUlD,OAAOe,YAAYwC,SAAS;IAC1E,MAAMD,OAAOnD,iBAAiBkD,OAAOG,GAAG,CAAC,CAAC,EAACF,IAAI,EAAC,GAAKA;IAErD,IAAIF,OAAO3B,WAAW,YAAY,CAAC6B,QAAQ,CAACpD,oBAAoBoD,MAAM,mBAAmB;QACvF,MAAM,IAAIlD,uBAAuB;IACnC;AACF;AAEA,eAAeqD,qBAAqB5B,EAAM,EAAEC,MAAc;IACxD,MAAM4B,UAAU,MAAM7B,GACnB8B,MAAM,CAAC3C,eACP4C,GAAG,CAAC;QAACL,WAAWtD,GAAG,CAAC,KAAK,CAAC;QAAE4D,WAAW5D,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD6C,KAAK,CACJjD,IACEC,GAAGkB,cAAcc,MAAM,EAAEA,SACzB9B,OAAOgB,cAAcuC,SAAS,GAC9BxD,GAAGiB,cAAc8C,SAAS,EAAE7D,GAAG,CAAC,KAAK,CAAC,IAGzC8D,SAAS,CAAC;QAACC,WAAWhD,cAAcgD,SAAS;IAAA;IAEhD,OAAO,IAAIC,IAAIP,QAAQF,GAAG,CAAC,CAAC,EAACQ,SAAS,EAAC,GAAKA,YAAYE,IAAI;AAC9D;AAEA,eAAeC,6BACb7B,MAEC;IAED,OAAO,MAAMzB,KAAKuD,WAAW,CAAC,OAAOvC;QACnC,MAAMrB,iBAAiBqB,IAAIS;QAC3B,IAAIA,OAAO+B,SAAS,KAAK,WAAW,MAAM5D,qBAAqBoB;QAE/D,MAAMyC,WAAW,MAAMjC,kBAAkBR,IAAI;YAC3C,GAAGS,MAAM;YACTiC,SAASjC,OAAOkC,KAAK,CAACD,OAAO;QAC/B;QACA,IAAID,UAAU,OAAOA;QAErB,MAAMxD,yBAAyBe,IAAIS,OAAOR,MAAM;QAChD,MAAMX,OAAO,MAAMuB,wBAAwBb,IAAIS,OAAOR,MAAM;QAC5D,MAAMmB,2BAA2BpB,IAAIS,OAAOY,OAAO;QACnD,IAAId,kBAAkB;QAEtB,IAAIE,OAAO+B,SAAS,KAAK,WAAW;YAClC,IAAIlD,KAAKM,MAAM,KAAK,UAAU;gBAC5B,MAAMgD,eAAe,MAAM5C,GACxBe,MAAM,CAAC;oBAACxB,IAAIL,YAAYK,EAAE;gBAAA,GAC1ByB,IAAI,CAAC9B,aACL2D,SAAS,CAACzD,OAAOnB,GAAGiB,YAAYe,MAAM,EAAEb,MAAMG,EAAE,GAChD0B,KAAK,CACJjD,IACEC,GAAGiB,YAAYuC,IAAI,EAAE,gBACrBtD,OAAOe,YAAYwC,SAAS,GAC5BzD,GAAGmB,MAAMQ,MAAM,EAAE,YAGpBsB,KAAK,CAAC;gBACT,MAAM4B,sBAAsB,MAAM9C,GAC/Be,MAAM,CAAC;oBAACxB,IAAIL,YAAYK,EAAE;gBAAA,GAC1ByB,IAAI,CAAC9B,aACL+B,KAAK,CACJjD,IACEC,GAAGiB,YAAYe,MAAM,EAAEX,KAAKC,EAAE,GAC9BtB,GAAGiB,YAAYuC,IAAI,EAAE,gBACrBtD,OAAOe,YAAYwC,SAAS,IAG/BR,KAAK,CAAC;gBACT,IAAI4B,oBAAoBC,MAAM,GAAG,KAAKH,aAAaG,MAAM,IAAI,GAAG;oBAC9D,MAAM,IAAIvE;gBACZ;gBAEA,MAAMwB,GACH8B,MAAM,CAAC1C,OACP2C,GAAG,CAAC;oBAACnC,QAAQ;oBAAaoC,WAAW5D,GAAG,CAAC,KAAK,CAAC;gBAAA,GAC/C6C,KAAK,CAAChD,GAAGmB,MAAMG,EAAE,EAAED,KAAKC,EAAE;YAC/B;YACAgB,kBAAkB,MAAMqB,qBAAqB5B,IAAIV,KAAKC,EAAE;QAC1D,OAAO,IAAIkB,OAAO+B,SAAS,KAAK,gBAAgBlD,KAAKM,MAAM,KAAK,aAAa;YAC3E,MAAMI,GACH8B,MAAM,CAAC1C,OACP2C,GAAG,CAAC;gBAACnC,QAAQ;gBAAUoC,WAAW5D,GAAG,CAAC,KAAK,CAAC;YAAA,GAC5C6C,KAAK,CAAChD,GAAGmB,MAAMG,EAAE,EAAED,KAAKC,EAAE;QAC/B,OAAO,IAAIkB,OAAO+B,SAAS,KAAK,mBAAmB;YACjDjC,kBAAkB,MAAMqB,qBAAqB5B,IAAIV,KAAKC,EAAE;QAC1D;QAEA,MAAMyD,UAAU,MAAMjD,gBAAgBC,IAAIV,KAAKC,EAAE;QACjD,MAAMa,SAA0C;YAC9Cd,MAAM0D;YACN1C,eAAeG,OAAOkC,KAAK,CAACrC,aAAa;YACzCC;QACF;QACA,MAAMzB,iBAAiBkB,IAAIS,OAAOkC,KAAK;QACvC,MAAM/B,mBAAmBZ,IAAIS,QAAQL;QACrC,OAAOD,iBAAiBC;IAC1B;AACF;AAIA,OAAO,eAAe6C,qBACpBxC,MAAmC;IAEnC,OAAO,MAAM6B,6BAA6B;QAAC,GAAG7B,MAAM;QAAE+B,WAAW;IAAS;AAC5E;AAEA,OAAO,eAAeU,wBACpBzC,MAAmC;IAEnC,OAAO,MAAM6B,6BAA6B;QAAC,GAAG7B,MAAM;QAAE+B,WAAW;IAAY;AAC/E;AAEA,OAAO,eAAeW,4BACpB1C,MAAmC;IAEnC,OAAO,MAAM6B,6BAA6B;QAAC,GAAG7B,MAAM;QAAE+B,WAAW;IAAiB;AACpF"}

package/dist/db/admin-user-summary.d.ts

@@ -0,0 +1,14 @@
+import type { AdministratorUserSummary } from '#core/entities/administrator-read-model.js';
+import type { db } from './db.js';
+type Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
+export type AdministratorUserSummaryExecutor = ReturnType<typeof db> | Tx;
+type AdministratorUserLookup = {
+    id: string;
+    email?: never;
+} | {
+    email: string;
+    id?: never;
+};
+export declare function findAdministratorUserSummary(executor: AdministratorUserSummaryExecutor, params: AdministratorUserLookup): Promise<AdministratorUserSummary | undefined>;
+export {};
+//# sourceMappingURL=admin-user-summary.d.ts.map

