@spfn/auth 0.2.0-beta.67 → 0.2.0-beta.69

package/dist/server.js

@@ -4471,7 +4471,8 @@ var init_schema3 = __esm({
     });
     PasswordSchema = Type.String({
       minLength: 8,
-      description: "User password (minimum 8 characters)"
+      maxLength: 72,
+      description: "User password (8\u201372 characters). bcrypt silently ignores bytes past 72, so longer inputs are rejected rather than truncated."
     });
     TargetTypeSchema = Type.Union([
       Type.Literal("email"),
@@ -5590,12 +5591,13 @@ var init_users_repository = __esm({
 
 // src/server/repositories/keys.repository.ts
 import { BaseRepository as BaseRepository2 } from "@spfn/core/db";
-import { eq as eq2, and as and2 } from "drizzle-orm";
-var KeysRepository, keysRepository;
+import { eq as eq2, and as and2, or, isNull, lt } from "drizzle-orm";
+var LAST_USED_THROTTLE_MS, KeysRepository, keysRepository;
 var init_keys_repository = __esm({
   "src/server/repositories/keys.repository.ts"() {
     "use strict";
     init_user_public_keys();
+    LAST_USED_THROTTLE_MS = 6e4;
     KeysRepository = class extends BaseRepository2 {
       /**
        * Key ID와 User ID로 공개키 조회
@@ -5699,13 +5701,24 @@ var init_keys_repository = __esm({
       }
       /**
        * Primary key로 마지막 사용 시간 업데이트 (authenticate용)
-       * Write primary 사용
+       * Write primary 사용.
+       *
+       * Throttled: only writes when lastUsedAt is stale (older than
+       * LAST_USED_THROTTLE_MS), so a busy key isn't UPDATEd on every request. The
+       * throttle lives in the WHERE clause — atomic, no read-then-write race. No
+       * RETURNING (callers fire-and-forget and discard the row).
        */
       async updateLastUsedById(id11) {
-        const result = await this.db.update(userPublicKeys).set({
+        const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
+        await this.db.update(userPublicKeys).set({
           lastUsedAt: /* @__PURE__ */ new Date()
-        }).where(eq2(userPublicKeys.id, id11)).returning();
-        return result[0] ?? null;
+        }).where(and2(
+          eq2(userPublicKeys.id, id11),
+          or(
+            isNull(userPublicKeys.lastUsedAt),
+            lt(userPublicKeys.lastUsedAt, staleBefore)
+          )
+        ));
       }
     };
     keysRepository = new KeysRepository();
@@ -5714,7 +5727,7 @@ var init_keys_repository = __esm({
 
 // src/server/repositories/verification-codes.repository.ts
 import { BaseRepository as BaseRepository3 } from "@spfn/core/db";
-import { eq as eq3, and as and3, lt, gt, isNull } from "drizzle-orm";
+import { eq as eq3, and as and3, lt as lt2, gt, isNull as isNull2 } from "drizzle-orm";
 var VerificationCodesRepository, verificationCodesRepository;
 var init_verification_codes_repository = __esm({
   "src/server/repositories/verification-codes.repository.ts"() {
@@ -5732,7 +5745,7 @@ var init_verification_codes_repository = __esm({
           and3(
             eq3(verificationCodes.target, target),
             eq3(verificationCodes.purpose, purpose),
-            isNull(verificationCodes.usedAt),
+            isNull2(verificationCodes.usedAt),
             gt(verificationCodes.expiresAt, now)
           )
         ).limit(1);
@@ -5787,7 +5800,7 @@ var init_verification_codes_repository = __esm({
        */
       async deleteExpired() {
         const now = /* @__PURE__ */ new Date();
-        const result = await this.db.delete(verificationCodes).where(lt(verificationCodes.expiresAt, now)).returning();
+        const result = await this.db.delete(verificationCodes).where(lt2(verificationCodes.expiresAt, now)).returning();
         return result.length;
       }
       /**
@@ -5802,7 +5815,7 @@ var init_verification_codes_repository = __esm({
           and3(
             eq3(verificationCodes.target, target),
             eq3(verificationCodes.purpose, purpose),
-            isNull(verificationCodes.usedAt)
+            isNull2(verificationCodes.usedAt)
           )
         ).returning();
         return result.length;
@@ -6048,7 +6061,7 @@ var init_role_permissions_repository = __esm({
 
