@shipfox/api-auth 2.0.0

package/dist/db/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AASnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}

package/dist/db/db.js

@@ -0,0 +1,28 @@
+import { drizzle } from '@shipfox/node-drizzle';
+import { pgClient } from '@shipfox/node-postgres';
+import { emailVerifications } from './schema/email-verifications.js';
+import { authOutbox } from './schema/outbox.js';
+import { passwordResets } from './schema/password-resets.js';
+import { authRateLimits } from './schema/rate-limits.js';
+import { refreshTokens } from './schema/refresh-tokens.js';
+import { users } from './schema/users.js';
+export const schema = {
+    users,
+    passwordResets,
+    refreshTokens,
+    emailVerifications,
+    authOutbox,
+    authRateLimits
+};
+let _db;
+export function db() {
+    if (!_db) _db = drizzle(pgClient(), {
+        schema
+    });
+    return _db;
+}
+export function closeDb() {
+    _db = undefined;
+}
+
+//# sourceMappingURL=db.js.map

package/dist/db/db.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {emailVerifications} from './schema/email-verifications.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets} from './schema/password-resets.js';\nimport {authRateLimits} from './schema/rate-limits.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\nexport const schema = {\n  users,\n  passwordResets,\n  refreshTokens,\n  emailVerifications,\n  authOutbox,\n  authRateLimits,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","emailVerifications","authOutbox","passwordResets","authRateLimits","refreshTokens","users","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,kBAAkB,QAAO,kCAAkC;AACnE,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAExC,OAAO,MAAMC,SAAS;IACpBD;IACAH;IACAE;IACAJ;IACAC;IACAE;AACF,EAAE;AAEF,IAAII;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMT,QAAQC,YAAY;QAACO;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}

package/dist/db/email-verifications.d.ts

@@ -0,0 +1,39 @@
+import type { EmailVerification } from '#core/entities/email-verification.js';
+import type { User } from '#core/entities/user.js';
+interface CreateEmailVerificationBaseParams {
+    userId: string;
+    hashedToken: string;
+    expiresAt: Date;
+}
+export type CreateEmailVerificationParams = CreateEmailVerificationBaseParams & ({
+    sendEmail: {
+        email: string;
+        verifyLink: string;
+    };
+    skipEmail?: never;
+} | {
+    sendEmail?: never;
+    skipEmail: true;
+});
+export declare function createEmailVerification(params: CreateEmailVerificationParams): Promise<EmailVerification>;
+export interface CreateResendEmailVerificationParams {
+    email: string;
+    hashedToken: string;
+    expiresAt: Date;
+    cooldownSeconds: number;
+    sendEmail: {
+        verifyLink: string;
+    };
+    now?: Date | undefined;
+}
+export interface CreateResendEmailVerificationResult {
+    user?: User | undefined;
+    verification?: EmailVerification | undefined;
+    nextResendAvailableAt: Date;
+}
+export declare function createResendEmailVerification(params: CreateResendEmailVerificationParams): Promise<CreateResendEmailVerificationResult>;
+export declare function consumeEmailVerification(params: {
+    hashedToken: string;
+}): Promise<EmailVerification | undefined>;
+export {};
+//# sourceMappingURL=email-verifications.d.ts.map

package/dist/db/email-verifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verifications.d.ts","sourceRoot":"","sources":["../../src/db/email-verifications.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,sCAAsC,CAAC;AAC5E,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAMjD,UAAU,iCAAiC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,6BAA6B,GAAG,iCAAiC,GAC3E,CACI;IAAC,SAAS,EAAE;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAC,GACnE;IAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAC,CACvC,CAAC;AAEJ,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CA0B5B;AAED,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,CAAC;IAChC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACxB;AAED,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACxB,YAAY,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC7C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAMD,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,mCAAmC,CAAC,CAkE9C;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAgBzC"}

package/dist/db/email-verifications.js

@@ -0,0 +1,95 @@
+import { AUTH_EMAIL_VERIFICATION_SEND_REQUESTED } from '@shipfox/api-auth-dto';
+import { writeOutboxEvent } from '@shipfox/node-outbox';
+import { and, desc, eq, gt, isNull, sql } from 'drizzle-orm';
+import { db } from './db.js';
+import { emailVerifications, toEmailVerification } from './schema/email-verifications.js';
+import { authOutbox } from './schema/outbox.js';
+import { toUser, users } from './schema/users.js';
+export async function createEmailVerification(params) {
+    return await db().transaction(async (tx)=>{
+        await tx.update(emailVerifications).set({
+            usedAt: sql`now()`
+        }).where(and(eq(emailVerifications.userId, params.userId), isNull(emailVerifications.usedAt)));
+        const rows = await tx.insert(emailVerifications).values({
+            userId: params.userId,
+            hashedToken: params.hashedToken,
+            expiresAt: params.expiresAt
+        }).returning();
+        const row = rows[0];
+        if (!row) throw new Error('Insert returned no rows');
+        if (params.sendEmail) {
+            await writeOutboxEvent(tx, authOutbox, {
+                type: AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
+                payload: params.sendEmail
+            });
+        }
+        return toEmailVerification(row);
+    });
+}
+function secondsAfter(date, seconds) {
+    return new Date(date.getTime() + seconds * 1000);
+}
+export async function createResendEmailVerification(params) {
+    const now = params.now ?? new Date();
+    const genericNextResendAvailableAt = secondsAfter(now, params.cooldownSeconds);
+    return await db().transaction(async (tx)=>{
+        const userRows = await tx.select().from(users).where(eq(users.email, params.email)).limit(1).for('update');
+        const userRow = userRows[0];
+        if (!userRow) {
+            return {
+                nextResendAvailableAt: genericNextResendAvailableAt
+            };
+        }
+        const user = toUser(userRow);
+        if (user.status !== 'active' || user.emailVerifiedAt !== null) {
+            return {
+                nextResendAvailableAt: genericNextResendAvailableAt
+            };
+        }
+        const latestRows = await tx.select().from(emailVerifications).where(and(eq(emailVerifications.userId, user.id), isNull(emailVerifications.usedAt))).orderBy(desc(emailVerifications.createdAt)).limit(1);
+        const latest = latestRows[0] ? toEmailVerification(latestRows[0]) : undefined;
+        if (latest && secondsAfter(latest.createdAt, params.cooldownSeconds) > now) {
+            // Return the same public retry estimate as no-op cases so the endpoint does
+            // not expose existing account state or prior verification timing.
+            return {
+                user,
+                nextResendAvailableAt: genericNextResendAvailableAt
+            };
+        }
+        await tx.update(emailVerifications).set({
+            usedAt: sql`now()`
+        }).where(and(eq(emailVerifications.userId, user.id), isNull(emailVerifications.usedAt)));
+        const rows = await tx.insert(emailVerifications).values({
+            userId: user.id,
+            hashedToken: params.hashedToken,
+            expiresAt: params.expiresAt
+        }).returning();
+        const row = rows[0];
+        if (!row) throw new Error('Insert returned no rows');
+        const verification = toEmailVerification(row);
+        if (params.sendEmail) {
+            await writeOutboxEvent(tx, authOutbox, {
+                type: AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
+                payload: {
+                    email: user.email,
+                    verifyLink: params.sendEmail.verifyLink
+                }
+            });
+        }
+        return {
+            user,
+            verification,
+            nextResendAvailableAt: secondsAfter(verification.createdAt, params.cooldownSeconds)
+        };
+    });
+}
+export async function consumeEmailVerification(params) {
+    const rows = await db().update(emailVerifications).set({
+        usedAt: sql`now()`
+    }).where(and(eq(emailVerifications.hashedToken, params.hashedToken), isNull(emailVerifications.usedAt), gt(emailVerifications.expiresAt, sql`now()`))).returning();
+    const row = rows[0];
+    if (!row) return undefined;
+    return toEmailVerification(row);
+}
+
+//# sourceMappingURL=email-verifications.js.map