package/dist/db/admin-user-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-summary.d.ts","sourceRoot":"","sources":["../../src/db/admin-user-summary.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAIhC,KAAK,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC;AAE1E,KAAK,uBAAuB,GAAG;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC;AAEzF,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,gCAAgC,EAC1C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAmC/C"}

package/dist/db/admin-user-summary.js

@@ -0,0 +1,31 @@
+import { and, eq, isNull } from 'drizzle-orm';
+import { highestAdminRole } from '#core/admin-role-model.js';
+import { adminGrants } from './schema/admin-grants.js';
+import { users } from './schema/users.js';
+export async function findAdministratorUserSummary(executor, params) {
+    const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);
+    const rows = await executor.select({
+        id: users.id,
+        email: users.email,
+        name: users.name,
+        emailVerifiedAt: users.emailVerifiedAt,
+        status: users.status,
+        createdAt: users.createdAt,
+        adminRole: adminGrants.role
+    }).from(users).leftJoin(adminGrants, and(eq(adminGrants.userId, users.id), isNull(adminGrants.revokedAt), eq(users.status, 'active'))).where(identifier);
+    const first = rows[0];
+    if (!first) return undefined;
+    return {
+        id: first.id,
+        email: first.email,
+        name: first.name,
+        emailVerifiedAt: first.emailVerifiedAt,
+        status: first.status,
+        createdAt: first.createdAt,
+        adminRole: highestAdminRole(rows.flatMap(({ adminRole })=>adminRole ? [
+                adminRole
+            ] : []))
+    };
+}
+
+//# sourceMappingURL=admin-user-summary.js.map

package/dist/db/admin-user-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/admin-user-summary.ts"],"sourcesContent":["import {and, eq, isNull} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';\nimport type {db} from './db.js';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {users} from './schema/users.js';\n\ntype Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\nexport type AdministratorUserSummaryExecutor = ReturnType<typeof db> | Tx;\n\ntype AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};\n\nexport async function findAdministratorUserSummary(\n  executor: AdministratorUserSummaryExecutor,\n  params: AdministratorUserLookup,\n): Promise<AdministratorUserSummary | undefined> {\n  const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);\n  const rows = await executor\n    .select({\n      id: users.id,\n      email: users.email,\n      name: users.name,\n      emailVerifiedAt: users.emailVerifiedAt,\n      status: users.status,\n      createdAt: users.createdAt,\n      adminRole: adminGrants.role,\n    })\n    .from(users)\n    .leftJoin(\n      adminGrants,\n      and(\n        eq(adminGrants.userId, users.id),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    )\n    .where(identifier);\n\n  const first = rows[0];\n  if (!first) return undefined;\n\n  return {\n    id: first.id,\n    email: first.email,\n    name: first.name,\n    emailVerifiedAt: first.emailVerifiedAt,\n    status: first.status,\n    createdAt: first.createdAt,\n    adminRole: highestAdminRole(rows.flatMap(({adminRole}) => (adminRole ? [adminRole] : []))),\n  } satisfies AdministratorUserSummary;\n}\n"],"names":["and","eq","isNull","highestAdminRole","adminGrants","users","findAdministratorUserSummary","executor","params","identifier","id","email","rows","select","name","emailVerifiedAt","status","createdAt","adminRole","role","from","leftJoin","userId","revokedAt","where","first","undefined","flatMap"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,MAAM,QAAO,cAAc;AAC5C,SAAQC,gBAAgB,QAAO,4BAA4B;AAG3D,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,KAAK,QAAO,oBAAoB;AAOxC,OAAO,eAAeC,6BACpBC,QAA0C,EAC1CC,MAA+B;IAE/B,MAAMC,aAAa,QAAQD,SAASP,GAAGI,MAAMK,EAAE,EAAEF,OAAOE,EAAE,IAAIT,GAAGI,MAAMM,KAAK,EAAEH,OAAOG,KAAK;IAC1F,MAAMC,OAAO,MAAML,SAChBM,MAAM,CAAC;QACNH,IAAIL,MAAMK,EAAE;QACZC,OAAON,MAAMM,KAAK;QAClBG,MAAMT,MAAMS,IAAI;QAChBC,iBAAiBV,MAAMU,eAAe;QACtCC,QAAQX,MAAMW,MAAM;QACpBC,WAAWZ,MAAMY,SAAS;QAC1BC,WAAWd,YAAYe,IAAI;IAC7B,GACCC,IAAI,CAACf,OACLgB,QAAQ,CACPjB,aACAJ,IACEC,GAAGG,YAAYkB,MAAM,EAAEjB,MAAMK,EAAE,GAC/BR,OAAOE,YAAYmB,SAAS,GAC5BtB,GAAGI,MAAMW,MAAM,EAAE,YAGpBQ,KAAK,CAACf;IAET,MAAMgB,QAAQb,IAAI,CAAC,EAAE;IACrB,IAAI,CAACa,OAAO,OAAOC;IAEnB,OAAO;QACLhB,IAAIe,MAAMf,EAAE;QACZC,OAAOc,MAAMd,KAAK;QAClBG,MAAMW,MAAMX,IAAI;QAChBC,iBAAiBU,MAAMV,eAAe;QACtCC,QAAQS,MAAMT,MAAM;QACpBC,WAAWQ,MAAMR,SAAS;QAC1BC,WAAWf,iBAAiBS,KAAKe,OAAO,CAAC,CAAC,EAACT,SAAS,EAAC,GAAMA,YAAY;gBAACA;aAAU,GAAG,EAAE;IACzF;AACF"}

package/dist/db/admin-users.d.ts

@@ -1,14 +1,5 @@
-import type { AdminRole } from '@shipfox/api-auth-dto';
-import type { UserStatus } from '#core/entities/user.js';
-export interface AdministratorUserRecord {
-    id: string;
-    email: string;
-    name: string | null;
-    emailVerifiedAt: Date | null;
-    status: UserStatus;
-    createdAt: Date;
-    adminRole: AdminRole | null;
-}
+import type { AdministratorUserSummary } from '#core/entities/administrator-read-model.js';
+export type AdministratorUserRecord = AdministratorUserSummary;
 type AdministratorUserLookup = {
     id: string;
     email?: never;

package/dist/db/admin-users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-users.d.ts","sourceRoot":"","sources":["../../src/db/admin-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAKvD,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,KAAK,uBAAuB,GAAG;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC;AAEzF,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAmC9C"}
+{"version":3,"file":"admin-users.d.ts","sourceRoot":"","sources":["../../src/db/admin-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,4CAA4C,CAAC;AAIzF,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAE/D,KAAK,uBAAuB,GAAG;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC;AAEzF,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAE9C"}

package/dist/db/admin-users.js

@@ -1,32 +1,7 @@
-import { and, eq, isNull } from 'drizzle-orm';
-import { highestAdminRole } from '#core/admin-role-model.js';
+import { findAdministratorUserSummary } from './admin-user-summary.js';
 import { db } from './db.js';
-import { adminGrants } from './schema/admin-grants.js';
-import { users } from './schema/users.js';
 export async function findAdministratorUser(params) {
-    const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);
-    const rows = await db().select({
-        id: users.id,
-        email: users.email,
-        name: users.name,
-        emailVerifiedAt: users.emailVerifiedAt,
-        status: users.status,
-        createdAt: users.createdAt,
-        adminRole: adminGrants.role
-    }).from(users).leftJoin(adminGrants, and(eq(adminGrants.userId, users.id), isNull(adminGrants.revokedAt), eq(users.status, 'active'))).where(identifier);
-    const first = rows[0];
-    if (!first) return undefined;
-    return {
-        id: first.id,
-        email: first.email,
-        name: first.name,
-        emailVerifiedAt: first.emailVerifiedAt,
-        status: first.status,
-        createdAt: first.createdAt,
-        adminRole: highestAdminRole(rows.flatMap(({ adminRole })=>adminRole ? [
-                adminRole
-            ] : []))
-    };
+    return await findAdministratorUserSummary(db(), params);
 }
 
