@shipfox/api-auth 18.0.0 → 20.0.0

package/dist/presentation/routes/rate-limit.js

@@ -41,6 +41,16 @@ const policies = {
             windowSeconds: 5 * 60
         }
     },
+    directory: {
+        ip: {
+            limit: 60,
+            windowSeconds: 5 * 60
+        },
+        actor: {
+            limit: 60,
+            windowSeconds: 5 * 60
+        }
+    },
     impersonate: {
         // Bounds mint and probing attempts: the IP bucket bounds aggregate source
         // traffic, and the actor bucket is a per-actor cap that prevents an actor
@@ -56,6 +66,30 @@ const policies = {
             limit: 20,
             windowSeconds: 15 * 60
         }
+    },
+    'oauth-register': {
+        ip: {
+            limit: 10,
+            windowSeconds: 60 * 60
+        }
+    },
+    'oauth-cimd': {
+        ip: {
+            limit: 30,
+            windowSeconds: 60 * 60
+        }
+    },
+    'oauth-authorize': {
+        ip: {
+            limit: 30,
+            windowSeconds: 5 * 60
+        }
+    },
+    'oauth-token': {
+        ip: {
+            limit: 60,
+            windowSeconds: 5 * 60
+        }
     }
 };
 function routeName(request) {

package/dist/presentation/routes/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {getUserContext} from '@shipfox/api-auth-context';\nimport {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {enforceRateLimit as enforceSharedRateLimit} from '@shipfox/node-rate-limit';\nimport {\n  type AuthRateLimitAction,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<\n  AuthRateLimitAction,\n  Partial<Record<AuthRateLimitScope, AuthRateLimitPolicy>>\n> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n  bootstrap: {\n    ip: {limit: 5, windowSeconds: 15 * 60},\n  },\n  'bootstrap-state': {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n  lookup: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n  impersonate: {\n    // Bounds mint and probing attempts: the IP bucket bounds aggregate source\n    // traffic, and the actor bucket is a per-actor cap that prevents an actor\n    // from evading the bound by rotating IPs (every request still consumes the\n    // IP bucket first, so a shared NAT cannot exhaust it faster by pooling\n    // actors). Ladder denials by an identifiable actor role are audited as\n    // `failed` events.\n    ip: {limit: 20, windowSeconds: 15 * 60},\n    actor: {limit: 20, windowSeconds: 15 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  const policy = policies[params.action][params.scope];\n  if (!policy) return;\n\n  await enforceSharedRateLimit({\n    request: params.request,\n    reply: params.reply,\n    check: () =>\n      checkAuthRateLimit({\n        action: params.action,\n        scope: params.scope,\n        identifier: params.identifier,\n        ...policy,\n      }),\n    route: routeName(params.request),\n    unavailableCode: 'auth-rate-limit-unavailable',\n    unavailableMessage: 'Authentication rate limiter unavailable',\n    setRetryAfter: (reply, retryAfterSeconds) => {\n      reply.header('Retry-After', String(retryAfterSeconds));\n    },\n    logWarn: (request, context) => {\n      request.log.warn(context, 'Auth rate limit blocked request');\n    },\n    logError: (request, context) => {\n      request.log.error(context, 'Auth rate limiter unavailable');\n    },\n    createClientError: (presentation, cause) =>\n      new ClientError(presentation.message, presentation.code, {\n        status: presentation.status,\n        ...(presentation.details ? {details: presentation.details} : {}),\n        data: presentation.data,\n        cause,\n      }),\n  });\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n\nexport function createAuthIpRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n  };\n}\n\n/**\n * Rate limits an authenticated route by source IP and by actor. Every request\n * consumes the IP bucket, which bounds aggregate source traffic; the actor\n * bucket is an additional per-actor cap that prevents an actor from evading\n * the bound by rotating IPs. Runs after authentication (auth is an `onRequest`\n * hook), so the user context is set.\n */\nexport function createAuthActorRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n    const client = getUserContext(request);\n    if (client) {\n      await enforceRateLimit({\n        request,\n        reply,\n        action,\n        scope: 'actor',\n        identifier: client.userId,\n      });\n    }\n  };\n}\n"],"names":["getUserContext","ClientError","enforceRateLimit","enforceSharedRateLimit","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","bootstrap","lookup","impersonate","actor","routeName","request","routeOptions","url","split","params","policy","action","scope","reply","check","identifier","route","unavailableCode","unavailableMessage","setRetryAfter","retryAfterSeconds","header","String","logWarn","context","log","warn","logError","error","createClientError","presentation","cause","message","code","status","details","data","createAuthRateLimitPreHandler","body","createAuthIpRateLimitPreHandler","createAuthActorRateLimitPreHandler","client","userId"],"mappings":"AAAA,SAAQA,cAAc,QAAO,4BAA4B;AACzD,SAAQC,WAAW,QAA+C,wBAAwB;AAC1F,SAAQC,oBAAoBC,sBAAsB,QAAO,2BAA2B;AACpF,SAIEC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAGF;IACFC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;IACAE,WAAW;QACTJ,IAAI;YAACC,OAAO;YAAGC,eAAe,KAAK;QAAE;IACvC;IACA,mBAAmB;QACjBF,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACAG,QAAQ;QACNL,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACAI,aAAa;QACX,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,mBAAmB;QACnBN,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCK,OAAO;YAACN,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;AACF;AAMA,SAASM,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAejB,iBAAiBkB,MAM/B;IACC,MAAMC,SAAShB,QAAQ,CAACe,OAAOE,MAAM,CAAC,CAACF,OAAOG,KAAK,CAAC;IACpD,IAAI,CAACF,QAAQ;IAEb,MAAMlB,uBAAuB;QAC3Ba,SAASI,OAAOJ,OAAO;QACvBQ,OAAOJ,OAAOI,KAAK;QACnBC,OAAO,IACLrB,mBAAmB;gBACjBkB,QAAQF,OAAOE,MAAM;gBACrBC,OAAOH,OAAOG,KAAK;gBACnBG,YAAYN,OAAOM,UAAU;gBAC7B,GAAGL,MAAM;YACX;QACFM,OAAOZ,UAAUK,OAAOJ,OAAO;QAC/BY,iBAAiB;QACjBC,oBAAoB;QACpBC,eAAe,CAACN,OAAOO;YACrBP,MAAMQ,MAAM,CAAC,eAAeC,OAAOF;QACrC;QACAG,SAAS,CAAClB,SAASmB;YACjBnB,QAAQoB,GAAG,CAACC,IAAI,CAACF,SAAS;QAC5B;QACAG,UAAU,CAACtB,SAASmB;YAClBnB,QAAQoB,GAAG,CAACG,KAAK,CAACJ,SAAS;QAC7B;QACAK,mBAAmB,CAACC,cAAcC,QAChC,IAAIzC,YAAYwC,aAAaE,OAAO,EAAEF,aAAaG,IAAI,EAAE;gBACvDC,QAAQJ,aAAaI,MAAM;gBAC3B,GAAIJ,aAAaK,OAAO,GAAG;oBAACA,SAASL,aAAaK,OAAO;gBAAA,IAAI,CAAC,CAAC;gBAC/DC,MAAMN,aAAaM,IAAI;gBACvBL;YACF;IACJ;AACF;AAEA,OAAO,SAASM,8BAA8B1B,MAA2B;IACvE,OAAO,OAAON,SAA4CQ;QACxD,MAAMtB,iBAAiB;YACrBc;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQT,EAAE;QACxB;QAEA,MAAML,iBAAiB;YACrBc;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQiC,IAAI,CAACvC,KAAK;QAChC;IACF;AACF;AAEA,OAAO,SAASwC,gCAAgC5B,MAA2B;IACzE,OAAO,OAAON,SAAyBQ;QACrC,MAAMtB,iBAAiB;YACrBc;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQT,EAAE;QACxB;IACF;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAAS4C,mCAAmC7B,MAA2B;IAC5E,OAAO,OAAON,SAAyBQ;QACrC,MAAMtB,iBAAiB;YACrBc;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQT,EAAE;QACxB;QACA,MAAM6C,SAASpD,eAAegB;QAC9B,IAAIoC,QAAQ;YACV,MAAMlD,iBAAiB;gBACrBc;gBACAQ;gBACAF;gBACAC,OAAO;gBACPG,YAAY0B,OAAOC,MAAM;YAC3B;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {getUserContext} from '@shipfox/api-auth-context';\nimport {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {enforceRateLimit as enforceSharedRateLimit} from '@shipfox/node-rate-limit';\nimport {\n  type AuthRateLimitAction,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<\n  AuthRateLimitAction,\n  Partial<Record<AuthRateLimitScope, AuthRateLimitPolicy>>\n> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n  bootstrap: {\n    ip: {limit: 5, windowSeconds: 15 * 60},\n  },\n  'bootstrap-state': {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n  lookup: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n  directory: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    actor: {limit: 60, windowSeconds: 5 * 60},\n  },\n  impersonate: {\n    // Bounds mint and probing attempts: the IP bucket bounds aggregate source\n    // traffic, and the actor bucket is a per-actor cap that prevents an actor\n    // from evading the bound by rotating IPs (every request still consumes the\n    // IP bucket first, so a shared NAT cannot exhaust it faster by pooling\n    // actors). Ladder denials by an identifiable actor role are audited as\n    // `failed` events.\n    ip: {limit: 20, windowSeconds: 15 * 60},\n    actor: {limit: 20, windowSeconds: 15 * 60},\n  },\n  'oauth-register': {\n    ip: {limit: 10, windowSeconds: 60 * 60},\n  },\n  'oauth-cimd': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n  },\n  'oauth-authorize': {\n    ip: {limit: 30, windowSeconds: 5 * 60},\n  },\n  'oauth-token': {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  const policy = policies[params.action][params.scope];\n  if (!policy) return;\n\n  await enforceSharedRateLimit({\n    request: params.request,\n    reply: params.reply,\n    check: () =>\n      checkAuthRateLimit({\n        action: params.action,\n        scope: params.scope,\n        identifier: params.identifier,\n        ...policy,\n      }),\n    route: routeName(params.request),\n    unavailableCode: 'auth-rate-limit-unavailable',\n    unavailableMessage: 'Authentication rate limiter unavailable',\n    setRetryAfter: (reply, retryAfterSeconds) => {\n      reply.header('Retry-After', String(retryAfterSeconds));\n    },\n    logWarn: (request, context) => {\n      request.log.warn(context, 'Auth rate limit blocked request');\n    },\n    logError: (request, context) => {\n      request.log.error(context, 'Auth rate limiter unavailable');\n    },\n    createClientError: (presentation, cause) =>\n      new ClientError(presentation.message, presentation.code, {\n        status: presentation.status,\n        ...(presentation.details ? {details: presentation.details} : {}),\n        data: presentation.data,\n        cause,\n      }),\n  });\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n\nexport function createAuthIpRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n  };\n}\n\n/**\n * Rate limits an authenticated route by source IP and by actor. Every request\n * consumes the IP bucket, which bounds aggregate source traffic; the actor\n * bucket is an additional per-actor cap that prevents an actor from evading\n * the bound by rotating IPs. Runs after authentication (auth is an `onRequest`\n * hook), so the user context is set.\n */\nexport function createAuthActorRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n    const client = getUserContext(request);\n    if (client) {\n      await enforceRateLimit({\n        request,\n        reply,\n        action,\n        scope: 'actor',\n        identifier: client.userId,\n      });\n    }\n  };\n}\n"],"names":["getUserContext","ClientError","enforceRateLimit","enforceSharedRateLimit","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","bootstrap","lookup","directory","actor","impersonate","routeName","request","routeOptions","url","split","params","policy","action","scope","reply","check","identifier","route","unavailableCode","unavailableMessage","setRetryAfter","retryAfterSeconds","header","String","logWarn","context","log","warn","logError","error","createClientError","presentation","cause","message","code","status","details","data","createAuthRateLimitPreHandler","body","createAuthIpRateLimitPreHandler","createAuthActorRateLimitPreHandler","client","userId"],"mappings":"AAAA,SAAQA,cAAc,QAAO,4BAA4B;AACzD,SAAQC,WAAW,QAA+C,wBAAwB;AAC1F,SAAQC,oBAAoBC,sBAAsB,QAAO,2BAA2B;AACpF,SAIEC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAGF;IACFC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;IACAE,WAAW;QACTJ,IAAI;YAACC,OAAO;YAAGC,eAAe,KAAK;QAAE;IACvC;IACA,mBAAmB;QACjBF,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACAG,QAAQ;QACNL,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACAI,WAAW;QACTN,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCK,OAAO;YAACN,OAAO;YAAIC,eAAe,IAAI;QAAE;IAC1C;IACAM,aAAa;QACX,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,mBAAmB;QACnBR,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCK,OAAO;YAACN,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,kBAAkB;QAChBF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;IACxC;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;IACxC;IACA,mBAAmB;QACjBF,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACA,eAAe;QACbF,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;AACF;AAMA,SAASO,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAelB,iBAAiBmB,MAM/B;IACC,MAAMC,SAASjB,QAAQ,CAACgB,OAAOE,MAAM,CAAC,CAACF,OAAOG,KAAK,CAAC;IACpD,IAAI,CAACF,QAAQ;IAEb,MAAMnB,uBAAuB;QAC3Bc,SAASI,OAAOJ,OAAO;QACvBQ,OAAOJ,OAAOI,KAAK;QACnBC,OAAO,IACLtB,mBAAmB;gBACjBmB,QAAQF,OAAOE,MAAM;gBACrBC,OAAOH,OAAOG,KAAK;gBACnBG,YAAYN,OAAOM,UAAU;gBAC7B,GAAGL,MAAM;YACX;QACFM,OAAOZ,UAAUK,OAAOJ,OAAO;QAC/BY,iBAAiB;QACjBC,oBAAoB;QACpBC,eAAe,CAACN,OAAOO;YACrBP,MAAMQ,MAAM,CAAC,eAAeC,OAAOF;QACrC;QACAG,SAAS,CAAClB,SAASmB;YACjBnB,QAAQoB,GAAG,CAACC,IAAI,CAACF,SAAS;QAC5B;QACAG,UAAU,CAACtB,SAASmB;YAClBnB,QAAQoB,GAAG,CAACG,KAAK,CAACJ,SAAS;QAC7B;QACAK,mBAAmB,CAACC,cAAcC,QAChC,IAAI1C,YAAYyC,aAAaE,OAAO,EAAEF,aAAaG,IAAI,EAAE;gBACvDC,QAAQJ,aAAaI,MAAM;gBAC3B,GAAIJ,aAAaK,OAAO,GAAG;oBAACA,SAASL,aAAaK,OAAO;gBAAA,IAAI,CAAC,CAAC;gBAC/DC,MAAMN,aAAaM,IAAI;gBACvBL;YACF;IACJ;AACF;AAEA,OAAO,SAASM,8BAA8B1B,MAA2B;IACvE,OAAO,OAAON,SAA4CQ;QACxD,MAAMvB,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQV,EAAE;QACxB;QAEA,MAAML,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQiC,IAAI,CAACxC,KAAK;QAChC;IACF;AACF;AAEA,OAAO,SAASyC,gCAAgC5B,MAA2B;IACzE,OAAO,OAAON,SAAyBQ;QACrC,MAAMvB,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQV,EAAE;QACxB;IACF;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAAS6C,mCAAmC7B,MAA2B;IAC5E,OAAO,OAAON,SAAyBQ;QACrC,MAAMvB,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQV,EAAE;QACxB;QACA,MAAM8C,SAASrD,eAAeiB;QAC9B,IAAIoC,QAAQ;YACV,MAAMnD,iBAAiB;gBACrBe;gBACAQ;gBACAF;gBACAC,OAAO;gBACPG,YAAY0B,OAAOC,MAAM;YAC3B;QACF;IACF;AACF"}

