@solidxai/core 0.1.13-beta.8 → 0.1.13

package/dist/services/mpin.service.js

@@ -0,0 +1,282 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var MpinService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MpinService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const error_messages_1 = require("../constants/error-messages");
+const success_messages_1 = require("../constants/success-messages");
+const user_device_credential_repository_1 = require("../repository/user-device-credential.repository");
+const user_repository_1 = require("../repository/user.repository");
+const authentication_service_1 = require("./authentication.service");
+const hashing_service_1 = require("./hashing.service");
+const setting_service_1 = require("./setting.service");
+const user_activity_history_service_1 = require("./user-activity-history.service");
+const MPIN_DENYLIST = new Set([
+    '0000', '1111', '2222', '3333', '4444', '5555', '6666', '7777', '8888', '9999',
+    '1234', '4321', '1212', '2001', '1004', '2000', '6969', '2580',
+    '000000', '111111', '123456', '654321', '121212', '112233', '123123',
+]);
+let MpinService = MpinService_1 = class MpinService {
+    constructor(credentialRepository, userRepository, hashingService, settingService, authenticationService, userActivityHistoryService) {
+        this.credentialRepository = credentialRepository;
+        this.userRepository = userRepository;
+        this.hashingService = hashingService;
+        this.settingService = settingService;
+        this.authenticationService = authenticationService;
+        this.userActivityHistoryService = userActivityHistoryService;
+        this.logger = new common_1.Logger(MpinService_1.name);
+    }
+    async setupMpin(activeUser, dto) {
+        this.assertEnabled();
+        this.assertMpinAcceptable(dto.mpin);
+        const user = await this.userRepository.findOne({ where: { id: activeUser.sub } });
+        if (!user) {
+            throw new common_1.NotFoundException(error_messages_1.ERROR_MESSAGES.USER_NOT_FOUND);
+        }
+        const deviceId = dto.deviceId.toLowerCase();
+        const existing = await this.credentialRepository.findOne({
+            where: { user: { id: user.id }, deviceId },
+        });
+        const record = existing ?? this.credentialRepository.create({
+            user,
+            deviceId,
+        });
+        record.credentialKey = this.buildCredentialKey(user.username, deviceId);
+        const credentialRef = this.mintCredentialRef();
+        record.hashedCredentialRef = this.hashCredentialRef(credentialRef);
+        record.hashedMpin = await this.hashingService.hash(dto.mpin);
+        record.mpinScheme = this.hashingService.name();
+        record.mpinSchemeVersion = this.hashingService.currentVersion();
+        record.deviceName = dto.deviceName ?? null;
+        record.platform = dto.platform ?? null;
+        record.isActive = true;
+        record.failedAttempts = 0;
+        record.lockedUntil = null;
+        await this.evictOldestIfAtCap(user.id, existing?.id);
+        await this.credentialRepository.save(record);
+        return { credentialRef, message: success_messages_1.SUCCESS_MESSAGES.MPIN_SETUP_SUCCESS };
+    }
+    async changeMpin(activeUser, dto) {
+        this.assertEnabled();
+        this.assertMpinAcceptable(dto.newMpin);
+        const credential = await this.credentialRepository.findOne({
+            where: {
+                hashedCredentialRef: this.hashCredentialRef(dto.credentialRef),
+                user: { id: activeUser.sub },
+            },
+        });
+        if (!credential || !credential.isActive) {
+            throw new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_INVALID);
+        }
+        this.assertNotLocked(credential);
+        const matches = await this.hashingService.compare(dto.currentMpin, credential.hashedMpin, credential.mpinSchemeVersion);
+        if (!matches) {
+            throw await this.registerFailedAttempt(credential);
+        }
+        const credentialRef = this.mintCredentialRef();
+        credential.hashedCredentialRef = this.hashCredentialRef(credentialRef);
+        credential.hashedMpin = await this.hashingService.hash(dto.newMpin);
+        credential.mpinScheme = this.hashingService.name();
+        credential.mpinSchemeVersion = this.hashingService.currentVersion();
+        credential.failedAttempts = 0;
+        credential.lockedUntil = null;
+        await this.credentialRepository.save(credential);
+        return { credentialRef, message: success_messages_1.SUCCESS_MESSAGES.MPIN_CHANGED_SUCCESS };
+    }
+    async loginWithMpin(dto) {
+        this.assertEnabled();
+        const credential = await this.credentialRepository.findOne({
+            where: { hashedCredentialRef: this.hashCredentialRef(dto.credentialRef) },
+            relations: { user: { roles: true } },
+        });
+        if (!credential || !credential.user) {
+            throw new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_INVALID);
+        }
+        if (!credential.isActive) {
+            throw new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_REVOKED);
+        }
+        this.assertNotLocked(credential);
+        const matches = await this.hashingService.compare(dto.mpin, credential.hashedMpin, credential.mpinSchemeVersion);
+        if (!matches) {
+            throw await this.registerFailedAttempt(credential);
+        }
+        credential.failedAttempts = 0;
+        credential.lockedUntil = null;
+        credential.lastUsedAt = new Date();
+        if (this.hashingService.needsRehash(credential.hashedMpin, credential.mpinSchemeVersion)) {
+            credential.hashedMpin = await this.hashingService.hash(dto.mpin);
+            credential.mpinScheme = this.hashingService.name();
+            credential.mpinSchemeVersion = this.hashingService.currentVersion();
+        }
+        await this.credentialRepository.save(credential);
+        const user = credential.user;
+        await this.userActivityHistoryService.logEvent('login', user);
+        const tokens = await this.authenticationService.generateTokens(user, credential.deviceId);
+        return {
+            user: {
+                id: user.id,
+                email: user.email,
+                mobile: user.mobile,
+                username: user.username,
+                forcePasswordChange: user.forcePasswordChange,
+                roles: (user.roles ?? []).map((role) => role.name),
+            },
+            ...tokens,
+        };
+    }
+    async listDevices(activeUser) {
+        this.assertEnabled();
+        const credentials = await this.credentialRepository.find({
+            where: { user: { id: activeUser.sub }, isActive: true },
+        });
+        return credentials
+            .sort((a, b) => this.lastUsedMillis(b) - this.lastUsedMillis(a))
+            .map((credential) => this.toDeviceView(credential));
+    }
+    async revokeDevice(activeUser, id) {
+        this.assertEnabled();
+        const credential = await this.credentialRepository.findOne({
+            where: { id, user: { id: activeUser.sub } },
+        });
+        if (!credential) {
+            throw new common_1.NotFoundException(error_messages_1.ERROR_MESSAGES.MPIN_CREDENTIAL_NOT_FOUND);
+        }
+        credential.isActive = false;
+        await this.credentialRepository.save(credential);
+        return { message: success_messages_1.SUCCESS_MESSAGES.MPIN_DEVICE_REVOKED };
+    }
+    toDeviceView(credential) {
+        return {
+            id: credential.id,
+            deviceId: credential.deviceId,
+            deviceName: credential.deviceName,
+            platform: credential.platform,
+            isActive: credential.isActive,
+            failedAttempts: credential.failedAttempts,
+            lockedUntil: credential.lockedUntil,
+            lastUsedAt: credential.lastUsedAt,
+            createdAt: credential.createdAt,
+        };
+    }
+    assertEnabled() {
+        if (!this.settingService.getConfigValue('mpinEnabled')) {
+            throw new common_1.NotFoundException(error_messages_1.ERROR_MESSAGES.MPIN_NOT_ENABLED);
+        }
+    }
+    assertNotLocked(credential) {
+        if (credential.lockedUntil && credential.lockedUntil.getTime() > Date.now()) {
+            throw new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_LOCKED);
+        }
+    }
+    assertMpinAcceptable(mpin) {
+        const pattern = String(this.settingService.getConfigValue('mpinRegex') ?? '^\\d{4,6}$');
+        let matches = false;
+        try {
+            matches = new RegExp(pattern).test(mpin);
+        }
+        catch {
+            this.logger.error(`Invalid mpinRegex setting: ${pattern}`);
+            throw new common_1.BadRequestException(error_messages_1.ERROR_MESSAGES.MPIN_FORMAT_INVALID);
+        }
+        if (!matches) {
+            throw new common_1.BadRequestException(error_messages_1.ERROR_MESSAGES.MPIN_FORMAT_INVALID);
+        }
+        if (this.isPredictable(mpin)) {
+            throw new common_1.BadRequestException(error_messages_1.ERROR_MESSAGES.MPIN_TOO_PREDICTABLE);
+        }
+    }
+    isPredictable(mpin) {
+        if (/^(\d)\1+$/.test(mpin)) {
+            return true;
+        }
+        if (this.isSequential(mpin)) {
+            return true;
+        }
+        return MPIN_DENYLIST.has(mpin);
+    }
+    isSequential(mpin) {
+        let ascending = true;