package/dist/db/email-verifications.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/email-verifications.ts"],"sourcesContent":["import {AUTH_EMAIL_VERIFICATION_SEND_REQUESTED, type AuthEventMap} from '@shipfox/api-auth-dto';\nimport {writeOutboxEvent} from '@shipfox/node-outbox';\nimport {and, desc, eq, gt, isNull, sql} from 'drizzle-orm';\nimport type {EmailVerification} from '#core/entities/email-verification.js';\nimport type {User} from '#core/entities/user.js';\nimport {db} from './db.js';\nimport {emailVerifications, toEmailVerification} from './schema/email-verifications.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {toUser, users} from './schema/users.js';\n\ninterface CreateEmailVerificationBaseParams {\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport type CreateEmailVerificationParams = CreateEmailVerificationBaseParams &\n  (\n    | {sendEmail: {email: string; verifyLink: string}; skipEmail?: never}\n    | {sendEmail?: never; skipEmail: true}\n  );\n\nexport async function createEmailVerification(\n  params: CreateEmailVerificationParams,\n): Promise<EmailVerification> {\n  return await db().transaction(async (tx) => {\n    await tx\n      .update(emailVerifications)\n      .set({usedAt: sql`now()`})\n      .where(and(eq(emailVerifications.userId, params.userId), isNull(emailVerifications.usedAt)));\n\n    const rows = await tx\n      .insert(emailVerifications)\n      .values({\n        userId: params.userId,\n        hashedToken: params.hashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    const row = rows[0];\n    if (!row) throw new Error('Insert returned no rows');\n    if (params.sendEmail) {\n      await writeOutboxEvent<AuthEventMap>(tx, authOutbox, {\n        type: AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,\n        payload: params.sendEmail,\n      });\n    }\n    return toEmailVerification(row);\n  });\n}\n\nexport interface CreateResendEmailVerificationParams {\n  email: string;\n  hashedToken: string;\n  expiresAt: Date;\n  cooldownSeconds: number;\n  sendEmail: {verifyLink: string};\n  now?: Date | undefined;\n}\n\nexport interface CreateResendEmailVerificationResult {\n  user?: User | undefined;\n  verification?: EmailVerification | undefined;\n  nextResendAvailableAt: Date;\n}\n\nfunction secondsAfter(date: Date, seconds: number): Date {\n  return new Date(date.getTime() + seconds * 1000);\n}\n\nexport async function createResendEmailVerification(\n  params: CreateResendEmailVerificationParams,\n): Promise<CreateResendEmailVerificationResult> {\n  const now = params.now ?? new Date();\n  const genericNextResendAvailableAt = secondsAfter(now, params.cooldownSeconds);\n\n  return await db().transaction(async (tx) => {\n    const userRows = await tx\n      .select()\n      .from(users)\n      .where(eq(users.email, params.email))\n      .limit(1)\n      .for('update');\n    const userRow = userRows[0];\n    if (!userRow) {\n      return {nextResendAvailableAt: genericNextResendAvailableAt};\n    }\n\n    const user = toUser(userRow);\n    if (user.status !== 'active' || user.emailVerifiedAt !== null) {\n      return {nextResendAvailableAt: genericNextResendAvailableAt};\n    }\n\n    const latestRows = await tx\n      .select()\n      .from(emailVerifications)\n      .where(and(eq(emailVerifications.userId, user.id), isNull(emailVerifications.usedAt)))\n      .orderBy(desc(emailVerifications.createdAt))\n      .limit(1);\n    const latest = latestRows[0] ? toEmailVerification(latestRows[0]) : undefined;\n    if (latest && secondsAfter(latest.createdAt, params.cooldownSeconds) > now) {\n      // Return the same public retry estimate as no-op cases so the endpoint does\n      // not expose existing account state or prior verification timing.\n      return {user, nextResendAvailableAt: genericNextResendAvailableAt};\n    }\n\n    await tx\n      .update(emailVerifications)\n      .set({usedAt: sql`now()`})\n      .where(and(eq(emailVerifications.userId, user.id), isNull(emailVerifications.usedAt)));\n\n    const rows = await tx\n      .insert(emailVerifications)\n      .values({\n        userId: user.id,\n        hashedToken: params.hashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    const row = rows[0];\n    if (!row) throw new Error('Insert returned no rows');\n    const verification = toEmailVerification(row);\n    if (params.sendEmail) {\n      await writeOutboxEvent<AuthEventMap>(tx, authOutbox, {\n        type: AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,\n        payload: {\n          email: user.email,\n          verifyLink: params.sendEmail.verifyLink,\n        },\n      });\n    }\n    return {\n      user,\n      verification,\n      nextResendAvailableAt: secondsAfter(verification.createdAt, params.cooldownSeconds),\n    };\n  });\n}\n\nexport async function consumeEmailVerification(params: {\n  hashedToken: string;\n}): Promise<EmailVerification | undefined> {\n  const rows = await db()\n    .update(emailVerifications)\n    .set({usedAt: sql`now()`})\n    .where(\n      and(\n        eq(emailVerifications.hashedToken, params.hashedToken),\n        isNull(emailVerifications.usedAt),\n        gt(emailVerifications.expiresAt, sql`now()`),\n      ),\n    )\n    .returning();\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toEmailVerification(row);\n}\n"],"names":["AUTH_EMAIL_VERIFICATION_SEND_REQUESTED","writeOutboxEvent","and","desc","eq","gt","isNull","sql","db","emailVerifications","toEmailVerification","authOutbox","toUser","users","createEmailVerification","params","transaction","tx","update","set","usedAt","where","userId","rows","insert","values","hashedToken","expiresAt","returning","row","Error","sendEmail","type","payload","secondsAfter","date","seconds","Date","getTime","createResendEmailVerification","now","genericNextResendAvailableAt","cooldownSeconds","userRows","select","from","email","limit","for","userRow","nextResendAvailableAt","user","status","emailVerifiedAt","latestRows","id","orderBy","createdAt","latest","undefined","verification","verifyLink","consumeEmailVerification"],"mappings":"AAAA,SAAQA,sCAAsC,QAA0B,wBAAwB;AAChG,SAAQC,gBAAgB,QAAO,uBAAuB;AACtD,SAAQC,GAAG,EAAEC,IAAI,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AAG3D,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,kBAAkB,EAAEC,mBAAmB,QAAO,kCAAkC;AACxF,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,MAAM,EAAEC,KAAK,QAAO,oBAAoB;AAchD,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,OAAO,MAAMP,KAAKQ,WAAW,CAAC,OAAOC;QACnC,MAAMA,GACHC,MAAM,CAACT,oBACPU,GAAG,CAAC;YAACC,QAAQb,GAAG,CAAC,KAAK,CAAC;QAAA,GACvBc,KAAK,CAACnB,IAAIE,GAAGK,mBAAmBa,MAAM,EAAEP,OAAOO,MAAM,GAAGhB,OAAOG,mBAAmBW,MAAM;QAE3F,MAAMG,OAAO,MAAMN,GAChBO,MAAM,CAACf,oBACPgB,MAAM,CAAC;YACNH,QAAQP,OAAOO,MAAM;YACrBI,aAAaX,OAAOW,WAAW;YAC/BC,WAAWZ,OAAOY,SAAS;QAC7B,GACCC,SAAS;QAEZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;QACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;QAC1B,IAAIf,OAAOgB,SAAS,EAAE;YACpB,MAAM9B,iBAA+BgB,IAAIN,YAAY;gBACnDqB,MAAMhC;gBACNiC,SAASlB,OAAOgB,SAAS;YAC3B;QACF;QACA,OAAOrB,oBAAoBmB;IAC7B;AACF;AAiBA,SAASK,aAAaC,IAAU,EAAEC,OAAe;IAC/C,OAAO,IAAIC,KAAKF,KAAKG,OAAO,KAAKF,UAAU;AAC7C;AAEA,OAAO,eAAeG,8BACpBxB,MAA2C;IAE3C,MAAMyB,MAAMzB,OAAOyB,GAAG,IAAI,IAAIH;IAC9B,MAAMI,+BAA+BP,aAAaM,KAAKzB,OAAO2B,eAAe;IAE7E,OAAO,MAAMlC,KAAKQ,WAAW,CAAC,OAAOC;QACnC,MAAM0B,WAAW,MAAM1B,GACpB2B,MAAM,GACNC,IAAI,CAAChC,OACLQ,KAAK,CAACjB,GAAGS,MAAMiC,KAAK,EAAE/B,OAAO+B,KAAK,GAClCC,KAAK,CAAC,GACNC,GAAG,CAAC;QACP,MAAMC,UAAUN,QAAQ,CAAC,EAAE;QAC3B,IAAI,CAACM,SAAS;YACZ,OAAO;gBAACC,uBAAuBT;YAA4B;QAC7D;QAEA,MAAMU,OAAOvC,OAAOqC;QACpB,IAAIE,KAAKC,MAAM,KAAK,YAAYD,KAAKE,eAAe,KAAK,MAAM;YAC7D,OAAO;gBAACH,uBAAuBT;YAA4B;QAC7D;QAEA,MAAMa,aAAa,MAAMrC,GACtB2B,MAAM,GACNC,IAAI,CAACpC,oBACLY,KAAK,CAACnB,IAAIE,GAAGK,mBAAmBa,MAAM,EAAE6B,KAAKI,EAAE,GAAGjD,OAAOG,mBAAmBW,MAAM,IAClFoC,OAAO,CAACrD,KAAKM,mBAAmBgD,SAAS,GACzCV,KAAK,CAAC;QACT,MAAMW,SAASJ,UAAU,CAAC,EAAE,GAAG5C,oBAAoB4C,UAAU,CAAC,EAAE,IAAIK;QACpE,IAAID,UAAUxB,aAAawB,OAAOD,SAAS,EAAE1C,OAAO2B,eAAe,IAAIF,KAAK;YAC1E,4EAA4E;YAC5E,kEAAkE;YAClE,OAAO;gBAACW;gBAAMD,uBAAuBT;YAA4B;QACnE;QAEA,MAAMxB,GACHC,MAAM,CAACT,oBACPU,GAAG,CAAC;YAACC,QAAQb,GAAG,CAAC,KAAK,CAAC;QAAA,GACvBc,KAAK,CAACnB,IAAIE,GAAGK,mBAAmBa,MAAM,EAAE6B,KAAKI,EAAE,GAAGjD,OAAOG,mBAAmBW,MAAM;QAErF,MAAMG,OAAO,MAAMN,GAChBO,MAAM,CAACf,oBACPgB,MAAM,CAAC;YACNH,QAAQ6B,KAAKI,EAAE;YACf7B,aAAaX,OAAOW,WAAW;YAC/BC,WAAWZ,OAAOY,SAAS;QAC7B,GACCC,SAAS;QAEZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;QACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;QAC1B,MAAM8B,eAAelD,oBAAoBmB;QACzC,IAAId,OAAOgB,SAAS,EAAE;YACpB,MAAM9B,iBAA+BgB,IAAIN,YAAY;gBACnDqB,MAAMhC;gBACNiC,SAAS;oBACPa,OAAOK,KAAKL,KAAK;oBACjBe,YAAY9C,OAAOgB,SAAS,CAAC8B,UAAU;gBACzC;YACF;QACF;QACA,OAAO;YACLV;YACAS;YACAV,uBAAuBhB,aAAa0B,aAAaH,SAAS,EAAE1C,OAAO2B,eAAe;QACpF;IACF;AACF;AAEA,OAAO,eAAeoB,yBAAyB/C,MAE9C;IACC,MAAMQ,OAAO,MAAMf,KAChBU,MAAM,CAACT,oBACPU,GAAG,CAAC;QAACC,QAAQb,GAAG,CAAC,KAAK,CAAC;IAAA,GACvBc,KAAK,CACJnB,IACEE,GAAGK,mBAAmBiB,WAAW,EAAEX,OAAOW,WAAW,GACrDpB,OAAOG,mBAAmBW,MAAM,GAChCf,GAAGI,mBAAmBkB,SAAS,EAAEpB,GAAG,CAAC,KAAK,CAAC,IAG9CqB,SAAS;IAEZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;IACnB,IAAI,CAACM,KAAK,OAAO8B;IACjB,OAAOjD,oBAAoBmB;AAC7B"}