package/dist/presentation/routes/registration/signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/registration/signup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAW1F,OAAO,EAAmC,KAAK,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAInF,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,2BAA2B,EACvC,YAAY,CAAC,EAAE,YAAY,mDAkG5B"}
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/registration/signup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAW1F,OAAO,EAAmC,KAAK,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAuDnF,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,2BAA2B,EACvC,YAAY,CAAC,EAAE,YAAY,mDA0D5B"}

package/dist/presentation/routes/registration/signup.js

@@ -6,6 +6,64 @@ import { EmailTakenError, InvitationEmailMismatchError, SignupNotAllowedError, T
 import { SIGNUP_DENIAL_MESSAGE_MAX_LENGTH } from '#core/ports.js';
 import { setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
 import { toUserDto } from '#presentation/dto/user.js';
+function handleEmailChallengeError(error) {
+    if (!(error instanceof EmailChallengeError)) return;
+    throw new ClientError(error.message, `email-challenge-${error.code}`, {
+        status: error.code === 'limited' ? 429 : 400,
+        ...error.retryAt ? {
+            details: {
+                retry_at: error.retryAt.toISOString()
+            }
+        } : {}
+    });
+}
+function handleSignupPolicyError(error) {
+    if (error instanceof EmailTakenError) {
+        throw new ClientError('Email already registered', 'email-taken', {
+            status: 409
+        });
+    }
+    if (error instanceof SignupNotAllowedError) {
+        const message = error.message.slice(0, SIGNUP_DENIAL_MESSAGE_MAX_LENGTH);
+        throw new ClientError(message, 'signup-not-allowed', {
+            status: 403,
+            details: {
+                message,
+                ...error.format ? {
+                    format: error.format
+                } : {}
+            }
+        });
+    }
+}
+function handleInvitationError(error) {
+    if (error instanceof TokenInvalidError) {
+        throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {
+            status: 410
+        });
+    }
+    if (error instanceof TokenAlreadyUsedError) {
+        throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {
+            status: 410
+        });
+    }
+    if (error instanceof TokenExpiredError) {
+        throw new ClientError('Invitation has expired', 'invitation-token-expired', {
+            status: 410
+        });
+    }
+    if (error instanceof InvitationEmailMismatchError) {
+        throw new ClientError('Signup email does not match the invitation', 'invitation-email-mismatch', {
+            status: 403
+        });
+    }
+}
+function handleSignupError(error) {
+    handleEmailChallengeError(error);
+    handleSignupPolicyError(error);
+    handleInvitationError(error);
+    throw error;
+}
 export function createSignupRoute(workspaces, signupPolicy) {
     return defineRoute({
         method: 'POST',
@@ -17,56 +75,7 @@ export function createSignupRoute(workspaces, signupPolicy) {
                 201: signupResponseSchema
             }
         },
-        errorHandler: (error)=>{
-            if (error instanceof EmailChallengeError) {
-                throw new ClientError(error.message, `email-challenge-${error.code}`, {
-                    status: error.code === 'limited' ? 429 : 400,
-                    ...error.retryAt ? {
-                        details: {
-                            retry_at: error.retryAt.toISOString()
-                        }
-                    } : {}
-                });
-            }
-            if (error instanceof EmailTakenError) {
-                throw new ClientError('Email already registered', 'email-taken', {
-                    status: 409
-                });
-            }
-            if (error instanceof SignupNotAllowedError) {
-                const message = error.message.slice(0, SIGNUP_DENIAL_MESSAGE_MAX_LENGTH);
-                throw new ClientError(message, 'signup-not-allowed', {
-                    status: 403,
-                    details: {
-                        message,
-                        ...error.format ? {
-                            format: error.format
-                        } : {}
-                    }
-                });
-            }
-            if (error instanceof TokenInvalidError) {
-                throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {
-                    status: 410
-                });
-            }
-            if (error instanceof TokenAlreadyUsedError) {
-                throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {
-                    status: 410
-                });
-            }
-            if (error instanceof TokenExpiredError) {
-                throw new ClientError('Invitation has expired', 'invitation-token-expired', {
-                    status: 410
-                });
-            }
-            if (error instanceof InvitationEmailMismatchError) {
-                throw new ClientError('Signup email does not match the invitation', 'invitation-email-mismatch', {
-                    status: 403
-                });
-            }
-            throw error;
-        },
+        errorHandler: handleSignupError,
         handler: async (request, reply)=>{
             const { email, password, name, invitation_token } = request.body;
             if (invitation_token === undefined) {