 // src/server/repositories/user-permissions.repository.ts
 import { BaseRepository as BaseRepository7 } from "@spfn/core/db";
-import { eq as eq7, and as and5, or, isNull as isNull2, isNotNull, lt as lt2, gt as gt2 } from "drizzle-orm";
+import { eq as eq7, and as and5, or as or2, isNull as isNull3, isNotNull, lt as lt3, gt as gt2 } from "drizzle-orm";
 var UserPermissionsRepository, userPermissionsRepository;
 var init_user_permissions_repository = __esm({
   "src/server/repositories/user-permissions.repository.ts"() {
@@ -6070,8 +6083,8 @@ var init_user_permissions_repository = __esm({
         return this.readDb.select().from(userPermissions).where(
           and5(
             eq7(userPermissions.userId, userId),
-            or(
-              isNull2(userPermissions.expiresAt),
+            or2(
+              isNull3(userPermissions.expiresAt),
               gt2(userPermissions.expiresAt, now)
             )
           )
@@ -6133,7 +6146,7 @@ var init_user_permissions_repository = __esm({
         const result = await this.db.delete(userPermissions).where(
           and5(
             isNotNull(userPermissions.expiresAt),
-            lt2(userPermissions.expiresAt, now)
+            lt3(userPermissions.expiresAt, now)
           )
         ).returning();
         return result.length;
@@ -6278,7 +6291,7 @@ var init_user_profiles_repository = __esm({
 });
 
 // src/server/repositories/invitations.repository.ts
-import { eq as eq9, and as and6, lt as lt3, desc, sql as sql3 } from "drizzle-orm";
+import { eq as eq9, and as and6, lt as lt4, desc, sql as sql3 } from "drizzle-orm";
 import { BaseRepository as BaseRepository9 } from "@spfn/core/db";
 var InvitationsRepository, invitationsRepository;
 var init_invitations_repository = __esm({
@@ -6372,7 +6385,7 @@ var init_invitations_repository = __esm({
         }).where(
           and6(
             eq9(userInvitations.status, "pending"),
-            lt3(userInvitations.expiresAt, now)
+            lt4(userInvitations.expiresAt, now)
           )
         ).returning();
         return result.length;
@@ -6847,7 +6860,7 @@ import { defineRouter as defineRouter5 } from "@spfn/core/route";
 init_schema3();
 
 // src/server/helpers/password.ts
-import bcrypt from "bcryptjs";
+import * as bcrypt from "@node-rs/bcrypt";
 import { env } from "@spfn/auth/config";
 import { createPasswordParser } from "@spfn/core/env";
 async function hashPassword(password) {
@@ -6856,14 +6869,14 @@ async function hashPassword(password) {
   }
   return bcrypt.hash(password, env.SPFN_AUTH_BCRYPT_SALT_ROUNDS);
 }
-async function verifyPassword(password, hash) {
+async function verifyPassword(password, hash2) {
   if (!password || password.length === 0) {
     throw new Error("Password cannot be empty");
   }
-  if (!hash || hash.length === 0) {
+  if (!hash2 || hash2.length === 0) {
     throw new Error("Hash cannot be empty");
   }
-  return bcrypt.compare(password, hash);
+  return bcrypt.verify(password, hash2);
 }
 var passwordValidator = createPasswordParser({
   minLength: 8,
@@ -6902,21 +6915,37 @@ function validatePasswordStrength(password) {
 import jwt from "jsonwebtoken";
 import crypto2 from "crypto";
 import { env as env2 } from "@spfn/auth/config";
+var PUBLIC_KEY_CACHE_MAX = 1e3;
+var publicKeyCache = /* @__PURE__ */ new Map();
+function getPublicKeyObject(publicKeyB64) {
+  const cached = publicKeyCache.get(publicKeyB64);
+  if (cached) {
+    return cached;
+  }
+  const keyObject = crypto2.createPublicKey({
+    key: Buffer.from(publicKeyB64, "base64"),
+    format: "der",
+    type: "spki"
+  });
+  if (publicKeyCache.size >= PUBLIC_KEY_CACHE_MAX) {
+    const oldest = publicKeyCache.keys().next().value;
+    if (oldest !== void 0) {
+      publicKeyCache.delete(oldest);
+    }
+  }
+  publicKeyCache.set(publicKeyB64, keyObject);
+  return keyObject;
+}
 function generateToken(payload) {
   return jwt.sign(payload, env2.SPFN_AUTH_JWT_SECRET, {
     expiresIn: env2.SPFN_AUTH_JWT_EXPIRES_IN
   });
 }
 function verifyToken(token) {
-  return jwt.verify(token, env2.SPFN_AUTH_JWT_SECRET);
+  return jwt.verify(token, env2.SPFN_AUTH_JWT_SECRET, { algorithms: ["HS256"] });
 }
 function verifyClientToken(token, publicKeyB64, algorithm) {
-  const publicKeyDER = Buffer.from(publicKeyB64, "base64");
-  const publicKeyObject = crypto2.createPublicKey({
-    key: publicKeyDER,
-    format: "der",
-    type: "spki"
-  });
+  const publicKeyObject = getPublicKeyObject(publicKeyB64);
   let decoded;
   try {
     decoded = jwt.verify(token, publicKeyObject, {
@@ -7002,6 +7031,7 @@ import {
 } from "@spfn/auth/errors";
 