package/dist/db/migrations.d.ts

@@ -0,0 +1,2 @@
+export declare const migrationsPath: string;
+//# sourceMappingURL=migrations.d.ts.map

package/dist/db/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/db/migrations.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,QAAoE,CAAC"}

package/dist/db/migrations.js

@@ -0,0 +1,5 @@
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const migrationsPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../drizzle');
+
+//# sourceMappingURL=migrations.js.map

package/dist/db/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/migrations.ts"],"sourcesContent":["import {dirname, resolve} from 'node:path';\nimport {fileURLToPath} from 'node:url';\n\nexport const migrationsPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../drizzle');\n"],"names":["dirname","resolve","fileURLToPath","migrationsPath","url"],"mappings":"AAAA,SAAQA,OAAO,EAAEC,OAAO,QAAO,YAAY;AAC3C,SAAQC,aAAa,QAAO,WAAW;AAEvC,OAAO,MAAMC,iBAAiBF,QAAQD,QAAQE,cAAc,YAAYE,GAAG,IAAI,iBAAiB"}

package/dist/db/password-resets.d.ts

@@ -0,0 +1,23 @@
+import type { PasswordReset } from '#core/entities/password-reset.js';
+interface CreatePasswordResetBaseParams {
+    userId: string;
+    hashedToken: string;
+    expiresAt: Date;
+}
+export type CreatePasswordResetParams = CreatePasswordResetBaseParams & ({
+    sendEmail: {
+        email: string;
+        resetLink: string;
+        expiresInHours: number;
+    };
+    skipEmail?: never;
+} | {
+    sendEmail?: never;
+    skipEmail: true;
+});
+export declare function createPasswordReset(params: CreatePasswordResetParams): Promise<PasswordReset>;
+export declare function consumePasswordReset(params: {
+    hashedToken: string;
+}): Promise<PasswordReset | undefined>;
+export {};
+//# sourceMappingURL=password-resets.d.ts.map

package/dist/db/password-resets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-resets.d.ts","sourceRoot":"","sources":["../../src/db/password-resets.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,kCAAkC,CAAC;AAKpE,UAAU,6BAA6B;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,yBAAyB,GAAG,6BAA6B,GACnE,CACI;IAAC,SAAS,EAAE;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,CAAC;IAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAC,GAC1F;IAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAC,CACvC,CAAC;AAEJ,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAgBrC"}

package/dist/db/password-resets.js

@@ -0,0 +1,37 @@
+import { AUTH_PASSWORD_RESET_SEND_REQUESTED } from '@shipfox/api-auth-dto';
+import { writeOutboxEvent } from '@shipfox/node-outbox';
+import { and, eq, gt, isNull, sql } from 'drizzle-orm';
+import { db } from './db.js';
+import { authOutbox } from './schema/outbox.js';
+import { passwordResets, toPasswordReset } from './schema/password-resets.js';
+export async function createPasswordReset(params) {
+    return await db().transaction(async (tx)=>{
+        await tx.update(passwordResets).set({
+            usedAt: sql`now()`
+        }).where(and(eq(passwordResets.userId, params.userId), isNull(passwordResets.usedAt)));
+        const rows = await tx.insert(passwordResets).values({
+            userId: params.userId,
+            hashedToken: params.hashedToken,
+            expiresAt: params.expiresAt
+        }).returning();
+        const row = rows[0];
+        if (!row) throw new Error('Insert returned no rows');
+        if (params.sendEmail) {
+            await writeOutboxEvent(tx, authOutbox, {
+                type: AUTH_PASSWORD_RESET_SEND_REQUESTED,
+                payload: params.sendEmail
+            });
+        }
+        return toPasswordReset(row);
+    });
+}
+export async function consumePasswordReset(params) {
+    const rows = await db().update(passwordResets).set({
+        usedAt: sql`now()`
+    }).where(and(eq(passwordResets.hashedToken, params.hashedToken), isNull(passwordResets.usedAt), gt(passwordResets.expiresAt, sql`now()`))).returning();
+    const row = rows[0];
+    if (!row) return undefined;
+    return toPasswordReset(row);
+}
+
+//# sourceMappingURL=password-resets.js.map