+        let descending = true;
+        for (let i = 1; i < mpin.length; i++) {
+            const step = mpin.charCodeAt(i) - mpin.charCodeAt(i - 1);
+            if (step !== 1)
+                ascending = false;
+            if (step !== -1)
+                descending = false;
+        }
+        return ascending || descending;
+    }
+    async registerFailedAttempt(credential) {
+        const lockThreshold = Number(this.settingService.getConfigValue('mpinMaxFailedAttempts'));
+        const deactivateThreshold = Number(this.settingService.getConfigValue('mpinMaxTotalFailedAttempts'));
+        const lockoutSeconds = Number(this.settingService.getConfigValue('mpinLockoutDuration'));
+        credential.failedAttempts += 1;
+        let error = new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_INVALID);
+        if (credential.isActive && deactivateThreshold > 0 && credential.failedAttempts >= deactivateThreshold) {
+            credential.isActive = false;
+            credential.lockedUntil = null;
+            error = new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_REVOKED);
+        }
+        else if (credential.isActive && lockThreshold > 0 && credential.failedAttempts % lockThreshold === 0) {
+            credential.lockedUntil = new Date(Date.now() + lockoutSeconds * 1000);
+            error = new common_1.UnauthorizedException(error_messages_1.ERROR_MESSAGES.MPIN_LOCKED);
+        }
+        await this.credentialRepository.save(credential);
+        return error;
+    }
+    async evictOldestIfAtCap(userId, excludeId) {
+        const cap = Number(this.settingService.getConfigValue('mpinMaxDevicesPerUser'));
+        if (!cap || cap <= 0) {
+            return;
+        }
+        const active = (await this.credentialRepository.find({
+            where: { user: { id: userId }, isActive: true },
+        })).filter((credential) => credential.id !== excludeId);
+        const overflow = active.length - (cap - 1);
+        if (overflow <= 0) {
+            return;
+        }
+        const doomed = active
+            .sort((a, b) => this.lastUsedMillis(a) - this.lastUsedMillis(b))
+            .slice(0, overflow);
+        for (const credential of doomed) {
+            credential.isActive = false;
+        }
+        await this.credentialRepository.save(doomed);
+        this.logger.log(`Evicted ${doomed.length} MPIN credential(s) for user ${userId} at the device cap of ${cap}`);
+    }
+    lastUsedMillis(credential) {
+        return credential.lastUsedAt?.getTime() ?? credential.createdAt?.getTime() ?? 0;
+    }
+    buildCredentialKey(username, deviceId) {
+        const normalizedUsername = (username ?? '').trim().toLowerCase().replace(/\s+/g, '-');
+        return `${normalizedUsername}-${deviceId}`;
+    }
+    mintCredentialRef() {
+        return (0, crypto_1.randomBytes)(32).toString('hex');
+    }
+    hashCredentialRef(credentialRef) {
+        return (0, crypto_1.createHash)('sha256').update(credentialRef).digest('hex');
+    }
+};
+exports.MpinService = MpinService;
+exports.MpinService = MpinService = MpinService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_device_credential_repository_1.UserDeviceCredentialRepository,
+        user_repository_1.UserRepository,
+        hashing_service_1.HashingService,
+        setting_service_1.SettingService,
+        authentication_service_1.AuthenticationService,
+        user_activity_history_service_1.UserActivityHistoryService])
+], MpinService);
+//# sourceMappingURL=mpin.service.js.map

package/dist/services/mpin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mpin.service.js","sourceRoot":"","sources":["../../src/services/mpin.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAMwB;AACxB,mCAAiD;AACjD,gEAA8D;AAC9D,oEAAkE;AAMlE,uGAAkG;AAClG,mEAAgE;AAEhE,qEAAiE;AACjE,uDAAmD;AACnD,uDAAmD;AACnD,mFAA6E;AAO7E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9D,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;CACvE,CAAC,CAAC;AAGI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGpB,YACqB,oBAAoD,EACpD,cAA8B,EAC9B,cAA8B,EAC9B,cAA8B,EAC9B,qBAA4C,EAC5C,0BAAsD;QALtD,yBAAoB,GAApB,oBAAoB,CAAgC;QACpD,mBAAc,GAAd,cAAc,CAAgB;QAC9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,+BAA0B,GAA1B,0BAA0B,CAA4B;QAR1D,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IASnD,CAAC;IAIL,KAAK,CAAC,SAAS,CAAC,UAA0B,EAAE,GAAiB;QACzD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAKpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,0BAAiB,CAAC,+BAAc,CAAC,cAAc,CAAC,CAAC;QAC/D,CAAC;QAOD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACrD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE;SAC7C,CAAC,CAAC;QAIH,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;YACxD,IAAI;YACJ,QAAQ;SACX,CAAC,CAAC;QAKH,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACnE,MAAM,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QAChE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;QAC3C,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC;QACvC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAE1B,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAI7C,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAgB,CAAC,kBAAkB,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAA0B,EAAE,GAAkB;QAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAIvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE;gBACH,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC9D,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE;aAC/B;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7C,GAAG,CAAC,WAAW,EACf,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,iBAAiB,CAC/B,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC;QAID,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACvE,UAAU,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnD,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QACpE,UAAU,CAAC,cAAc,GAAG,CAAC,CAAC;QAC9B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAgB,CAAC,oBAAoB,EAAE,CAAC;IAC7E,CAAC;IAID,KAAK,CAAC,aAAa,CAAC,GAAiB;QACjC,IAAI,CAAC,aAAa,EAAE,CAAC;QAIrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;YACzE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;SACvC,CAAC,CAAC;QAGH,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QAUD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QAID,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7C,GAAG,CAAC,IAAI,EACR,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,iBAAiB,CAC/B,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC;QAED,UAAU,CAAC,cAAc,GAAG,CAAC,CAAC;QAC9B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,UAAU,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvF,UAAU,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACnD,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAK9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE1F,OAAO;YACH,IAAI,EAAE;gBACF,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aACrD;YACD,GAAG,MAAM;SACZ,CAAC;IACN,CAAC;IAID,KAAK,CAAC,WAAW,CAAC,UAA0B;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YACrD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC1D,CAAC,CAAC;QAEH,OAAO,WAAW;aACb,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;aAC/D,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAA0B,EAAE,EAAU;QACrD,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,0BAAiB,CAAC,+BAAc,CAAC,yBAAyB,CAAC,CAAC;QAC1E,CAAC;QAKD,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;QAC5B,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,OAAO,EAAE,OAAO,EAAE,mCAAgB,CAAC,mBAAmB,EAAE,CAAC;IAC7D,CAAC;IAUO,YAAY,CAAC,UAAgC;QACjD,OAAO;YACH,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,SAAS,EAAE,UAAU,CAAC,SAAS;SAClC,CAAC;IACN,CAAC;IAEO,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,aAAa,CAAC,EAAE,CAAC;YAEvE,MAAM,IAAI,0BAAiB,CAAC,+BAAc,CAAC,gBAAgB,CAAC,CAAC;QACjE,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAgC;QACpD,IAAI,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;IAEO,oBAAoB,CAAC,IAAY;QACrC,MAAM,OAAO,GAAG,MAAM,CAClB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,WAAW,CAAC,IAAI,YAAY,CACpF,CAAC;QAMF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACD,OAAO,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YAC3D,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,mBAAmB,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,mBAAmB,CAAC,CAAC;QACtE,CAAC;QAID,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAI3B,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,oBAAoB,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,IAAY;QAC9B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,IAAY;QAC7B,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,KAAK,CAAC;gBAAE,SAAS,GAAG,KAAK,CAAC;YAClC,IAAI,IAAI,KAAK,CAAC,CAAC;gBAAE,UAAU,GAAG,KAAK,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,IAAI,UAAU,CAAC;IACnC,CAAC;IAUO,KAAK,CAAC,qBAAqB,CAC/B,UAAgC;QAEhC,MAAM,aAAa,GAAG,MAAM,CACxB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,uBAAuB,CAAC,CAChF,CAAC;QACF,MAAM,mBAAmB,GAAG,MAAM,CAC9B,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,4BAA4B,CAAC,CACrF,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,CACzB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,qBAAqB,CAAC,CAC9E,CAAC;QAEF,UAAU,CAAC,cAAc,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAG,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QAEnE,IAAI,UAAU,CAAC,QAAQ,IAAI,mBAAmB,GAAG,CAAC,IAAI,UAAU,CAAC,cAAc,IAAI,mBAAmB,EAAE,CAAC;YACrG,