package/dist/presentation/routes/registration/signup.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/presentation/routes/registration/signup.ts"],"sourcesContent":["import {signupBodySchema, signupResponseSchema} from '@shipfox/api-auth-dto';\nimport {EmailChallengeError} from '@shipfox/api-email-challenges';\nimport type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {signup, signupWithInvitation} from '#core/auth.js';\nimport {\n  EmailTakenError,\n  InvitationEmailMismatchError,\n  SignupNotAllowedError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n} from '#core/errors.js';\nimport {SIGNUP_DENIAL_MESSAGE_MAX_LENGTH, type SignupPolicy} from '#core/ports.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nexport function createSignupRoute(\n  workspaces: WorkspacesInterModuleClient,\n  signupPolicy?: SignupPolicy,\n) {\n  return defineRoute({\n    method: 'POST',\n    path: '/signup',\n    description:\n      'Create a user account. Sends a verification email unless an invitation token is supplied.',\n    schema: {\n      body: signupBodySchema,\n      response: {\n        201: signupResponseSchema,\n      },\n    },\n    errorHandler: (error) => {\n      if (error instanceof EmailChallengeError) {\n        throw new ClientError(error.message, `email-challenge-${error.code}`, {\n          status: error.code === 'limited' ? 429 : 400,\n          ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),\n        });\n      }\n      if (error instanceof EmailTakenError) {\n        throw new ClientError('Email already registered', 'email-taken', {status: 409});\n      }\n      if (error instanceof SignupNotAllowedError) {\n        const message = error.message.slice(0, SIGNUP_DENIAL_MESSAGE_MAX_LENGTH);\n        throw new ClientError(message, 'signup-not-allowed', {\n          status: 403,\n          details: {message, ...(error.format ? {format: error.format} : {})},\n        });\n      }\n      if (error instanceof TokenInvalidError) {\n        throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenAlreadyUsedError) {\n        throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenExpiredError) {\n        throw new ClientError('Invitation has expired', 'invitation-token-expired', {\n          status: 410,\n        });\n      }\n      if (error instanceof InvitationEmailMismatchError) {\n        throw new ClientError(\n          'Signup email does not match the invitation',\n          'invitation-email-mismatch',\n          {status: 403},\n        );\n      }\n      throw error;\n    },\n    handler: async (request, reply) => {\n      const {email, password, name, invitation_token} = request.body;\n\n      if (invitation_token === undefined) {\n        const result = await signup({\n          email,\n          password,\n          name,\n          sourceIp: request.ip,\n          signupPolicy,\n        });\n        reply.code(201);\n        return {\n          user: toUserDto(result),\n          email_challenge: {\n            id: result.emailChallenge.id,\n            next_resend_available_at: result.emailChallenge.nextResendAvailableAt.toISOString(),\n          },\n        };\n      }\n\n      const result = await signupWithInvitation({\n        email,\n        password,\n        name,\n        invitationToken: invitation_token,\n        workspaces,\n      });\n      setRefreshTokenCookie(reply, result.refreshToken);\n      reply.code(201);\n      return {\n        user: toUserDto(result.user),\n        token: result.token,\n        membership: result.membership\n          ? {\n              id: result.membership.id,\n              user_id: result.membership.userId,\n              workspace_id: result.membership.workspaceId,\n            }\n          : null,\n        ...(result.acceptError ? {accept_error: result.acceptError} : {}),\n      };\n    },\n  });\n}\n"],"names":["signupBodySchema","signupResponseSchema","EmailChallengeError","ClientError","defineRoute","signup","signupWithInvitation","EmailTakenError","InvitationEmailMismatchError","SignupNotAllowedError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","SIGNUP_DENIAL_MESSAGE_MAX_LENGTH","setRefreshTokenCookie","toUserDto","createSignupRoute","workspaces","signupPolicy","method","path","description","schema","body","response","errorHandler","error","message","code","status","retryAt","details","retry_at","toISOString","slice","format","handler","request","reply","email","password","name","invitation_token","undefined","result","sourceIp","ip","user","email_challenge","id","emailChallenge","next_resend_available_at","nextResendAvailableAt","invitationToken","refreshToken","token","membership","user_id","userId","workspace_id","workspaceId","acceptError","accept_error"],"mappings":"AAAA,SAAQA,gBAAgB,EAAEC,oBAAoB,QAAO,wBAAwB;AAC7E,SAAQC,mBAAmB,QAAO,gCAAgC;AAElE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,gBAAgB;AAC3D,SACEC,eAAe,EACfC,4BAA4B,EAC5BC,qBAAqB,EACrBC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,gCAAgC,QAA0B,iBAAiB;AACnF,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,OAAO,SAASC,kBACdC,UAAuC,EACvCC,YAA2B;IAE3B,OAAOd,YAAY;QACjBe,QAAQ;QACRC,MAAM;QACNC,aACE;QACFC,QAAQ;YACNC,MAAMvB;YACNwB,UAAU;gBACR,KAAKvB;YACP;QACF;QACAwB,cAAc,CAACC;YACb,IAAIA,iBAAiBxB,qBAAqB;gBACxC,MAAM,IAAIC,YAAYuB,MAAMC,OAAO,EAAE,CAAC,gBAAgB,EAAED,MAAME,IAAI,EAAE,EAAE;oBACpEC,QAAQH,MAAME,IAAI,KAAK,YAAY,MAAM;oBACzC,GAAIF,MAAMI,OAAO,GAAG;wBAACC,SAAS;4BAACC,UAAUN,MAAMI,OAAO,CAACG,WAAW;wBAAE;oBAAC,IAAI,CAAC,CAAC;gBAC7E;YACF;YACA,IAAIP,iBAAiBnB,iBAAiB;gBACpC,MAAM,IAAIJ,YAAY,4BAA4B,eAAe;oBAAC0B,QAAQ;gBAAG;YAC/E;YACA,IAAIH,iBAAiBjB,uBAAuB;gBAC1C,MAAMkB,UAAUD,MAAMC,OAAO,CAACO,KAAK,CAAC,GAAGrB;gBACvC,MAAM,IAAIV,YAAYwB,SAAS,sBAAsB;oBACnDE,QAAQ;oBACRE,SAAS;wBAACJ;wBAAS,GAAID,MAAMS,MAAM,GAAG;4BAACA,QAAQT,MAAMS,MAAM;wBAAA,IAAI,CAAC,CAAC;oBAAC;gBACpE;YACF;YACA,IAAIT,iBAAiBd,mBAAmB;gBACtC,MAAM,IAAIT,YAAY,+BAA+B,4BAA4B;oBAC/E0B,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBhB,uBAAuB;gBAC1C,MAAM,IAAIP,YAAY,wCAAwC,yBAAyB;oBACrF0B,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBf,mBAAmB;gBACtC,MAAM,IAAIR,YAAY,0BAA0B,4BAA4B;oBAC1E0B,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBlB,8BAA8B;gBACjD,MAAM,IAAIL,YACR,8CACA,6BACA;oBAAC0B,QAAQ;gBAAG;YAEhB;YACA,MAAMH;QACR;QACAU,SAAS,OAAOC,SAASC;YACvB,MAAM,EAACC,KAAK,EAAEC,QAAQ,EAAEC,IAAI,EAAEC,gBAAgB,EAAC,GAAGL,QAAQd,IAAI;YAE9D,IAAImB,qBAAqBC,WAAW;gBAClC,MAAMC,SAAS,MAAMvC,OAAO;oBAC1BkC;oBACAC;oBACAC;oBACAI,UAAUR,QAAQS,EAAE;oBACpB5B;gBACF;gBACAoB,MAAMV,IAAI,CAAC;gBACX,OAAO;oBACLmB,MAAMhC,UAAU6B;oBAChBI,iBAAiB;wBACfC,IAAIL,OAAOM,cAAc,CAACD,EAAE;wBAC5BE,0BAA0BP,OAAOM,cAAc,CAACE,qBAAqB,CAACnB,WAAW;oBACnF;gBACF;YACF;YAEA,MAAMW,SAAS,MAAMtC,qBAAqB;gBACxCiC;gBACAC;gBACAC;gBACAY,iBAAiBX;gBACjBzB;YACF;YACAH,sBAAsBwB,OAAOM,OAAOU,YAAY;YAChDhB,MAAMV,IAAI,CAAC;YACX,OAAO;gBACLmB,MAAMhC,UAAU6B,OAAOG,IAAI;gBAC3BQ,OAAOX,OAAOW,KAAK;gBACnBC,YAAYZ,OAAOY,UAAU,GACzB;oBACEP,IAAIL,OAAOY,UAAU,CAACP,EAAE;oBACxBQ,SAASb,OAAOY,UAAU,CAACE,MAAM;oBACjCC,cAAcf,OAAOY,UAAU,CAACI,WAAW;gBAC7C,IACA;gBACJ,GAAIhB,OAAOiB,WAAW,GAAG;oBAACC,cAAclB,OAAOiB,WAAW;gBAAA,IAAI,CAAC,CAAC;YAClE;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../../src/presentation/routes/registration/signup.ts"],"sourcesContent":["import {signupBodySchema, signupResponseSchema} from '@shipfox/api-auth-dto';\nimport {EmailChallengeError} from '@shipfox/api-email-challenges';\nimport type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {signup, signupWithInvitation} from '#core/auth.js';\nimport {\n  EmailTakenError,\n  InvitationEmailMismatchError,\n  SignupNotAllowedError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n} from '#core/errors.js';\nimport {SIGNUP_DENIAL_MESSAGE_MAX_LENGTH, type SignupPolicy} from '#core/ports.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nfunction handleEmailChallengeError(error: unknown): void {\n  if (!(error instanceof EmailChallengeError)) return;\n  throw new ClientError(error.message, `email-challenge-${error.code}`, {\n    status: error.code === 'limited' ? 429 : 400,\n    ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),\n  });\n}\n\nfunction handleSignupPolicyError(error: unknown): void {\n  if (error instanceof EmailTakenError) {\n    throw new ClientError('Email already registered', 'email-taken', {status: 409});\n  }\n  if (error instanceof SignupNotAllowedError) {\n    const message = error.message.slice(0, SIGNUP_DENIAL_MESSAGE_MAX_LENGTH);\n    throw new ClientError(message, 'signup-not-allowed', {\n      status: 403,\n      details: {message, ...(error.format ? {format: error.format} : {})},\n    });\n  }\n}\n\nfunction handleInvitationError(error: unknown): void {\n  if (error instanceof TokenInvalidError) {\n    throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {status: 410});\n  }\n  if (error instanceof TokenAlreadyUsedError) {\n    throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {\n      status: 410,\n    });\n  }\n  if (error instanceof TokenExpiredError) {\n    throw new ClientError('Invitation has expired', 'invitation-token-expired', {status: 410});\n  }\n  if (error instanceof InvitationEmailMismatchError) {\n    throw new ClientError(\n      'Signup email does not match the invitation',\n      'invitation-email-mismatch',\n      {\n        status: 403,\n      },\n    );\n  }\n}\n\nfunction handleSignupError(error: unknown): never {\n  handleEmailChallengeError(error);\n  handleSignupPolicyError(error);\n  handleInvitationError(error);\n  throw error;\n}\n\nexport function createSignupRoute(\n  workspaces: WorkspacesInterModuleClient,\n  signupPolicy?: SignupPolicy,\n) {\n  return defineRoute({\n    method: 'POST',\n    path: '/signup',\n    description:\n      'Create a user account. Sends a verification email unless an invitation token is