package/dist/db/password-resets.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/password-resets.ts"],"sourcesContent":["import {AUTH_PASSWORD_RESET_SEND_REQUESTED, type AuthEventMap} from '@shipfox/api-auth-dto';\nimport {writeOutboxEvent} from '@shipfox/node-outbox';\nimport {and, eq, gt, isNull, sql} from 'drizzle-orm';\nimport type {PasswordReset} from '#core/entities/password-reset.js';\nimport {db} from './db.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets, toPasswordReset} from './schema/password-resets.js';\n\ninterface CreatePasswordResetBaseParams {\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport type CreatePasswordResetParams = CreatePasswordResetBaseParams &\n  (\n    | {sendEmail: {email: string; resetLink: string; expiresInHours: number}; skipEmail?: never}\n    | {sendEmail?: never; skipEmail: true}\n  );\n\nexport async function createPasswordReset(\n  params: CreatePasswordResetParams,\n): Promise<PasswordReset> {\n  return await db().transaction(async (tx) => {\n    await tx\n      .update(passwordResets)\n      .set({usedAt: sql`now()`})\n      .where(and(eq(passwordResets.userId, params.userId), isNull(passwordResets.usedAt)));\n\n    const rows = await tx\n      .insert(passwordResets)\n      .values({\n        userId: params.userId,\n        hashedToken: params.hashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    const row = rows[0];\n    if (!row) throw new Error('Insert returned no rows');\n    if (params.sendEmail) {\n      await writeOutboxEvent<AuthEventMap>(tx, authOutbox, {\n        type: AUTH_PASSWORD_RESET_SEND_REQUESTED,\n        payload: params.sendEmail,\n      });\n    }\n    return toPasswordReset(row);\n  });\n}\n\nexport async function consumePasswordReset(params: {\n  hashedToken: string;\n}): Promise<PasswordReset | undefined> {\n  const rows = await db()\n    .update(passwordResets)\n    .set({usedAt: sql`now()`})\n    .where(\n      and(\n        eq(passwordResets.hashedToken, params.hashedToken),\n        isNull(passwordResets.usedAt),\n        gt(passwordResets.expiresAt, sql`now()`),\n      ),\n    )\n    .returning();\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toPasswordReset(row);\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","writeOutboxEvent","and","eq","gt","isNull","sql","db","authOutbox","passwordResets","toPasswordReset","createPasswordReset","params","transaction","tx","update","set","usedAt","where","userId","rows","insert","values","hashedToken","expiresAt","returning","row","Error","sendEmail","type","payload","consumePasswordReset","undefined"],"mappings":"AAAA,SAAQA,kCAAkC,QAA0B,wBAAwB;AAC5F,SAAQC,gBAAgB,QAAO,uBAAuB;AACtD,SAAQC,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AAErD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,EAAEC,eAAe,QAAO,8BAA8B;AAc5E,OAAO,eAAeC,oBACpBC,MAAiC;IAEjC,OAAO,MAAML,KAAKM,WAAW,CAAC,OAAOC;QACnC,MAAMA,GACHC,MAAM,CAACN,gBACPO,GAAG,CAAC;YAACC,QAAQX,GAAG,CAAC,KAAK,CAAC;QAAA,GACvBY,KAAK,CAAChB,IAAIC,GAAGM,eAAeU,MAAM,EAAEP,OAAOO,MAAM,GAAGd,OAAOI,eAAeQ,MAAM;QAEnF,MAAMG,OAAO,MAAMN,GAChBO,MAAM,CAACZ,gBACPa,MAAM,CAAC;YACNH,QAAQP,OAAOO,MAAM;YACrBI,aAAaX,OAAOW,WAAW;YAC/BC,WAAWZ,OAAOY,SAAS;QAC7B,GACCC,SAAS;QAEZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;QACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;QAC1B,IAAIf,OAAOgB,SAAS,EAAE;YACpB,MAAM3B,iBAA+Ba,IAAIN,YAAY;gBACnDqB,MAAM7B;gBACN8B,SAASlB,OAAOgB,SAAS;YAC3B;QACF;QACA,OAAOlB,gBAAgBgB;IACzB;AACF;AAEA,OAAO,eAAeK,qBAAqBnB,MAE1C;IACC,MAAMQ,OAAO,MAAMb,KAChBQ,MAAM,CAACN,gBACPO,GAAG,CAAC;QAACC,QAAQX,GAAG,CAAC,KAAK,CAAC;IAAA,GACvBY,KAAK,CACJhB,IACEC,GAAGM,eAAec,WAAW,EAAEX,OAAOW,WAAW,GACjDlB,OAAOI,eAAeQ,MAAM,GAC5Bb,GAAGK,eAAee,SAAS,EAAElB,GAAG,CAAC,KAAK,CAAC,IAG1CmB,SAAS;IAEZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;IACnB,IAAI,CAACM,KAAK,OAAOM;IACjB,OAAOtB,gBAAgBgB;AACzB"}

package/dist/db/rate-limits.d.ts

@@ -0,0 +1,18 @@
+export interface ConsumeAuthRateLimitParams {
+    action: string;
+    scope: string;
+    identifierHmac: string;
+    windowStart: Date;
+    expiresAt: Date;
+    timeoutMs: number;
+}
+export interface ConsumeAuthRateLimitResult {
+    count: number;
+    expiresAt: Date;
+}
+export declare function consumeAuthRateLimit(params: ConsumeAuthRateLimitParams): Promise<ConsumeAuthRateLimitResult>;
+export declare function pruneExpiredAuthRateLimits(params?: {
+    now?: Date | undefined;
+    minIntervalMs?: number | undefined;
+}): Promise<number | undefined>;
+//# sourceMappingURL=rate-limits.d.ts.map

package/dist/db/rate-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limits.d.ts","sourceRoot":"","sources":["../../src/db/rate-limits.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAgCrC;AAID,wBAAsB,0BAA0B,CAC9C,MAAM,GAAE;IAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAM,GACxE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B"}

package/dist/db/rate-limits.js

@@ -0,0 +1,44 @@
+import { lt, sql } from 'drizzle-orm';
+import { db } from './db.js';
+import { authRateLimits } from './schema/rate-limits.js';
+export async function consumeAuthRateLimit(params) {
+    return await db().transaction(async (tx)=>{
+        await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);
+        const rows = await tx.insert(authRateLimits).values({
+            action: params.action,
+            scope: params.scope,
+            identifierHmac: params.identifierHmac,
+            windowStart: params.windowStart,
+            count: 1,
+            expiresAt: params.expiresAt
+        }).onConflictDoUpdate({
+            target: [
+                authRateLimits.action,
+                authRateLimits.scope,
+                authRateLimits.identifierHmac,
+                authRateLimits.windowStart
+            ],
+            set: {
+                count: sql`${authRateLimits.count} + 1`,
+                updatedAt: sql`now()`
+            }
+        }).returning({
+            count: authRateLimits.count,
+            expiresAt: authRateLimits.expiresAt
+        });
+        const row = rows[0];
+        if (!row) throw new Error('Rate limit upsert returned no rows');
+        return row;
+    });
+}
+let nextPruneAt = 0;
+export async function pruneExpiredAuthRateLimits(params = {}) {
+    const now = params.now ?? new Date();
+    const minIntervalMs = params.minIntervalMs ?? 60_000;
+    if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;
+    nextPruneAt = now.getTime() + minIntervalMs;
+    const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
+    return result.rowCount ?? 0;
+}
+
+//# sourceMappingURL=rate-limits.js.map