 //# sourceMappingURL=admin-users.js.map

package/dist/db/admin-users.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/admin-users.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {and, eq, isNull} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {UserStatus} from '#core/entities/user.js';\nimport {db} from './db.js';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {users} from './schema/users.js';\n\nexport interface AdministratorUserRecord {\n  id: string;\n  email: string;\n  name: string | null;\n  emailVerifiedAt: Date | null;\n  status: UserStatus;\n  createdAt: Date;\n  adminRole: AdminRole | null;\n}\n\ntype AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};\n\nexport async function findAdministratorUser(\n  params: AdministratorUserLookup,\n): Promise<AdministratorUserRecord | undefined> {\n  const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);\n  const rows = await db()\n    .select({\n      id: users.id,\n      email: users.email,\n      name: users.name,\n      emailVerifiedAt: users.emailVerifiedAt,\n      status: users.status,\n      createdAt: users.createdAt,\n      adminRole: adminGrants.role,\n    })\n    .from(users)\n    .leftJoin(\n      adminGrants,\n      and(\n        eq(adminGrants.userId, users.id),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    )\n    .where(identifier);\n\n  const first = rows[0];\n  if (!first) return undefined;\n\n  return {\n    id: first.id,\n    email: first.email,\n    name: first.name,\n    emailVerifiedAt: first.emailVerifiedAt,\n    status: first.status,\n    createdAt: first.createdAt,\n    adminRole: highestAdminRole(rows.flatMap(({adminRole}) => (adminRole ? [adminRole] : []))),\n  };\n}\n"],"names":["and","eq","isNull","highestAdminRole","db","adminGrants","users","findAdministratorUser","params","identifier","id","email","rows","select","name","emailVerifiedAt","status","createdAt","adminRole","role","from","leftJoin","userId","revokedAt","where","first","undefined","flatMap"],"mappings":"AACA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,MAAM,QAAO,cAAc;AAC5C,SAAQC,gBAAgB,QAAO,4BAA4B;AAE3D,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,KAAK,QAAO,oBAAoB;AAcxC,OAAO,eAAeC,sBACpBC,MAA+B;IAE/B,MAAMC,aAAa,QAAQD,SAASP,GAAGK,MAAMI,EAAE,EAAEF,OAAOE,EAAE,IAAIT,GAAGK,MAAMK,KAAK,EAAEH,OAAOG,KAAK;IAC1F,MAAMC,OAAO,MAAMR,KAChBS,MAAM,CAAC;QACNH,IAAIJ,MAAMI,EAAE;QACZC,OAAOL,MAAMK,KAAK;QAClBG,MAAMR,MAAMQ,IAAI;QAChBC,iBAAiBT,MAAMS,eAAe;QACtCC,QAAQV,MAAMU,MAAM;QACpBC,WAAWX,MAAMW,SAAS;QAC1BC,WAAWb,YAAYc,IAAI;IAC7B,GACCC,IAAI,CAACd,OACLe,QAAQ,CACPhB,aACAL,IACEC,GAAGI,YAAYiB,MAAM,EAAEhB,MAAMI,EAAE,GAC/BR,OAAOG,YAAYkB,SAAS,GAC5BtB,GAAGK,MAAMU,MAAM,EAAE,YAGpBQ,KAAK,CAACf;IAET,MAAMgB,QAAQb,IAAI,CAAC,EAAE;IACrB,IAAI,CAACa,OAAO,OAAOC;IAEnB,OAAO;QACLhB,IAAIe,MAAMf,EAAE;QACZC,OAAOc,MAAMd,KAAK;QAClBG,MAAMW,MAAMX,IAAI;QAChBC,iBAAiBU,MAAMV,eAAe;QACtCC,QAAQS,MAAMT,MAAM;QACpBC,WAAWQ,MAAMR,SAAS;QAC1BC,WAAWf,iBAAiBS,KAAKe,OAAO,CAAC,CAAC,EAACT,SAAS,EAAC,GAAMA,YAAY;gBAACA;aAAU,GAAG,EAAE;IACzF;AACF"}
+{"version":3,"sources":["../../src/db/admin-users.ts"],"sourcesContent":["import type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';\nimport {findAdministratorUserSummary} from './admin-user-summary.js';\nimport {db} from './db.js';\n\nexport type AdministratorUserRecord = AdministratorUserSummary;\n\ntype AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};\n\nexport async function findAdministratorUser(\n  params: AdministratorUserLookup,\n): Promise<AdministratorUserRecord | undefined> {\n  return await findAdministratorUserSummary(db(), params);\n}\n"],"names":["findAdministratorUserSummary","db","findAdministratorUser","params"],"mappings":"AACA,SAAQA,4BAA4B,QAAO,0BAA0B;AACrE,SAAQC,EAAE,QAAO,UAAU;AAM3B,OAAO,eAAeC,sBACpBC,MAA+B;IAE/B,OAAO,MAAMH,6BAA6BC,MAAME;AAClD"}

package/dist/db/refresh-tokens.d.ts

@@ -1,4 +1,7 @@
 import type { RefreshToken } from '#core/entities/refresh-token.js';
+import { db } from './db.js';
+type Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
+export declare function lockUserSessionMutations(tx: Tx, userId: string): Promise<void>;
 export interface CreateRefreshTokenParams {
     sessionId?: string | undefined;
     userId: string;
@@ -6,6 +9,7 @@ export interface CreateRefreshTokenParams {
     expiresAt: Date;
 }
 export declare function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken>;
+export declare function createRefreshTokenForActiveUser(params: CreateRefreshTokenParams): Promise<RefreshToken | undefined>;
 /**
  * Looks up the live session token by hash — one that can still authenticate as
  * the current session. Returns `undefined` for revoked, expired, or already
@@ -15,10 +19,6 @@ export declare function createRefreshToken(params: CreateRefreshTokenParams): Pr
 export declare function findActiveRefreshTokenByHash(params: {
     hashedToken: string;
 }): Promise<RefreshToken | undefined>;
-export declare function findActiveRefreshSession(params: {
-    sessionId: string;
-    userId: string;
-}): Promise<RefreshToken | undefined>;
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
@@ -34,6 +34,7 @@ export declare function findRefreshTokenByHash(params: {
  * If the successor insert fails, the predecessor rotation rolls back.
  */
 export declare function rotateRefreshToken(params: {
+    userId?: string | undefined;
     id: string;
     currentHashedToken: string;
     nextHashedToken: string;
@@ -50,4 +51,5 @@ export declare function revokeRefreshTokensForUser(params: {
     userId: string;
     exceptRefreshTokenId?: string | undefined;
 }): Promise<void>;
+export {};
 //# sourceMappingURL=refresh-tokens.d.ts.map