supplied.',\n    schema: {\n      body: signupBodySchema,\n      response: {\n        201: signupResponseSchema,\n      },\n    },\n    errorHandler: handleSignupError,\n    handler: async (request, reply) => {\n      const {email, password, name, invitation_token} = request.body;\n\n      if (invitation_token === undefined) {\n        const result = await signup({\n          email,\n          password,\n          name,\n          sourceIp: request.ip,\n          signupPolicy,\n        });\n        reply.code(201);\n        return {\n          user: toUserDto(result),\n          email_challenge: {\n            id: result.emailChallenge.id,\n            next_resend_available_at: result.emailChallenge.nextResendAvailableAt.toISOString(),\n          },\n        };\n      }\n\n      const result = await signupWithInvitation({\n        email,\n        password,\n        name,\n        invitationToken: invitation_token,\n        workspaces,\n      });\n      setRefreshTokenCookie(reply, result.refreshToken);\n      reply.code(201);\n      return {\n        user: toUserDto(result.user),\n        token: result.token,\n        membership: result.membership\n          ? {\n              id: result.membership.id,\n              user_id: result.membership.userId,\n              workspace_id: result.membership.workspaceId,\n            }\n          : null,\n        ...(result.acceptError ? {accept_error: result.acceptError} : {}),\n      };\n    },\n  });\n}\n"],"names":["signupBodySchema","signupResponseSchema","EmailChallengeError","ClientError","defineRoute","signup","signupWithInvitation","EmailTakenError","InvitationEmailMismatchError","SignupNotAllowedError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","SIGNUP_DENIAL_MESSAGE_MAX_LENGTH","setRefreshTokenCookie","toUserDto","handleEmailChallengeError","error","message","code","status","retryAt","details","retry_at","toISOString","handleSignupPolicyError","slice","format","handleInvitationError","handleSignupError","createSignupRoute","workspaces","signupPolicy","method","path","description","schema","body","response","errorHandler","handler","request","reply","email","password","name","invitation_token","undefined","result","sourceIp","ip","user","email_challenge","id","emailChallenge","next_resend_available_at","nextResendAvailableAt","invitationToken","refreshToken","token","membership","user_id","userId","workspace_id","workspaceId","acceptError","accept_error"],"mappings":"AAAA,SAAQA,gBAAgB,EAAEC,oBAAoB,QAAO,wBAAwB;AAC7E,SAAQC,mBAAmB,QAAO,gCAAgC;AAElE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,gBAAgB;AAC3D,SACEC,eAAe,EACfC,4BAA4B,EAC5BC,qBAAqB,EACrBC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,gCAAgC,QAA0B,iBAAiB;AACnF,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,SAASC,0BAA0BC,KAAc;IAC/C,IAAI,CAAEA,CAAAA,iBAAiBf,mBAAkB,GAAI;IAC7C,MAAM,IAAIC,YAAYc,MAAMC,OAAO,EAAE,CAAC,gBAAgB,EAAED,MAAME,IAAI,EAAE,EAAE;QACpEC,QAAQH,MAAME,IAAI,KAAK,YAAY,MAAM;QACzC,GAAIF,MAAMI,OAAO,GAAG;YAACC,SAAS;gBAACC,UAAUN,MAAMI,OAAO,CAACG,WAAW;YAAE;QAAC,IAAI,CAAC,CAAC;IAC7E;AACF;AAEA,SAASC,wBAAwBR,KAAc;IAC7C,IAAIA,iBAAiBV,iBAAiB;QACpC,MAAM,IAAIJ,YAAY,4BAA4B,eAAe;YAACiB,QAAQ;QAAG;IAC/E;IACA,IAAIH,iBAAiBR,uBAAuB;QAC1C,MAAMS,UAAUD,MAAMC,OAAO,CAACQ,KAAK,CAAC,GAAGb;QACvC,MAAM,IAAIV,YAAYe,SAAS,sBAAsB;YACnDE,QAAQ;YACRE,SAAS;gBAACJ;gBAAS,GAAID,MAAMU,MAAM,GAAG;oBAACA,QAAQV,MAAMU,MAAM;gBAAA,IAAI,CAAC,CAAC;YAAC;QACpE;IACF;AACF;AAEA,SAASC,sBAAsBX,KAAc;IAC3C,IAAIA,iBAAiBL,mBAAmB;QACtC,MAAM,IAAIT,YAAY,+BAA+B,4BAA4B;YAACiB,QAAQ;QAAG;IAC/F;IACA,IAAIH,iBAAiBP,uBAAuB;QAC1C,MAAM,IAAIP,YAAY,wCAAwC,yBAAyB;YACrFiB,QAAQ;QACV;IACF;IACA,IAAIH,iBAAiBN,mBAAmB;QACtC,MAAM,IAAIR,YAAY,0BAA0B,4BAA4B;YAACiB,QAAQ;QAAG;IAC1F;IACA,IAAIH,iBAAiBT,8BAA8B;QACjD,MAAM,IAAIL,YACR,8CACA,6BACA;YACEiB,QAAQ;QACV;IAEJ;AACF;AAEA,SAASS,kBAAkBZ,KAAc;IACvCD,0BAA0BC;IAC1BQ,wBAAwBR;IACxBW,sBAAsBX;IACtB,MAAMA;AACR;AAEA,OAAO,SAASa,kBACdC,UAAuC,EACvCC,YAA2B;IAE3B,OAAO5B,YAAY;QACjB6B,QAAQ;QACRC,MAAM;QACNC,aACE;QACFC,QAAQ;YACNC,MAAMrC;YACNsC,UAAU;gBACR,KAAKrC;YACP;QACF;QACAsC,cAAcV;QACdW,SAAS,OAAOC,SAASC;YACvB,MAAM,EAACC,KAAK,EAAEC,QAAQ,EAAEC,IAAI,EAAEC,gBAAgB,EAAC,GAAGL,QAAQJ,IAAI;YAE9D,IAAIS,qBAAqBC,WAAW;gBAClC,MAAMC,SAAS,MAAM3C,OAAO;oBAC1BsC;oBACAC;oBACAC;oBACAI,UAAUR,QAAQS,EAAE;oBACpBlB;gBACF;gBACAU,MAAMvB,IAAI,CAAC;gBACX,OAAO;oBACLgC,MAAMpC,UAAUiC;oBAChBI,iBAAiB;wBACfC,IAAIL,OAAOM,cAAc,CAACD,EAAE;wBAC5BE,0BAA0BP,OAAOM,cAAc,CAACE,qBAAqB,CAAChC,WAAW;oBACnF;gBACF;YACF;YAEA,MAAMwB,SAAS,MAAM1C,qBAAqB;gBACxCqC;gBACAC;gBACAC;gBACAY,iBAAiBX;gBACjBf;YACF;YACAjB,sBAAsB4B,OAAOM,OAAOU,YAAY;YAChDhB,MAAMvB,IAAI,CAAC;YACX,OAAO;gBACLgC,MAAMpC,UAAUiC,OAAOG,IAAI;gBAC3BQ,OAAOX,OAAOW,KAAK;gBACnBC,YAAYZ,OAAOY,UAAU,GACzB;oBACEP,IAAIL,OAAOY,UAAU,CAACP,EAAE;oBACxBQ,SAASb,OAAOY,UAAU,CAACE,MAAM;oBACjCC,cAAcf,OAAOY,UAAU,CAACI,WAAW;gBAC7C,IACA;gBACJ,GAAIhB,OAAOiB,WAAW,GAAG;oBAACC,cAAclB,OAAOiB,WAAW;gBAAA,IAAI,CAAC,CAAC;YAClE;QACF;IACF;AACF"}