 // src/server/services/verification.service.ts
+import crypto4 from "crypto";
 import { env as env4 } from "@spfn/auth/config";
 import { InvalidVerificationCodeError } from "@spfn/auth/errors";
 import jwt2 from "jsonwebtoken";
@@ -7027,11 +7057,12 @@ var authLogger = {
 
 // src/server/services/verification.service.ts
 init_repositories();
+var ACCOUNT_EXISTS_NOTICE_DEDUPE_MINUTES = 60;
 var VERIFICATION_TOKEN_EXPIRY = "15m";
 var VERIFICATION_CODE_EXPIRY_MINUTES = 5;
 var MAX_VERIFICATION_ATTEMPTS = 5;
 function generateVerificationCode() {
-  return Math.floor(Math.random() * 1e6).toString().padStart(6, "0");
+  return crypto4.randomInt(0, 1e6).toString().padStart(6, "0");
 }
 async function storeVerificationCode(target, targetType, code, purpose) {
   const expiresAt = /* @__PURE__ */ new Date();
@@ -7126,8 +7157,39 @@ async function sendVerificationSMS(phone, code, purpose) {
     });
   }
 }
+async function accountExistsForTarget(target, targetType) {
+  const user = targetType === "email" ? await usersRepository.findByEmail(target) : await usersRepository.findByPhone(target);
+  return !!user;
+}
+async function sendAccountExistsNotice(target, targetType) {
+  const result = targetType === "email" ? await sendEmail({ to: target, template: "account-exists", data: {} }) : await sendSMS({ to: target, template: "account-exists", data: {} });
+  if (!result.success) {
+    const log = targetType === "email" ? authLogger.email : authLogger.sms;
+    log.error("Failed to send account-exists notice", { target, error: result.error });
+  }
+}
 async function sendVerificationCodeService(params) {
   const { target, targetType, purpose } = params;
+  if (purpose === "registration" && await accountExistsForTarget(target, targetType)) {
+    const recentNotice = await verificationCodesRepository.findValidByTargetAndPurpose(target, purpose);
+    if (!recentNotice) {
+      const dedupeExpiresAt = new Date(Date.now() + ACCOUNT_EXISTS_NOTICE_DEDUPE_MINUTES * 6e4);
+      await verificationCodesRepository.invalidatePreviousCodes(target, purpose);
+      await verificationCodesRepository.create({
+        target,
+        targetType,
+        code: generateVerificationCode(),
+        purpose,
+        expiresAt: dedupeExpiresAt,
+        attempts: 0
+      });
+      await sendAccountExistsNotice(target, targetType);
+    }
+    return {
+      success: true,
+      expiresAt: new Date(Date.now() + VERIFICATION_CODE_EXPIRY_MINUTES * 6e4).toISOString()
+    };
+  }
   const code = generateVerificationCode();
   const codeRecord = await storeVerificationCode(target, targetType, code, purpose);
   if (targetType === "email") {
@@ -7344,27 +7406,12 @@ var invitationAcceptedEvent = defineEvent(
 );
 
