@shipfox/api-auth 10.1.0 → 11.0.0

package/src/db/admin-grants.ts

@@ -1,15 +1,11 @@
 import type {AdminRole} from '@shipfox/api-auth-dto';
-import type {
-  AdministrationActionEvent,
-  AdministrationActionEventMap,
-} from '@shipfox/api-common-dto';
+import type {AdministrationActionEvent} from '@shipfox/api-common-dto';
 import {
   paginateTimestampIdRows,
   type TimestampIdCursor,
   timestampIdCursorWhere,
 } from '@shipfox/node-drizzle';
-import {writeOutboxEvent} from '@shipfox/node-outbox';
-import {and, desc, eq, isNull, sql} from 'drizzle-orm';
+import {and, desc, eq, isNull} from 'drizzle-orm';
 import {highestAdminRole} from '#core/admin-role-model.js';
 import type {AdminGrant} from '#core/entities/admin-grant.js';
 import type {AdministratorGrantSummary} from '#core/entities/administrator-read-model.js';
@@ -17,21 +13,22 @@ import {
   AdminBootstrapClosedError,
   AdminGrantAlreadyExistsError,
   AdminGrantNotFoundError,
-  AdminIdempotencyKeyReuseError,
   LastAdminOwnerError,
   UserNotFoundError,
 } from '#core/errors.js';
-import {db} from './db.js';
 import {
-  type AdminCommandResultDb,
-  adminCommandResults,
-  type StoredAdminGrant,
-} from './schema/admin-command-results.js';
+  findAdminCommandResult,
+  lockAdminCommand,
+  lockAdminOwnerGrants,
+  storeAdminCommandResult,
+  type Tx,
+  writeAdminAction,
+} from './admin-command.js';
+import {db} from './db.js';
+import type {StoredAdminGrant} from './schema/admin-command-results.js';
 import {adminGrants, toAdminGrant} from './schema/admin-grants.js';
-import {authOutbox} from './schema/outbox.js';
 import {users} from './schema/users.js';
 
-type Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
 type AdminOwnerQueryExecutor = ReturnType<typeof db> | Tx;
 
 function activeAdminOwnerWhere() {
@@ -145,7 +142,7 @@ export async function revokeAdminGrant(params: {grantId: string}): Promise<Admin
   return await db().transaction(async (tx) => {
     // All owner grant changes share one lock so concurrent revocations cannot
     // both observe the same final owner and leave the instance ownerless.
-    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+    await lockAdminOwnerGrants(tx);
 
     const rows = await tx
       .select()
@@ -208,23 +205,10 @@ async function findCommandResult(
     command: string;
   },
 ): Promise<AdminGrant | undefined> {
-  const rows = await tx
-    .select()
-    .from(adminCommandResults)
-    .where(
-      and(
-        eq(adminCommandResults.actorId, params.actorId),
-        eq(adminCommandResults.idempotencyKeyFingerprint, params.idempotencyKeyFingerprint),
-      ),
-    )
-    .limit(1);
-  const result: AdminCommandResultDb | undefined = rows[0];
+  const result = await findAdminCommandResult(tx, params);
   if (!result) return undefined;
-  if (
-    result.command !== params.command ||
-    result.requestFingerprint !== params.requestFingerprint
-  ) {
-    throw new AdminIdempotencyKeyReuseError();
+  if (!('grant' in result.result)) {
+    throw new Error('Administrator command result has an unexpected shape');
   }
   return fromStoredAdminGrant(result.result.grant);
 }
@@ -234,29 +218,7 @@ async function storeCommandResult(
   params: AuditedAdminCommandParams,
   grant: AdminGrant,
 ): Promise<void> {
-  await tx.insert(adminCommandResults).values({
-    actorId: params.actorId,
-    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
-    command: params.event.command,
-    requestFingerprint: params.requestFingerprint,
-    result: {grant: toStoredAdminGrant(grant)},
-  });
-}
-
-async function writeAdminAction(tx: Tx, event: AdministrationActionEvent): Promise<void> {
-  await writeOutboxEvent<AdministrationActionEventMap>(tx, authOutbox, {
-    type: 'administration.action.performed',
-    payload: event,
-  });
-}
-
-async function lockAdminCommand(
-  tx: Tx,
-  params: {actorId: string; idempotencyKeyFingerprint: string},
-) {
-  await tx.execute(
-    sql`select pg_advisory_xact_lock(hashtext(${`auth_admin_command:${params.actorId}:${params.idempotencyKeyFingerprint}`}))`,
-  );
+  await storeAdminCommandResult(tx, params, {grant: toStoredAdminGrant(grant)});
 }
 