package/dist/db/refresh-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-tokens.d.ts","sourceRoot":"","sources":["../../src/db/refresh-tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,iCAAiC,CAAC;AAIlE,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC,CAchG;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAiBpC;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAkBpC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAgBpC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAqCpC;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3F;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB"}
+{"version":3,"file":"refresh-tokens.d.ts","sourceRoot":"","sources":["../../src/db/refresh-tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAI3B,KAAK,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7E,wBAAsB,wBAAwB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpF;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC,CAchG;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAuBnC;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAiBpC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAgBpC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAwDpC;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3F;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB"}

package/dist/db/refresh-tokens.js

@@ -1,6 +1,10 @@
 import { and, eq, gt, isNull, ne, sql } from 'drizzle-orm';
 import { db } from './db.js';
 import { refreshTokens, toRefreshToken } from './schema/refresh-tokens.js';
+import { users } from './schema/users.js';
+export async function lockUserSessionMutations(tx, userId) {
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${`auth_user_sessions:${userId}`}))`);
+}
 export async function createRefreshToken(params) {
     const rows = await db().insert(refreshTokens).values({
         sessionId: params.sessionId,
@@ -12,6 +16,24 @@ export async function createRefreshToken(params) {
     if (!row) throw new Error('Insert returned no rows');
     return toRefreshToken(row);
 }
+export async function createRefreshTokenForActiveUser(params) {
+    return await db().transaction(async (tx)=>{
+        await lockUserSessionMutations(tx, params.userId);
+        const userRows = await tx.select({
+            status: users.status
+        }).from(users).where(eq(users.id, params.userId)).limit(1);
+        if (userRows[0]?.status !== 'active') return undefined;
+        const rows = await tx.insert(refreshTokens).values({
+            sessionId: params.sessionId,
+            userId: params.userId,
+            hashedToken: params.hashedToken,
+            expiresAt: params.expiresAt
+        }).returning();
+        const row = rows[0];
+        if (!row) throw new Error('Insert returned no rows');
+        return toRefreshToken(row);
+    });
+}
 /**
  * Looks up the live session token by hash — one that can still authenticate as
  * the current session. Returns `undefined` for revoked, expired, or already
@@ -23,12 +45,6 @@ export async function createRefreshToken(params) {
     if (!row) return undefined;
     return toRefreshToken(row);
 }
-export async function findActiveRefreshSession(params) {
-    const rows = await db().select().from(refreshTokens).where(and(eq(refreshTokens.sessionId, params.sessionId), eq(refreshTokens.userId, params.userId), isNull(refreshTokens.revokedAt), isNull(refreshTokens.rotatedAt), gt(refreshTokens.expiresAt, sql`now()`))).limit(1);
-    const row = rows[0];
-    if (!row) return undefined;
-    return toRefreshToken(row);
-}
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
@@ -46,6 +62,15 @@ export async function findActiveRefreshSession(params) {
  * If the successor insert fails, the predecessor rotation rolls back.
  */ export async function rotateRefreshToken(params) {
     return await db().transaction(async (tx)=>{
+        const userId = params.userId ?? (await tx.select({
+            userId: refreshTokens.userId
+        }).from(refreshTokens).where(eq(refreshTokens.id, params.id)).limit(1))[0]?.userId;
+        if (!userId) return undefined;
+        await lockUserSessionMutations(tx, userId);
+        const userRows = await tx.select({
+            status: users.status
+        }).from(users).where(eq(users.id, userId)).limit(1);
+        if (userRows[0]?.status !== 'active') return undefined;
         const rotatedRows = await tx.update(refreshTokens).set({
             rotatedAt: sql`now()`,
             lastUsedAt: sql`now()`,