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;YAC5B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;YAK9B,KAAK,GAAG,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,IAAI,aAAa,GAAG,CAAC,IAAI,UAAU,CAAC,cAAc,GAAG,aAAa,KAAK,CAAC,EAAE,CAAC;YACrG,UAAU,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,CAAC;YACtE,KAAK,GAAG,IAAI,8BAAqB,CAAC,+BAAc,CAAC,WAAW,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACjB,CAAC;IAQO,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,SAAkB;QAC/D,MAAM,GAAG,GAAG,MAAM,CACd,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,uBAAuB,CAAC,CAChF,CAAC;QACF,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YACjD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAGxD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QAKD,MAAM,MAAM,GAAG,MAAM;aAChB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;aAC/D,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAExB,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;YAC9B,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CACX,WAAW,MAAM,CAAC,MAAM,gCAAgC,MAAM,yBAAyB,GAAG,EAAE,CAC/F,CAAC;IACN,CAAC;IAEO,cAAc,CAAC,UAAgC;QACnD,OAAO,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IAUO,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;QACzD,MAAM,kBAAkB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtF,OAAO,GAAG,kBAAkB,IAAI,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAEO,iBAAiB;QACrB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAKO,iBAAiB,CAAC,aAAqB;QAC3C,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;CACJ,CAAA;AA3ZY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAKkC,kEAA8B;QACpC,gCAAc;QACd,gCAAc;QACd,gCAAc;QACP,8CAAqB;QAChB,0DAA0B;GATlE,WAAW,CA2ZvB","sourcesContent":["import {\n    BadRequestException,\n    Injectable,\n    Logger,\n    NotFoundException,\n    UnauthorizedException,\n} from '@nestjs/common';\nimport { createHash, randomBytes } from 'crypto';\nimport { ERROR_MESSAGES } from 'src/constants/error-messages';\nimport { SUCCESS_MESSAGES } from 'src/constants/success-messages';\nimport { ChangeMpinDto } from 'src/dtos/change-mpin.dto';\nimport { MpinLoginDto } from 'src/dtos/mpin-login.dto';\nimport { SetupMpinDto } from 'src/dtos/setup-mpin.dto';\nimport { UserDeviceCredential } from 'src/entities/user-device-credential.entity';\nimport { ActiveUserData } from 'src/interfaces/active-user-data.interface';\nimport { UserDeviceCredentialRepository } from 'src/repository/user-device-credential.repository';\nimport { UserRepository } from 'src/repository/user.repository';\nimport type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';\nimport { AuthenticationService } from './authentication.service';\nimport { HashingService } from './hashing.service';\nimport { SettingService } from './setting.service';\nimport { UserActivityHistoryService } from './user-activity-history.service';\n\n/**\n * The most-chosen PINs in published analyses of breached sets. `1234` alone\n * accounts for roughly a tenth of four-digit choices, so a list this short\n * removes a disproportionate share of guessable values.\n */\nconst MPIN_DENYLIST = new Set([\n    '0000', '1111', '2222', '3333', '4444', '5555', '6666', '7777', '8888', '9999',\n    '1234', '4321', '1212', '2001', '1004', '2000', '6969', '2580',\n    '000000', '111111', '123456', '654321', '121212', '112233', '123123',\n]);\n\n@Injectable()\nexport class MpinService {\n    private readonly logger = new Logger(MpinService.name);\n\n    constructor(\n        private readonly credentialRepository: UserDeviceCredentialRepository,\n        private readonly userRepository: UserRepository,\n        private readonly hashingService: HashingService,\n        private readonly settingService: SettingService,\n        private readonly authenticationService: AuthenticationService,\n        private readonly userActivityHistoryService: UserActivityHistoryService,\n    ) { }\n\n    // ---------------------------------------------------------------- setup\n\n    async setupMpin(activeUser: ActiveUserData, dto: SetupMpinDto) {\n        this.assertEnabled();\n        this.assertMpinAcceptable(dto.mpin);\n\n        // The account comes from the access token, never from the body - a\n        // client can only ever create a credential for the user it is signed\n        // in as.\n        const user = await this.userRepository.findOne({ where: { id: activeUser.sub } });\n        if (!user) {\n            throw new NotFoundException(ERROR_MESSAGES.USER_NOT_FOUND);\n        }\n\n        // Lower-cased because @IsUUID is case-insensitive: iOS renders a UUID\n        // uppercase (identifierForVendor.uuidString) while Android renders it\n        // lowercase, and both validate. Without normalising, the same physical\n        // device could present two spellings, miss this exact-match lookup and\n        // end up with two credential rows consuming two slots against the cap.\n        const deviceId = dto.deviceId.toLowerCase();\n\n        const existing = await this.credentialRepository.findOne({\n            where: { user: { id: user.id }, deviceId },\n        });\n\n        // Re-running setup on the same device rotates the credential rather\n        // than adding a second one.\n        const record = existing ?? this.credentialRepository.create({\n            user,\n            deviceId,\n        });\n\n        // Recomputed on every setup so a renamed user does not keep a stale\n        // key. It is an identifier for humans and tooling, never a lookup key,\n        // so drift here costs nothing operationally.\n        record.credentialKey = this.buildCredentialKey(user.username, deviceId);\n\n        const credentialRef = this.mintCredentialRef();\n        record.hashedCredentialRef = this.hashCredentialRef(credentialRef);\n        record.hashedMpin = await this.hashingService.hash(dto.mpin);\n        record.mpinScheme = this.hashingService.name();\n        record.mpinSchemeVersion = this.hashingService.currentVersion();\n        record.deviceName = dto.deviceName ?? null;\n        record.platform = dto.platform ?? null;\n        record.isActive = true;\n        record.failedAttempts = 0;\n        record.lockedUntil = null;\n\n        await this.evictOldestIfAtCap(user.id, existing?.id);\n        await this.credentialRepository.save(record);\n\n        // Returned once. Only its SHA-256 is stored, so it can never be\n        // re-issued - the client must persist it before reporting success.\n        return { credentialRef, message: SUCCESS_MESSAGES.MPIN_SETUP_SUCCESS };\n    }\n\n    async changeMpin(activeUser: ActiveUserData, dto: ChangeMpinDto) {\n        this.assertEnabled();\n        this.assertMpinAcceptable(dto.newMpin);\n\n        // Scoped to the caller, so holding someone else's handle is not enough\n        // to change their MPIN.\n        const credential = await this.credentialRepository.findOne({\n            where: {\n                hashedCredentialRef: this.hashCredentialRef(dto.credentialRef),\n                user: { id: activeUser.sub },\n            },\n        });\n\n        if (!credential || !credential.isActive) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_INVALID);\n        }\n        this.assertNotLocked(credential);\n\n        const matches = await this.hashingService.compare(\n            dto.currentMpin,\n            credential.hashedMpin,\n            credential.mpinSchemeVersion,\n        );\n        if (!matches) {\n            throw await this.registerFailedAttempt(credential);\n        }\n\n        // Rotate the handle alongside the MPIN: a changed credential should\n        // invalidate anything captured previously.\n        const credentialRef = this.mintCredentialRef();\n        credential.hashedCredentialRef = this.hashCredentialRef(credentialRef);\n        credential.hashedMpin = await this.hashingService.hash(dto.newMpin);\n        credential.mpinScheme = this.hashingService.name();\n        credential.mpinSchemeVersion = this.hashingService.currentVersion();\n        credential.failedAttempts = 0;\n        credential.lockedUntil = null;\n        await this.credentialRepository.save(credential);\n\n        return { credentialRef, message: SUCCESS_MESSAGES.MPIN_CHANGED_SUCCESS };\n    }\n\n    // ---------------------------------------------------------------- login\n\n    async loginWithMpin(dto: MpinLoginDto) {\n        this.assertEnabled();\n\n        // A single indexed exact-match lookup. The row already names the user,\n        // so there is nothing to resolve and no identifier to enumerate with.\n        const credential = await this.credentialRepository.findOne({\n            where: { hashedCredentialRef: this.hashCredentialRef(dto.credentialRef) },\n            relations: { user: { roles: true } },\n        });\n\n        // An unknown handle is reported exactly as a wrong MPIN is.\n        if (!credential || !credential.user) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_INVALID);\n        }\n\n        // A dead credential is reported as such regardless of what MPIN was\n        // supplied. Gating this on a correct MPIN would be marginally more\n        // conservative, but it protects almost nothing - \"this dead handle was\n        // once real\" grants no capability - and it costs an asymmetry that\n        // reads as a bug: the attempt that causes deactivation reports\n        // MPIN_REVOKED, while the very next identical attempt would report\n        // MPIN_INVALID. The enumeration resistance that matters comes from the\n        // handle being unguessable, not from this branch.