package/dist/db/rate-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/rate-limits.ts"],"sourcesContent":["import {lt, sql} from 'drizzle-orm';\nimport {db} from './db.js';\nimport {authRateLimits} from './schema/rate-limits.js';\n\nexport interface ConsumeAuthRateLimitParams {\n  action: string;\n  scope: string;\n  identifierHmac: string;\n  windowStart: Date;\n  expiresAt: Date;\n  timeoutMs: number;\n}\n\nexport interface ConsumeAuthRateLimitResult {\n  count: number;\n  expiresAt: Date;\n}\n\nexport async function consumeAuthRateLimit(\n  params: ConsumeAuthRateLimitParams,\n): Promise<ConsumeAuthRateLimitResult> {\n  return await db().transaction(async (tx) => {\n    await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);\n\n    const rows = await tx\n      .insert(authRateLimits)\n      .values({\n        action: params.action,\n        scope: params.scope,\n        identifierHmac: params.identifierHmac,\n        windowStart: params.windowStart,\n        count: 1,\n        expiresAt: params.expiresAt,\n      })\n      .onConflictDoUpdate({\n        target: [\n          authRateLimits.action,\n          authRateLimits.scope,\n          authRateLimits.identifierHmac,\n          authRateLimits.windowStart,\n        ],\n        set: {\n          count: sql`${authRateLimits.count} + 1`,\n          updatedAt: sql`now()`,\n        },\n      })\n      .returning({count: authRateLimits.count, expiresAt: authRateLimits.expiresAt});\n\n    const row = rows[0];\n    if (!row) throw new Error('Rate limit upsert returned no rows');\n    return row;\n  });\n}\n\nlet nextPruneAt = 0;\n\nexport async function pruneExpiredAuthRateLimits(\n  params: {now?: Date | undefined; minIntervalMs?: number | undefined} = {},\n): Promise<number | undefined> {\n  const now = params.now ?? new Date();\n  const minIntervalMs = params.minIntervalMs ?? 60_000;\n  if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;\n\n  nextPruneAt = now.getTime() + minIntervalMs;\n\n  const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));\n\n  return result.rowCount ?? 0;\n}\n"],"names":["lt","sql","db","authRateLimits","consumeAuthRateLimit","params","transaction","tx","execute","timeoutMs","rows","insert","values","action","scope","identifierHmac","windowStart","count","expiresAt","onConflictDoUpdate","target","set","updatedAt","returning","row","Error","nextPruneAt","pruneExpiredAuthRateLimits","now","Date","minIntervalMs","getTime","undefined","result","delete","where","rowCount"],"mappings":"AAAA,SAAQA,EAAE,EAAEC,GAAG,QAAO,cAAc;AACpC,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,cAAc,QAAO,0BAA0B;AAgBvD,OAAO,eAAeC,qBACpBC,MAAkC;IAElC,OAAO,MAAMH,KAAKI,WAAW,CAAC,OAAOC;QACnC,MAAMA,GAAGC,OAAO,CAACP,GAAG,CAAC,uCAAuC,EAAE,GAAGI,OAAOI,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;QAE9F,MAAMC,OAAO,MAAMH,GAChBI,MAAM,CAACR,gBACPS,MAAM,CAAC;YACNC,QAAQR,OAAOQ,MAAM;YACrBC,OAAOT,OAAOS,KAAK;YACnBC,gBAAgBV,OAAOU,cAAc;YACrCC,aAAaX,OAAOW,WAAW;YAC/BC,OAAO;YACPC,WAAWb,OAAOa,SAAS;QAC7B,GACCC,kBAAkB,CAAC;YAClBC,QAAQ;gBACNjB,eAAeU,MAAM;gBACrBV,eAAeW,KAAK;gBACpBX,eAAeY,cAAc;gBAC7BZ,eAAea,WAAW;aAC3B;YACDK,KAAK;gBACHJ,OAAOhB,GAAG,CAAC,EAAEE,eAAec,KAAK,CAAC,IAAI,CAAC;gBACvCK,WAAWrB,GAAG,CAAC,KAAK,CAAC;YACvB;QACF,GACCsB,SAAS,CAAC;YAACN,OAAOd,eAAec,KAAK;YAAEC,WAAWf,eAAee,SAAS;QAAA;QAE9E,MAAMM,MAAMd,IAAI,CAAC,EAAE;QACnB,IAAI,CAACc,KAAK,MAAM,IAAIC,MAAM;QAC1B,OAAOD;IACT;AACF;AAEA,IAAIE,cAAc;AAElB,OAAO,eAAeC,2BACpBtB,SAAuE,CAAC,CAAC;IAEzE,MAAMuB,MAAMvB,OAAOuB,GAAG,IAAI,IAAIC;IAC9B,MAAMC,gBAAgBzB,OAAOyB,aAAa,IAAI;IAC9C,IAAIA,gBAAgB,KAAKF,IAAIG,OAAO,KAAKL,aAAa,OAAOM;IAE7DN,cAAcE,IAAIG,OAAO,KAAKD;IAE9B,MAAMG,SAAS,MAAM/B,KAAKgC,MAAM,CAAC/B,gBAAgBgC,KAAK,CAACnC,GAAGG,eAAee,SAAS,EAAEU;IAEpF,OAAOK,OAAOG,QAAQ,IAAI;AAC5B"}

package/dist/db/refresh-tokens.d.ts

@@ -0,0 +1,44 @@
+import type { RefreshToken } from '#core/entities/refresh-token.js';
+export interface CreateRefreshTokenParams {
+    userId: string;
+    hashedToken: string;
+    expiresAt: Date;
+}
+export declare function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken>;
+/**
+ * Looks up the live session token by hash — one that can still authenticate as
+ * the current session. Returns `undefined` for revoked, expired, or already
+ * rotated tokens; rotated rows survive in the table only for the grace window
+ * and are not "active".
+ */
+export declare function findActiveRefreshTokenByHash(params: {
+    hashedToken: string;
+}): Promise<RefreshToken | undefined>;
+/**
+ * Looks up a non-revoked, non-expired token by hash, including ones already
+ * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
+ * rotate, honour the grace window, or reject reuse, so — unlike
+ * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.
+ */
+export declare function findRefreshTokenByHash(params: {
+    hashedToken: string;
+}): Promise<RefreshToken | undefined>;
+/**
+ * Atomically claims rotation and inserts the successor token. The predecessor is
+ * marked rather than deleted so later reuse of the retired token can be detected.
+ * If the successor insert fails, the predecessor rotation rolls back.
+ */
+export declare function rotateRefreshToken(params: {
+    id: string;
+    currentHashedToken: string;
+    nextHashedToken: string;
+    expiresAt: Date;
+}): Promise<RefreshToken | undefined>;
+export declare function revokeRefreshTokenByHash(params: {
+    hashedToken: string;
+}): Promise<void>;
+export declare function revokeRefreshTokensForUser(params: {
+    userId: string;
+    exceptRefreshTokenId?: string | undefined;
+}): Promise<void>;
+//# sourceMappingURL=refresh-tokens.d.ts.map