 export async function bootstrapFirstAdminOwner(
@@ -264,7 +226,7 @@ export async function bootstrapFirstAdminOwner(
 ): Promise<AdminGrant> {
   return await db().transaction(async (tx) => {
     await lockAdminCommand(tx, params);
-    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+    await lockAdminOwnerGrants(tx);
 
     const existing = await findCommandResult(tx, {
       ...params,
@@ -301,7 +263,7 @@ export async function grantAdminRoleWithAudit(
 ): Promise<AdminGrant> {
   return await db().transaction(async (tx) => {
     await lockAdminCommand(tx, params);
-    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+    await lockAdminOwnerGrants(tx);
 
     const existing = await findCommandResult(tx, {
       ...params,
@@ -349,7 +311,7 @@ export async function revokeAdminGrantWithAudit(
 ): Promise<AdminGrant> {
   return await db().transaction(async (tx) => {
     await lockAdminCommand(tx, params);
-    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+    await lockAdminOwnerGrants(tx);
 
     const existing = await findCommandResult(tx, {
       ...params,

package/src/db/admin-user-moderation.ts

@@ -0,0 +1,230 @@
+import type {AdministrationActionEvent} from '@shipfox/api-common-dto';
+import {and, eq, gt, isNull, sql} from 'drizzle-orm';
+import {hasMinimumAdminRole, highestAdminRole} from '#core/admin-role-model.js';
+import type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';
+import {AdminRoleRequiredError, LastAdminOwnerError, UserNotFoundError} from '#core/errors.js';
+import {
+  findAdminCommandResult,
+  lockAdminCommand,
+  lockAdminOwnerGrants,
+  storeAdminCommandResult,
+  type Tx,
+  writeAdminAction,
+} from './admin-command.js';
+import {findAdministratorUserSummary} from './admin-user-summary.js';
+import {db} from './db.js';
+import {lockUserSessionMutations} from './refresh-tokens.js';
+import type {
+  StoredAdministratorUserSummary,
+  StoredAdminUserModerationResult,
+} from './schema/admin-command-results.js';
+import {adminGrants} from './schema/admin-grants.js';
+import {refreshTokens} from './schema/refresh-tokens.js';
+import {users} from './schema/users.js';
+
+interface UserModerationCommandParams {
+  actorId: string;
+  userId: string;
+  idempotencyKeyFingerprint: string;
+  requestFingerprint: string;
+  event: AdministrationActionEvent;
+}
+
+function toStoredUserSummary(user: AdministratorUserSummary): StoredAdministratorUserSummary {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    emailVerifiedAt: user.emailVerifiedAt?.toISOString() ?? null,
+    status: user.status,
+    createdAt: user.createdAt.toISOString(),
+    adminRole: user.adminRole,
+  };
+}
+
+async function findUserSummary(tx: Tx, userId: string): Promise<StoredAdministratorUserSummary> {
+  const user = await findAdministratorUserSummary(tx, {id: userId});
+  if (!user) throw new Error('User summary query returned no rows');
+  return toStoredUserSummary(user);
+}
+
+function fromStoredResult(result: StoredAdminUserModerationResult) {
+  return {
+    user: {
+      id: result.user.id,
+      email: result.user.email,
+      name: result.user.name,
+      emailVerifiedAt: result.user.emailVerifiedAt ? new Date(result.user.emailVerifiedAt) : null,
+      status: result.user.status,
+      createdAt: new Date(result.user.createdAt),
+      adminRole: result.user.adminRole,
+    },
+    correlationId: result.correlationId,
+    sessionsRevoked: result.sessionsRevoked,
+  };
+}
+
+async function findCommandResult(
+  tx: Tx,
+  params: Pick<
+    UserModerationCommandParams,
+    'actorId' | 'idempotencyKeyFingerprint' | 'requestFingerprint'
+  > & {command: string},
+) {
+  const result = await findAdminCommandResult(tx, params);
+  if (!result) return undefined;
+  if (!('userModeration' in result.result)) {
+    throw new Error('Administrator command result has an unexpected shape');
+  }
+  return fromStoredResult(result.result.userModeration);
+}
+
+async function storeCommandResult(
+  tx: Tx,
+  params: UserModerationCommandParams,
+  result: StoredAdminUserModerationResult,
+): Promise<void> {
+  await storeAdminCommandResult(tx, params, {userModeration: result});
+}
+
+async function readTargetUserForUpdate(tx: Tx, userId: string) {
+  const rows = await tx
+    .select({id: users.id, status: users.status})
+    .from(users)
+    .where(eq(users.id, userId))
+    .limit(1)
+    .for('update');
+  const user = rows[0];
+  if (!user || user.status === 'deleted') throw new UserNotFoundError(userId);