package/dist/temporal/activities/agent-access-retention.d.ts

@@ -0,0 +1,13 @@
+export interface AgentAccessRetentionResult {
+    deleted: number;
+    transitioned: number;
+    iterations: number;
+    timedOut: boolean;
+}
+/**
+ * Drains bounded retention batches for the current tick. Heartbeats continue
+ * while a database batch waits on a lock, and the wall-clock budget keeps the
+ * activity inside its five-minute Temporal start-to-close timeout.
+ */
+export declare function agentAccessRetentionActivity(): Promise<AgentAccessRetentionResult>;
+//# sourceMappingURL=agent-access-retention.d.ts.map

package/dist/temporal/activities/agent-access-retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access-retention.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/agent-access-retention.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD;;;;GAIG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,0BAA0B,CAAC,CA8CxF"}

package/dist/temporal/activities/agent-access-retention.js

@@ -0,0 +1,58 @@
+import { Context } from '@temporalio/activity';
+import { pruneAgentAccessBatch } from '#db/agent-access.js';
+import { AGENT_ACCESS_RETENTION_BATCH_LIMIT, AGENT_ACCESS_RETENTION_MAX_ITERATIONS, AGENT_ACCESS_RETENTION_TIME_BUDGET_MS } from '#db/agent-access-retention.js';
+function isAgentAccessRetentionTimeout(error) {
+    if (typeof error !== 'object' || error === null) return false;
+    const details = error;
+    if (details.code === '55P03' || details.code === '57014') return true;
+    return details.cause !== undefined && details.cause !== error ? isAgentAccessRetentionTimeout(details.cause) : false;
+}
+/**
+ * Drains bounded retention batches for the current tick. Heartbeats continue
+ * while a database batch waits on a lock, and the wall-clock budget keeps the
+ * activity inside its five-minute Temporal start-to-close timeout.
+ */ export async function agentAccessRetentionActivity() {
+    const ctx = Context.current();
+    const startedAt = Date.now();
+    const deadline = startedAt + AGENT_ACCESS_RETENTION_TIME_BUDGET_MS;
+    const result = {
+        deleted: 0,
+        transitioned: 0,
+        iterations: 0,
+        timedOut: false
+    };
+    const heartbeat = ()=>ctx.heartbeat(result);
+    const heartbeatTimer = setInterval(heartbeat, 15_000);
+    try {
+        while(result.iterations < AGENT_ACCESS_RETENTION_MAX_ITERATIONS){
+            if (Date.now() >= deadline) {
+                result.timedOut = true;
+                break;
+            }
+            try {
+                const batch = await pruneAgentAccessBatch({
+                    limit: AGENT_ACCESS_RETENTION_BATCH_LIMIT,
+                    deadlineMs: deadline
+                });
+                result.deleted += batch.deleted;
+                result.transitioned += batch.transitioned;
+                result.iterations += 1;
+                heartbeat();
+                if (batch.deleted === 0 && batch.transitioned === 0) break;
+            } catch (error) {
+                if (!isAgentAccessRetentionTimeout(error)) throw error;
+                result.timedOut = true;
+                break;
+            }
+        }
+        if (result.iterations >= AGENT_ACCESS_RETENTION_MAX_ITERATIONS) {
+            result.timedOut = true;
+        }
+        heartbeat();
+        return result;
+    } finally{
+        clearInterval(heartbeatTimer);
+    }
+}
+
+//# sourceMappingURL=agent-access-retention.js.map

package/dist/temporal/activities/agent-access-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/temporal/activities/agent-access-retention.ts"],"sourcesContent":["import {Context} from '@temporalio/activity';\nimport {pruneAgentAccessBatch} from '#db/agent-access.js';\nimport {\n  AGENT_ACCESS_RETENTION_BATCH_LIMIT,\n  AGENT_ACCESS_RETENTION_MAX_ITERATIONS,\n  AGENT_ACCESS_RETENTION_TIME_BUDGET_MS,\n} from '#db/agent-access-retention.js';\n\nexport interface AgentAccessRetentionResult {\n  deleted: number;\n  transitioned: number;\n  iterations: number;\n  timedOut: boolean;\n}\n\nfunction isAgentAccessRetentionTimeout(error: unknown): boolean {\n  if (typeof error !== 'object' || error === null) return false;\n  const details = error as {cause?: unknown; code?: unknown};\n  if (details.code === '55P03' || details.code === '57014') return true;\n  return details.cause !== undefined && details.cause !== error\n    ? isAgentAccessRetentionTimeout(details.cause)\n    : false;\n}\n\n/**\n * Drains bounded retention batches for the current tick. Heartbeats continue\n * while a database batch waits on a lock, and the wall-clock budget keeps the\n * activity inside its five-minute Temporal start-to-close timeout.\n */\nexport async function agentAccessRetentionActivity(): Promise<AgentAccessRetentionResult> {\n  const ctx = Context.current();\n  const startedAt = Date.now();\n  const deadline = startedAt + AGENT_ACCESS_RETENTION_TIME_BUDGET_MS;\n  const result: AgentAccessRetentionResult = {\n    deleted: 0,\n    transitioned: 0,\n    iterations: 0,\n    timedOut: false,\n  };\n  const heartbeat = () => ctx.heartbeat(result);\n  const heartbeatTimer = setInterval(heartbeat, 15_000);\n\n  try {\n    while (result.iterations < AGENT_ACCESS_RETENTION_MAX_ITERATIONS) {\n      if (Date.now() >= deadline) {\n        result.timedOut = true;\n        break;\n      }\n\n      try {\n        const batch = await pruneAgentAccessBatch({\n          limit: AGENT_ACCESS_RETENTION_BATCH_LIMIT,\n          deadlineMs: deadline,\n        });\n        result.deleted += batch.deleted;\n        result.transitioned += batch.transitioned;\n        result.iterations += 1;\n        heartbeat();\n\n        if (batch.deleted === 0 && batch.transitioned === 0) break;\n      } catch (error) {\n        if (!isAgentAccessRetentionTimeout(error)) throw error;\n        result.timedOut = true;\n        break;\n      }\n    }\n\n    if (result.iterations >= AGENT_ACCESS_RETENTION_MAX_ITERATIONS) {\n      result.timedOut = true;\n    }\n    heartbeat();\n    return result;\n  } finally {\n    clearInterval(heartbeatTimer);\n  }\n}\n"],"names":["Context","pruneAgentAccessBatch","AGENT_ACCESS_RETENTION_BATCH_LIMIT","AGENT_ACCESS_RETENTION_MAX_ITERATIONS","AGENT_ACCESS_RETENTION_TIME_BUDGET_MS","isAgentAccessRetentionTimeout","error","details","code","cause","undefined","agentAccessRetentionActivity","ctx","current","startedAt","Date","now","deadline","result","deleted","transitioned","iterations","timedOut","heartbeat","heartbeatTimer","setInterval","batch","limit","deadlineMs","clearInterval"],"mappings":"AAAA,SAAQA,OAAO,QAAO,uBAAuB;AAC7C,SAAQC,qBAAqB,QAAO,sBAAsB;AAC1D,SACEC,kCAAkC,EAClCC,qCAAqC,EACrCC,qCAAqC,QAChC,gCAAgC;AASvC,SAASC,8BAA8BC,KAAc;IACnD,IAAI,OAAOA,UAAU,YAAYA,UAAU,MAAM,OAAO;IACxD,MAAMC,UAAUD;IAChB,IAAIC,QAAQC,IAAI,KAAK,WAAWD,QAAQC,IAAI,KAAK,SAAS,OAAO;IACjE,OAAOD,QAAQE,KAAK,KAAKC,aAAaH,QAAQE,KAAK,KAAKH,QACpDD,8BAA8BE,QAAQE,KAAK,IAC3C;AACN;AAEA;;;;CAIC,GACD,OAAO,eAAeE;IACpB,MAAMC,MAAMZ,QAAQa,OAAO;IAC3B,MAAMC,YAAYC,KAAKC,GAAG;IAC1B,MAAMC,WAAWH,YAAYV;IAC7B,MAAMc,SAAqC;QACzCC,SAAS;QACTC,cAAc;QACdC,YAAY;QACZC,UAAU;IACZ;IACA,MAAMC,YAAY,IAAMX,IAAIW,SAAS,CAACL;IACtC,MAAMM,iBAAiBC,YAAYF,WAAW;IAE9C,IAAI;QACF,MAAOL,OAAOG,UAAU,GAAGlB,sCAAuC;YAChE,IAAIY,KAAKC,GAAG,MAAMC,UAAU;gBAC1BC,OAAOI,QAAQ,GAAG;gBAClB;YACF;YAEA,IAAI;gBACF,MAAMI,QAAQ,MAAMzB,sBAAsB;oBACxC0B,OAAOzB;oBACP0B,YAAYX;gBACd;gBACAC,OAAOC,OAAO,IAAIO,MAAMP,OAAO;gBAC/BD,OAAOE,YAAY,IAAIM,MAAMN,YAAY;gBACzCF,OAAOG,UAAU,IAAI;gBACrBE;gBAEA,IAAIG,MAAMP,OAAO,KAAK,KAAKO,MAAMN,YAAY,KAAK,GAAG;YACvD,EAAE,OAAOd,OAAO;gBACd,IAAI,CAACD,8BAA8BC,QAAQ,MAAMA;gBACjDY,OAAOI,QAAQ,GAAG;gBAClB;YACF;QACF;QAEA,IAAIJ,OAAOG,UAAU,IAAIlB,uCAAuC;YAC9De,OAAOI,QAAQ,GAAG;QACpB;QACAC;QACA,OAAOL;IACT,SAAU;QACRW,cAAcL;IAChB;AACF"}