 // src/server/services/auth.service.ts
-async function checkAccountExistsService(params) {
-  const { email, phone } = params;
-  let identifier;
-  let identifierType;
-  let user;
-  if (email) {
-    identifier = email;
-    identifierType = "email";
-    user = await usersRepository.findByEmail(email);
-  } else if (phone) {
-    identifier = phone;
-    identifierType = "phone";
-    user = await usersRepository.findByPhone(phone);
-  } else {
-    throw new ValidationError2({ message: "Either email or phone must be provided" });
+var dummyHashPromise = null;
+function getDummyHash() {
+  if (!dummyHashPromise) {
+    dummyHashPromise = hashPassword("spfn-nonexistent-account-timing-equalizer");
   }
-  return {
-    exists: !!user,
-    identifier,
-    identifierType
-  };
+  return dummyHashPromise;
 }
 async function registerService(params) {
   const { email, phone, verificationToken, password, publicKey, keyId, fingerprint, algorithm, metadata } = params;
@@ -7431,6 +7478,7 @@ async function loginService(params) {
     throw new ValidationError2({ message: "Either email or phone must be provided" });
   }
   if (!user || !user.passwordHash) {
+    await verifyPassword(password, await getDummyHash());
     throw new InvalidCredentialsError();
   }
   const isValid = await verifyPassword(password, user.passwordHash);
@@ -7717,6 +7765,7 @@ async function syncMappings(allMappings, rolesByName, permsByName) {
 
 // src/server/services/permission.service.ts
 init_repositories();
+import { ForbiddenError } from "@spfn/core/errors";
 async function getUserPermissions(userId) {
   const userIdNum = typeof userId === "string" ? Number(userId) : Number(userId);
   const user = await usersRepository.findById(userIdNum);
@@ -7781,15 +7830,32 @@ async function hasAnyRole(userId, roleNames) {
   }
   return false;
 }
+async function assertCanAssignRole(callerUserId, targetRoleId) {
+  const callerRole = await getUserRole(callerUserId);
+  if (callerRole === "superadmin") {
+    return;
+  }
+  const targetRole = await rolesRepository.findById(targetRoleId);
+  if (targetRole?.name === "superadmin") {
+    throw new ForbiddenError({ message: "Only superadmin can assign superadmin role" });
+  }
+  if (targetRole?.name === "admin") {
+    const canPromote = await hasPermission(callerUserId, "admin:promote");
+    if (!canPromote) {
+      throw new ForbiddenError({ message: "admin:promote permission required to assign admin role" });
+    }
+  }
+}
 
 // src/server/services/index.ts
 init_role_service();
 