\n        if (!credential.isActive) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_REVOKED);\n        }\n\n        // Checked before the hash comparison, so attempts made during a lockout\n        // neither extend it nor cost a bcrypt call.\n        this.assertNotLocked(credential);\n\n        const matches = await this.hashingService.compare(\n            dto.mpin,\n            credential.hashedMpin,\n            credential.mpinSchemeVersion,\n        );\n\n        if (!matches) {\n            throw await this.registerFailedAttempt(credential);\n        }\n\n        credential.failedAttempts = 0;\n        credential.lockedUntil = null;\n        credential.lastUsedAt = new Date();\n        if (this.hashingService.needsRehash(credential.hashedMpin, credential.mpinSchemeVersion)) {\n            credential.hashedMpin = await this.hashingService.hash(dto.mpin);\n            credential.mpinScheme = this.hashingService.name();\n            credential.mpinSchemeVersion = this.hashingService.currentVersion();\n        }\n        await this.credentialRepository.save(credential);\n\n        const user = credential.user;\n        await this.userActivityHistoryService.logEvent('login', user);\n\n        // A fresh token pair - never a replay of a stored refresh token. This\n        // is what makes MPIN survive logout and refresh-token expiry. The\n        // stable deviceId keeps repeat logins in one session bucket.\n        const tokens = await this.authenticationService.generateTokens(user, credential.deviceId);\n\n        return {\n            user: {\n                id: user.id,\n                email: user.email,\n                mobile: user.mobile,\n                username: user.username,\n                forcePasswordChange: user.forcePasswordChange,\n                roles: (user.roles ?? []).map((role) => role.name),\n            },\n            ...tokens,\n        };\n    }\n\n    // ----------------------------------------------------- device management\n\n    async listDevices(activeUser: ActiveUserData) {\n        this.assertEnabled();\n\n        const credentials = await this.credentialRepository.find({\n            where: { user: { id: activeUser.sub }, isActive: true },\n        });\n\n        return credentials\n            .sort((a, b) => this.lastUsedMillis(b) - this.lastUsedMillis(a))\n            .map((credential) => this.toDeviceView(credential));\n    }\n\n    async revokeDevice(activeUser: ActiveUserData, id: number) {\n        this.assertEnabled();\n\n        const credential = await this.credentialRepository.findOne({\n            where: { id, user: { id: activeUser.sub } },\n        });\n        if (!credential) {\n            throw new NotFoundException(ERROR_MESSAGES.MPIN_CREDENTIAL_NOT_FOUND);\n        }\n\n        // Soft-delete. The row survives so a correct MPIN can be answered with\n        // MPIN_REVOKED rather than a baffling MPIN_INVALID; only active rows\n        // count towards the device cap.\n        credential.isActive = false;\n        await this.credentialRepository.save(credential);\n\n        return { message: SUCCESS_MESSAGES.MPIN_DEVICE_REVOKED };\n    }\n\n    // -------------------------------------------------------------- internals\n\n    /**\n     * Never exposes the stored hashes, independently of whatever serialiser\n     * configuration a consuming app runs. The entity also withholds them via\n     * @Exclude()/@Expose(), but building the response explicitly means a\n     * carelessly added decorator cannot leak a credential.\n     */\n    private toDeviceView(credential: UserDeviceCredential) {\n        return {\n            id: credential.id,\n            deviceId: credential.deviceId,\n            deviceName: credential.deviceName,\n            platform: credential.platform,\n            isActive: credential.isActive,\n            failedAttempts: credential.failedAttempts,\n            lockedUntil: credential.lockedUntil,\n            lastUsedAt: credential.lastUsedAt,\n            createdAt: credential.createdAt,\n        };\n    }\n\n    private assertEnabled(): void {\n        if (!this.settingService.getConfigValue<SolidCoreSetting>('mpinEnabled')) {\n            // 404 rather than 403: a disabled feature should look absent.\n            throw new NotFoundException(ERROR_MESSAGES.MPIN_NOT_ENABLED);\n        }\n    }\n\n    private assertNotLocked(credential: UserDeviceCredential): void {\n        if (credential.lockedUntil && credential.lockedUntil.getTime() > Date.now()) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_LOCKED);\n        }\n    }\n\n    private assertMpinAcceptable(mpin: string): void {\n        const pattern = String(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinRegex') ?? '^\\\\d{4,6}$',\n        );\n\n        // Fails closed. `matches` starts false and a malformed pattern - the\n        // setting is admin-editable free text - becomes a rejection rather\n        // than a skipped check, so a typo cannot silently let users set an\n        // MPIN weaker than policy allows.\n        let matches = false;\n        try {\n            matches = new RegExp(pattern).test(mpin);\n        } catch {\n            this.logger.error(`Invalid mpinRegex setting: ${pattern}`);\n            throw new BadRequestException(ERROR_MESSAGES.MPIN_FORMAT_INVALID);\n        }\n\n        if (!matches) {\n            throw new BadRequestException(ERROR_MESSAGES.MPIN_FORMAT_INVALID);\n        }\n\n        // Predictability is semantics, not shape - a regex expressing \"not\n        // sequential\" would be unreadable and easy to get subtly wrong.\n        if (this.isPredictable(mpin)) {\n            // Safe to distinguish, and 400 rather than 401: this only ever\n            // happens on a bearer-authenticated route, so it is a validation\n            // failure rather than an authentication one.\n            throw new BadRequestException(ERROR_MESSAGES.MPIN_TOO_PREDICTABLE);\n        }\n    }\n\n    private isPredictable(mpin: string): boolean {\n        if (/^(\\d)\\1+$/.test(mpin)) {\n            return true;\n        }\n        if (this.isSequential(mpin)) {\n            return true;\n        }\n        return MPIN_DENYLIST.has(mpin);\n    }\n\n    private isSequential(mpin: string): boolean {\n        let ascending = true;\n        let descending = true;\n        for (let i = 1; i < mpin.length; i++) {\n            const step = mpin.charCodeAt(i) - mpin.charCodeAt(i - 1);\n            if (step !== 1) ascending = false;\n            if (step !== -1) descending = false;\n        }\n        return ascending || descending;\n    }\n\n    /**\n     * Records a failure and escalates. `failedAttempts` is cumulative and\n     * resets only on success - never when a lockout expires - which is what\n     * makes the second threshold detectable without a separate counter.\n     *\n     * Returns the exception for the caller to throw, so the save is always\n     * awaited before the response leaves.\n     */\n    private async registerFailedAttempt(\n        credential: UserDeviceCredential,\n    ): Promise<UnauthorizedException> {\n        const lockThreshold = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinMaxFailedAttempts'),\n        );\n        const deactivateThreshold = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinMaxTotalFailedAttempts'),\n        );\n        const lockoutSeconds = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinLockoutDuration'),\n        );\n\n        credential.failedAttempts += 1;\n        let error = new UnauthorizedException(ERROR_MESSAGES.MPIN_INVALID);\n\n        if (credential.isActive && deactivateThreshold > 0 && credential.failedAttempts >= deactivateThreshold) {\n            credential.isActive = false;\n            credential.lockedUntil = null;\n            // This attempt caused the deactivation, so it is reported. The\n            // caller reached the limit on a handle they demonstrably hold and\n            // caused this state themselves, so nothing is disclosed - and\n            // without it they would keep retrying a permanently dead credential.\n            error = new UnauthorizedException(ERROR_MESSAGES.MPIN_REVOKED);\n        } else if (credential.isActive && lockThreshold > 0 && credential.failedAttempts % lockThreshold === 0) {\n            credential.lockedUntil = new Date(Date.now() + lockoutSeconds * 1000);\n            error = new UnauthorizedException(ERROR_MESSAGES.MPIN_LOCKED);\n        }\n\n        await this.credentialRepository.save(credential);\n        return error;\n    }\n\n    /**\n     * The cap evicts rather than rejects. A reinstall wipes the client's\n     * deviceId, so the app generates a new one and setup adds a row instead of\n     * replacing the old, orphaned one. Rejecting at the cap would mean a user\n     * who reinstalls a few times could never set MPIN up again.\n     */\n    private async evictOldestIfAtCap(userId: number, excludeId?: number): Promise<void> {\n        const cap = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinMaxDevicesPerUser'),\n        );\n        if (!cap || cap <= 0) {\n            return;\n        }\n\n        const active = (await this.credentialRepository.find({\n            where: { user: { id: userId }, isActive: true },\n        })).filter((credential) => credential.id !