@shipfox/api-auth 2.0.0

package/dist/core/auth.d.ts

@@ -0,0 +1,108 @@
+import type { User } from './entities/user.js';
+import { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError } from './errors.js';
+export interface SignupParams {
+    email: string;
+    password: string;
+    name?: string | undefined;
+}
+export interface ProvisionUserParams {
+    email: string;
+    name?: string | null | undefined;
+}
+/**
+ * Creates a verified, password-less user for an external identity provider.
+ * Existing users are returned unchanged, including their password and profile.
+ */
+export declare function provisionUser(params: ProvisionUserParams): Promise<User>;
+export declare function signup(params: SignupParams): Promise<User>;
+export interface SignupWithInvitationParams extends SignupParams {
+    invitationToken: string;
+}
+export interface SignupWithInvitationResult extends LoginResult {
+    membership: {
+        id: string;
+        userId: string;
+        workspaceId: string;
+    } | null;
+    acceptError?: {
+        code: string;
+        message: string;
+    };
+}
+export declare function signupWithInvitation(params: SignupWithInvitationParams): Promise<SignupWithInvitationResult>;
+export interface CreateUserParams extends SignupParams {
+    verified: boolean;
+}
+export declare function createUser(params: CreateUserParams): Promise<User>;
+export interface LoginParams {
+    email: string;
+    password: string;
+}
+export interface LoginResult {
+    token: string;
+    refreshToken: string;
+    user: User;
+}
+export declare function login(params: LoginParams): Promise<LoginResult>;
+export interface CreateSessionForUserParams {
+    userId?: string | undefined;
+    email?: string | undefined;
+}
+export interface CreateSessionForUserResult {
+    token: string;
+    refreshToken: string;
+    user: User;
+}
+export type CreateSessionForUserError = AuthDependencyUnavailableError | EmailNotVerifiedError | InvalidCredentialsError | UserNotFoundError;
+export declare function createSessionForUser(params: CreateSessionForUserParams): Promise<CreateSessionForUserResult>;
+export interface RefreshAccessTokenResult {
+    token: string;
+    /** Undefined on a grace-window hit: keep the existing cookie instead of rotating it. */
+    refreshToken: string | undefined;
+    user: User;
+}
+export declare function refreshAccessToken(params: {
+    refreshToken: string;
+}): Promise<RefreshAccessTokenResult>;
+export interface ConfirmEmailVerificationResult {
+    token: string;
+    refreshToken: string;
+    user: User;
+}
+export interface ResendEmailVerificationResult {
+    nextResendAvailableAt: Date;
+}
+export declare function confirmEmailVerification(params: {
+    token: string;
+}): Promise<ConfirmEmailVerificationResult>;
+export declare function resendEmailVerification(params: {
+    email: string;
+}): Promise<ResendEmailVerificationResult>;
+export declare function requestPasswordReset(params: {
+    email: string;
+}): Promise<void>;
+export interface ConfirmPasswordResetResult {
+    token: string;
+    refreshToken: string;
+    user: User;
+}
+export declare function confirmPasswordReset(params: {
+    token: string;
+    newPassword: string;
+}): Promise<ConfirmPasswordResetResult>;
+export declare function changePassword(params: {
+    userId: string;
+    currentPassword: string;
+    newPassword: string;
+    refreshToken?: string | undefined;
+}): Promise<void>;
+export declare function logout(params: {
+    refreshToken?: string | undefined;
+}): Promise<void>;
+export interface GetCurrentUserResult {
+    user: User;
+}
+export declare function getCurrentUser(params: {
+    userId: string;
+}): Promise<GetCurrentUserResult>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/core/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EAErB,uBAAuB,EAEvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AA8ErB,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9E;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhE;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,0BAA2B,SAAQ,WAAW;IAC7D,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IACrE,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CA2ErC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAyBrE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAqBrC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAmDpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAe1C;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAazC;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAuBtC;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAO5F"}

package/dist/core/auth.js

@@ -0,0 +1,476 @@
+import { EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS, emailSchema } from '@shipfox/api-auth-dto';
+import { acceptWorkspaceInvitation, InvitationEmailMismatchError, listMembershipsByUser, peekInvitationByRawToken, TokenAlreadyUsedError, TokenExpiredError, TokenInvalidError as WorkspacesTokenInvalidError } from '@shipfox/api-workspaces';
+import { generateOpaqueToken, hashOpaqueToken } from '@shipfox/node-tokens';
+import { config } from '#config.js';
+import { consumeEmailVerification, createEmailVerification, createResendEmailVerification } from '#db/email-verifications.js';
+import { consumePasswordReset, createPasswordReset } from '#db/password-resets.js';
+import { createRefreshToken, findActiveRefreshTokenByHash, findRefreshTokenByHash, revokeRefreshTokenByHash, revokeRefreshTokensForUser, rotateRefreshToken } from '#db/refresh-tokens.js';
+import { createUser as createDbUser, findUserByEmail, findUserById, markEmailVerified, provisionUser as provisionDbUser, updateUserPassword } from '#db/users.js';
+import { recordTokenRefreshed } from '#metrics/index.js';
+import { AuthDependencyUnavailableError, EmailNotVerifiedError, EmailTakenError, InvalidCredentialsError, TokenInvalidError, UserNotFoundError } from './errors.js';
+import { signUserToken } from './jwt.js';
+import { hashPassword, verifyPassword } from './password.js';
+const VERIFICATION_TTL_HOURS = 24;
+const RESET_TTL_HOURS = 1;
+let dummyHashCache;
+async function getDummyHash() {
+    if (!dummyHashCache) {
+        dummyHashCache = await hashPassword({
+            password: 'dummy-for-timing-parity'
+        });
+    }
+    return dummyHashCache;
+}
+function hoursFromNow(hours) {
+    return new Date(Date.now() + hours * 60 * 60 * 1000);
+}
+function daysFromNow(days) {
+    return new Date(Date.now() + days * 24 * 60 * 60 * 1000);
+}
+function recordRefreshOutcome(outcome) {
+    recordTokenRefreshed(outcome);
+}
+async function signAccessToken(user) {
+    const memberships = await listMembershipsByUser({
+        userId: user.id
+    }).catch((error)=>{
+        throw new AuthDependencyUnavailableError('workspaces', error);
+    });
+    return await signUserToken({
+        userId: user.id,
+        email: user.email,
+        name: user.name,
+        memberships: memberships.map((m)=>({
+                workspaceId: m.workspaceId,
+                role: 'admin'
+            })),
+        secret: config.AUTH_JWT_SECRET,
+        expiresIn: config.AUTH_JWT_EXPIRES_IN
+    });
+}
+function isWithinRotationGrace(refreshToken) {
+    if (!refreshToken.rotatedAt) return false;
+    const graceMs = config.AUTH_REFRESH_ROTATION_GRACE_SECONDS * 1000;
+    return Date.now() - refreshToken.rotatedAt.getTime() <= graceMs;
+}
+async function createRefreshSession(user) {
+    const refreshToken = generateOpaqueToken('refreshToken');
+    await createRefreshToken({
+        userId: user.id,
+        hashedToken: hashOpaqueToken(refreshToken),
+        expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS)
+    });
+    return refreshToken;
+}
+function verificationLink(rawToken) {
+    return `${config.CLIENT_BASE_URL}/auth/verify-email?token=${rawToken}`;
+}
+function passwordResetLink(rawToken) {
+    return `${config.CLIENT_BASE_URL}/auth/reset?token=${rawToken}`;
+}
+async function createAndQueueEmailVerification(user) {
+    const rawToken = generateOpaqueToken('emailVerification');
+    await createEmailVerification({
+        userId: user.id,
+        hashedToken: hashOpaqueToken(rawToken),
+        expiresAt: hoursFromNow(VERIFICATION_TTL_HOURS),
+        sendEmail: {
+            email: user.email,
+            verifyLink: verificationLink(rawToken)
+        }
+    });
+}
+/**
+ * Creates a verified, password-less user for an external identity provider.