+  return user;
+}
+
+async function requireActiveAdminOperator(tx: Tx, actorId: string): Promise<void> {
+  const actorRows = await tx
+    .select({status: users.status})
+    .from(users)
+    .where(eq(users.id, actorId))
+    .limit(1);
+  const actor = actorRows[0];
+  const grants = await tx
+    .select({role: adminGrants.role})
+    .from(adminGrants)
+    .where(and(eq(adminGrants.userId, actorId), isNull(adminGrants.revokedAt)));
+  const role = highestAdminRole(grants.map(({role}) => role));
+
+  if (actor?.status !== 'active' || !role || !hasMinimumAdminRole(role, 'admin-operator')) {
+    throw new AdminRoleRequiredError('admin-operator');
+  }
+}
+
+async function revokeActiveSessions(tx: Tx, userId: string): Promise<number> {
+  const revoked = await tx
+    .update(refreshTokens)
+    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})
+    .where(
+      and(
+        eq(refreshTokens.userId, userId),
+        isNull(refreshTokens.revokedAt),
+        gt(refreshTokens.expiresAt, sql`now()`),
+      ),
+    )
+    .returning({sessionId: refreshTokens.sessionId});
+
+  return new Set(revoked.map(({sessionId}) => sessionId)).size;
+}
+
+async function executeUserModerationCommand(
+  params: UserModerationCommandParams & {
+    operation: 'suspend' | 'reactivate' | 'revoke-sessions';
+  },
+) {
+  return await db().transaction(async (tx) => {
+    await lockAdminCommand(tx, params);
+    if (params.operation === 'suspend') await lockAdminOwnerGrants(tx);
+
+    const existing = await findCommandResult(tx, {
+      ...params,
+      command: params.event.command,
+    });
+    if (existing) return existing;
+
+    await lockUserSessionMutations(tx, params.userId);
+    const user = await readTargetUserForUpdate(tx, params.userId);
+    await requireActiveAdminOperator(tx, params.actorId);
+    let sessionsRevoked = 0;
+
+    if (params.operation === 'suspend') {
+      if (user.status === 'active') {
+        const activeOwners = await tx
+          .select({id: adminGrants.id})
+          .from(adminGrants)
+          .innerJoin(users, eq(adminGrants.userId, users.id))
+          .where(
+            and(
+              eq(adminGrants.role, 'admin-owner'),
+              isNull(adminGrants.revokedAt),
+              eq(users.status, 'active'),
+            ),
+          )
+          .limit(2);
+        const targetIsActiveOwner = await tx
+          .select({id: adminGrants.id})
+          .from(adminGrants)
+          .where(
+            and(
+              eq(adminGrants.userId, user.id),
+              eq(adminGrants.role, 'admin-owner'),
+              isNull(adminGrants.revokedAt),
+            ),
+          )
+          .limit(1);
+        if (targetIsActiveOwner.length > 0 && activeOwners.length <= 1) {
+          throw new LastAdminOwnerError();
+        }
+
+        await tx
+          .update(users)
+          .set({status: 'suspended', updatedAt: sql`now()`})
+          .where(eq(users.id, user.id));
+      }
+      sessionsRevoked = await revokeActiveSessions(tx, user.id);
+    } else if (params.operation === 'reactivate' && user.status === 'suspended') {
+      await tx
+        .update(users)
+        .set({status: 'active', updatedAt: sql`now()`})
+        .where(eq(users.id, user.id));
+    } else if (params.operation === 'revoke-sessions') {
+      sessionsRevoked = await revokeActiveSessions(tx, user.id);
+    }
+
+    const summary = await findUserSummary(tx, user.id);
+    const result: StoredAdminUserModerationResult = {
+      user: summary,
+      correlationId: params.event.correlationId,
+      sessionsRevoked,
+    };
+    await writeAdminAction(tx, params.event);
+    await storeCommandResult(tx, params, result);
+    return fromStoredResult(result);
+  });
+}
+
+export type UserModerationResult = Awaited<ReturnType<typeof executeUserModerationCommand>>;
+
+export async function suspendUserWithAudit(
+  params: UserModerationCommandParams,
+): Promise<UserModerationResult> {
+  return await executeUserModerationCommand({...params, operation: 'suspend'});
+}
+
+export async function reactivateUserWithAudit(
+  params: UserModerationCommandParams,
+): Promise<UserModerationResult> {
+  return await executeUserModerationCommand({...params, operation: 'reactivate'});
+}
+
+export async function revokeUserSessionsWithAudit(
+  params: UserModerationCommandParams,
+): Promise<UserModerationResult> {
+  return await executeUserModerationCommand({...params, operation: 'revoke-sessions'});
+}

