@spfn/auth 0.2.0-beta.82 → 0.2.0-beta.84

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { j as AuthInitOptions, k as OAuthProvider, e as VerificationPurpose, i as PermissionCategory, l as AuthContext } from './authenticate-B6CbndRk.js';
-export { C as ChangePasswordParams, a3 as EmailSchema, I as IssueOneTimeTokenResult, s as LoginParams, L as LoginResult, t as LogoutParams, aa as NativeVerifyOptions, a8 as NormalizedIdentity, Z as OAuthCallbackParams, _ as OAuthCallbackResult, ab as OAuthCodeExchangeOptions, a0 as OAuthNativeParams, c as OAuthNativeResult, Y as OAuthStartParams, O as OAuthStartResult, a9 as OAuthTokens, a5 as PasswordSchema, a4 as PhoneSchema, q as RegisterParams, E as RegisterPublicKeyParams, a as RegisterResult, G as RevokeKeyParams, F as RotateKeyParams, b as RotateKeyResult, w as SendVerificationCodeParams, S as SendVerificationCodeResult, a6 as TargetTypeSchema, g as VERIFICATION_PURPOSES, f as VERIFICATION_TARGET_TYPES, a7 as VerificationPurposeSchema, V as VerificationTargetType, x as VerifyCodeParams, y as VerifyCodeResult, m as authRouter, a1 as authenticate, N as buildOAuthErrorUrl, p as changePasswordService, W as getEnabledOAuthProviders, X as getGoogleAccessToken, ad as getOAuthProvider, ae as getRegisteredProviders, Q as isOAuthProviderEnabled, H as issueOneTimeTokenService, n as loginService, o as logoutService, M as oauthCallbackService, $ as oauthNativeService, K as oauthStartService, a2 as optionalAuth, ac as registerOAuthProvider, z as registerPublicKeyService, r as registerService, T as requireEnabledProvider, D as revokeKeyService, B as rotateKeyService, u as sendVerificationCodeService, v as verifyCodeService, J as verifyOneTimeTokenService } from './authenticate-B6CbndRk.js';
+import { j as AuthInitOptions, k as OAuthProvider, e as VerificationPurpose, i as PermissionCategory, l as AuthContext } from './authenticate-ngWdlWWL.js';
+export { C as ChangePasswordParams, a5 as EmailSchema, I as IssueOneTimeTokenResult, s as LoginParams, L as LoginResult, t as LogoutParams, ac as NativeVerifyOptions, aa as NormalizedIdentity, _ as OAuthCallbackParams, $ as OAuthCallbackResult, ad as OAuthCodeExchangeOptions, a2 as OAuthNativeParams, c as OAuthNativeResult, Z as OAuthStartParams, O as OAuthStartResult, ab as OAuthTokens, a7 as PasswordSchema, a6 as PhoneSchema, q as RegisterParams, E as RegisterPublicKeyParams, a as RegisterResult, G as RevokeKeyParams, F as RotateKeyParams, b as RotateKeyResult, w as SendVerificationCodeParams, S as SendVerificationCodeResult, a8 as TargetTypeSchema, af as UnlinkNotification, ag as UnlinkNotifyRejection, ae as UnlinkNotifyRequest, a0 as UnlinkNotifyResult, g as VERIFICATION_PURPOSES, f as VERIFICATION_TARGET_TYPES, a9 as VerificationPurposeSchema, V as VerificationTargetType, x as VerifyCodeParams, y as VerifyCodeResult, m as authRouter, a3 as authenticate, N as buildOAuthErrorUrl, p as changePasswordService, W as getEnabledOAuthProviders, X as getGoogleAccessToken, ai as getOAuthProvider, aj as getRegisteredProviders, Q as isOAuthProviderEnabled, H as issueOneTimeTokenService, n as loginService, o as logoutService, M as oauthCallbackService, a1 as oauthNativeService, K as oauthStartService, Y as oauthUnlinkNotifyService, a4 as optionalAuth, ah as registerOAuthProvider, z as registerPublicKeyService, r as registerService, T as requireEnabledProvider, D as revokeKeyService, B as rotateKeyService, u as sendVerificationCodeService, v as verifyCodeService, J as verifyOneTimeTokenService } from './authenticate-ngWdlWWL.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { K as KeyAlgorithmType, c as InvitationStatus, e as SocialProvider, g as AccountDeletionRequestedBy, h as PurgeStrategy } from './types-1BMx0OX1.js';
 export { b as ACCOUNT_DELETION_REQUESTED_BY, A as ACCOUNT_DELETION_REQUEST_STATUSES, f as AccountDeletionRequestStatus, I as INVITATION_STATUSES, a as KEY_ALGORITHM, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, d as UserStatus } from './types-1BMx0OX1.js';
@@ -6434,6 +6434,29 @@ declare const authDeletionCompletedEvent: _spfn_core_event.EventDef<{
     userPublicId: string;
     purgeStrategy: "anonymize" | "hard-delete";
 }>;
+/**
+ * auth.oauth.unlinked - provider발 연동 해제 이벤트
+ *
+ * 발행 시점:
+ * - provider(카카오·네이버 등)가 unlink-notify 웹훅으로 연동 해제를 알려와
+ *   소셜 계정 연결과 저장 토큰이 삭제된 직후
+ *
+ * 연결 삭제까지는 프레임워크가 수행하고, 그 이후(계정 탈퇴로 이어갈지 등)는
+ * 앱 정책이므로 이 이벤트를 구독해 처리한다.
+ *
+ * @example
+ * ```typescript
+ * oauthUnlinkedEvent.subscribe(async (payload) => {
+ *     await requestAccountDeletionService({ userId: payload.userId, requestedBy: 'self' });
+ * });
+ * ```
+ */
+declare const oauthUnlinkedEvent: _spfn_core_event.EventDef<{
+    reason?: string | undefined;
+    userId: string;
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    providerUserId: string;
+}>;
 /**
  * Auth event payload types
  */
@@ -6444,5 +6467,6 @@ type InvitationAcceptedPayload = typeof invitationAcceptedEvent._payload;
 type AuthDeletionRequestedPayload = typeof authDeletionRequestedEvent._payload;
 type AuthDeletionCancelledPayload = typeof authDeletionCancelledEvent._payload;
 type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
+type OAuthUnlinkedPayload = typeof oauthUnlinkedEvent._payload;
 