package/dist/db/refresh-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-tokens.d.ts","sourceRoot":"","sources":["../../src/db/refresh-tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,iCAAiC,CAAC;AAIlE,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC,CAahG;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAiBpC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAgBpC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAoCpC;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3F;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB"}

package/dist/db/refresh-tokens.js

@@ -0,0 +1,71 @@
+import { and, eq, gt, isNull, ne, sql } from 'drizzle-orm';
+import { db } from './db.js';
+import { refreshTokens, toRefreshToken } from './schema/refresh-tokens.js';
+export async function createRefreshToken(params) {
+    const rows = await db().insert(refreshTokens).values({
+        userId: params.userId,
+        hashedToken: params.hashedToken,
+        expiresAt: params.expiresAt
+    }).returning();
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    return toRefreshToken(row);
+}
+/**
+ * Looks up the live session token by hash — one that can still authenticate as
+ * the current session. Returns `undefined` for revoked, expired, or already
+ * rotated tokens; rotated rows survive in the table only for the grace window
+ * and are not "active".
+ */ export async function findActiveRefreshTokenByHash(params) {
+    const rows = await db().select().from(refreshTokens).where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt), isNull(refreshTokens.rotatedAt), gt(refreshTokens.expiresAt, sql`now()`))).limit(1);
+    const row = rows[0];
+    if (!row) return undefined;
+    return toRefreshToken(row);
+}
+/**
+ * Looks up a non-revoked, non-expired token by hash, including ones already
+ * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
+ * rotate, honour the grace window, or reject reuse, so — unlike
+ * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.
+ */ export async function findRefreshTokenByHash(params) {
+    const rows = await db().select().from(refreshTokens).where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt), gt(refreshTokens.expiresAt, sql`now()`))).limit(1);
+    const row = rows[0];
+    if (!row) return undefined;
+    return toRefreshToken(row);
+}
+/**
+ * Atomically claims rotation and inserts the successor token. The predecessor is
+ * marked rather than deleted so later reuse of the retired token can be detected.
+ * If the successor insert fails, the predecessor rotation rolls back.
+ */ export async function rotateRefreshToken(params) {
+    return await db().transaction(async (tx)=>{
+        const rotatedRows = await tx.update(refreshTokens).set({
+            rotatedAt: sql`now()`,
+            lastUsedAt: sql`now()`,
+            updatedAt: sql`now()`
+        }).where(and(eq(refreshTokens.id, params.id), eq(refreshTokens.hashedToken, params.currentHashedToken), isNull(refreshTokens.revokedAt), isNull(refreshTokens.rotatedAt), gt(refreshTokens.expiresAt, sql`now()`))).returning();
+        const rotated = rotatedRows[0];
+        if (!rotated) return undefined;
+        const successorRows = await tx.insert(refreshTokens).values({
+            userId: rotated.userId,
+            hashedToken: params.nextHashedToken,
+            expiresAt: params.expiresAt
+        }).returning();
+        if (!successorRows[0]) throw new Error('Insert returned no rows');
+        return toRefreshToken(rotated);
+    });
+}
+export async function revokeRefreshTokenByHash(params) {
+    await db().update(refreshTokens).set({
+        revokedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));
+}
+export async function revokeRefreshTokensForUser(params) {
+    await db().update(refreshTokens).set({
+        revokedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(refreshTokens.userId, params.userId), isNull(refreshTokens.revokedAt), params.exceptRefreshTokenId ? ne(refreshTokens.id, params.exceptRefreshTokenId) : undefined));
+}
+
+//# sourceMappingURL=refresh-tokens.js.map