== excludeId);\n\n        // One slot is about to be taken by the credential being written.\n        const overflow = active.length - (cap - 1);\n        if (overflow <= 0) {\n            return;\n        }\n\n        // Sorted in JS rather than SQL because a never-used credential has a\n        // null lastUsedAt, and Postgres sorts nulls last on ASC - which would\n        // treat the least-used rows as the most recently used.\n        const doomed = active\n            .sort((a, b) => this.lastUsedMillis(a) - this.lastUsedMillis(b))\n            .slice(0, overflow);\n\n        for (const credential of doomed) {\n            credential.isActive = false;\n        }\n        await this.credentialRepository.save(doomed);\n        this.logger.log(\n            `Evicted ${doomed.length} MPIN credential(s) for user ${userId} at the device cap of ${cap}`,\n        );\n    }\n\n    private lastUsedMillis(credential: UserDeviceCredential): number {\n        return credential.lastUsedAt?.getTime() ?? credential.createdAt?.getTime() ?? 0;\n    }\n\n    /**\n     * `<username>-<deviceId>`, the model's natural key.\n     *\n     * Not slugified: lodash `kebabCase` splits digit/letter boundaries, so it\n     * would shred a UUID into `3-f-7-b-8-a-10-...`. The username is lower-cased\n     * and stripped of whitespace, which is enough for a key that is only ever\n     * read, never parsed back into its parts.\n     */\n    private buildCredentialKey(username: string, deviceId: string): string {\n        const normalizedUsername = (username ?? '').trim().toLowerCase().replace(/\\s+/g, '-');\n        return `${normalizedUsername}-${deviceId}`;\n    }\n\n    private mintCredentialRef(): string {\n        return randomBytes(32).toString('hex');\n    }\n\n    // SHA-256, not bcrypt: 256 bits of randomness has nothing to brute-force,\n    // so a slow hash would only add latency to every login. Same reasoning as\n    // ApiKeyService.hash.\n    private hashCredentialRef(credentialRef: string): string {\n        return createHash('sha256').update(credentialRef).digest('hex');\n    }\n}\n"]}

package/dist/services/refresh-token-ids-storage.service.d.ts

@@ -1,21 +1,40 @@
 import { Cache } from 'cache-manager';
 import { AuthenticationService } from './authentication.service';
+import { SettingService } from './setting.service';
 export declare class InvalidatedRefreshTokenError extends Error {
 }
 type RefreshTokenState = {
     currentRefreshToken: string;
     previousRefreshToken: string;
+    previousValidUntil?: number;
+};
+export type RefreshTokenClaims = {
+    deviceKey?: string;
+    epoch?: number;
+};
+export type RotatedRefreshToken = {
+    refreshToken: string;
+    deviceKey?: string;
 };
 export declare class RefreshTokenIdsStorageService {
     private cacheManager;
     private readonly authenticationService;
-    constructor(cacheManager: Cache, authenticationService: AuthenticationService);
-    insert(userId: number, refreshToken: string, previousRefreshToken?: string): Promise<void>;
-    validate(userId: number, refreshToken: string): Promise<boolean>;
-    invalidate(userId: number): Promise<void>;
-    validateAndRotate(user: any, refreshToken: string): Promise<string>;
+    private readonly settingService;
+    constructor(cacheManager: Cache, authenticationService: AuthenticationService, settingService: SettingService);
+    areConcurrentLoginsAllowed(): boolean;
+    insert(userId: number, refreshToken: string, previousRefreshToken?: string, deviceKey?: string): Promise<void>;
+    invalidate(userId: number, deviceKey?: string): Promise<void>;
+    invalidateAll(userId: number): Promise<void>;
+    getEpoch(userId: number): Promise<number | undefined>;
+    validateAndRotate(user: any, refreshToken: string, claims?: RefreshTokenClaims): Promise<RotatedRefreshToken>;
+    getCurrentRefreshTokenState(userId: number, deviceKey?: string): Promise<RefreshTokenState | undefined>;
     private getKey;
-    getCurrentRefreshTokenState(userId: number): Promise<RefreshTokenState | undefined>;
+    private getEpochKey;
+    private resolveNextDeviceKey;
+    private isEpochCurrent;
+    private getStateTtlMs;
+    private isRefreshTokenState;
+    private isWithinGraceWindow;
 }
 export {};
 //# sourceMappingURL=refresh-token-ids-storage.service.d.ts.map

package/dist/services/refresh-token-ids-storage.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token-ids-storage.service.d.ts","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,qBAAa,4BAA6B,SAAQ,KAAK;CAAI;AAE3D,KAAK,iBAAiB,GAAG;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,qBAEa,6BAA6B;IAeX,OAAO,CAAC,YAAY;IAE3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAFP,YAAY,EAAE,KAAK,EAEjC,qBAAqB,EAAE,qBAAqB;IAG3D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1F,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUhE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoEzE,OAAO,CAAC,MAAM;IAId,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;CAGtF"}
+{"version":3,"file":"refresh-token-ids-storage.service.d.ts","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,qBAAa,4BAA6B,SAAQ,KAAK;CAAI;AAe3D,KAAK,iBAAiB,GAAG;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAM7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAQF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IAGrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,qBACa,6BAA6B;IAEX,OAAO,CAAC,YAAY;IAE3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAHA,YAAY,EAAE,KAAK,EAEjC,qBAAqB,EAAE,qBAAqB,EAC5C,cAAc,EAAE,cAAc;IAenD,0BAA0B,IAAI,OAAO;IAI/B,MAAM,CACR,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,oBAAoB,CAAC,EAAE,MAAM,EAC7B,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAeV,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa7D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIrD,iBAAiB,CACnB,IAAI,EAAE,GAAG,EACT,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,kBAAuB,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAwD/B,2BAA2B,CACvB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAIzC,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,oBAAoB;YAOd,cAAc;IAc5B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,mBAAmB;CAoB9B"}

package/dist/services/refresh-token-ids-storage.service.js

@@ -15,69 +15,106 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RefreshTokenIdsStorageService = exports.InvalidatedRefreshTokenError = void 0;
 const cache_manager_1 = require("@nestjs/cache-manager");
 const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
 const authentication_service_1 = require("./authentication.service");
+const setting_service_1 = require("./setting.service");
 class InvalidatedRefreshTokenError extends Error {
 }
 exports.InvalidatedRefreshTokenError = InvalidatedRefreshTokenError;
+const PREVIOUS_TOKEN_GRACE_MS = 60 * 1000;
+const STATE_TTL_BUFFER_SECONDS = 60;
 let RefreshTokenIdsStorageService = class RefreshTokenIdsStorageService {
-    constructor(cacheManager, authenticationService) {
+    constructor(cacheManager, authenticationService, settingService) {
         this.cacheManager = cacheManager;
         this.authenticationService = authenticationService;
+        this.settingService = settingService;
     }
-    async insert(userId, refreshToken, previousRefreshToken) {
+    areConcurrentLoginsAllowed() {
+        return !this.settingService.getConfigValue("preventConcurrentLogins");
+    }
+    async insert(userId, refreshToken, previousRefreshToken, deviceKey) {
         const refreshTokenState = {
             currentRefreshToken: refreshToken,
             previousRefreshToken: previousRefreshToken ?? "",
+            ...(previousRefreshToken
+                ? { previousValidUntil: Date.now() + PREVIOUS_TOKEN_GRACE_MS }
+                : {}),
         };
-        await this.cacheManager.set(this.getKey(userId), refreshTokenState);
+        await this.cacheManager.set(this.getKey(userId, deviceKey), refreshTokenState, this.getStateTtlMs());
     }
-    async validate(userId, refreshToken) {
-        const storedId = await this.cacheManager.get(this.getKey(userId));
-        if (storedId !== refreshToken) {
-            throw new InvalidatedRefreshTokenError();
-        }
-        return storedId === refreshToken;
+    async invalidate(userId, deviceKey) {
+        await this.cacheManager.del(this.getKey(userId, deviceKey));
     }
-    async invalidate(userId) {
+    async invalidateAll(userId) {
+        const currentEpoch = (await this.getEpoch(userId)) ?? 0;
+        await this.cacheManager.set(this.getEpochKey(userId), currentEpoch + 1, this.getStateTtlMs());
         await this.cacheManager.del(this.getKey(userId));
     }
-    async validateAndRotate(user, refreshToken) {
-        let valid = false;
-        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id));
-        let newRefreshToken;
-        if (refreshTokenState &&
-            typeof refreshTokenState === 'object' &&
-            'currentRefreshToken' in refreshTokenState &&
-            'previousRefreshToken' in refreshTokenState) {
-            if (refreshTokenState.currentRefreshToken === refreshToken) {
-                valid = true;
-                newRefreshToken = await this.authenticationService.generateRefreshToken(user, refreshTokenState.currentRefreshToken);
-                setTimeout(async () => {
-                    const state = (await this.cacheManager.get(this.getKey(user.id)));