+ * Existing users are returned unchanged, including their password and profile.
+ */ export async function provisionUser(params) {
+    return await provisionDbUser({
+        email: emailSchema.parse(params.email),
+        name: params.name ?? null
+    });
+}
+export async function signup(params) {
+    const existing = await findUserByEmail({
+        email: params.email
+    });
+    if (existing) {
+        throw new EmailTakenError(params.email);
+    }
+    const hashedPassword = await hashPassword({
+        password: params.password
+    });
+    const user = await createDbUser({
+        email: params.email,
+        hashedPassword,
+        name: params.name ?? null
+    });
+    await createAndQueueEmailVerification(user);
+    return user;
+}
+export async function signupWithInvitation(params) {
+    // Step 1: Pre-validate the invitation BEFORE any user write so an invalid
+    // token never produces an orphan user. Re-validation happens again inside
+    // acceptWorkspaceInvitation (race-safe) after the user is created.
+    const invitation = await peekInvitationByRawToken({
+        token: params.invitationToken
+    });
+    if (!invitation) {
+        throw new WorkspacesTokenInvalidError('Invitation token is invalid');
+    }
+    if (invitation.acceptedAt !== null) {
+        throw new TokenAlreadyUsedError();
+    }
+    if (invitation.expiresAt.getTime() <= Date.now()) {
+        throw new TokenExpiredError();
+    }
+    if (invitation.email !== params.email) {
+        throw new InvitationEmailMismatchError();
+    }
+    // Step 2: Create the user as verified. The invitation email is the proof of
+    // ownership, and this avoids a second auth-table write just to mark verified.
+    const existing = await findUserByEmail({
+        email: params.email
+    });
+    if (existing) {
+        throw new EmailTakenError(params.email);
+    }
+    const hashedPassword = await hashPassword({
+        password: params.password
+    });
+    const user = await createDbUser({
+        email: params.email,
+        hashedPassword,
+        name: params.name ?? null,
+        emailVerifiedAt: new Date()
+    });
+    // Step 3: Accept the invitation through the workspaces module boundary.
+    // This is intentionally not one database transaction with auth; treat it like
+    // calling another service. If it fails after user creation, return a verified
+    // signed-in user and an explicit retryable accept error.
+    let membership = null;
+    let acceptError;
+    try {
+        const result = await acceptWorkspaceInvitation({
+            token: params.invitationToken,
+            userId: user.id,
+            email: user.email,
+            name: user.name
+        });
+        membership = {
+            id: result.membership.id,
+            userId: result.membership.userId,
+            workspaceId: result.membership.workspaceId
+        };
+    } catch (error) {
+        if (error instanceof WorkspacesTokenInvalidError || error instanceof TokenAlreadyUsedError || error instanceof TokenExpiredError || error instanceof InvitationEmailMismatchError) {
+            acceptError = {
+                code: error.name,
+                message: error.message
+            };
+        } else {
+            acceptError = {
+                code: 'AcceptFailed',
+                message: 'Could not accept the invitation; please retry from the invite link.'
+            };
+        }
+    }
+    // Step 4: Issue session. signAccessToken reads memberships through the
+    // workspaces module API, so a successful accept is reflected in the JWT.
+    const token = await signAccessToken(user);
+    const refreshToken = await createRefreshSession(user);
+    if (acceptError) {
+        return {
+            token,
+            refreshToken,
+            user,
+            membership,
+            acceptError
+        };
+    }
+    return {
+        token,
+        refreshToken,
+        user,
+        membership
+    };
+}
+export async function createUser(params) {
+    const existing = await findUserByEmail({
+        email: params.email
+    });
+    if (existing) {
+        throw new EmailTakenError(params.email);
+    }
+    const hashedPassword = await hashPassword({
+        password: params.password
+    });
+    const user = await createDbUser({
+        email: params.email,
+        hashedPassword,
+        name: params.name ?? null,
+        emailVerifiedAt: params.verified ? new Date() : null
+    });
+    return user;
+}
+export async function login(params) {
+    const user = await findUserByEmail({
+        email: params.email
+    });
+    if (!user) {
+        await verifyPassword({
+            password: params.password,
+            hash: await getDummyHash()
+        });
+        throw new InvalidCredentialsError();
+    }
+    const hasPassword = user.hashedPassword !== null;
+    const ok = await verifyPassword({
+        password: params.password,
+        hash: user.hashedPassword ?? await getDummyHash()
+    });
+    if (!hasPassword || !ok || user.status !== 'active') {
+        throw new InvalidCredentialsError();
+    }
+    if (user.emailVerifiedAt === null) {
+        throw new EmailNotVerifiedError();
+    }
+    const token = await signAccessToken(user);
+    const refreshToken = await createRefreshSession(user);
+    return {
+        token,
+        refreshToken,
+        user
+    };
+}
+export async function createSessionForUser(params) {
+    const user = params.userId ? await findUserById({
+        id: params.userId
+    }) : params.email ? await findUserByEmail({
+        email: params.email
+    }) : undefined;
+    if (!user) {
+        throw new UserNotFoundError(params.userId ?? params.email ?? 'unknown');
+    }
+    if (user.emailVerifiedAt === null) {
+        throw new EmailNotVerifiedError();
+    }
+    if (user.status !== 'active') {
+        throw new InvalidCredentialsError();
+    }
+    const token = await signAccessToken(user);
+    const refreshToken = await createRefreshSession(user);
+    return {
+        token,
+        refreshToken,
+        user
+    };
+}
+export async function refreshAccessToken(params) {
+    const currentHashedToken = hashOpaqueToken(params.refreshToken);
+    const current = await findRefreshTokenByHash({
+        hashedToken: currentHashedToken
+    });
+    if (!current) {
+        recordRefreshOutcome('rejected');
+        throw new TokenInvalidError('Refresh token is invalid or expired');
+    }
+    const user = await findUserById({
+        id: current.userId
+    });
+    if (user?.status !== 'active') {
+        await revokeRefreshTokenByHash({
+            hashedToken: currentHashedToken
+        });
+        recordRefreshOutcome('rejected');
+        throw new TokenInvalidError('Refresh token is invalid or expired');
+    }
+    // Within the grace window a rotated token means a concurrent refresh (e.g. a
+    // second tab); past it, reuse of a retired token means a compromised session.
+    if (current.rotatedAt) {
+        if (isWithinRotationGrace(current)) {
+            const token = await signAccessToken(user);
+            recordRefreshOutcome('grace');
+            return {
+                token,
+                refreshToken: undefined,
+                user
+            };
+        }
+        await revokeRefreshTokensForUser({
+            userId: user.id
+        });
+        recordRefreshOutcome('rejected');
+        throw new TokenInvalidError('Refresh token reused after rotation');
+    }
+    // Losing the CAS requires a state check: another request may have rotated,
+    // revoked, or expired the token before this refresh could claim it.