package/src/db/admin-user-summary.ts

@@ -0,0 +1,51 @@
+import {and, eq, isNull} from 'drizzle-orm';
+import {highestAdminRole} from '#core/admin-role-model.js';
+import type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';
+import type {db} from './db.js';
+import {adminGrants} from './schema/admin-grants.js';
+import {users} from './schema/users.js';
+
+type Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
+export type AdministratorUserSummaryExecutor = ReturnType<typeof db> | Tx;
+
+type AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};
+
+export async function findAdministratorUserSummary(
+  executor: AdministratorUserSummaryExecutor,
+  params: AdministratorUserLookup,
+): Promise<AdministratorUserSummary | undefined> {
+  const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);
+  const rows = await executor
+    .select({
+      id: users.id,
+      email: users.email,
+      name: users.name,
+      emailVerifiedAt: users.emailVerifiedAt,
+      status: users.status,
+      createdAt: users.createdAt,
+      adminRole: adminGrants.role,
+    })
+    .from(users)
+    .leftJoin(
+      adminGrants,
+      and(
+        eq(adminGrants.userId, users.id),
+        isNull(adminGrants.revokedAt),
+        eq(users.status, 'active'),
+      ),
+    )
+    .where(identifier);
+
+  const first = rows[0];
+  if (!first) return undefined;
+
+  return {
+    id: first.id,
+    email: first.email,
+    name: first.name,
+    emailVerifiedAt: first.emailVerifiedAt,
+    status: first.status,
+    createdAt: first.createdAt,
+    adminRole: highestAdminRole(rows.flatMap(({adminRole}) => (adminRole ? [adminRole] : []))),
+  } satisfies AdministratorUserSummary;
+}

package/src/db/admin-users.ts

@@ -1,58 +1,13 @@
-import type {AdminRole} from '@shipfox/api-auth-dto';
-import {and, eq, isNull} from 'drizzle-orm';
-import {highestAdminRole} from '#core/admin-role-model.js';
-import type {UserStatus} from '#core/entities/user.js';
+import type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';
+import {findAdministratorUserSummary} from './admin-user-summary.js';
 import {db} from './db.js';
-import {adminGrants} from './schema/admin-grants.js';
-import {users} from './schema/users.js';
 