package/dist/db/refresh-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/refresh-tokens.ts"],"sourcesContent":["import {and, eq, gt, isNull, ne, sql} from 'drizzle-orm';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport {db} from './db.js';\nimport {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';\n\nexport interface CreateRefreshTokenParams {\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport async function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken> {\n  const rows = await db()\n    .insert(refreshTokens)\n    .values({\n      userId: params.userId,\n      hashedToken: params.hashedToken,\n      expiresAt: params.expiresAt,\n    })\n    .returning();\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up the live session token by hash — one that can still authenticate as\n * the current session. Returns `undefined` for revoked, expired, or already\n * rotated tokens; rotated rows survive in the table only for the grace window\n * and are not \"active\".\n */\nexport async function findActiveRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        isNull(refreshTokens.rotatedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up a non-revoked, non-expired token by hash, including ones already\n * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to\n * rotate, honour the grace window, or reject reuse, so — unlike\n * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.\n */\nexport async function findRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Atomically claims rotation and inserts the successor token. The predecessor is\n * marked rather than deleted so later reuse of the retired token can be detected.\n * If the successor insert fails, the predecessor rotation rolls back.\n */\nexport async function rotateRefreshToken(params: {\n  id: string;\n  currentHashedToken: string;\n  nextHashedToken: string;\n  expiresAt: Date;\n}): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    const rotatedRows = await tx\n      .update(refreshTokens)\n      .set({\n        rotatedAt: sql`now()`,\n        lastUsedAt: sql`now()`,\n        updatedAt: sql`now()`,\n      })\n      .where(\n        and(\n          eq(refreshTokens.id, params.id),\n          eq(refreshTokens.hashedToken, params.currentHashedToken),\n          isNull(refreshTokens.revokedAt),\n          isNull(refreshTokens.rotatedAt),\n          gt(refreshTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning();\n\n    const rotated = rotatedRows[0];\n    if (!rotated) return undefined;\n\n    const successorRows = await tx\n      .insert(refreshTokens)\n      .values({\n        userId: rotated.userId,\n        hashedToken: params.nextHashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    if (!successorRows[0]) throw new Error('Insert returned no rows');\n\n    return toRefreshToken(rotated);\n  });\n}\n\nexport async function revokeRefreshTokenByHash(params: {hashedToken: string}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));\n}\n\nexport async function revokeRefreshTokensForUser(params: {\n  userId: string;\n  exceptRefreshTokenId?: string | undefined;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n        params.exceptRefreshTokenId ? ne(refreshTokens.id, params.exceptRefreshTokenId) : undefined,\n      ),\n    );\n}\n"],"names":["and","eq","gt","isNull","ne","sql","db","refreshTokens","toRefreshToken","createRefreshToken","params","rows","insert","values","userId","hashedToken","expiresAt","returning","row","Error","findActiveRefreshTokenByHash","select","from","where","revokedAt","rotatedAt","limit","undefined","findRefreshTokenByHash","rotateRefreshToken","transaction","tx","rotatedRows","update","set","lastUsedAt","updatedAt","id","currentHashedToken","rotated","successorRows","nextHashedToken","revokeRefreshTokenByHash","revokeRefreshTokensForUser","exceptRefreshTokenId"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEzD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,aAAa,EAAEC,cAAc,QAAO,6BAA6B;AAQzE,OAAO,eAAeC,mBAAmBC,MAAgC;IACvE,MAAMC,OAAO,MAAML,KAChBM,MAAM,CAACL,eACPM,MAAM,CAAC;QACNC,QAAQJ,OAAOI,MAAM;QACrBC,aAAaL,OAAOK,WAAW;QAC/BC,WAAWN,OAAOM,SAAS;IAC7B,GACCC,SAAS;IAEZ,MAAMC,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOX,eAAeU;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAeE,6BAA6BV,MAElD;IACC,MAAMC,OAAO,MAAML,KAChBe,MAAM,GACNC,IAAI,CAACf,eACLgB,KAAK,CACJvB,IACEC,GAAGM,cAAcQ,WAAW,EAAEL,OAAOK,WAAW,GAChDZ,OAAOI,cAAciB,SAAS,GAC9BrB,OAAOI,cAAckB,SAAS,GAC9BvB,GAAGK,cAAcS,SAAS,EAAEX,GAAG,CAAC,KAAK,CAAC,IAGzCqB,KAAK,CAAC;IAET,MAAMR,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOS;IACjB,OAAOnB,eAAeU;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAeU,uBAAuBlB,MAE5C;IACC,MAAMC,OAAO,MAAML,KAChBe,MAAM,GACNC,IAAI,CAACf,eACLgB,KAAK,CACJvB,IACEC,GAAGM,cAAcQ,WAAW,EAAEL,OAAOK,WAAW,GAChDZ,OAAOI,cAAciB,SAAS,GAC9BtB,GAAGK,cAAcS,SAAS,EAAEX,GAAG,CAAC,KAAK,CAAC,IAGzCqB,KAAK,CAAC;IAET,MAAMR,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOS;IACjB,OAAOnB,eAAeU;AACxB;AAEA;;;;CAIC,GACD,OAAO,eAAeW,mBAAmBnB,MAKxC;IACC,OAAO,MAAMJ,KAAKwB,WAAW,CAAC,OAAOC;QACnC,MAAMC,cAAc,MAAMD,GACvBE,MAAM,CAAC1B,eACP2B,GAAG,CAAC;YACHT,WAAWpB,GAAG,CAAC,KAAK,CAAC;YACrB8B,YAAY9B,GAAG,CAAC,KAAK,CAAC;YACtB+B,WAAW/B,GAAG,CAAC,KAAK,CAAC;QACvB,GACCkB,KAAK,CACJvB,IACEC,GAAGM,cAAc8B,EAAE,EAAE3B,OAAO2B,EAAE,GAC9BpC,GAAGM,cAAcQ,WAAW,EAAEL,OAAO4B,kBAAkB,GACvDnC,OAAOI,cAAciB,SAAS,GAC9BrB,OAAOI,cAAckB,SAAS,GAC9BvB,GAAGK,cAAcS,SAAS,EAAEX,GAAG,CAAC,KAAK,CAAC,IAGzCY,SAAS;QAEZ,MAAMsB,UAAUP,WAAW,CAAC,EAAE;QAC9B,IAAI,CAACO,SAAS,OAAOZ;QAErB,MAAMa,gBAAgB,MAAMT,GACzBnB,MAAM,CAACL,eACPM,MAAM,CAAC;YACNC,QAAQyB,QAAQzB,MAAM;YACtBC,aAAaL,OAAO+B,eAAe;YACnCzB,WAAWN,OAAOM,SAAS;QAC7B,GACCC,SAAS;QAEZ,IAAI,CAACuB,aAAa,CAAC,EAAE,EAAE,MAAM,IAAIrB,MAAM;QAEvC,OAAOX,eAAe+B;IACxB;AACF;AAEA,OAAO,eAAeG,yBAAyBhC,MAA6B;IAC1E,MAAMJ,KACH2B,MAAM,CAAC1B,eACP2B,GAAG,CAAC;QAACV,WAAWnB,GAAG,CAAC,KAAK,CAAC;QAAE+B,WAAW/B,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDkB,KAAK,CAACvB,IAAIC,GAAGM,cAAcQ,WAAW,EAAEL,OAAOK,WAAW,GAAGZ,OAAOI,cAAciB,SAAS;AAChG;AAEA,OAAO,eAAemB,2BAA2BjC,MAGhD;IACC,MAAMJ,KACH2B,MAAM,CAAC1B,eACP2B,GAAG,CAAC;QAACV,WAAWnB,GAAG,CAAC,KAAK,CAAC;QAAE+B,WAAW/B,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDkB,KAAK,CACJvB,IACEC,GAAGM,cAAcO,MAAM,EAAEJ,OAAOI,MAAM,GACtCX,OAAOI,cAAciB,SAAS,GAC9Bd,OAAOkC,oBAAoB,GAAGxC,GAAGG,cAAc8B,EAAE,EAAE3B,OAAOkC,oBAAoB,IAAIjB;AAG1F"}

package/dist/db/schema/common.d.ts

@@ -0,0 +1,2 @@
+export declare const pgTable: import("drizzle-orm/pg-core").PgTableFn<undefined>;
+//# sourceMappingURL=common.d.ts.map

package/dist/db/schema/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/db/schema/common.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,oDAA2C,CAAC"}

package/dist/db/schema/common.js

@@ -0,0 +1,4 @@
+import { pgTableCreator } from 'drizzle-orm/pg-core';
+export const pgTable = pgTableCreator((name)=>`auth_${name}`);
+
+//# sourceMappingURL=common.js.map

package/dist/db/schema/common.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/common.ts"],"sourcesContent":["import {pgTableCreator} from 'drizzle-orm/pg-core';\n\nexport const pgTable = pgTableCreator((name) => `auth_${name}`);\n"],"names":["pgTableCreator","pgTable","name"],"mappings":"AAAA,SAAQA,cAAc,QAAO,sBAAsB;AAEnD,OAAO,MAAMC,UAAUD,eAAe,CAACE,OAAS,CAAC,KAAK,EAAEA,MAAM,EAAE"}