+    const nextRefreshToken = generateOpaqueToken('refreshToken');
+    const rotated = await rotateRefreshToken({
+        id: current.id,
+        currentHashedToken,
+        nextHashedToken: hashOpaqueToken(nextRefreshToken),
+        expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS)
+    });
+    if (!rotated) {
+        const latest = await findRefreshTokenByHash({
+            hashedToken: currentHashedToken
+        });
+        if (!latest || !isWithinRotationGrace(latest)) {
+            recordRefreshOutcome('rejected');
+            throw new TokenInvalidError('Refresh token is invalid or expired');
+        }
+        const token = await signAccessToken(user);
+        recordRefreshOutcome('grace');
+        return {
+            token,
+            refreshToken: undefined,
+            user
+        };
+    }
+    const token = await signAccessToken(user);
+    recordRefreshOutcome('rotated');
+    return {
+        token,
+        refreshToken: nextRefreshToken,
+        user
+    };
+}
+export async function confirmEmailVerification(params) {
+    const consumed = await consumeEmailVerification({
+        hashedToken: hashOpaqueToken(params.token)
+    });
+    if (!consumed) {
+        throw new TokenInvalidError('Verification token is invalid or expired');
+    }
+    const user = await markEmailVerified({
+        userId: consumed.userId
+    });
+    if (user?.status !== 'active') {
+        throw new TokenInvalidError('Verification token is invalid or expired');
+    }
+    const token = await signAccessToken(user);
+    const refreshToken = await createRefreshSession(user);
+    return {
+        token,
+        refreshToken,
+        user
+    };
+}
+export async function resendEmailVerification(params) {
+    const rawToken = generateOpaqueToken('emailVerification');
+    const result = await createResendEmailVerification({
+        email: params.email,
+        hashedToken: hashOpaqueToken(rawToken),
+        expiresAt: hoursFromNow(VERIFICATION_TTL_HOURS),
+        cooldownSeconds: EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS,
+        sendEmail: {
+            verifyLink: verificationLink(rawToken)
+        }
+    });
+    return {
+        nextResendAvailableAt: result.nextResendAvailableAt
+    };
+}
+export async function requestPasswordReset(params) {
+    const user = await findUserByEmail({
+        email: params.email
+    });
+    if (user?.status !== 'active' || user.hashedPassword === null) {
+        return;
+    }
+    const rawToken = generateOpaqueToken('passwordReset');
+    await createPasswordReset({
+        userId: user.id,
+        hashedToken: hashOpaqueToken(rawToken),
+        expiresAt: hoursFromNow(RESET_TTL_HOURS),
+        sendEmail: {
+            email: user.email,
+            resetLink: passwordResetLink(rawToken),
+            expiresInHours: RESET_TTL_HOURS
+        }
+    });
+}
+export async function confirmPasswordReset(params) {
+    const consumed = await consumePasswordReset({
+        hashedToken: hashOpaqueToken(params.token)
+    });
+    if (!consumed) {
+        throw new TokenInvalidError('Reset token is invalid or expired');
+    }
+    const existingUser = await findUserById({
+        id: consumed.userId
+    });
+    if (existingUser?.status !== 'active' || existingUser.hashedPassword === null) {
+        throw new TokenInvalidError('Reset token is invalid or expired');
+    }
+    const hashedPassword = await hashPassword({
+        password: params.newPassword
+    });
+    const user = await updateUserPassword({
+        userId: consumed.userId,
+        hashedPassword
+    });
+    if (user?.status !== 'active') {
+        throw new TokenInvalidError('Reset token is invalid or expired');
+    }
+    await revokeRefreshTokensForUser({
+        userId: consumed.userId
+    });
+    const token = await signAccessToken(user);
+    const refreshToken = await createRefreshSession(user);
+    return {
+        token,
+        refreshToken,
+        user
+    };
+}
+export async function changePassword(params) {
+    const user = await findUserById({
+        id: params.userId
+    });
+    if (!user) {
+        throw new UserNotFoundError(params.userId);
+    }
+    const hasPassword = user.hashedPassword !== null;
+    const ok = await verifyPassword({
+        password: params.currentPassword,
+        hash: user.hashedPassword ?? await getDummyHash()
+    });
+    if (!hasPassword || !ok) {
+        throw new InvalidCredentialsError();
+    }
+    const hashedPassword = await hashPassword({
+        password: params.newPassword
+    });
+    const currentRefreshSession = params.refreshToken ? await findActiveRefreshTokenByHash({
+        hashedToken: hashOpaqueToken(params.refreshToken)
+    }) : undefined;
+    const exceptRefreshTokenId = currentRefreshSession?.userId === user.id ? currentRefreshSession.id : undefined;
+    await updateUserPassword({
+        userId: user.id,
+        hashedPassword
+    });
+    await revokeRefreshTokensForUser({
+        userId: user.id,
+        exceptRefreshTokenId
+    });
+}
+export async function logout(params) {
+    if (!params.refreshToken) return;
+    await revokeRefreshTokenByHash({
+        hashedToken: hashOpaqueToken(params.refreshToken)
+    });
+}
+export async function getCurrentUser(params) {
+    const user = await findUserById({
+        id: params.userId
+    });
+    if (!user) {
+        throw new UserNotFoundError(params.userId);
+    }
+    return {
+        user
+    };
+}
+
+//# sourceMappingURL=auth.js.map