-export interface AdministratorUserRecord {
-  id: string;
-  email: string;
-  name: string | null;
-  emailVerifiedAt: Date | null;
-  status: UserStatus;
-  createdAt: Date;
-  adminRole: AdminRole | null;
-}
+export type AdministratorUserRecord = AdministratorUserSummary;
 
 type AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};
 
 export async function findAdministratorUser(
   params: AdministratorUserLookup,
 ): Promise<AdministratorUserRecord | undefined> {
-  const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);
-  const rows = await db()
-    .select({
-      id: users.id,
-      email: users.email,
-      name: users.name,
-      emailVerifiedAt: users.emailVerifiedAt,
-      status: users.status,
-      createdAt: users.createdAt,
-      adminRole: adminGrants.role,
-    })
-    .from(users)
-    .leftJoin(
-      adminGrants,
-      and(
-        eq(adminGrants.userId, users.id),
-        isNull(adminGrants.revokedAt),
-        eq(users.status, 'active'),
-      ),
-    )
-    .where(identifier);
-
-  const first = rows[0];
-  if (!first) return undefined;
-
-  return {
-    id: first.id,
-    email: first.email,
-    name: first.name,
-    emailVerifiedAt: first.emailVerifiedAt,
-    status: first.status,
-    createdAt: first.createdAt,
-    adminRole: highestAdminRole(rows.flatMap(({adminRole}) => (adminRole ? [adminRole] : []))),
-  };
+  return await findAdministratorUserSummary(db(), params);
 }

package/src/db/refresh-tokens.test.ts

@@ -1,7 +1,6 @@
 import {hashOpaqueToken} from '@shipfox/node-tokens';
 import {
   createRefreshToken,
-  findActiveRefreshSession,
   findActiveRefreshTokenByHash,
   findRefreshTokenByHash,
   revokeRefreshSession,
@@ -45,24 +44,6 @@ describe('refresh-tokens db', () => {
     expect(found).toBeUndefined();
   });
 
-  test('finds only the active session owned by the requested user', async () => {
-    const user = await createUser({email: emailFor('rt-session'), hashedPassword: 'h'});
-    const otherUser = await createUser({email: emailFor('rt-session-other'), hashedPassword: 'h'});
-    const sessionId = crypto.randomUUID();
-    await createRefreshToken({
-      userId: user.id,
-      sessionId,
-      hashedToken: hashOpaqueToken(`active-${crypto.randomUUID()}`),
-      expiresAt: new Date(Date.now() + 60_000),
-    });
-
-    const found = await findActiveRefreshSession({sessionId, userId: user.id});
-    const otherUserFound = await findActiveRefreshSession({sessionId, userId: otherUser.id});
-
-    expect(found?.sessionId).toBe(sessionId);
-    expect(otherUserFound).toBeUndefined();
-  });
-
   test('rotates a token once, creates the successor, and only the first caller wins', async () => {
     const user = await createUser({email: emailFor('rt-rotate'), hashedPassword: 'h'});
     const currentHashedToken = hashOpaqueToken(`current-${crypto.randomUUID()}`);

package/src/db/refresh-tokens.ts

@@ -2,6 +2,13 @@ import {and, eq, gt, isNull, ne, sql} from 'drizzle-orm';
 import type {RefreshToken} from '#core/entities/refresh-token.js';
 import {db} from './db.js';
 import {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';
+import {users} from './schema/users.js';
+
+type Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
+
+export async function lockUserSessionMutations(tx: Tx, userId: string): Promise<void> {
+  await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${`auth_user_sessions:${userId}`}))`);
+}
 
 export interface CreateRefreshTokenParams {
   sessionId?: string | undefined;
@@ -26,6 +33,33 @@ export async function createRefreshToken(params: CreateRefreshTokenParams): Prom
   return toRefreshToken(row);
 }
 