package/dist/db/refresh-tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/refresh-tokens.ts"],"sourcesContent":["import {and, eq, gt, isNull, ne, sql} from 'drizzle-orm';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport {db} from './db.js';\nimport {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';\n\nexport interface CreateRefreshTokenParams {\n  sessionId?: string | undefined;\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport async function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken> {\n  const rows = await db()\n    .insert(refreshTokens)\n    .values({\n      sessionId: params.sessionId,\n      userId: params.userId,\n      hashedToken: params.hashedToken,\n      expiresAt: params.expiresAt,\n    })\n    .returning();\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up the live session token by hash — one that can still authenticate as\n * the current session. Returns `undefined` for revoked, expired, or already\n * rotated tokens; rotated rows survive in the table only for the grace window\n * and are not \"active\".\n */\nexport async function findActiveRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        isNull(refreshTokens.rotatedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\nexport async function findActiveRefreshSession(params: {\n  sessionId: string;\n  userId: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.sessionId, params.sessionId),\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n        isNull(refreshTokens.rotatedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up a non-revoked, non-expired token by hash, including ones already\n * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to\n * rotate, honour the grace window, or reject reuse, so — unlike\n * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.\n */\nexport async function findRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Atomically claims rotation and inserts the successor token. The predecessor is\n * marked rather than deleted so later reuse of the retired token can be detected.\n * If the successor insert fails, the predecessor rotation rolls back.\n */\nexport async function rotateRefreshToken(params: {\n  id: string;\n  currentHashedToken: string;\n  nextHashedToken: string;\n  expiresAt: Date;\n}): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    const rotatedRows = await tx\n      .update(refreshTokens)\n      .set({\n        rotatedAt: sql`now()`,\n        lastUsedAt: sql`now()`,\n        updatedAt: sql`now()`,\n      })\n      .where(\n        and(\n          eq(refreshTokens.id, params.id),\n          eq(refreshTokens.hashedToken, params.currentHashedToken),\n          isNull(refreshTokens.revokedAt),\n          isNull(refreshTokens.rotatedAt),\n          gt(refreshTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning();\n\n    const rotated = rotatedRows[0];\n    if (!rotated) return undefined;\n\n    const successorRows = await tx\n      .insert(refreshTokens)\n      .values({\n        sessionId: rotated.sessionId,\n        userId: rotated.userId,\n        hashedToken: params.nextHashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    if (!successorRows[0]) throw new Error('Insert returned no rows');\n\n    return toRefreshToken(rotated);\n  });\n}\n\nexport async function revokeRefreshTokenByHash(params: {hashedToken: string}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));\n}\n\nexport async function revokeRefreshSession(params: {\n  sessionId: string;\n  userId: string;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.sessionId, params.sessionId),\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n      ),\n    );\n}\n\nexport async function revokeRefreshTokensForUser(params: {\n  userId: string;\n  exceptRefreshTokenId?: string | undefined;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n        params.exceptRefreshTokenId ? ne(refreshTokens.id, params.exceptRefreshTokenId) : undefined,\n      ),\n    );\n}\n"],"names":["and","eq","gt","isNull","ne","sql","db","refreshTokens","toRefreshToken","createRefreshToken","params","rows","insert","values","sessionId","userId","hashedToken","expiresAt","returning","row","Error","findActiveRefreshTokenByHash","select","from","where","revokedAt","rotatedAt","limit","undefined","findActiveRefreshSession","findRefreshTokenByHash","rotateRefreshToken","transaction","tx","rotatedRows","update","set","lastUsedAt","updatedAt","id","currentHashedToken","rotated","successorRows","nextHashedToken","revokeRefreshTokenByHash","revokeRefreshSession","revokeRefreshTokensForUser","exceptRefreshTokenId"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEzD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,aAAa,EAAEC,cAAc,QAAO,6BAA6B;AASzE,OAAO,eAAeC,mBAAmBC,MAAgC;IACvE,MAAMC,OAAO,MAAML,KAChBM,MAAM,CAACL,eACPM,MAAM,CAAC;QACNC,WAAWJ,OAAOI,SAAS;QAC3BC,QAAQL,OAAOK,MAAM;QACrBC,aAAaN,OAAOM,WAAW;QAC/BC,WAAWP,OAAOO,SAAS;IAC7B,GACCC,SAAS;IAEZ,MAAMC,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOZ,eAAeW;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAeE,6BAA6BX,MAElD;IACC,MAAMC,OAAO,MAAML,KAChBgB,MAAM,GACNC,IAAI,CAAChB,eACLiB,KAAK,CACJxB,IACEC,GAAGM,cAAcS,WAAW,EAAEN,OAAOM,WAAW,GAChDb,OAAOI,cAAckB,SAAS,GAC9BtB,OAAOI,cAAcmB,SAAS,GAC9BxB,GAAGK,cAAcU,SAAS,EAAEZ,GAAG,CAAC,KAAK,CAAC,IAGzCsB,KAAK,CAAC;IAET,MAAMR,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOS;IACjB,OAAOpB,eAAeW;AACxB;AAEA,OAAO,eAAeU,yBAAyBnB,MAG9C;IACC,MAAMC,OAAO,MAAML,KAChBgB,MAAM,GACNC,IAAI,CAAChB,eACLiB,KAAK,CACJxB,IACEC,GAAGM,cAAcO,SAAS,EAAEJ,OAAOI,SAAS,GAC5Cb,GAAGM,cAAcQ,MAAM,EAAEL,OAAOK,MAAM,GACtCZ,OAAOI,cAAckB,SAAS,GAC9BtB,OAAOI,cAAcmB,SAAS,GAC9BxB,GAAGK,cAAcU,SAAS,EAAEZ,GAAG,CAAC,KAAK,CAAC,IAGzCsB,KAAK,CAAC;IAET,MAAMR,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOS;IACjB,OAAOpB,eAAeW;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAeW,uBAAuBpB,MAE5C;IACC,MAAMC,OAAO,MAAML,KAChBgB,MAAM,GACNC,IAAI,CAAChB,eACLiB,KAAK,CACJxB,IACEC,GAAGM,cAAcS,WAAW,EAAEN,OAAOM,WAAW,GAChDb,OAAOI,cAAckB,SAAS,GAC9BvB,GAAGK,cAAcU,SAAS,EAAEZ,GAAG,CAAC,KAAK,CAAC,IAGzCsB,KAAK,CAAC;IAET,MAAMR,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOS;IACjB,OAAOpB,eAAeW;AACxB;AAEA;;;;CAIC,GACD,OAAO,eAAeY,mBAAmBrB,MAKxC;IACC,OAAO,MAAMJ,KAAK0B,WAAW,CAAC,OAAOC;QACnC,MAAMC,cAAc,MAAMD,GACvBE,MAAM,CAAC5B,eACP6B,GAAG,CAAC;YACHV,WAAWrB,GAAG,CAAC,KAAK,CAAC;YACrBgC,YAAYhC,GAAG,CAAC,KAAK,CAAC;YACtBiC,WAAWjC,GAAG,CAAC,KAAK,CAAC;QACvB,GACCmB,KAAK,CACJxB,IACEC,GAAGM,cAAcgC,EAAE,EAAE7B,OAAO6B,EAAE,GAC9BtC,GAAGM,cAAcS,WAAW,EAAEN,OAAO8B,kBAAkB,GACvDrC,OAAOI,cAAckB,SAAS,GAC9BtB,OAAOI,cAAcmB,SAAS,GAC9BxB,GAAGK,cAAcU,SAAS,EAAEZ,GAAG,CAAC,KAAK,CAAC,IAGzCa,SAAS;QAEZ,MAAMuB,UAAUP,WAAW,CAAC,EAAE;QAC9B,IAAI,CAACO,SAAS,OAAOb;QAErB,MAAMc,gBAAgB,MAAMT,GACzBrB,MAAM,CAACL,eACPM,MAAM,CAAC;YACNC,WAAW2B,QAAQ3B,SAAS;YAC5BC,QAAQ0B,QAAQ1B,MAAM;YACtBC,aAAaN,OAAOiC,eAAe;YACnC1B,WAAWP,OAAOO,SAAS;QAC7B,GACCC,SAAS;QAEZ,IAAI,CAACwB,aAAa,CAAC,EAAE,EAAE,MAAM,IAAItB,MAAM;QAEvC,OAAOZ,eAAeiC;IACxB;AACF;AAEA,OAAO,eAAeG,yBAAyBlC,MAA6B;IAC1E,MAAMJ,KACH6B,MAAM,CAAC5B,eACP6B,GAAG,CAAC;QAACX,WAAWpB,GAAG,CAAC,KAAK,CAAC;QAAEiC,WAAWjC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDmB,KAAK,CAACxB,IAAIC,GAAGM,cAAcS,WAAW,EAAEN,OAAOM,WAAW,GAAGb,OAAOI,cAAckB,SAAS;AAChG;AAEA,OAAO,eAAeoB,qBAAqBnC,MAG1C;IACC,MAAMJ,KACH6B,MAAM,CAAC5B,eACP6B,GAAG,CAAC;QAACX,WAAWpB,GAAG,CAAC,KAAK,CAAC;QAAEiC,WAAWjC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDmB,KAAK,CACJxB,IACEC,GAAGM,cAAcO,SAAS,EAAEJ,OAAOI,SAAS,GAC5Cb,GAAGM,cAAcQ,MAAM,EAAEL,OAAOK,MAAM,GACtCZ,OAAOI,cAAckB,SAAS;AAGtC;AAEA,OAAO,eAAeqB,2BAA2BpC,MAGhD;IACC,MAAMJ,KACH6B,MAAM,CAAC5B,eACP6B,GAAG,CAAC;QAACX,WAAWpB,GAAG,CAAC,KAAK,CAAC;QAAEiC,WAAWjC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDmB,KAAK,CACJxB,IACEC,GAAGM,cAAcQ,MAAM,EAAEL,OAAOK,MAAM,GACtCZ,OAAOI,cAAckB,SAAS,GAC9Bf,OAAOqC,oBAAoB,GAAG3C,GAAGG,cAAcgC,EAAE,EAAE7B,OAAOqC,oBAAoB,IAAInB;AAG1F"}