package/dist/core/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/auth.ts"],"sourcesContent":["import {EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS, emailSchema} from '@shipfox/api-auth-dto';\nimport {\n  acceptWorkspaceInvitation,\n  InvitationEmailMismatchError,\n  listMembershipsByUser,\n  peekInvitationByRawToken,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError as WorkspacesTokenInvalidError,\n} from '@shipfox/api-workspaces';\nimport {generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {config} from '#config.js';\nimport {\n  consumeEmailVerification,\n  createEmailVerification,\n  createResendEmailVerification,\n} from '#db/email-verifications.js';\nimport {consumePasswordReset, createPasswordReset} from '#db/password-resets.js';\nimport {\n  createRefreshToken,\n  findActiveRefreshTokenByHash,\n  findRefreshTokenByHash,\n  revokeRefreshTokenByHash,\n  revokeRefreshTokensForUser,\n  rotateRefreshToken,\n} from '#db/refresh-tokens.js';\nimport {\n  createUser as createDbUser,\n  findUserByEmail,\n  findUserById,\n  markEmailVerified,\n  provisionUser as provisionDbUser,\n  updateUserPassword,\n} from '#db/users.js';\nimport {type AuthTokenRefreshOutcome, recordTokenRefreshed} from '#metrics/index.js';\nimport type {RefreshToken} from './entities/refresh-token.js';\nimport type {User} from './entities/user.js';\nimport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  EmailTakenError,\n  InvalidCredentialsError,\n  TokenInvalidError,\n  UserNotFoundError,\n} from './errors.js';\nimport {signUserToken} from './jwt.js';\nimport {hashPassword, verifyPassword} from './password.js';\n\nconst VERIFICATION_TTL_HOURS = 24;\nconst RESET_TTL_HOURS = 1;\n\nlet dummyHashCache: string | undefined;\nasync function getDummyHash(): Promise<string> {\n  if (!dummyHashCache) {\n    dummyHashCache = await hashPassword({password: 'dummy-for-timing-parity'});\n  }\n  return dummyHashCache;\n}\n\nfunction hoursFromNow(hours: number): Date {\n  return new Date(Date.now() + hours * 60 * 60 * 1000);\n}\n\nfunction daysFromNow(days: number): Date {\n  return new Date(Date.now() + days * 24 * 60 * 60 * 1000);\n}\n\nfunction recordRefreshOutcome(outcome: AuthTokenRefreshOutcome): void {\n  recordTokenRefreshed(outcome);\n}\n\nasync function signAccessToken(user: User): Promise<string> {\n  const memberships = await listMembershipsByUser({userId: user.id}).catch((error: unknown) => {\n    throw new AuthDependencyUnavailableError('workspaces', error);\n  });\n  return await signUserToken({\n    userId: user.id,\n    email: user.email,\n    name: user.name,\n    memberships: memberships.map((m) => ({workspaceId: m.workspaceId, role: 'admin' as const})),\n    secret: config.AUTH_JWT_SECRET,\n    expiresIn: config.AUTH_JWT_EXPIRES_IN,\n  });\n}\n\nfunction isWithinRotationGrace(refreshToken: RefreshToken): boolean {\n  if (!refreshToken.rotatedAt) return false;\n  const graceMs = config.AUTH_REFRESH_ROTATION_GRACE_SECONDS * 1000;\n  return Date.now() - refreshToken.rotatedAt.getTime() <= graceMs;\n}\n\nasync function createRefreshSession(user: User): Promise<string> {\n  const refreshToken = generateOpaqueToken('refreshToken');\n  await createRefreshToken({\n    userId: user.id,\n    hashedToken: hashOpaqueToken(refreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  return refreshToken;\n}\n\nfunction verificationLink(rawToken: string): string {\n  return `${config.CLIENT_BASE_URL}/auth/verify-email?token=${rawToken}`;\n}\n\nfunction passwordResetLink(rawToken: string): string {\n  return `${config.CLIENT_BASE_URL}/auth/reset?token=${rawToken}`;\n}\n\nasync function createAndQueueEmailVerification(user: User): Promise<void> {\n  const rawToken = generateOpaqueToken('emailVerification');\n  await createEmailVerification({\n    userId: user.id,\n    hashedToken: hashOpaqueToken(rawToken),\n    expiresAt: hoursFromNow(VERIFICATION_TTL_HOURS),\n    sendEmail: {\n      email: user.email,\n      verifyLink: verificationLink(rawToken),\n    },\n  });\n}\n\nexport interface SignupParams {\n  email: string;\n  password: string;\n  name?: string | undefined;\n}\n\nexport interface ProvisionUserParams {\n  email: string;\n  name?: string | null | undefined;\n}\n\n/**\n * Creates a verified, password-less user for an external identity provider.\n * Existing users are returned unchanged, including their password and profile.\n */\nexport async function provisionUser(params: ProvisionUserParams): Promise<User> {\n  return await provisionDbUser({\n    email: emailSchema.parse(params.email),\n    name: params.name ?? null,\n  });\n}\n\nexport async function signup(params: SignupParams): Promise<User> {\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n  });\n\n  await createAndQueueEmailVerification(user);\n\n  return user;\n}\n\nexport interface SignupWithInvitationParams extends SignupParams {\n  invitationToken: string;\n}\n\nexport interface SignupWithInvitationResult extends LoginResult {\n  membership: {id: string; userId: string; workspaceId: string} | null;\n  acceptError?: {code: string; message: string};\n}\n\nexport async function signupWithInvitation(\n  params: SignupWithInvitationParams,\n): Promise<SignupWithInvitationResult> {\n  // Step 1: Pre-validate the invitation BEFORE any user write so an invalid\n  // token never produces an orphan user. Re-validation happens again inside\n  // acceptWorkspaceInvitation (race-safe) after the user is created.\n  const invitation = await peekInvitationByRawToken({token: params.invitationToken});\n  if (!invitation) {\n    throw new WorkspacesTokenInvalidError('Invitation token is invalid');\n  }\n  if (invitation.acceptedAt !== null) {\n    throw new TokenAlreadyUsedError();\n  }\n  if (invitation.expiresAt.getTime() <= Date.now()) {\n    throw new TokenExpiredError();\n  }\n  if (invitation.email !== params.email) {\n    throw new InvitationEmailMismatchError();\n  }\n\n  // Step 2: Create the user as verified. The invitation email is the proof of\n  // ownership, and this avoids a second auth-table write just to mark verified.