 // src/server/services/invitation.service.ts
 init_repositories();
-import crypto4 from "crypto";
+import crypto5 from "crypto";
+import { BadRequestError, NotFoundError as NotFoundError2, ConflictError } from "@spfn/core/errors";
 function generateInvitationToken() {
-  return crypto4.randomUUID();
+  return crypto5.randomUUID();
 }
 function calculateExpiresAt(days = 7) {
   const expiresAt = /* @__PURE__ */ new Date();
@@ -7800,23 +7866,23 @@ async function createInvitation(params) {
   const { email, roleId, invitedBy, expiresInDays = 7, expiresAt: expiresAtParam, metadata } = params;
   const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
   if (!emailRegex.test(email)) {
-    throw new Error("Invalid email format");
+    throw new BadRequestError({ message: "Invalid email format" });
   }
   const existingUser = await usersRepository.findByEmail(email);
   if (existingUser) {
-    throw new Error("User with this email already exists");
+    throw new ConflictError({ message: "User with this email already exists" });
   }
   const existingInvitation = await invitationsRepository.findPendingByEmail(email);
   if (existingInvitation) {
-    throw new Error("Pending invitation already exists for this email");
+    throw new ConflictError({ message: "Pending invitation already exists for this email" });
   }
   const role = await rolesRepository.findById(roleId);
   if (!role) {
-    throw new Error(`Role with id ${roleId} not found`);
+    throw new NotFoundError2({ message: `Role with id ${roleId} not found`, resource: "Role" });
   }
   const inviter = await usersRepository.findById(invitedBy);
   if (!inviter) {
-    throw new Error(`User with id ${invitedBy} not found`);
+    throw new NotFoundError2({ message: `User with id ${invitedBy} not found`, resource: "User" });
   }
   const token = generateInvitationToken();
   const expiresAt = expiresAtParam ?? calculateExpiresAt(expiresInDays);
@@ -7870,12 +7936,12 @@ async function acceptInvitation(params) {
   const { token, password, publicKey, keyId, fingerprint, algorithm } = params;
   const validation = await validateInvitation(token);
   if (!validation.valid || !validation.invitation) {
-    throw new Error(validation.error || "Invalid invitation");
+    throw new BadRequestError({ message: validation.error || "Invalid invitation" });
   }
   const invitation = validation.invitation;
   const role = await rolesRepository.findById(invitation.roleId);
   if (!role) {
-    throw new Error("Role not found");
+    throw new NotFoundError2({ message: "Role not found", resource: "Role" });
   }
   const passwordHash = await hashPassword(password);
   const newUser = await usersRepository.create({
@@ -7922,10 +7988,10 @@ async function listInvitations(params) {
 async function cancelInvitation(id11, cancelledBy, reason) {
   const invitation = await invitationsRepository.findById(id11);
   if (!invitation) {
-    throw new Error("Invitation not found");
+    throw new NotFoundError2({ message: "Invitation not found", resource: "Invitation" });
   }
   if (invitation.status !== "pending") {
-    throw new Error(`Cannot cancel ${invitation.status} invitation`);
+    throw new ConflictError({ message: `Cannot cancel ${invitation.status} invitation` });
   }
   await invitationsRepository.cancel(id11, cancelledBy, reason, invitation.metadata);
   console.log(`[Auth] \u26A0\uFE0F  Invitation cancelled: ${invitation.email} (reason: ${reason || "none"})`);
@@ -7944,10 +8010,10 @@ async function expireOldInvitations() {
 async function resendInvitation(id11, expiresInDays = 7) {
   const invitation = await invitationsRepository.findById(id11);
   if (!invitation) {
-    throw new Error("Invitation not found");
+    throw new NotFoundError2({ message: "Invitation not found", resource: "Invitation" });
   }
   if (!["pending", "expired"].includes(invitation.status)) {
-    throw new Error(`Cannot resend ${invitation.status} invitation`);
+    throw new ConflictError({ message: `Cannot resend ${invitation.status} invitation` });
   }
   const newExpiresAt = calculateExpiresAt(expiresInDays);
   const updated = await invitationsRepository.resend(id11, newExpiresAt);
@@ -8668,16 +8734,8 @@ async function persistNativeLogin(identity, params) {
 // src/server/routes/auth/index.ts
 init_esm();
 import { Transactional } from "@spfn/core/db";
+import { rateLimit } from "@spfn/core/middleware";
 import { defineRouter, route } from "@spfn/core/route";
-var checkAccountExists = route.post("/_auth/exists").input({
-  body: Type.Union([
-    Type.Object({ email: EmailSchema }),
-    Type.Object({ phone: PhoneSchema })
-  ])
-}).skip(["auth"]).handler(async (c) => {
-  const { body } = await c.data();
-  return await checkAccountExistsService(body);
-});
 var sendVerificationCode = route.post("/_auth/codes").input({
   body: Type.Object({
     target: Type.String({
@@ -8686,7 +8744,7 @@ var sendVerificationCode = route.post("/_auth/codes").input({
     targetType: TargetTypeSchema,
     purpose: VerificationPurposeSchema
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimit({ limit: 5, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await sendVerificationCodeService(body);
 });
@@ -8704,7 +8762,7 @@ var verifyCode = route.post("/_auth/codes/verify").input({
     }),
     purpose: VerificationPurposeSchema
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimit({ limit: 10, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await verifyCodeService(body);
 });
@@ -8756,7 +8814,7 @@ var login = route.post("/_auth/login").input({
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" }),
     oldKeyId: Type.Optional(Type.String({ description: "Previous key ID for rotation" }))
   })
-}).use([Transactional()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimit({ limit: 10, windowMs: 6e4 }), Transactional()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await loginService(body);
 });
@@ -8816,7 +8874,6 @@ var issueOneTimeToken = route.post("/_auth/tokens").handler(async (c) => {
   return await issueOneTimeTokenService(userId);
 });
 var authRouter = defineRouter({
-  checkAccountExists,
   sendVerificationCode,
   verifyCode,
   register,
@@ -8965,7 +9022,7 @@ var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
 