package/dist/temporal/activities/index.d.ts

@@ -0,0 +1,5 @@
+import { agentAccessRetentionActivity } from './agent-access-retention.js';
+export declare function createAuthMaintenanceActivities(): {
+    agentAccessRetentionActivity: typeof agentAccessRetentionActivity;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/temporal/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,4BAA4B,EAAC,MAAM,6BAA6B,CAAC;AAEzE,wBAAgB,+BAA+B;;EAE9C"}

package/dist/temporal/activities/index.js

@@ -0,0 +1,8 @@
+import { agentAccessRetentionActivity } from './agent-access-retention.js';
+export function createAuthMaintenanceActivities() {
+    return {
+        agentAccessRetentionActivity
+    };
+}
+
+//# sourceMappingURL=index.js.map

package/dist/temporal/activities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/temporal/activities/index.ts"],"sourcesContent":["import {agentAccessRetentionActivity} from './agent-access-retention.js';\n\nexport function createAuthMaintenanceActivities() {\n  return {agentAccessRetentionActivity};\n}\n"],"names":["agentAccessRetentionActivity","createAuthMaintenanceActivities"],"mappings":"AAAA,SAAQA,4BAA4B,QAAO,8BAA8B;AAEzE,OAAO,SAASC;IACd,OAAO;QAACD;IAA4B;AACtC"}

package/dist/temporal/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE = "auth-agent-access-maintenance";
+//# sourceMappingURL=constants.d.ts.map

package/dist/temporal/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/temporal/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wCAAwC,kCAAkC,CAAC"}

package/dist/temporal/constants.js

@@ -0,0 +1,3 @@
+export const AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE = 'auth-agent-access-maintenance';
+
+//# sourceMappingURL=constants.js.map

package/dist/temporal/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/temporal/constants.ts"],"sourcesContent":["export const AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE = 'auth-agent-access-maintenance';\n"],"names":["AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE"],"mappings":"AAAA,OAAO,MAAMA,2CAA2C,gCAAgC"}

package/dist/temporal/workflows/agent-access-retention-cron.d.ts

@@ -0,0 +1,2 @@
+export declare function agentAccessRetentionCron(): Promise<void>;
+//# sourceMappingURL=agent-access-retention-cron.d.ts.map

package/dist/temporal/workflows/agent-access-retention-cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access-retention-cron.d.ts","sourceRoot":"","sources":["../../../src/temporal/workflows/agent-access-retention-cron.ts"],"names":[],"mappings":"AAYA,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAU9D"}

package/dist/temporal/workflows/agent-access-retention-cron.js

@@ -0,0 +1,22 @@
+import { log, proxyActivities } from '@temporalio/workflow';
+const { agentAccessRetentionActivity } = proxyActivities({
+    startToCloseTimeout: '5 minutes',
+    heartbeatTimeout: '1 minute',
+    // Retry on the next cron tick so a timed-out attempt cannot overlap its own sweep.
+    retry: {
+        maximumAttempts: 1
+    }
+});
+export async function agentAccessRetentionCron() {
+    const result = await agentAccessRetentionActivity();
+    if (result.deleted > 0 || result.transitioned > 0 || result.timedOut) {
+        log.info('Agent-access retention sweep complete', {
+            deleted: result.deleted,
+            transitioned: result.transitioned,
+            iterations: result.iterations,
+            timedOut: result.timedOut
+        });
+    }
+}
+
+//# sourceMappingURL=agent-access-retention-cron.js.map

package/dist/temporal/workflows/agent-access-retention-cron.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/temporal/workflows/agent-access-retention-cron.ts"],"sourcesContent":["import {log, proxyActivities} from '@temporalio/workflow';\nimport type {createAuthMaintenanceActivities} from '../activities/index.js';\n\nconst {agentAccessRetentionActivity} = proxyActivities<\n  ReturnType<typeof createAuthMaintenanceActivities>\n>({\n  startToCloseTimeout: '5 minutes',\n  heartbeatTimeout: '1 minute',\n  // Retry on the next cron tick so a timed-out attempt cannot overlap its own sweep.\n  retry: {maximumAttempts: 1},\n});\n\nexport async function agentAccessRetentionCron(): Promise<void> {\n  const result = await agentAccessRetentionActivity();\n  if (result.deleted > 0 || result.transitioned > 0 || result.timedOut) {\n    log.info('Agent-access retention sweep complete', {\n      deleted: result.deleted,\n      transitioned: result.transitioned,\n      iterations: result.iterations,\n      timedOut: result.timedOut,\n    });\n  }\n}\n"],"names":["log","proxyActivities","agentAccessRetentionActivity","startToCloseTimeout","heartbeatTimeout","retry","maximumAttempts","agentAccessRetentionCron","result","deleted","transitioned","timedOut","info","iterations"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,eAAe,QAAO,uBAAuB;AAG1D,MAAM,EAACC,4BAA4B,EAAC,GAAGD,gBAErC;IACAE,qBAAqB;IACrBC,kBAAkB;IAClB,mFAAmF;IACnFC,OAAO;QAACC,iBAAiB;IAAC;AAC5B;AAEA,OAAO,eAAeC;IACpB,MAAMC,SAAS,MAAMN;IACrB,IAAIM,OAAOC,OAAO,GAAG,KAAKD,OAAOE,YAAY,GAAG,KAAKF,OAAOG,QAAQ,EAAE;QACpEX,IAAIY,IAAI,CAAC,yCAAyC;YAChDH,SAASD,OAAOC,OAAO;YACvBC,cAAcF,OAAOE,YAAY;YACjCG,YAAYL,OAAOK,UAAU;YAC7BF,UAAUH,OAAOG,QAAQ;QAC3B;IACF;AACF"}