-                    if (state && state.currentRefreshToken === newRefreshToken) {
-                        await this.cacheManager.set(this.getKey(user.id), {
-                            currentRefreshToken: newRefreshToken,
-                            previousRefreshToken: "",
-                        });
-                    }
-                }, 1 * 60 * 1000);
+    async getEpoch(userId) {
+        return (await this.cacheManager.get(this.getEpochKey(userId))) ?? undefined;
+    }
+    async validateAndRotate(user, refreshToken, claims = {}) {
+        const { deviceKey, epoch } = claims;
+        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id, deviceKey));
+        if (!this.isRefreshTokenState(refreshTokenState)) {
+            throw new InvalidatedRefreshTokenError();
+        }
+        if (deviceKey && !(await this.isEpochCurrent(user.id, epoch))) {
+            throw new InvalidatedRefreshTokenError();
+        }
+        if (refreshTokenState.currentRefreshToken === refreshToken) {
+            const nextDeviceKey = this.resolveNextDeviceKey(deviceKey);
+            const rotated = await this.authenticationService.generateRefreshToken(user, refreshToken, nextDeviceKey);
+            if (nextDeviceKey !== deviceKey) {
+                await this.cacheManager.del(this.getKey(user.id, deviceKey));
             }
-            else if (refreshTokenState.previousRefreshToken === refreshToken) {
-                valid = true;
-                const existingRefreshTokenState = (await this.cacheManager.get(this.getKey(user.id)));
-                newRefreshToken = existingRefreshTokenState?.currentRefreshToken;
+            return { refreshToken: rotated, deviceKey: nextDeviceKey };
+        }
+        if (refreshTokenState.previousRefreshToken && refreshTokenState.previousRefreshToken === refreshToken) {
+            if (!this.isWithinGraceWindow(refreshTokenState)) {
+                throw new InvalidatedRefreshTokenError();
             }
+            return { refreshToken: refreshTokenState.currentRefreshToken, deviceKey };
         }
-        if (!valid) {
-            throw new InvalidatedRefreshTokenError();
+        throw new InvalidatedRefreshTokenError();
+    }
+    getCurrentRefreshTokenState(userId, deviceKey) {
+        return this.cacheManager.get(this.getKey(userId, deviceKey));
+    }
+    getKey(userId, deviceKey) {
+        return deviceKey ? `user-${userId}-${deviceKey}` : `user-${userId}`;
+    }
+    getEpochKey(userId) {
+        return `user-epoch-${userId}`;
+    }
+    resolveNextDeviceKey(deviceKey) {
+        if (!this.areConcurrentLoginsAllowed()) {
+            return undefined;
         }
-        return newRefreshToken;
+        return deviceKey ?? (0, crypto_1.randomUUID)();
     }
-    getKey(userId) {
-        return `user-${userId}`;
+    async isEpochCurrent(userId, epoch) {
+        const storedEpoch = await this.getEpoch(userId);
+        if (storedEpoch === undefined) {
+            return true;
+        }
+        return epoch === storedEpoch;
+    }
+    getStateTtlMs() {
+        const refreshTokenTtlSeconds = Number(this.settingService.getConfigValue("refreshTokenTtl"));
+        return (refreshTokenTtlSeconds + STATE_TTL_BUFFER_SECONDS) * 1000;
     }
-    getCurrentRefreshTokenState(userId) {
-        return this.cacheManager.get(this.getKey(userId));
+    isRefreshTokenState(state) {
+        return (!!state &&
+            typeof state === 'object' &&
+            'currentRefreshToken' in state &&
+            'previousRefreshToken' in state);
+    }
+    isWithinGraceWindow(state) {
+        if (state.previousValidUntil === undefined) {
+            return true;
+        }
+        return Date.now() < state.previousValidUntil;
     }
 };
 exports.RefreshTokenIdsStorageService = RefreshTokenIdsStorageService;
@@ -85,6 +122,7 @@ exports.RefreshTokenIdsStorageService = RefreshTokenIdsStorageService = __decora
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(cache_manager_1.CACHE_MANAGER)),
     __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => authentication_service_1.AuthenticationService))),
-    __metadata("design:paramtypes", [Object, authentication_service_1.AuthenticationService])
+    __metadata("design:paramtypes", [Object, authentication_service_1.AuthenticationService,
+        setting_service_1.SettingService])
 ], RefreshTokenIdsStorageService);
 //# sourceMappingURL=refresh-token-ids-storage.service.js.map

package/dist/services/refresh-token-ids-storage.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token-ids-storage.service.js","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,yDAAsD;AACtD,2CAAgE;AAEhE,qEAAiE;AAGjE,MAAa,4BAA6B,SAAQ,KAAK;CAAI;AAA3D,oEAA2D;AASpD,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IActC,YACmC,YAAmB,EAEjC,qBAA4C;QAF9B,iBAAY,GAAZ,YAAY,CAAO;QAEjC,0BAAqB,GAArB,qBAAqB,CAAuB;IAC7D,CAAC;IAEL,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,YAAoB,EAAE,oBAA6B;QAC5E,MAAM,iBAAiB,GAAsB;YACzC,mBAAmB,EAAE,YAAY;YACjC,oBAAoB,EAAE,oBAAoB,IAAI,EAAE;SACnD,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,YAAoB;QAG/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,QAAQ,KAAK,YAAY,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAS,EAAE,YAAoB;QACnD,IAAI,KAAK,GAAG,KAAK,CAAC;QAIlB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAkC,CAAC;QAc7G,IAAI,eAAmC,CAAC;QACxC,IACI,iBAAiB;YACjB,OAAO,iBAAiB,KAAK,QAAQ;YACrC,qBAAqB,IAAI,iBAAiB;YAC1C,sBAAsB,IAAI,iBAAiB,EAC7C,CAAC;YACC,IAAI,iBAAiB,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;gBAEzD,KAAK,GAAG,IAAI,CAAC;gBAEb,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;gBAUrH,UAAU,CAAC,KAAK,IAAI,EAAE;oBAClB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAQ,CAAC;oBACzE,IAAI,KAAK,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe,EAAE,CAAC;wBACzD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;4BAC9C,mBAAmB,EAAE,eAAe;4BACpC,oBAAoB,EAAE,EAAE;yBAC3B,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,IAAI,iBAAiB,CAAC,oBAAoB,KAAK,YAAY,EAAE,CAAC;gBAEjE,KAAK,GAAG,IAAI,CAAC;gBAGb,MAAM,yBAAyB,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAkC,CAAC;gBACvH,eAAe,GAAG,yBAAyB,EAAE,mBAAmB,CAAC;YACrE,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QAGD,OAAO,eAAe,CAAC;IAC3B,CAAC;IAEO,MAAM,CAAC,MAAc;QACzB,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,2BAA2B,CAAC,MAAc;QACtC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;CACJ,CAAA;AArHY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,mBAAU,GAAE;IAiBJ,WAAA,IAAA,eAAM,EAAC,6BAAa,CAAC,CAAA;IACrB,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8CAAqB,CAAC,CAAC,CAAA;6CACR,8CAAqB;GAjBxD,6BAA6B,CAqHzC","sourcesContent":["import { CACHE_MANAGER } from '@nestjs/cache-manager';\nimport { Inject, Injectable, forwardRef } from '@nestjs/common';\nimport { Cache } from 'cache-manager';\nimport { AuthenticationService } from './authentication.service';\n\n// TODO: Ideally this should be in a separate file - putting this here for brevity\nexport class InvalidatedRefreshTokenError extends Error { }\n\ntype RefreshTokenState = {\n    currentRefreshToken: string;\n    previousRefreshToken: string;\n};\n\n@Injectable()\n// export class RefreshTokenIdsStorageService implements OnApplicationBootstrap, OnApplicationShutdown {\nexport class RefreshTokenIdsStorageService {\n    // private redisClient: Redis;\n    // onApplicationBootstrap() {\n    //     // TODO: Ideally, we should move this to the dedicated \"RedisModule\" instead of initiating the connection here.\n    //     this.redisClient = new Redis({\n    //         // TODO: According to best practices, we should use the environment variables here instead.\n    //         host: 'localhost',\n    //         port: 6379,\n    //     });\n    // }\n    // onApplicationShutdown(signal?: string) {\n    //     return this.redisClient.quit();\n    // }\n\n    constructor(\n        @Inject(CACHE_MANAGER) private cacheManager: Cache,\n        @Inject(forwardRef(() => AuthenticationService))\n        private readonly authenticationService: AuthenticationService\n    ) { }\n\n    async insert(userId: number, refreshToken: string, previousRefreshToken?: string): Promise<void> {\n        const refreshTokenState: RefreshTokenState = {\n            currentRefreshToken: refreshToken,\n            previousRefreshToken: previousRefreshToken ?? \"\",\n        };\n        await this.cacheManager.set(this.getKey(userId), refreshTokenState);\n    }\n\n    async validate(userId: number, refreshToken: string): Promise<boolean> {\n        // TODO: Assume you get this shape out of the cache {\"currentRefreshToken\": \"\", \"previousRefreshToken\": \"\"}\n        // Then you will compare against the currentRefreshToken.\n        const storedId = await this.cacheManager.get(this.getKey(userId));\n        if (storedId !== refreshToken) {\n            throw new InvalidatedRefreshTokenError();\n        }\n        return storedId === refreshToken;\n    }\n\n    async invalidate(userId: number): Promise<void> {\n        await this.cacheManager.del(this.getKey(userId));\n    }\n\n    async validateAndRotate(user: any, refreshToken: string): Promise<string> {\n        let valid = false;\n\n        // TODO: Assume you get this shape out of the cache {\"currentRefreshToken\": \"\", \"previousRefreshToken\": \"\"}\n        // Then you will compare against the currentRefreshToken.