\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: new Date(),\n  });\n\n  // Step 3: Accept the invitation through the workspaces module boundary.\n  // This is intentionally not one database transaction with auth; treat it like\n  // calling another service. If it fails after user creation, return a verified\n  // signed-in user and an explicit retryable accept error.\n  let membership: SignupWithInvitationResult['membership'] = null;\n  let acceptError: SignupWithInvitationResult['acceptError'];\n  try {\n    const result = await acceptWorkspaceInvitation({\n      token: params.invitationToken,\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n    });\n    membership = {\n      id: result.membership.id,\n      userId: result.membership.userId,\n      workspaceId: result.membership.workspaceId,\n    };\n  } catch (error) {\n    if (\n      error instanceof WorkspacesTokenInvalidError ||\n      error instanceof TokenAlreadyUsedError ||\n      error instanceof TokenExpiredError ||\n      error instanceof InvitationEmailMismatchError\n    ) {\n      acceptError = {code: error.name, message: error.message};\n    } else {\n      acceptError = {\n        code: 'AcceptFailed',\n        message: 'Could not accept the invitation; please retry from the invite link.',\n      };\n    }\n  }\n\n  // Step 4: Issue session. signAccessToken reads memberships through the\n  // workspaces module API, so a successful accept is reflected in the JWT.\n  const token = await signAccessToken(user);\n  const refreshToken = await createRefreshSession(user);\n\n  if (acceptError) {\n    return {token, refreshToken, user, membership, acceptError};\n  }\n  return {token, refreshToken, user, membership};\n}\n\nexport interface CreateUserParams extends SignupParams {\n  verified: boolean;\n}\n\nexport async function createUser(params: CreateUserParams): Promise<User> {\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: params.verified ? new Date() : null,\n  });\n\n  return user;\n}\n\nexport interface LoginParams {\n  email: string;\n  password: string;\n}\n\nexport interface LoginResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n}\n\nexport async function login(params: LoginParams): Promise<LoginResult> {\n  const user = await findUserByEmail({email: params.email});\n\n  if (!user) {\n    await verifyPassword({password: params.password, hash: await getDummyHash()});\n    throw new InvalidCredentialsError();\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.password,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok || user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n\n  const token = await signAccessToken(user);\n  const refreshToken = await createRefreshSession(user);\n\n  return {token, refreshToken, user};\n}\n\nexport interface CreateSessionForUserParams {\n  userId?: string | undefined;\n  email?: string | undefined;\n}\n\nexport interface CreateSessionForUserResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n}\n\nexport type CreateSessionForUserError =\n  | AuthDependencyUnavailableError\n  | EmailNotVerifiedError\n  | InvalidCredentialsError\n  | UserNotFoundError;\n\nexport async function createSessionForUser(\n  params: CreateSessionForUserParams,\n): Promise<CreateSessionForUserResult> {\n  const user = params.userId\n    ? await findUserById({id: params.userId})\n    : params.email\n      ? await findUserByEmail({email: params.email})\n      : undefined;\n\n  if (!user) {\n    throw new UserNotFoundError(params.userId ?? params.email ?? 'unknown');\n  }\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n  if (user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  const token = await signAccessToken(user);\n  const refreshToken = await createRefreshSession(user);\n\n  return {token, refreshToken, user};\n}\n\nexport interface RefreshAccessTokenResult {\n  token: string;\n  /** Undefined on a grace-window hit: keep the existing cookie instead of rotating it. */\n  refreshToken: string | undefined;\n  user: User;\n}\n\nexport async function refreshAccessToken(params: {\n  refreshToken: string;\n}): Promise<RefreshAccessTokenResult> {\n  const currentHashedToken = hashOpaqueToken(params.refreshToken);\n  const current = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n  if (!current) {\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n\n  const user = await findUserById({id: current.userId});\n  if (user?.status !== 'active') {\n    await revokeRefreshTokenByHash({hashedToken: currentHashedToken});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n\n  // Within the grace window a rotated token means a concurrent refresh (e.g. a\n  // second tab); past it, reuse of a retired token means a compromised session.\n  if (current.rotatedAt) {\n    if (isWithinRotationGrace(current)) {\n      const token = await signAccessToken(user);\n      recordRefreshOutcome('grace');\n      return {token, refreshToken: undefined, user};\n    }\n    await revokeRefreshTokensForUser({userId: user.id});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token reused after rotation');\n  }\n\n  // Losing the CAS requires a state check: another request may have rotated,\n  // revoked, or expired the token before this refresh could claim it.