 // src/server/middleware/require-permission.ts
 import { defineMiddleware as defineMiddleware2 } from "@spfn/core/route";
-import { ForbiddenError } from "@spfn/core/errors";
+import { ForbiddenError as ForbiddenError2 } from "@spfn/core/errors";
 import { InsufficientPermissionsError } from "@spfn/auth/errors";
 import { getAuth as getAuth2, hasAllPermissions as hasAllPermissions2, hasAnyPermission as hasAnyPermission2, authLogger as authLogger3 } from "@spfn/auth/server";
 var requirePermissions = defineMiddleware2(
@@ -8977,7 +9034,7 @@ var requirePermissions = defineMiddleware2(
         permissions: permissionNames,
         path: c.req.path
       });
-      throw new ForbiddenError({ message: "Authentication required" });
+      throw new ForbiddenError2({ message: "Authentication required" });
     }
     const { userId } = auth;
     const allowed = await hasAllPermissions2(userId, permissionNames);
@@ -9005,7 +9062,7 @@ var requireAnyPermission = defineMiddleware2(
         permissions: permissionNames,
         path: c.req.path
       });
-      throw new ForbiddenError({ message: "Authentication required" });
+      throw new ForbiddenError2({ message: "Authentication required" });
     }
     const { userId } = auth;
     const allowed = await hasAnyPermission2(userId, permissionNames);
@@ -9028,7 +9085,7 @@ var requireAnyPermission = defineMiddleware2(
 // src/server/middleware/require-role.ts
 import { defineMiddleware as defineMiddleware3 } from "@spfn/core/route";
 import { getAuth as getAuth3, authLogger as authLogger4 } from "@spfn/auth/server";
-import { ForbiddenError as ForbiddenError2 } from "@spfn/core/errors";
+import { ForbiddenError as ForbiddenError3 } from "@spfn/core/errors";
 import { InsufficientRoleError } from "@spfn/auth/errors";
 var requireRole = defineMiddleware3(
   "role",
@@ -9039,7 +9096,7 @@ var requireRole = defineMiddleware3(
         roles: roleNames,
         path: c.req.path
       });
-      throw new ForbiddenError2({ message: "Authentication required" });
+      throw new ForbiddenError3({ message: "Authentication required" });
     }
     const { userId, role: userRole } = auth;
     if (!userRole || !roleNames.includes(userRole)) {
@@ -9063,7 +9120,7 @@ var requireRole = defineMiddleware3(
 // src/server/middleware/role-guard.ts
 import { defineMiddleware as defineMiddleware4 } from "@spfn/core/route";
 import { getAuth as getAuth4, authLogger as authLogger5 } from "@spfn/auth/server";
-import { ForbiddenError as ForbiddenError3 } from "@spfn/core/errors";
+import { ForbiddenError as ForbiddenError4 } from "@spfn/core/errors";
 import { InsufficientRoleError as InsufficientRoleError2 } from "@spfn/auth/errors";
 var roleGuard = defineMiddleware4(
   "roleGuard",
@@ -9077,7 +9134,7 @@ var roleGuard = defineMiddleware4(
       authLogger5.middleware.warn("Role guard failed: not authenticated", {
         path: c.req.path
       });
-      throw new ForbiddenError3({ message: "Authentication required" });
+      throw new ForbiddenError4({ message: "Authentication required" });
     }
     const { userId, role: userRole } = auth;
     if (deny && deny.length > 0) {
@@ -9156,6 +9213,7 @@ function extractOTTHeader(header) {
 // src/server/routes/invitations/index.ts
 init_types();
 init_esm();
+import { Transactional as Transactional2 } from "@spfn/core/db";
 import { defineRouter as defineRouter2, route as route2 } from "@spfn/core/route";
 var INVITATION_STATUSES2 = ["pending", "accepted", "expired", "cancelled"];
 var getInvitation = route2.get("/_auth/invitations/:token").input({
@@ -9203,7 +9261,7 @@ var acceptInvitation2 = route2.post("/_auth/invitations/accept").input({
     fingerprint: Type.String({ description: "Key fingerprint" }),
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" })
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([Transactional2()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await acceptInvitation({
     token: body.token,
@@ -9239,6 +9297,7 @@ var createInvitation2 = route2.post("/_auth/invitations").input({
 }).use([authenticate, requirePermissions("user:invite")]).handler(async (c) => {
   const { body } = await c.data();
   const { userId } = getAuth(c);
+  await assertCanAssignRole(userId, body.roleId);
   const invitation = await createInvitation({
     email: body.email,
     roleId: body.roleId,
@@ -9419,8 +9478,9 @@ var userRouter = defineRouter3({
 // src/server/routes/oauth/index.ts
 init_esm();
 init_types();
-import { Transactional as Transactional2 } from "@spfn/core/db";
+import { Transactional as Transactional3 } from "@spfn/core/db";
 import { ValidationError as ValidationError7 } from "@spfn/core/errors";
+import { rateLimit as rateLimit2 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter4, route as route4 } from "@spfn/core/route";
 var providerParams = Type.Object({
   provider: Type.Union(SOCIAL_PROVIDERS.map((p) => Type.Literal(p)), {
@@ -9433,7 +9493,7 @@ var oauthGoogleStart = route4.get("/_auth/oauth/google").input({
       description: "Encrypted OAuth state (returnUrl, publicKey, keyId, fingerprint, algorithm)"
     })
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { query } = await c.data();
   if (!isGoogleOAuthEnabled()) {
     return c.redirect(buildOAuthErrorUrl("Google OAuth is not configured"));
@@ -9456,7 +9516,7 @@ var oauthGoogleCallback = route4.get("/_auth/oauth/google/callback").input({
       description: "Error description from Google"
     }))
   })
-}).use([Transactional2()]).skip(["auth"]).handler(async (c) => {
+}).use([Transactional3()]).skip(["auth"]).handler(async (c) => {
   const { query } = await c.data();
   if (query.error) {
     const errorMessage = query.error_description || query.error;
@@ -9501,7 +9561,7 @@ var oauthStart = route4.post("/_auth/oauth/start").input({
       description: "Custom metadata passed to authRegisterEvent (e.g. referral code, UTM params)"
     }))
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   const result = await oauthStartService(body);
   return result;
@@ -9554,7 +9614,7 @@ var oauthProviderStart = route4.get("/_auth/oauth/:provider").input({
       description: "Encrypted OAuth state (returnUrl, publicKey, keyId, fingerprint, algorithm)"
     })
   })
-}).skip(["auth"]).handler(async (c) => {
+}).use([rateLimit2({ limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params, query } = await c.data();
   const provider = getOAuthProvider(params.provider);
   if (!provider?.isEnabled()) {
@@ -9578,7 +9638,7 @@ var oauthProviderCallback = route4.get("/_auth/oauth/:provider/callback").input(
       description: "Error description from provider"
     }))
   })
-}).use([Transactional2()]).skip(["auth"]).handler(async (c) => {
+}).use([Transactional3()]).skip(["auth"]).handler(async (c) => {
   const { params, query } = await c.data();
   if (query.error) {
     const errorMessage = query.error_description || query.error;
@@ -9657,9 +9717,8 @@ var oauthRouter = defineRouter4({
 });
 