\n        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id)) as RefreshTokenState | undefined;\n\n        // Use the authentication service to generate a new refresh token, set it in the currentRefreshToken in scenario 1 and return.\n\n        // if UI.refresh_token is matching with Cache.currentRefreshToken\n        //   then invalidate (updated cache state, no need to delete anything), then generate new token and return.\n        //   also set a setTimeout to run after X minutes, this will simply update the RefreshTokenCacheState to this object {\"currentRefreshToken\": \"R2\",\"justInvalidatedRefreshToken\": \"\"}\n        // valid=true\n\n        //   - if UI.refresh_token is matching Cache.justInvalidatedRefreshToken        \n        //       then use the Cache.currentRefreshToken, generate new access token and return.\n        //       We do not modify the cache state at all.\n        // valid=true\n\n        let newRefreshToken: string | undefined;\n        if (\n            refreshTokenState &&\n            typeof refreshTokenState === 'object' &&\n            'currentRefreshToken' in refreshTokenState &&\n            'previousRefreshToken' in refreshTokenState\n        ) {\n            if (refreshTokenState.currentRefreshToken === refreshToken) {\n                // Scenario 1: Token matches currentRefreshToken\n                valid = true;\n                // Rotate tokens: move current to previous, set new current (simulate generation)\n                newRefreshToken = await this.authenticationService.generateRefreshToken(user, refreshTokenState.currentRefreshToken); // Replace with real token generation logic\n\n\n                //   updated cache state\n                // await this.cacheManager.set(this.getKey(user.id), {\n                //     currentRefreshToken: newRefreshToken,\n                //     previousRefreshToken: refreshTokenState.currentRefreshToken,\n                // });\n\n                // Optionally, set a timeout to clear previousRefreshToken after X minutes\n                setTimeout(async () => {\n                    const state = (await this.cacheManager.get(this.getKey(user.id))) as any;\n                    if (state && state.currentRefreshToken === newRefreshToken) {\n                        await this.cacheManager.set(this.getKey(user.id), {\n                            currentRefreshToken: newRefreshToken,\n                            previousRefreshToken: \"\",\n                        });\n                    }\n                }, 1 * 60 * 1000); // 5 minutes\n            } else if (refreshTokenState.previousRefreshToken === refreshToken) {\n                // Scenario 2: Token matches previousRefreshToken\n                valid = true;\n                // Do not modify cache\n                // Generate new refresh token based on currentRefreshToken\n                const existingRefreshTokenState = (await this.cacheManager.get(this.getKey(user.id))) as RefreshTokenState | undefined;\n                newRefreshToken = existingRefreshTokenState?.currentRefreshToken;\n            }\n        }\n\n\n        if (!valid) {\n            throw new InvalidatedRefreshTokenError();\n        }\n\n        // TODO: return the refresh token either currentRefreshToken\n        return newRefreshToken; // Fallback to the provided tokenId if no new token was generated\n    }\n\n    private getKey(userId: number): string {\n        return `user-${userId}`;\n    }\n\n    getCurrentRefreshTokenState(userId: number): Promise<RefreshTokenState | undefined> {\n        return this.cacheManager.get(this.getKey(userId));\n    }\n}\n"]}
+{"version":3,"file":"refresh-token-ids-storage.service.js","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,yDAAsD;AACtD,2CAAgE;AAEhE,mCAAoC;AAEpC,qEAAiE;AACjE,uDAAmD;AAGnD,MAAa,4BAA6B,SAAQ,KAAK;CAAI;AAA3D,oEAA2D;AAO3D,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAM1C,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAgC7B,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACtC,YACmC,YAAmB,EAEjC,qBAA4C,EAC5C,cAA8B;QAHhB,iBAAY,GAAZ,YAAY,CAAO;QAEjC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;IAC/C,CAAC;IAcL,0BAA0B;QACtB,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,yBAAyB,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,MAAM,CACR,MAAc,EACd,YAAoB,EACpB,oBAA6B,EAC7B,SAAkB;QAElB,MAAM,iBAAiB,GAAsB;YACzC,mBAAmB,EAAE,YAAY;YACjC,oBAAoB,EAAE,oBAAoB,IAAI,EAAE;YAChD,GAAG,CAAC,oBAAoB;gBACpB,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACvB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAC9B,iBAAiB,EACjB,IAAI,CAAC,aAAa,EAAE,CACvB,CAAC;IACN,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAkB;QAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAWD,KAAK,CAAC,aAAa,CAAC,MAAc;QAC9B,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EACxB,YAAY,GAAG,CAAC,EAGhB,IAAI,CAAC,aAAa,EAAE,CACvB,CAAC;QAGF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QACzB,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,iBAAiB,CACnB,IAAS,EACT,YAAoB,EACpB,SAA6B,EAAE;QAE/B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAMpC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CACD,CAAC;QAEnC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QAKD,IAAI,iBAAiB,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;YACzD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CACjE,IAAI,EACJ,YAAY,EACZ,aAAa,CAChB,CAAC;YAEF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAM9B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACjE,CAAC;YAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,CAAC;QAMD,IAAI,iBAAiB,CAAC,oBAAoB,IAAI,iBAAiB,CAAC,oBAAoB,KAAK,YAAY,EAAE,CAAC;YACpG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,4BAA4B,EAAE,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC7C,CAAC;IAED,2BAA2B,CACvB,MAAc,EACd,SAAkB;QAElB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,MAAM,CAAC,MAAc,EAAE,SAAkB;QAC7C,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;IACxE,CAAC;IAIO,WAAW,CAAC,MAAc;QAC9B,OAAO,cAAc,MAAM,EAAE,CAAC;IAClC,CAAC;IAUO,oBAAoB,CAAC,SAAkB;QAC3C,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,KAAc;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAIhD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,KAAK,WAAW,CAAC;IACjC,CAAC;IAKO,aAAa;QACjB,MAAM,sBAAsB,GAAG,MAAM,CACjC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,iBAAiB,CAAC,CAC1E,CAAC;QACF,OAAO,CAAC,sBAAsB,GAAG,wBAAwB,CAAC,GAAG,IAAI,CAAC;IACtE,CAAC;IAEO,mBAAmB,CAAC,KAAc;QACtC,OAAO,CACH,CAAC,CAAC,KAAK;YACP,OAAO,KAAK,KAAK,QAAQ;YACzB,qBAAqB,IAAI,KAAK;YAC9B,sBAAsB,IAAI,KAAK,CAClC,CAAC;IACN,CAAC;IAEO,mBAAmB,CAAC,KAAwB;QAehD,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC;IACjD,CAAC;CACJ,CAAA;AAzNY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAGJ,WAAA,IAAA,eAAM,EAAC,6BAAa,CAAC,CAAA;IACrB,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8CAAqB,CAAC,CAAC,CAAA;6CACR,8CAAqB;QAC5B,gCAAc;GAL1C,6BAA6B,CAyNzC","sourcesContent":["import { CACHE_MANAGER } from '@nestjs/cache-manager';\nimport { Inject, Injectable, forwardRef } from '@nestjs/common';\nimport { Cache } from 'cache-manager';\nimport { randomUUID } from 'crypto';\nimport type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';\nimport { AuthenticationService } from './authentication.service';\nimport { SettingService } from './setting.service';\n\n// TODO: Ideally this should be in a separate file - putting this here for brevity\nexport class InvalidatedRefreshTokenError extends Error { }\n\n// How long a rotated-out refresh token stays acceptable. This window is the\n// point of keeping a previous token at all: concurrent requests from one user\n// must not break each other. core-ui's single-flight guard is module-level and\n// therefore per tab, so two tabs crossing the refresh threshold together will\n// both present the same token - the second one is served from here.\nconst PREVIOUS_TOKEN_GRACE_MS = 60 * 1000;\n\n// The cache entry must outlive the JWT it holds. If it expired first, refresh\n// would fail with ACCESS_DENIED (InvalidatedRefreshTokenError) rather than the\n// SESSION_EXPIRED that the token's own `exp` produces - the same event\n// reported two different ways.\nconst STATE_TTL_BUFFER_SECONDS = 60;\n\ntype RefreshTokenState = {\n    currentRefreshToken: string;\n    previousRefreshToken: string;\n    // Absolute epoch-ms deadline after which previousRefreshToken is refused.\n    // Stored rather than scheduled: an in-process timer is lost when the pod\n    // restarts, which used to leave the rotated-out token valid until the next\n    // rotation instead of for one minute. Optional because entries written\n    // before this field existed will not carry it.\n    previousValidUntil?: number;\n};\n\n/**\n * The bucket-identifying claims carried on a refresh token. Absent on tokens\n * issued before per-device sessions existed, and on tokens issued while\n * preventConcurrentLogins is on - which is exactly how the read path tells the\n * two schemes apart without consulting any setting.\n */\nexport type RefreshTokenClaims = {\n    deviceKey?: string;\n    epoch?: number;\n};\n\nexport type RotatedRefreshToken = {\n    refreshToken: string;\n    // The bucket the rotated token now lives in. Differs from the incoming\n    // deviceKey only when a pre-migration token was just moved into one.\n    deviceKey?: string;\n};\n\n@Injectable()\nexport class RefreshTokenIdsStorageService {\n    constructor(\n        @Inject(CACHE_MANAGER) private cacheManager: Cache,\n        @Inject(forwardRef(() => AuthenticationService))\n        private readonly authenticationService: AuthenticationService,\n        private readonly settingService: SettingService,\n    ) { }\n\n    /**\n     * The inverse of the `preventConcurrentLogins` setting, and the only place\n     * it is interpreted.