+{"version":3,"sources":["../../src/db/refresh-tokens.ts"],"sourcesContent":["import {and, eq, gt, isNull, ne, sql} from 'drizzle-orm';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport {db} from './db.js';\nimport {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\ntype Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\n\nexport async function lockUserSessionMutations(tx: Tx, userId: string): Promise<void> {\n  await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${`auth_user_sessions:${userId}`}))`);\n}\n\nexport interface CreateRefreshTokenParams {\n  sessionId?: string | undefined;\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport async function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken> {\n  const rows = await db()\n    .insert(refreshTokens)\n    .values({\n      sessionId: params.sessionId,\n      userId: params.userId,\n      hashedToken: params.hashedToken,\n      expiresAt: params.expiresAt,\n    })\n    .returning();\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toRefreshToken(row);\n}\n\nexport async function createRefreshTokenForActiveUser(\n  params: CreateRefreshTokenParams,\n): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    await lockUserSessionMutations(tx, params.userId);\n    const userRows = await tx\n      .select({status: users.status})\n      .from(users)\n      .where(eq(users.id, params.userId))\n      .limit(1);\n    if (userRows[0]?.status !== 'active') return undefined;\n\n    const rows = await tx\n      .insert(refreshTokens)\n      .values({\n        sessionId: params.sessionId,\n        userId: params.userId,\n        hashedToken: params.hashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n    const row = rows[0];\n    if (!row) throw new Error('Insert returned no rows');\n    return toRefreshToken(row);\n  });\n}\n\n/**\n * Looks up the live session token by hash — one that can still authenticate as\n * the current session. Returns `undefined` for revoked, expired, or already\n * rotated tokens; rotated rows survive in the table only for the grace window\n * and are not \"active\".\n */\nexport async function findActiveRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        isNull(refreshTokens.rotatedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up a non-revoked, non-expired token by hash, including ones already\n * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to\n * rotate, honour the grace window, or reject reuse, so — unlike\n * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.\n */\nexport async function findRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Atomically claims rotation and inserts the successor token. The predecessor is\n * marked rather than deleted so later reuse of the retired token can be detected.\n * If the successor insert fails, the predecessor rotation rolls back.\n */\nexport async function rotateRefreshToken(params: {\n  userId?: string | undefined;\n  id: string;\n  currentHashedToken: string;\n  nextHashedToken: string;\n  expiresAt: Date;\n}): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    const userId =\n      params.userId ??\n      (\n        await tx\n          .select({userId: refreshTokens.userId})\n          .from(refreshTokens)\n          .where(eq(refreshTokens.id, params.id))\n          .limit(1)\n      )[0]?.userId;\n    if (!userId) return undefined;\n\n    await lockUserSessionMutations(tx, userId);\n    const userRows = await tx\n      .select({status: users.status})\n      .from(users)\n      .where(eq(users.id, userId))\n      .limit(1);\n    if (userRows[0]?.status !== 'active') return undefined;\n\n    const rotatedRows = await tx\n      .update(refreshTokens)\n      .set({\n        rotatedAt: sql`now()`,\n        lastUsedAt: sql`now()`,\n        updatedAt: sql`now()`,\n      })\n      .where(\n        and(\n          eq(refreshTokens.id, params.id),\n          eq(refreshTokens.hashedToken, params.currentHashedToken),\n          isNull(refreshTokens.revokedAt),\n          isNull(refreshTokens.rotatedAt),\n          gt(refreshTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning();\n\n    const rotated = rotatedRows[0];\n    if (!rotated) return undefined;\n\n    const successorRows = await tx\n      .insert(refreshTokens)\n      .values({\n        sessionId: rotated.sessionId,\n        userId: rotated.userId,\n        hashedToken: params.nextHashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    if (!successorRows[0]) throw new Error('Insert returned no rows');\n\n    return toRefreshToken(rotated);\n  });\n}\n\nexport async function revokeRefreshTokenByHash(params: {hashedToken: string}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));\n}\n\nexport async function revokeRefreshSession(params: {\n  sessionId: string;\n  userId: string;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.sessionId, params.sessionId),\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n      ),\n    );\n}\n\nexport async function revokeRefreshTokensForUser(params: {\n  userId: string;\n  exceptRefreshTokenId?: string | undefined;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n        params.exceptRefreshTokenId ? ne(refreshTokens.id, params.exceptRefreshTokenId) : undefined,\n      ),\n    );\n}\n"],"names":["and","eq","gt","isNull","ne","sql","db","refreshTokens","toRefreshToken","users","lockUserSessionMutations","tx","userId","execute","createRefreshToken","params","rows","insert","values","sessionId","hashedToken","expiresAt","returning","row","Error","createRefreshTokenForActiveUser","transaction","userRows","select","status","from","where","id","limit","undefined","findActiveRefreshTokenByHash","revokedAt","rotatedAt","findRefreshTokenByHash","rotateRefreshToken","rotatedRows","update","set","lastUsedAt","updatedAt","currentHashedToken","rotated","successorRows","nextHashedToken","revokeRefreshTokenByHash","revokeRefreshSession","revokeRefreshTokensForUser","exceptRefreshTokenId"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEzD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,aAAa,EAAEC,cAAc,QAAO,6BAA6B;AACzE,SAAQC,KAAK,QAAO,oBAAoB;AAIxC,OAAO,eAAeC,yBAAyBC,EAAM,EAAEC,MAAc;IACnE,MAAMD,GAAGE,OAAO,CAACR,GAAG,CAAC,sCAAsC,EAAE,CAAC,mBAAmB,EAAEO,QAAQ,CAAC,EAAE,CAAC;AACjG;AASA,OAAO,eAAeE,mBAAmBC,MAAgC;IACvE,MAAMC,OAAO,MAAMV,KAChBW,MAAM,CAACV,eACPW,MAAM,CAAC;QACNC,WAAWJ,OAAOI,SAAS;QAC3BP,QAAQG,OAAOH,MAAM;QACrBQ,aAAaL,OAAOK,WAAW;QAC/BC,WAAWN,OAAOM,SAAS;IAC7B,GACCC,SAAS;IAEZ,MAAMC,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOhB,eAAee;AACxB;AAEA,OAAO,eAAeE,gCACpBV,MAAgC;IAEhC,OAAO,MAAMT,KAAKoB,WAAW,CAAC,OAAOf;QACnC,MAAMD,yBAAyBC,IAAII,OAAOH,MAAM;QAChD,MAAMe,WAAW,MAAMhB,GACpBiB,MAAM,CAAC;YAACC,QAAQpB,MAAMoB,MAAM;QAAA,GAC5BC,IAAI,CAACrB,OACLsB,KAAK,CAAC9B,GAAGQ,MAAMuB,EAAE,EAAEjB,OAAOH,MAAM,GAChCqB,KAAK,CAAC;QACT,IAAIN,QAAQ,CAAC,EAAE,EAAEE,WAAW,UAAU,OAAOK;QAE7C,MAAMlB,OAAO,MAAML,GAChBM,MAAM,CAACV,eACPW,MAAM,CAAC;YACNC,WAAWJ,OAAOI,SAAS;YAC3BP,QAAQG,OAAOH,MAAM;YACrBQ,aAAaL,OAAOK,WAAW;YAC/BC,WAAWN,OAAOM,SAAS;QAC7B,GACCC,SAAS;QACZ,MAAMC,MAAMP,IAAI,CAAC,EAAE;QACnB,IAAI,CAACO,KAAK,MAAM,IAAIC,MAAM;QAC1B,OAAOhB,eAAee;IACxB;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeY,6BAA6BpB,MAElD;IACC,MAAMC,OAAO,MAAMV,KAChBsB,MAAM,GACNE,IAAI,CAACvB,eACLwB,KAAK,CACJ/B,IACEC,GAAGM,cAAca,WAAW,EAAEL,OAAOK,WAAW,GAChDjB,OAAOI,cAAc6B,SAAS,GAC9BjC,OAAOI,cAAc8B,SAAS,GAC9BnC,GAAGK,cAAcc,SAAS,EAAEhB,GAAG,CAAC,KAAK,CAAC,IAGzC4B,KAAK,CAAC;IAET,MAAMV,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOW;IACjB,OAAO1B,eAAee;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAee,uBAAuBvB,MAE5C;IACC,MAAMC,OAAO,MAAMV,KAChBsB,MAAM,GACNE,IAAI,CAACvB,eACLwB,KAAK,CACJ/B,IACEC,GAAGM,cAAca,WAAW,EAAEL,OAAOK,WAAW,GAChDjB,OAAOI,cAAc6B,SAAS,GAC9BlC,GAAGK,cAAcc,SAAS,EAAEhB,GAAG,CAAC,KAAK,CAAC,IAGzC4B,KAAK,CAAC;IAET,MAAMV,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOW;IACjB,OAAO1B,eAAee;AACxB;AAEA;;;;CAIC,GACD,OAAO,eAAegB,mBAAmBxB,MAMxC;IACC,OAAO,MAAMT,KAAKoB,WAAW,CAAC,OAAOf;QACnC,MAAMC,SACJG,OAAOH,MAAM,IACb,AACE,CAAA,MAAMD,GACHiB,MAAM,CAAC;YAAChB,QAAQL,cAAcK,MAAM;QAAA,GACpCkB,IAAI,CAACvB,eACLwB,KAAK,CAAC9B,GAAGM,cAAcyB,EAAE,EAAEjB,OAAOiB,EAAE,GACpCC,KAAK,CAAC,EAAC,CACX,CAAC,EAAE,EAAErB;QACR,IAAI,CAACA,QAAQ,OAAOsB;QAEpB,MAAMxB,yBAAyBC,IAAIC;QACnC,MAAMe,WAAW,MAAMhB,GACpBiB,MAAM,CAAC;YAACC,QAAQpB,MAAMoB,MAAM;QAAA,GAC5BC,IAAI,CAACrB,OACLsB,KAAK,CAAC9B,GAAGQ,MAAMuB,EAAE,EAAEpB,SACnBqB,KAAK,CAAC;QACT,IAAIN,QAAQ,CAAC,EAAE,EAAEE,WAAW,UAAU,OAAOK;QAE7C,MAAMM,cAAc,MAAM7B,GACvB8B,MAAM,CAAClC,eACPmC,GAAG,CAAC;YACHL,WAAWhC,GAAG,CAAC,KAAK,CAAC;YACrBsC,YAAYtC,GAAG,CAAC,KAAK,CAAC;YACtBuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;QACvB,GACC0B,KAAK,CACJ/B,IACEC,GAAGM,cAAcyB,EAAE,EAAEjB,OAAOiB,EAAE,GAC9B/B,GAAGM,cAAca,WAAW,EAAEL,OAAO8B,kBAAkB,GACvD1C,OAAOI,cAAc6B,SAAS,GAC9BjC,OAAOI,cAAc8B,SAAS,GAC9BnC,GAAGK,cAAcc,SAAS,EAAEhB,GAAG,CAAC,KAAK,CAAC,IAGzCiB,SAAS;QAEZ,MAAMwB,UAAUN,WAAW,CAAC,EAAE;QAC9B,IAAI,CAACM,SAAS,OAAOZ;QAErB,MAAMa,gBAAgB,MAAMpC,GACzBM,MAAM,CAACV,eACPW,MAAM,CAAC;YACNC,WAAW2B,QAAQ3B,SAAS;YAC5BP,QAAQkC,QAAQlC,MAAM;YACtBQ,aAAaL,OAAOiC,eAAe;YACnC3B,WAAWN,OAAOM,SAAS;QAC7B,GACCC,SAAS;QAEZ,IAAI,CAACyB,aAAa,CAAC,EAAE,EAAE,MAAM,IAAIvB,MAAM;QAEvC,OAAOhB,eAAesC;IACxB;AACF;AAEA,OAAO,eAAeG,yBAAyBlC,MAA6B;IAC1E,MAAMT,KACHmC,MAAM,CAAClC,eACPmC,GAAG,CAAC;QAACN,WAAW/B,GAAG,CAAC,KAAK,CAAC;QAAEuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD0B,KAAK,CAAC/B,IAAIC,GAAGM,cAAca,WAAW,EAAEL,OAAOK,WAAW,GAAGjB,OAAOI,cAAc6B,SAAS;AAChG;AAEA,OAAO,eAAec,qBAAqBnC,MAG1C;IACC,MAAMT,KACHmC,MAAM,CAAClC,eACPmC,GAAG,CAAC;QAACN,WAAW/B,GAAG,CAAC,KAAK,CAAC;QAAEuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD0B,KAAK,CACJ/B,IACEC,GAAGM,cAAcY,SAAS,EAAEJ,OAAOI,SAAS,GAC5ClB,GAAGM,cAAcK,MAAM,EAAEG,OAAOH,MAAM,GACtCT,OAAOI,cAAc6B,SAAS;AAGtC;AAEA,OAAO,eAAee,2BAA2BpC,MAGhD;IACC,MAAMT,KACHmC,MAAM,CAAClC,eACPmC,GAAG,CAAC;QAACN,WAAW/B,GAAG,CAAC,KAAK,CAAC;QAAEuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD0B,KAAK,CACJ/B,IACEC,GAAGM,cAAcK,MAAM,EAAEG,OAAOH,MAAM,GACtCT,OAAOI,cAAc6B,SAAS,GAC9BrB,OAAOqC,oBAAoB,GAAGhD,GAAGG,cAAcyB,EAAE,EAAEjB,OAAOqC,oBAAoB,IAAIlB;AAG1F"}