 // src/server/routes/admin/index.ts
-init_repositories();
 init_esm();
-import { ForbiddenError as ForbiddenError4 } from "@spfn/core/errors";
+import { ForbiddenError as ForbiddenError5 } from "@spfn/core/errors";
 import { route as route5 } from "@spfn/core/route";
 var listRoles = route5.get("/_auth/admin/roles").input({
   query: Type.Object({
@@ -9728,26 +9787,14 @@ var updateUserRole = route5.patch("/_auth/admin/users/:userId/role").input({
 }).use([authenticate, requireRole("admin", "superadmin")]).handler(async (c) => {
   const { params, body } = await c.data();
   const auth = getAuth(c);
-  const callerRole = await getUserRole(auth.userId);
   if (params.userId === Number(auth.userId)) {
-    throw new ForbiddenError4({ message: "Cannot change your own role" });
+    throw new ForbiddenError5({ message: "Cannot change your own role" });
   }
   const targetRole = await getUserRole(params.userId);
   if (targetRole === "superadmin") {
-    throw new ForbiddenError4({ message: "Cannot modify superadmin role" });
-  }
-  if (callerRole !== "superadmin") {
-    const newRole = await rolesRepository.findById(body.roleId);
-    if (newRole?.name === "superadmin") {
-      throw new ForbiddenError4({ message: "Only superadmin can assign superadmin role" });
-    }
-    if (newRole?.name === "admin") {
-      const canPromote = await hasPermission(auth.userId, "admin:promote");
-      if (!canPromote) {
-        throw new ForbiddenError4({ message: "admin:promote permission required to assign admin role" });
-      }
-    }
+    throw new ForbiddenError5({ message: "Cannot modify superadmin role" });
   }
+  await assertCanAssignRole(auth.userId, body.roleId);
   await updateUserService(params.userId, { roleId: body.roleId });
   return { userId: params.userId, roleId: body.roleId };
 });
@@ -9755,7 +9802,6 @@ var updateUserRole = route5.patch("/_auth/admin/users/:userId/role").input({
 // src/server/routes/index.ts
 var mainAuthRouter = defineRouter5({
   // Auth routes
-  checkAccountExists,
   sendVerificationCode,
   verifyCode,
   register,
@@ -9806,11 +9852,11 @@ init_types();
 init_schema3();
 