\n  const nextRefreshToken = generateOpaqueToken('refreshToken');\n  const rotated = await rotateRefreshToken({\n    id: current.id,\n    currentHashedToken,\n    nextHashedToken: hashOpaqueToken(nextRefreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  if (!rotated) {\n    const latest = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n    if (!latest || !isWithinRotationGrace(latest)) {\n      recordRefreshOutcome('rejected');\n      throw new TokenInvalidError('Refresh token is invalid or expired');\n    }\n    const token = await signAccessToken(user);\n    recordRefreshOutcome('grace');\n    return {token, refreshToken: undefined, user};\n  }\n\n  const token = await signAccessToken(user);\n  recordRefreshOutcome('rotated');\n  return {token, refreshToken: nextRefreshToken, user};\n}\n\nexport interface ConfirmEmailVerificationResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n}\n\nexport interface ResendEmailVerificationResult {\n  nextResendAvailableAt: Date;\n}\n\nexport async function confirmEmailVerification(params: {\n  token: string;\n}): Promise<ConfirmEmailVerificationResult> {\n  const consumed = await consumeEmailVerification({hashedToken: hashOpaqueToken(params.token)});\n  if (!consumed) {\n    throw new TokenInvalidError('Verification token is invalid or expired');\n  }\n\n  const user = await markEmailVerified({userId: consumed.userId});\n  if (user?.status !== 'active') {\n    throw new TokenInvalidError('Verification token is invalid or expired');\n  }\n\n  const token = await signAccessToken(user);\n  const refreshToken = await createRefreshSession(user);\n\n  return {token, refreshToken, user};\n}\n\nexport async function resendEmailVerification(params: {\n  email: string;\n}): Promise<ResendEmailVerificationResult> {\n  const rawToken = generateOpaqueToken('emailVerification');\n  const result = await createResendEmailVerification({\n    email: params.email,\n    hashedToken: hashOpaqueToken(rawToken),\n    expiresAt: hoursFromNow(VERIFICATION_TTL_HOURS),\n    cooldownSeconds: EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS,\n    sendEmail: {\n      verifyLink: verificationLink(rawToken),\n    },\n  });\n\n  return {nextResendAvailableAt: result.nextResendAvailableAt};\n}\n\nexport async function requestPasswordReset(params: {email: string}): Promise<void> {\n  const user = await findUserByEmail({email: params.email});\n  if (user?.status !== 'active' || user.hashedPassword === null) {\n    return;\n  }\n\n  const rawToken = generateOpaqueToken('passwordReset');\n  await createPasswordReset({\n    userId: user.id,\n    hashedToken: hashOpaqueToken(rawToken),\n    expiresAt: hoursFromNow(RESET_TTL_HOURS),\n    sendEmail: {\n      email: user.email,\n      resetLink: passwordResetLink(rawToken),\n      expiresInHours: RESET_TTL_HOURS,\n    },\n  });\n}\n\nexport interface ConfirmPasswordResetResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n}\n\nexport async function confirmPasswordReset(params: {\n  token: string;\n  newPassword: string;\n}): Promise<ConfirmPasswordResetResult> {\n  const consumed = await consumePasswordReset({hashedToken: hashOpaqueToken(params.token)});\n  if (!consumed) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const existingUser = await findUserById({id: consumed.userId});\n  if (existingUser?.status !== 'active' || existingUser.hashedPassword === null) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const user = await updateUserPassword({userId: consumed.userId, hashedPassword});\n  if (user?.status !== 'active') {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  await revokeRefreshTokensForUser({userId: consumed.userId});\n\n  const token = await signAccessToken(user);\n  const refreshToken = await createRefreshSession(user);\n\n  return {token, refreshToken, user};\n}\n\nexport async function changePassword(params: {\n  userId: string;\n  currentPassword: string;\n  newPassword: string;\n  refreshToken?: string | undefined;\n}): Promise<void> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.currentPassword,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok) {\n    throw new InvalidCredentialsError();\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const currentRefreshSession = params.refreshToken\n    ? await findActiveRefreshTokenByHash({hashedToken: hashOpaqueToken(params.refreshToken)})\n    : undefined;\n  const exceptRefreshTokenId =\n    currentRefreshSession?.userId === user.id ? currentRefreshSession.id : undefined;\n\n  await updateUserPassword({userId: user.id, hashedPassword});\n  await revokeRefreshTokensForUser({userId: user.id, exceptRefreshTokenId});\n}\n\nexport async function logout(params: {refreshToken?: string | undefined}): Promise<void> {\n  if (!params.refreshToken) return;\n  await revokeRefreshTokenByHash({hashedToken: hashOpaqueToken(params.refreshToken)});\n}\n\nexport interface GetCurrentUserResult {\n  user: User;\n}\n\nexport async function getCurrentUser(params: {userId: string}): Promise<GetCurrentUserResult> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  return {user};\n}\n"],"names":["EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS","emailSchema","acceptWorkspaceInvitation","InvitationEmailMismatchError","listMembershipsByUser","peekInvitationByRawToken","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","WorkspacesTokenInvalidError","generateOpaqueToken","hashOpaqueToken","config","consumeEmailVerification","createEmailVerification","createResendEmailVerification","consumePasswordReset","createPasswordReset","createRefreshToken","findActiveRefreshTokenByHash","findRefreshTokenByHash","revokeRefreshTokenByHash","revokeRefreshTokensForUser","rotateRefreshToken","createUser","createDbUser","findUserByEmail","findUserById","markEmailVerified","provisionUser","provisionDbUser","updateUserPassword","recordTokenRefreshed","AuthDependencyUnavailableError","EmailNotVerifiedError","EmailTakenError","InvalidCredentialsError","UserNotFoundError","signUserToken","hashPassword","verifyPassword","VERIFICATION_TTL_HOURS","RESET_TTL_HOURS","dummyHashCache","getDummyHash","password","hoursFromNow","hours","Date","now","daysFromNow","days","recordRefreshOutcome","outcome","signAccessToken","user","memberships","userId","