+export async function createRefreshTokenForActiveUser(
+  params: CreateRefreshTokenParams,
+): Promise<RefreshToken | undefined> {
+  return await db().transaction(async (tx) => {
+    await lockUserSessionMutations(tx, params.userId);
+    const userRows = await tx
+      .select({status: users.status})
+      .from(users)
+      .where(eq(users.id, params.userId))
+      .limit(1);
+    if (userRows[0]?.status !== 'active') return undefined;
+
+    const rows = await tx
+      .insert(refreshTokens)
+      .values({
+        sessionId: params.sessionId,
+        userId: params.userId,
+        hashedToken: params.hashedToken,
+        expiresAt: params.expiresAt,
+      })
+      .returning();
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    return toRefreshToken(row);
+  });
+}
+
 /**
  * Looks up the live session token by hash — one that can still authenticate as
  * the current session. Returns `undefined` for revoked, expired, or already
@@ -53,29 +87,6 @@ export async function findActiveRefreshTokenByHash(params: {
   return toRefreshToken(row);
 }
 
-export async function findActiveRefreshSession(params: {
-  sessionId: string;
-  userId: string;
-}): Promise<RefreshToken | undefined> {
-  const rows = await db()
-    .select()
-    .from(refreshTokens)
-    .where(
-      and(
-        eq(refreshTokens.sessionId, params.sessionId),
-        eq(refreshTokens.userId, params.userId),
-        isNull(refreshTokens.revokedAt),
-        isNull(refreshTokens.rotatedAt),
-        gt(refreshTokens.expiresAt, sql`now()`),
-      ),
-    )
-    .limit(1);
-
-  const row = rows[0];
-  if (!row) return undefined;
-  return toRefreshToken(row);
-}
-
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
@@ -108,12 +119,32 @@ export async function findRefreshTokenByHash(params: {
  * If the successor insert fails, the predecessor rotation rolls back.
  */
 export async function rotateRefreshToken(params: {
+  userId?: string | undefined;
   id: string;
   currentHashedToken: string;
   nextHashedToken: string;
   expiresAt: Date;
 }): Promise<RefreshToken | undefined> {
   return await db().transaction(async (tx) => {
+    const userId =
+      params.userId ??
+      (
+        await tx
+          .select({userId: refreshTokens.userId})
+          .from(refreshTokens)
+          .where(eq(refreshTokens.id, params.id))
+          .limit(1)
+      )[0]?.userId;
+    if (!userId) return undefined;
+
+    await lockUserSessionMutations(tx, userId);
+    const userRows = await tx
+      .select({status: users.status})
+      .from(users)
+      .where(eq(users.id, userId))
+      .limit(1);
+    if (userRows[0]?.status !== 'active') return undefined;
+
     const rotatedRows = await tx
       .update(refreshTokens)
       .set({

package/src/db/schema/admin-command-results.ts

@@ -1,6 +1,7 @@
 import type {AdminRole} from '@shipfox/api-auth-dto';
 import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
 import {jsonb, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {UserStatus} from '#core/entities/user.js';
 import {pgTable} from './common.js';
 import {users} from './users.js';
 
@@ -13,10 +14,30 @@ export interface StoredAdminGrant {
   updatedAt: string;
 }
 
-export interface StoredAdminCommandResult {
-  grant: StoredAdminGrant;
+export interface StoredAdministratorUserSummary {
+  id: string;
+  email: string;
+  name: string | null;
+  emailVerifiedAt: string | null;
+  status: UserStatus;
+  createdAt: string;
+  adminRole: AdminRole | null;
 }
 
+export interface StoredAdminUserModerationResult {
+  user: StoredAdministratorUserSummary;
+  correlationId: string;
+  sessionsRevoked: number;
+}
+
+export type StoredAdminCommandResult =
+  | {
+      grant: StoredAdminGrant;
+    }
+  | {
+      userModeration: StoredAdminUserModerationResult;
+    };
+
 export const adminCommandResults = pgTable(
   'admin_command_results',
   {

package/src/index.ts

@@ -40,7 +40,10 @@ export {
 export {
   bootstrapFirstAdminOwner,
   grantAdministratorRole,
+  reactivateAdministratorUser,
   revokeAdministratorGrant,
+  revokeAdministratorUserSessions,
+  suspendAdministratorUser,
 } from '#core/administration.js';
 export type {
   CreateSessionForUserError,