 // src/server/lib/crypto.ts
-import crypto5 from "crypto";
+import crypto6 from "crypto";
 import jwt3 from "jsonwebtoken";
 function generateKeyPairES256() {
-  const keyId = crypto5.randomUUID();
-  const { privateKey, publicKey } = crypto5.generateKeyPairSync("ec", {
+  const keyId = crypto6.randomUUID();
+  const { privateKey, publicKey } = crypto6.generateKeyPairSync("ec", {
     namedCurve: "P-256",
     // ES256
     publicKeyEncoding: {
@@ -9824,7 +9870,7 @@ function generateKeyPairES256() {
   });
   const privateKeyB64 = privateKey.toString("base64");
   const publicKeyB64 = publicKey.toString("base64");
-  const fingerprint = crypto5.createHash("sha256").update(publicKey).digest("hex");
+  const fingerprint = crypto6.createHash("sha256").update(publicKey).digest("hex");
   return {
     privateKey: privateKeyB64,
     publicKey: publicKeyB64,
@@ -9834,8 +9880,8 @@ function generateKeyPairES256() {
   };
 }
 function generateKeyPairRS256() {
-  const keyId = crypto5.randomUUID();
-  const { privateKey, publicKey } = crypto5.generateKeyPairSync("rsa", {
+  const keyId = crypto6.randomUUID();
+  const { privateKey, publicKey } = crypto6.generateKeyPairSync("rsa", {
     modulusLength: 2048,
     publicKeyEncoding: {
       type: "spki",
@@ -9848,7 +9894,7 @@ function generateKeyPairRS256() {
   });
   const privateKeyB64 = privateKey.toString("base64");
   const publicKeyB64 = publicKey.toString("base64");
-  const fingerprint = crypto5.createHash("sha256").update(publicKey).digest("hex");
+  const fingerprint = crypto6.createHash("sha256").update(publicKey).digest("hex");
   return {
     privateKey: privateKeyB64,
     publicKey: publicKeyB64,
@@ -9863,7 +9909,7 @@ function generateKeyPair(algorithm = "ES256") {
 function generateClientToken(payload, privateKeyB64, algorithm, options) {
   try {
     const privateKeyDER = Buffer.from(privateKeyB64, "base64");
-    const privateKeyObject = crypto5.createPrivateKey({
+    const privateKeyObject = crypto6.createPrivateKey({
       key: privateKeyDER,
       format: "der",
       type: "pkcs8"
@@ -9918,8 +9964,8 @@ async function getSessionSecretKey() {
 }
 async function getSecretFingerprint() {
   const key = await getSessionSecretKey();
-  const hash = await crypto.subtle.digest("SHA-256", key.buffer);
-  const hex = Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  const hash2 = await crypto.subtle.digest("SHA-256", key.buffer);
+  const hex = Array.from(new Uint8Array(hash2)).map((b) => b.toString(16).padStart(2, "0")).join("");
   return hex.slice(0, 8);
 }
 async function sealSession(data, ttl = 60 * 60 * 24 * 7) {
@@ -10160,6 +10206,7 @@ export {
   acceptInvitation,
   addPermissionToRole,
   appleProvider,
+  assertCanAssignRole,
   authLogger,
   authLoginEvent,
   authMetadata,
@@ -10171,7 +10218,6 @@ export {
   buildOAuthErrorUrl,
   cancelInvitation,
   changePasswordService,
-  checkAccountExistsService,
   checkUsernameAvailableService,
   configureAuth,
   createAuthLifecycle,