package/dist/db/schema/admin-command-results.d.ts

@@ -1,4 +1,5 @@
 import type { AdminRole } from '@shipfox/api-auth-dto';
+import type { UserStatus } from '#core/entities/user.js';
 export interface StoredAdminGrant {
     id: string;
     userId: string;
@@ -7,9 +8,25 @@ export interface StoredAdminGrant {
     createdAt: string;
     updatedAt: string;
 }
-export interface StoredAdminCommandResult {
-    grant: StoredAdminGrant;
+export interface StoredAdministratorUserSummary {
+    id: string;
+    email: string;
+    name: string | null;
+    emailVerifiedAt: string | null;
+    status: UserStatus;
+    createdAt: string;
+    adminRole: AdminRole | null;
 }
+export interface StoredAdminUserModerationResult {
+    user: StoredAdministratorUserSummary;
+    correlationId: string;
+    sessionsRevoked: number;
+}
+export type StoredAdminCommandResult = {
+    grant: StoredAdminGrant;
+} | {
+    userModeration: StoredAdminUserModerationResult;
+};
 export declare const adminCommandResults: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "admin_command_results";
     schema: undefined;

package/dist/db/schema/admin-command-results.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-command-results.d.ts","sourceRoot":"","sources":["../../../src/db/schema/admin-command-results.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAMrD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmB/B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,OAAO,mBAAmB,CAAC,YAAY,CAAC"}
+{"version":3,"file":"admin-command-results.d.ts","sourceRoot":"","sources":["../../../src/db/schema/admin-command-results.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAIvD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,KAAK,EAAE,gBAAgB,CAAC;CACzB,GACD;IACE,cAAc,EAAE,+BAA+B,CAAC;CACjD,CAAC;AAEN,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmB/B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,OAAO,mBAAmB,CAAC,YAAY,CAAC"}