\n     *\n     * That setting already promises, when off, that sessions may coexist;\n     * splitting the refresh-token keyspace per device is what finally delivers\n     * it. When it is on, its stated purpose is a single live session, so\n     * per-device keys would be meaningless and the original single slot is kept.\n     *\n     * This governs the WRITE path only. Reads always branch on the token's own\n     * claim, so toggling the setting never invalidates a live session.\n     */\n    areConcurrentLoginsAllowed(): boolean {\n        return !this.settingService.getConfigValue<SolidCoreSetting>(\"preventConcurrentLogins\");\n    }\n\n    async insert(\n        userId: number,\n        refreshToken: string,\n        previousRefreshToken?: string,\n        deviceKey?: string,\n    ): Promise<void> {\n        const refreshTokenState: RefreshTokenState = {\n            currentRefreshToken: refreshToken,\n            previousRefreshToken: previousRefreshToken ?? \"\",\n            ...(previousRefreshToken\n                ? { previousValidUntil: Date.now() + PREVIOUS_TOKEN_GRACE_MS }\n                : {}),\n        };\n        await this.cacheManager.set(\n            this.getKey(userId, deviceKey),\n            refreshTokenState,\n            this.getStateTtlMs(),\n        );\n    }\n\n    async invalidate(userId: number, deviceKey?: string): Promise<void> {\n        await this.cacheManager.del(this.getKey(userId, deviceKey));\n    }\n\n    /**\n     * Bulk invalidation - \"log out everywhere\", and the right hook for password\n     * change or forced deactivation.\n     *\n     * Per-device buckets cannot be enumerated through cache-manager, so this\n     * bumps a per-user epoch that every per-device token carries as a claim.\n     * One write invalidates every outstanding token without a scan and without\n     * the read-modify-write race an index of device keys would have.\n     */\n    async invalidateAll(userId: number): Promise<void> {\n        const currentEpoch = (await this.getEpoch(userId)) ?? 0;\n        await this.cacheManager.set(\n            this.getEpochKey(userId),\n            currentEpoch + 1,\n            // Outlives every bucket that could hold a pre-bump token: those were\n            // written earlier, so they expire no later than this key does.\n            this.getStateTtlMs(),\n        );\n        // Single-slot mode and pre-migration entries live under the bare key,\n        // which carries no epoch claim - delete it directly.\n        await this.cacheManager.del(this.getKey(userId));\n    }\n\n    async getEpoch(userId: number): Promise<number | undefined> {\n        return (await this.cacheManager.get<number>(this.getEpochKey(userId))) ?? undefined;\n    }\n\n    async validateAndRotate(\n        user: any,\n        refreshToken: string,\n        claims: RefreshTokenClaims = {},\n    ): Promise<RotatedRefreshToken> {\n        const { deviceKey, epoch } = claims;\n\n        // The read key comes from the token's own claim, never from a setting.\n        // A token issued under either scheme therefore stays valid when\n        // preventConcurrentLogins is toggled - in both directions - and a\n        // pre-migration token still finds the bare key it was written to.\n        const refreshTokenState = await this.cacheManager.get(\n            this.getKey(user.id, deviceKey),\n        ) as RefreshTokenState | undefined;\n\n        if (!this.isRefreshTokenState(refreshTokenState)) {\n            throw new InvalidatedRefreshTokenError();\n        }\n\n        if (deviceKey && !(await this.isEpochCurrent(user.id, epoch))) {\n            throw new InvalidatedRefreshTokenError();\n        }\n\n        // Scenario 1: the live token. Rotate it. generateRefreshToken calls\n        // insert(), which writes the new state and stamps the grace deadline\n        // onto the token being rotated out.\n        if (refreshTokenState.currentRefreshToken === refreshToken) {\n            const nextDeviceKey = this.resolveNextDeviceKey(deviceKey);\n            const rotated = await this.authenticationService.generateRefreshToken(\n                user,\n                refreshToken,\n                nextDeviceKey,\n            );\n\n            if (nextDeviceKey !== deviceKey) {\n                // The session changed buckets - either migrating out of the\n                // pre-deploy single slot, or collapsing back into it because\n                // preventConcurrentLogins was switched on. The new state is\n                // already written; drop the key it came from so nothing is\n                // left behind.\n                await this.cacheManager.del(this.getKey(user.id, deviceKey));\n            }\n\n            return { refreshToken: rotated, deviceKey: nextDeviceKey };\n        }\n\n        // Scenario 2: the token just rotated out. This is the concurrent-request\n        // case the previous slot exists for - a second in-flight request that\n        // was issued the old token before the first one rotated it. Hand back\n        // the live token so it succeeds, provided the grace window is still open.\n        if (refreshTokenState.previousRefreshToken && refreshTokenState.previousRefreshToken === refreshToken) {\n            if (!this.isWithinGraceWindow(refreshTokenState)) {\n                throw new InvalidatedRefreshTokenError();\n            }\n            return { refreshToken: refreshTokenState.currentRefreshToken, deviceKey };\n        }\n\n        throw new InvalidatedRefreshTokenError();\n    }\n\n    getCurrentRefreshTokenState(\n        userId: number,\n        deviceKey?: string,\n    ): Promise<RefreshTokenState | undefined> {\n        return this.cacheManager.get(this.getKey(userId, deviceKey));\n    }\n\n    private getKey(userId: number, deviceKey?: string): string {\n        return deviceKey ? `user-${userId}-${deviceKey}` : `user-${userId}`;\n    }\n\n    // Deliberately not `user-${userId}-epoch`, which a device key of the\n    // literal string \"epoch\" would collide with.\n    private getEpochKey(userId: number): string {\n        return `user-epoch-${userId}`;\n    }\n\n    /**\n     * Which bucket a rotated token should land in. The setting is consulted\n     * first so that turning preventConcurrentLogins ON collapses existing\n     * per-device sessions back into the single slot on their next refresh -\n     * where normal last-login-wins applies, which is what that setting means.\n     * Leaving them in their own buckets would keep concurrent sessions alive\n     * while the setting claimed to forbid them.\n     */\n    private resolveNextDeviceKey(deviceKey?: string): string | undefined {\n        if (!this.areConcurrentLoginsAllowed()) {\n            return undefined;\n        }\n        return deviceKey ?? randomUUID();\n    }\n\n    private async isEpochCurrent(userId: number, epoch?: number): Promise<boolean> {\n        const storedEpoch = await this.getEpoch(userId);\n        // Nothing has ever been bulk-invalidated for this user - or the cache\n        // was flushed, in which case every bucket is gone and the token is\n        // already dead by the read above. Either way, accept.\n        if (storedEpoch === undefined) {\n            return true;\n        }\n        return epoch === storedEpoch;\n    }\n\n    // cache-manager v5 expects milliseconds; refreshTokenTtl is configured in\n    // seconds. Without an explicit TTL these entries never expire - neither\n    // cache path supplies a default - and the keyspace grows without bound.\n    private getStateTtlMs(): number {\n        const refreshTokenTtlSeconds = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>(\"refreshTokenTtl\"),\n        );\n        return (refreshTokenTtlSeconds + STATE_TTL_BUFFER_SECONDS) * 1000;\n    }\n\n    private isRefreshTokenState(state: unknown): state is RefreshTokenState {\n        return (\n            !!state &&\n            typeof state === 'object' &&\n            'currentRefreshToken' in state &&\n            'previousRefreshToken' in state\n        );\n    }\n\n    private isWithinGraceWindow(state: RefreshTokenState): boolean {\n        // TRANSITIONAL - safe to delete one refreshTokenTtl after this ships.\n        //\n        // Entries written before previousValidUntil existed carry no deadline\n        // to test. They are accepted so that the deploy rejects nobody: a tab\n        // that legitimately rotated moments earlier keeps working. The cost is\n        // that for such an entry the previous token stays acceptable until its\n        // own JWT `exp` rather than for 60s - which is exactly how the old code\n        // already behaved whenever its in-process timer was lost to a restart,\n        // so this is an unfixed pre-existing case, not a new one.\n        //\n        // It self-heals: the user's next rotation writes a new-format state\n        // with a deadline. Once every pre-deploy entry has rotated or expired\n        // (one refreshTokenTtl), this branch is unreachable - drop it, and the\n        // undefined case becomes a rejection.\n        if (state.previousValidUntil === undefined) {\n            return true;\n        }\n        return Date.now() < state.previousValidUntil;\n    }\n}\n"]}