id","catch","error","email","name","map","m","workspaceId","role","secret","AUTH_JWT_SECRET","expiresIn","AUTH_JWT_EXPIRES_IN","isWithinRotationGrace","refreshToken","rotatedAt","graceMs","AUTH_REFRESH_ROTATION_GRACE_SECONDS","getTime","createRefreshSession","hashedToken","expiresAt","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","verificationLink","rawToken","CLIENT_BASE_URL","passwordResetLink","createAndQueueEmailVerification","sendEmail","verifyLink","params","parse","signup","existing","hashedPassword","signupWithInvitation","invitation","token","invitationToken","acceptedAt","emailVerifiedAt","membership","acceptError","result","code","message","verified","login","hash","hasPassword","ok","status","createSessionForUser","undefined","refreshAccessToken","currentHashedToken","current","nextRefreshToken","rotated","nextHashedToken","latest","confirmEmailVerification","consumed","resendEmailVerification","cooldownSeconds","nextResendAvailableAt","requestPasswordReset","resetLink","expiresInHours","confirmPasswordReset","existingUser","newPassword","changePassword","currentPassword","currentRefreshSession","exceptRefreshTokenId","logout","getCurrentUser"],"mappings":"AAAA,SAAQA,0CAA0C,EAAEC,WAAW,QAAO,wBAAwB;AAC9F,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,qBAAqB,EACrBC,wBAAwB,EACxBC,qBAAqB,EACrBC,iBAAiB,EACjBC,qBAAqBC,2BAA2B,QAC3C,0BAA0B;AACjC,SAAQC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAC1E,SAAQC,MAAM,QAAO,aAAa;AAClC,SACEC,wBAAwB,EACxBC,uBAAuB,EACvBC,6BAA6B,QACxB,6BAA6B;AACpC,SAAQC,oBAAoB,EAAEC,mBAAmB,QAAO,yBAAyB;AACjF,SACEC,kBAAkB,EAClBC,4BAA4B,EAC5BC,sBAAsB,EACtBC,wBAAwB,EACxBC,0BAA0B,EAC1BC,kBAAkB,QACb,wBAAwB;AAC/B,SACEC,cAAcC,YAAY,EAC1BC,eAAe,EACfC,YAAY,EACZC,iBAAiB,EACjBC,iBAAiBC,eAAe,EAChCC,kBAAkB,QACb,eAAe;AACtB,SAAsCC,oBAAoB,QAAO,oBAAoB;AAGrF,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,eAAe,EACfC,uBAAuB,EACvB5B,iBAAiB,EACjB6B,iBAAiB,QACZ,cAAc;AACrB,SAAQC,aAAa,QAAO,WAAW;AACvC,SAAQC,YAAY,EAAEC,cAAc,QAAO,gBAAgB;AAE3D,MAAMC,yBAAyB;AAC/B,MAAMC,kBAAkB;AAExB,IAAIC;AACJ,eAAeC;IACb,IAAI,CAACD,gBAAgB;QACnBA,iBAAiB,MAAMJ,aAAa;YAACM,UAAU;QAAyB;IAC1E;IACA,OAAOF;AACT;AAEA,SAASG,aAAaC,KAAa;IACjC,OAAO,IAAIC,KAAKA,KAAKC,GAAG,KAAKF,QAAQ,KAAK,KAAK;AACjD;AAEA,SAASG,YAAYC,IAAY;IAC/B,OAAO,IAAIH,KAAKA,KAAKC,GAAG,KAAKE,OAAO,KAAK,KAAK,KAAK;AACrD;AAEA,SAASC,qBAAqBC,OAAgC;IAC5DrB,qBAAqBqB;AACvB;AAEA,eAAeC,gBAAgBC,IAAU;IACvC,MAAMC,cAAc,MAAMpD,sBAAsB;QAACqD,QAAQF,KAAKG,EAAE;IAAA,GAAGC,KAAK,CAAC,CAACC;QACxE,MAAM,IAAI3B,+BAA+B,cAAc2B;IACzD;IACA,OAAO,MAAMtB,cAAc;QACzBmB,QAAQF,KAAKG,EAAE;QACfG,OAAON,KAAKM,KAAK;QACjBC,MAAMP,KAAKO,IAAI;QACfN,aAAaA,YAAYO,GAAG,CAAC,CAACC,IAAO,CAAA;gBAACC,aAAaD,EAAEC,WAAW;gBAAEC,MAAM;YAAgB,CAAA;QACxFC,QAAQvD,OAAOwD,eAAe;QAC9BC,WAAWzD,OAAO0D,mBAAmB;IACvC;AACF;AAEA,SAASC,sBAAsBC,YAA0B;IACvD,IAAI,CAACA,aAAaC,SAAS,EAAE,OAAO;IACpC,MAAMC,UAAU9D,OAAO+D,mCAAmC,GAAG;IAC7D,OAAO3B,KAAKC,GAAG,KAAKuB,aAAaC,SAAS,CAACG,OAAO,MAAMF;AAC1D;AAEA,eAAeG,qBAAqBtB,IAAU;IAC5C,MAAMiB,eAAe9D,oBAAoB;IACzC,MAAMQ,mBAAmB;QACvBuC,QAAQF,KAAKG,EAAE;QACfoB,aAAanE,gBAAgB6D;QAC7BO,WAAW7B,YAAYtC,OAAOoE,kCAAkC;IAClE;IACA,OAAOR;AACT;AAEA,SAASS,iBAAiBC,QAAgB;IACxC,OAAO,GAAGtE,OAAOuE,eAAe,CAAC,yBAAyB,EAAED,UAAU;AACxE;AAEA,SAASE,kBAAkBF,QAAgB;IACzC,OAAO,GAAGtE,OAAOuE,eAAe,CAAC,kBAAkB,EAAED,UAAU;AACjE;AAEA,eAAeG,gCAAgC9B,IAAU;IACvD,MAAM2B,WAAWxE,oBAAoB;IACrC,MAAMI,wBAAwB;QAC5B2C,QAAQF,KAAKG,EAAE;QACfoB,aAAanE,gBAAgBuE;QAC7BH,WAAWjC,aAAaL;QACxB6C,WAAW;YACTzB,OAAON,KAAKM,KAAK;YACjB0B,YAAYN,iBAAiBC;QAC/B;IACF;AACF;AAaA;;;CAGC,GACD,OAAO,eAAerD,cAAc2D,MAA2B;IAC7D,OAAO,MAAM1D,gBAAgB;QAC3B+B,OAAO5D,YAAYwF,KAAK,CAACD,OAAO3B,KAAK;QACrCC,MAAM0B,OAAO1B,IAAI,IAAI;IACvB;AACF;AAEA,OAAO,eAAe4B,OAAOF,MAAoB;IAC/C,MAAMG,WAAW,MAAMjE,gBAAgB;QAACmC,OAAO2B,OAAO3B,KAAK;IAAA;IAC3D,IAAI8B,UAAU;QACZ,MAAM,IAAIxD,gBAAgBqD,OAAO3B,KAAK;IACxC;IAEA,MAAM+B,iBAAiB,MAAMrD,aAAa;QAACM,UAAU2C,OAAO3C,QAAQ;IAAA;IACpE,MAAMU,OAAO,MAAM9B,aAAa;QAC9BoC,OAAO2B,OAAO3B,KAAK;QACnB+B;QACA9B,MAAM0B,OAAO1B,IAAI,IAAI;IACvB;IAEA,MAAMuB,gCAAgC9B;IAEtC,OAAOA;AACT;AAWA,OAAO,eAAesC,qBACpBL,MAAkC;IAElC,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,MAAMM,aAAa,MAAMzF,yBAAyB;QAAC0F,OAAOP,OAAOQ,eAAe;IAAA;IAChF,IAAI,CAACF,YAAY;QACf,MAAM,IAAIrF,4BAA4B;IACxC;IACA,IAAIqF,WAAWG,UAAU,KAAK,MAAM;QAClC,MAAM,IAAI3F;IACZ;IACA,IAAIwF,WAAWf,SAAS,CAACH,OAAO,MAAM5B,KAAKC,GAAG,IAAI;QAChD,MAAM,IAAI1C;IACZ;IACA,IAAIuF,WAAWjC,KAAK,KAAK2B,OAAO3B,KAAK,EAAE;QACrC,MAAM,IAAI1D;IACZ;IAEA,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMwF,WAAW,MAAMjE,gBAAgB;QAACmC,OAAO2B,OAAO3B,KAAK;IAAA;IAC3D,IAAI8B,UAAU;QACZ,MAAM,IAAIxD,gBAAgBqD,OAAO3B,KAAK;IACxC;IACA,MAAM+B,iBAAiB,MAAMrD,aAAa;QAACM,UAAU2C,OAAO3C,QAAQ;IAAA;IACpE,MAAMU,OAAO,MAAM9B,aAAa;QAC9BoC,OAAO2B,OAAO3B,KAAK;QACnB+B;QACA9B,MAAM0B,OAAO1B,IAAI,IAAI;QACrBoC,iBAAiB,IAAIlD;IACvB;IAEA,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAImD,aAAuD;IAC3D,IAAIC;IACJ,IAAI;QACF,MAAMC,SAAS,MAAMnG,0BAA0B;YAC7C6F,OAAOP,OAAOQ,eAAe;YAC7BvC,QAAQF,KAAKG,EAAE;YACfG,OAAON,KAAKM,KAAK;YACjBC,MAAMP,KAAKO,IAAI;QACjB;QACAqC,aAAa;YACXzC,IAAI2C,OAAOF,UAAU,CAACzC,EAAE;YACxBD,QAAQ4C,OAAOF,UAAU,CAAC1C,MAAM;YAChCQ,aAAaoC,OAAOF,UAAU,CAAClC,WAAW;QAC5C;IACF,EAAE,OAAOL,OAAO;QACd,IACEA,iBAAiBnD,+BACjBmD,iBAAiBtD,yBACjBsD,iBAAiBrD,qBACjBqD,iBAAiBzD,8BACjB;YACAiG,cAAc;gBAACE,MAAM1C,MAAME,IAAI;gBAAEyC,SAAS3C,MAAM2C,OAAO;YAAA;QACzD,OAAO;YACLH,cAAc;gBACZE,MAAM;gBACNC,SAAS;YACX;QACF;IACF;IAEA,uEAAuE;IACvE,yEAAyE;IACzE,MAAMR,QAAQ,MAAMzC,gBAAgBC;IACpC,MAAMiB,eAAe,MAAMK,qBAAqBtB;IAEhD,IAAI6C,aAAa;QACf,OAAO;YAACL;YAAOvB;YAAcjB;YAAM4C;YAAYC;QAAW;IAC5D;IACA,OAAO;QAACL;QAAOvB;QAAcjB;QAAM4C;IAAU;AAC/C;AAMA,OAAO,eAAe3E,WAAWgE,MAAwB;IACvD,MAAMG,WAAW,MAAMjE,gBAAgB;QAACmC,OAAO2B,OAAO3B,KAAK;IAAA;IAC3D,IAAI8B,UAAU;QACZ,MAAM,IAAIxD,gBAAgBqD,OAAO3B,KAAK;IACxC;IAEA,MAAM+B,iBAAiB,MAAMrD,aAAa;QAACM,UAAU2C,OAAO3C,QAAQ;IAAA;IACpE,MAAMU,OAAO,MAAM9B,aAAa;QAC9BoC,OAAO2B,OAAO3B,KAAK;QACnB+B;QACA9B,MAAM0B,OAAO1B,IAAI,IAAI;QACrBoC,iBAAiBV,OAAOgB,QAAQ,GAAG,IAAIxD,SAAS;IAClD;IAEA,OAAOO;AACT;AAaA,OAAO,eAAekD,MAAMjB,MAAmB;IAC7C,MAAMjC,OAAO,MAAM7B,gBAAgB;QAACmC,OAAO2B,OAAO3B,KAAK;IAAA;IAEvD,IAAI,CAACN,MAAM;QACT,MAAMf,eAAe;YAACK,UAAU2C,OAAO3C,QAAQ;YAAE6D,MAAM,MAAM9D;QAAc;QAC3E,MAAM,IAAIR;IACZ;IAEA,MAAMuE,cAAcpD,KAAKqC,cAAc,KAAK;IAC5C,MAAMgB,KAAK,MAAMpE,eAAe;QAC9BK,UAAU2C,OAAO3C,QAAQ;QACzB6D,MAAMnD,KAAKqC,cAAc,IAAK,MAAMhD;IACtC;IACA,IAAI,CAAC+D,eAAe,CAACC,MAAMrD,KAAKsD,MAAM,KAAK,UAAU;QACnD,MAAM,IAAIzE;IACZ;IAEA,IAAImB,KAAK2C,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIhE;IACZ;IAEA,MAAM6D,QAAQ,MAAMzC,gBAAgBC;IACpC,MAAMiB,eAAe,MAAMK,qBAAqBtB;IAEhD,OAAO;QAACwC;QAAOvB;QAAcjB;IAAI;AACnC;AAmBA,OAAO,eAAeuD,qBACpBtB,MAAkC;IAElC,MAAMjC,OAAOiC,OAAO/B,MAAM,GACtB,MAAM9B,aAAa;QAAC+B,IAAI8B,OAAO/B,MAAM;IAAA,KACrC+B,OAAO3B,KAAK,GACV,MAAMnC,gBAAgB;QAACmC,OAAO2B,OAAO3B,KAAK;IAAA,KAC1CkD;IAEN,IAAI,CAACxD,MAAM;QACT,MAAM,IAAIlB,kBAAkBmD,OAAO/B,MAAM,IAAI+B,OAAO3B,KAAK,IAAI;IAC/D;IACA,IAAIN,KAAK2C,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIhE;IACZ;IACA,IAAIqB,KAAKsD,MAAM,KAAK,UAAU;QAC5B,MAAM,IAAIzE;IACZ;IAEA,MAAM2D,QAAQ,MAAMzC,gBAAgBC;IACpC,MAAMiB,eAAe,MAAMK,qBAAqBtB;IAEhD,OAAO;QAACwC;QAAOvB;QAAcjB;IAAI;AACnC;AASA,OAAO,eAAeyD,mBAAmBxB,MAExC;IACC,MAAMyB,qBAAqBtG,gBAAgB6E,OAAOhB,YAAY;IAC9D,MAAM0C,UAAU,MAAM9F,uBAAuB;QAAC0D,aAAamC;IAAkB;IAC7E,IAAI,CAACC,SAAS;QACZ9D,qBAAqB;QACrB,MAAM,IAAI5C,kBAAkB;IAC9B;IAEA,MAAM+C,OAAO,MAAM5B,aAAa;QAAC+B,IAAIwD,QAAQzD,MAAM;IAAA;IACnD,IAAIF,MAAMsD,WAAW,UAAU;QAC7B,MAAMxF,yBAAyB;YAACyD,aAAamC;QAAkB;QAC/D7D,qBAAqB;QACrB,MAAM,IAAI5C,kBAAkB;IAC9B;IAEA,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI0G,QAAQzC,SAAS,EAAE;QACrB,IAAIF,sBAAsB2C,UAAU;YAClC,MAAMnB,QAAQ,MAAMzC,gBAAgBC;YACpCH,qBAAqB;YACrB,OAAO;gBAAC2C;gBAAOvB,cAAcuC;gBAAWxD;YAAI;QAC9C;QACA,MAAMjC,2BAA2B;YAACmC,QAAQF,KAAKG,EAAE;QAAA;QACjDN,qBAAqB;QACrB,MAAM,IAAI5C,kBAAkB;IAC9B;IAEA,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM2G,mBAAmBzG,oBAAoB;IAC7C,MAAM0G,UAAU,MAAM7F,mBAAmB;QACvCmC,IAAIwD,QAAQxD,EAAE;QACduD;QACAI,iBAAiB1G,gBAAgBwG;QACjCpC,WAAW7B,YAAYtC,OAAOoE,kCAAkC;IAClE;IACA,IAAI,CAACoC,SAAS;QACZ,MAAME,SAAS,MAAMlG,uBAAuB;YAAC0D,aAAamC;QAAkB;QAC5E,IAAI,CAACK,UAAU,CAAC/C,sBAAsB+C,SAAS;YAC7ClE,qBAAqB;YACrB,MAAM,IAAI5C,kBAAkB;QAC9B;QACA,MAAMuF,QAAQ,MAAMzC,gBAAgBC;QACpCH,qBAAqB;QACrB,OAAO;YAAC2C;YAAOvB,cAAcuC;YAAWxD;QAAI;IAC9C;IAEA,MAAMwC,QAAQ,MAAMzC,gBAAgBC;IACpCH,qBAAqB;IACrB,OAAO;QAAC2C;QAAOvB,cAAc2C;QAAkB5D;IAAI;AACrD;AAYA,OAAO,eAAegE,yBAAyB/B,MAE9C;IACC,MAAMgC,WAAW,MAAM3G,yBAAyB;QAACiE,aAAanE,gBAAgB6E,OAAOO,KAAK;IAAC;IAC3F,IAAI,CAACyB,UAAU;QACb,MAAM,IAAIhH,kBAAkB;IAC9B;IAEA,MAAM+C,OAAO,MAAM3B,kBAAkB;QAAC6B,QAAQ+D,SAAS/D,MAAM;IAAA;IAC7D,IAAIF,MAAMsD,WAAW,UAAU;QAC7B,MAAM,IAAIrG,kBAAkB;IAC9B;IAEA,MAAMuF,QAAQ,MAAMzC,gBAAgBC;IACpC,MAAMiB,eAAe,MAAMK,qBAAqBtB;IAEhD,OAAO;QAACwC;QAAOvB;QAAcjB;IAAI;AACnC;AAEA,OAAO,eAAekE,wBAAwBjC,MAE7C;IACC,MAAMN,WAAWxE,oBAAoB;IACrC,MAAM2F,SAAS,MAAMtF,8BAA8B;QACjD8C,OAAO2B,OAAO3B,KAAK;QACnBiB,aAAanE,gBAAgBuE;QAC7BH,WAAWjC,aAAaL;QACxBiF,iBAAiB1H;QACjBsF,WAAW;YACTC,YAAYN,iBAAiBC;QAC/B;IACF;IAEA,OAAO;QAACyC,uBAAuBtB,OAAOsB,qBAAqB;IAAA;AAC7D;AAEA,OAAO,eAAeC,qBAAqBpC,MAAuB;IAChE,MAAMjC,OAAO,MAAM7B,gBAAgB;QAACmC,OAAO2B,OAAO3B,KAAK;IAAA;IACvD,IAAIN,MAAMsD,WAAW,YAAYtD,KAAKqC,cAAc,KAAK,MAAM;QAC7D;IACF;IAEA,MAAMV,WAAWxE,oBAAoB;IACrC,MAAMO,oBAAoB;QACxBwC,QAAQF,KAAKG,EAAE;QACfoB,aAAanE,gBAAgBuE;QAC7BH,WAAWjC,aAAaJ;QACxB4C,WAAW;YACTzB,OAAON,KAAKM,KAAK;YACjBgE,WAAWzC,kBAAkBF;YAC7B4C,gBAAgBpF;QAClB;IACF;AACF;AAQA,OAAO,eAAeqF,qBAAqBvC,MAG1C;IACC,MAAMgC,WAAW,MAAMxG,qBAAqB;QAAC8D,aAAanE,gBAAgB6E,OAAOO,KAAK;IAAC;IACvF,IAAI,CAACyB,UAAU;QACb,MAAM,IAAIhH,kBAAkB;IAC9B;IAEA,MAAMwH,eAAe,MAAMrG,aAAa;QAAC+B,IAAI8D,SAAS/D,MAAM;IAAA;IAC5D,IAAIuE,cAAcnB,WAAW,YAAYmB,aAAapC,cAAc,KAAK,MAAM;QAC7E,MAAM,IAAIpF,kBAAkB;IAC9B;IAEA,MAAMoF,iBAAiB,MAAMrD,aAAa;QAACM,UAAU2C,OAAOyC,WAAW;IAAA;IACvE,MAAM1E,OAAO,MAAMxB,mBAAmB;QAAC0B,QAAQ+D,SAAS/D,MAAM;QAAEmC;IAAc;IAC9E,IAAIrC,MAAMsD,WAAW,UAAU;QAC7B,MAAM,IAAIrG,kBAAkB;IAC9B;IAEA,MAAMc,2BAA2B;QAACmC,QAAQ+D,SAAS/D,MAAM;IAAA;IAEzD,MAAMsC,QAAQ,MAAMzC,gBAAgBC;IACpC,MAAMiB,eAAe,MAAMK,qBAAqBtB;IAEhD,OAAO;QAACwC;QAAOvB;QAAcjB;IAAI;AACnC;AAEA,OAAO,eAAe2E,eAAe1C,MAKpC;IACC,MAAMjC,OAAO,MAAM5B,aAAa;QAAC+B,IAAI8B,OAAO/B,MAAM;IAAA;IAClD,IAAI,CAACF,MAAM;QACT,MAAM,IAAIlB,kBAAkBmD,OAAO/B,MAAM;IAC3C;IAEA,MAAMkD,cAAcpD,KAAKqC,cAAc,KAAK;IAC5C,MAAMgB,KAAK,MAAMpE,eAAe;QAC9BK,UAAU2C,OAAO2C,eAAe;QAChCzB,MAAMnD,KAAKqC,cAAc,IAAK,MAAMhD;IACtC;IACA,IAAI,CAAC+D,eAAe,CAACC,IAAI;QACvB,MAAM,IAAIxE;IACZ;IAEA,MAAMwD,iBAAiB,MAAMrD,aAAa;QAACM,UAAU2C,OAAOyC,WAAW;IAAA;IACvE,MAAMG,wBAAwB5C,OAAOhB,YAAY,GAC7C,MAAMrD,6BAA6B;QAAC2D,aAAanE,gBAAgB6E,OAAOhB,YAAY;IAAC,KACrFuC;IACJ,MAAMsB,uBACJD,uBAAuB3E,WAAWF,KAAKG,EAAE,GAAG0E,sBAAsB1E,EAAE,GAAGqD;IAEzE,MAAMhF,mBAAmB;QAAC0B,QAAQF,KAAKG,EAAE;QAAEkC;IAAc;IACzD,MAAMtE,2BAA2B;QAACmC,QAAQF,KAAKG,EAAE;QAAE2E;IAAoB;AACzE;AAEA,OAAO,eAAeC,OAAO9C,MAA2C;IACtE,IAAI,CAACA,OAAOhB,YAAY,EAAE;IAC1B,MAAMnD,yBAAyB;QAACyD,aAAanE,gBAAgB6E,OAAOhB,YAAY;IAAC;AACnF;AAMA,OAAO,eAAe+D,eAAe/C,MAAwB;IAC3D,MAAMjC,OAAO,MAAM5B,aAAa;QAAC+B,IAAI8B,OAAO/B,MAAM;IAAA;IAClD,IAAI,CAACF,MAAM;QACT,MAAM,IAAIlB,kBAAkBmD,OAAO/B,MAAM;IAC3C;IAEA,OAAO;QAACF;IAAI;AACd"}

package/dist/core/entities/email-verification.d.ts

@@ -0,0 +1,9 @@
+export interface EmailVerification {
+    id: string;
+    userId: string;
+    hashedToken: string;
+    expiresAt: Date;
+    usedAt: Date | null;
+    createdAt: Date;
+}
+//# sourceMappingURL=email-verification.d.ts.map

package/dist/core/entities/email-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.d.ts","sourceRoot":"","sources":["../../../src/core/entities/email-verification.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/core/entities/email-verification.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=email-verification.js.map