package/dist/db/schema/admin-command-results.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/db/schema/admin-command-results.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {jsonb, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport {pgTable} from './common.js';\nimport {users} from './users.js';\n\nexport interface StoredAdminGrant {\n  id: string;\n  userId: string;\n  role: AdminRole;\n  revokedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport interface StoredAdminCommandResult {\n  grant: StoredAdminGrant;\n}\n\nexport const adminCommandResults = pgTable(\n  'admin_command_results',\n  {\n    id: uuidv7PrimaryKey(),\n    actorId: uuid('actor_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    idempotencyKeyFingerprint: text('idempotency_key_fingerprint').notNull(),\n    command: text('command').notNull(),\n    requestFingerprint: text('request_fingerprint').notNull(),\n    result: jsonb('result').$type<StoredAdminCommandResult>().notNull(),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_admin_command_results_actor_key_unique').on(\n      table.actorId,\n      table.idempotencyKeyFingerprint,\n    ),\n  ],\n);\n\nexport type AdminCommandResultDb = typeof adminCommandResults.$inferSelect;\n"],"names":["uuidv7PrimaryKey","jsonb","text","timestamp","uniqueIndex","uuid","pgTable","users","adminCommandResults","id","actorId","notNull","references","onDelete","idempotencyKeyFingerprint","command","requestFingerprint","result","$type","createdAt","withTimezone","defaultNow","table","on"],"mappings":"AACA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,KAAK,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AAC9E,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,KAAK,QAAO,aAAa;AAejC,OAAO,MAAMC,sBAAsBF,QACjC,yBACA;IACEG,IAAIT;IACJU,SAASL,KAAK,YACXM,OAAO,GACPC,UAAU,CAAC,IAAML,MAAME,EAAE,EAAE;QAACI,UAAU;IAAS;IAClDC,2BAA2BZ,KAAK,+BAA+BS,OAAO;IACtEI,SAASb,KAAK,WAAWS,OAAO;IAChCK,oBAAoBd,KAAK,uBAAuBS,OAAO;IACvDM,QAAQhB,MAAM,UAAUiB,KAAK,GAA6BP,OAAO;IACjEQ,WAAWhB,UAAU,cAAc;QAACiB,cAAc;IAAI,GAAGT,OAAO,GAAGU,UAAU;AAC/E,GACA,CAACC,QAAU;QACTlB,YAAY,+CAA+CmB,EAAE,CAC3DD,MAAMZ,OAAO,EACbY,MAAMR,yBAAyB;KAElC,EACD"}
+{"version":3,"sources":["../../../src/db/schema/admin-command-results.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {jsonb, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport type {UserStatus} from '#core/entities/user.js';\nimport {pgTable} from './common.js';\nimport {users} from './users.js';\n\nexport interface StoredAdminGrant {\n  id: string;\n  userId: string;\n  role: AdminRole;\n  revokedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport interface StoredAdministratorUserSummary {\n  id: string;\n  email: string;\n  name: string | null;\n  emailVerifiedAt: string | null;\n  status: UserStatus;\n  createdAt: string;\n  adminRole: AdminRole | null;\n}\n\nexport interface StoredAdminUserModerationResult {\n  user: StoredAdministratorUserSummary;\n  correlationId: string;\n  sessionsRevoked: number;\n}\n\nexport type StoredAdminCommandResult =\n  | {\n      grant: StoredAdminGrant;\n    }\n  | {\n      userModeration: StoredAdminUserModerationResult;\n    };\n\nexport const adminCommandResults = pgTable(\n  'admin_command_results',\n  {\n    id: uuidv7PrimaryKey(),\n    actorId: uuid('actor_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    idempotencyKeyFingerprint: text('idempotency_key_fingerprint').notNull(),\n    command: text('command').notNull(),\n    requestFingerprint: text('request_fingerprint').notNull(),\n    result: jsonb('result').$type<StoredAdminCommandResult>().notNull(),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_admin_command_results_actor_key_unique').on(\n      table.actorId,\n      table.idempotencyKeyFingerprint,\n    ),\n  ],\n);\n\nexport type AdminCommandResultDb = typeof adminCommandResults.$inferSelect;\n"],"names":["uuidv7PrimaryKey","jsonb","text","timestamp","uniqueIndex","uuid","pgTable","users","adminCommandResults","id","actorId","notNull","references","onDelete","idempotencyKeyFingerprint","command","requestFingerprint","result","$type","createdAt","withTimezone","defaultNow","table","on"],"mappings":"AACA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,KAAK,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AAE9E,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,KAAK,QAAO,aAAa;AAmCjC,OAAO,MAAMC,sBAAsBF,QACjC,yBACA;IACEG,IAAIT;IACJU,SAASL,KAAK,YACXM,OAAO,GACPC,UAAU,CAAC,IAAML,MAAME,EAAE,EAAE;QAACI,UAAU;IAAS;IAClDC,2BAA2BZ,KAAK,+BAA+BS,OAAO;IACtEI,SAASb,KAAK,WAAWS,OAAO;IAChCK,oBAAoBd,KAAK,uBAAuBS,OAAO;IACvDM,QAAQhB,MAAM,UAAUiB,KAAK,GAA6BP,OAAO;IACjEQ,WAAWhB,UAAU,cAAc;QAACiB,cAAc;IAAI,GAAGT,OAAO,GAAGU,UAAU;AAC/E,GACA,CAACC,QAAU;QACTlB,YAAY,+CAA+CmB,EAAE,CAC3DD,MAAMZ,OAAO,EACbY,MAAMR,yBAAyB;KAElC,EACD"}

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import type { ShipfoxModule } from '@shipfox/node-module';
 import type { SignupPolicy } from '#core/ports.js';
 export type { AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
 export { ADMIN_ROLES, getCurrentAdminRole, hasMinimumAdminRole, highestAdminRole, requireAdminRole, revokeAdminGrant, } from '#core/admin-role.js';
-export { bootstrapFirstAdminOwner, grantAdministratorRole, revokeAdministratorGrant, } from '#core/administration.js';
+export { bootstrapFirstAdminOwner, grantAdministratorRole, reactivateAdministratorUser, revokeAdministratorGrant, revokeAdministratorUserSessions, suspendAdministratorUser, } from '#core/administration.js';
 export type { CreateSessionForUserError, CreateSessionForUserParams, CreateSessionForUserResult, ProvisionUserParams, } from '#core/auth.js';
 export { createSessionForUser, provisionUser } from '#core/auth.js';
 export type { EmailOwner, FindUserByEmailParams } from '#core/email-owner.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAqBjD,YAAY,EAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACpG,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,+BAA+B,EAC/B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,EACV,YAA8C,GAC/C,EAAE,uBAAuB,GAAG,aAAa,CAiBzC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAqBjD,YAAY,EAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACpG,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,+BAA+B,EAC/B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,EACV,YAA8C,GAC/C,EAAE,uBAAuB,GAAG,aAAa,CAiBzC"}

package/dist/index.js

@@ -20,7 +20,7 @@ const authPublisherEventSchemas = {
     ...administrationActionEventSchemas
 };
 export { ADMIN_ROLES, getCurrentAdminRole, hasMinimumAdminRole, highestAdminRole, requireAdminRole, revokeAdminGrant } from '#core/admin-role.js';
-export { bootstrapFirstAdminOwner, grantAdministratorRole, revokeAdministratorGrant } from '#core/administration.js';
+export { bootstrapFirstAdminOwner, grantAdministratorRole, reactivateAdministratorUser, revokeAdministratorGrant, revokeAdministratorUserSessions, suspendAdministratorUser } from '#core/administration.js';
 export { createSessionForUser, provisionUser } from '#core/auth.js';
 export { findUserByEmail } from '#core/email-owner.js';
 export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidAdminBootstrapTokenError, InvalidCredentialsError, LastAdminOwnerError, SignupNotAllowedError, UserNotFoundError } from '#core/errors.js';