-export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, type DecryptedOAuthToken, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, KeyAlgorithmType, type KeyPair, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewInvitation, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, encryptToken, exchangeCodeForTokens, expireOldInvitations, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, generateOAuthNonce, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getDeletionConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getKeySize, getLocale, getOneTimeTokenManager, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, kakaoProvider, keysRepository, listInvitations, matchOAuthCsrfCookies, naverProvider, oneTimeTokenAuth, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requirePermissions, requireRole, resendInvitation, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, shouldRotateKey, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyPassword, verifyToken };
+export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, type DecryptedOAuthToken, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, KeyAlgorithmType, type KeyPair, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewInvitation, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, encryptToken, exchangeCodeForTokens, expireOldInvitations, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, generateOAuthNonce, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getDeletionConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getKeySize, getLocale, getOneTimeTokenManager, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, kakaoProvider, keysRepository, listInvitations, matchOAuthCsrfCookies, naverProvider, oauthUnlinkedEvent, oneTimeTokenAuth, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requirePermissions, requireRole, resendInvitation, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, shouldRotateKey, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyPassword, verifyToken };

package/dist/server.js

@@ -6937,6 +6937,14 @@ var init_schema5 = __esm({
           examples: ["your-kakao-client-secret"]
         })
       },
+      SPFN_AUTH_KAKAO_ADMIN_KEY: {
+        ...envString({
+          description: "Kakao app admin key. Required to verify the User Unlinked webhook (Authorization: KakaoAK header).",
+          required: false,
+          sensitive: true,
+          examples: ["your-kakao-admin-key"]
+        })
+      },
       SPFN_AUTH_KAKAO_SCOPES: {
         ...envString({
           description: "Comma-separated Kakao consent scopes. Defaults to account_email.",
@@ -8398,6 +8406,16 @@ var authDeletionCompletedEvent = defineEvent(
     purgeStrategy: Type.Union([Type.Literal("anonymize"), Type.Literal("hard-delete")])
   })
 );
+var oauthUnlinkedEvent = defineEvent(
+  "auth.oauth.unlinked",
+  Type.Object({
+    userId: Type.String(),
+    provider: AuthProviderSchema,
+    providerUserId: Type.String(),
+    /** provider가 전달한 해제 경로 (kakao referrer_type 등) */
+    reason: Type.Optional(Type.String())
+  })
+);
 
 // src/server/services/account-deletion.service.ts
 var POSTGRES_UNIQUE_VIOLATION = "23505";
@@ -9521,6 +9539,14 @@ async function verifyOAuthState(encryptedState) {
 }
 
 // src/server/lib/oauth/provider.ts
+var UnlinkNotifyRejection = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.name = "UnlinkNotifyRejection";
+    this.status = status;
+  }
+};
 var registry2 = /* @__PURE__ */ new Map();
 function registerOAuthProvider(provider) {
   registry2.set(provider.id, provider);
@@ -9835,6 +9861,7 @@ registerOAuthProvider(githubProvider);
 // src/server/lib/oauth/kakao-provider.ts
 init_config();
 import { ValidationError as ValidationError7 } from "@spfn/core/errors";
+import { timingSafeEqual } from "crypto";
 var KAKAO_AUTH_URL = "https://kauth.kakao.com/oauth/authorize";
 var KAKAO_TOKEN_URL = "https://kauth.kakao.com/oauth/token";
 var KAKAO_USERINFO_URL = "https://kapi.kakao.com/v2/user/me";
@@ -9938,6 +9965,32 @@ var kakaoProvider = {
       params.set("client_secret", config2.clientSecret);
     }
     return requestKakaoTokens(params);
+  },
+  /**
+   * 카카오 연결 해제 웹훅(User Unlinked) 검증
+   *
+   * 카카오는 `Authorization: KakaoAK ${대표 어드민 키}` 헤더로 요청하므로
+   * 어드민 키 일치가 곧 발신자 검증이다. 웹훅 규격상 GET/POST 모두 가능하며
+   * 본문 필드는 app_id · user_id · referrer_type.
+   */
+  async verifyUnlinkNotification(request) {
+    const adminKey = env3.SPFN_AUTH_KAKAO_ADMIN_KEY;
+    if (!adminKey) {
+      throw new UnlinkNotifyRejection(401, "SPFN_AUTH_KAKAO_ADMIN_KEY is not configured");
+    }
+    const expected = Buffer.from(`KakaoAK ${adminKey}`);
+    const actual = Buffer.from(request.authorization ?? "");
+    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+      throw new UnlinkNotifyRejection(401, "Kakao admin key mismatch");
+    }
+    const userId = request.fields.user_id;
+    if (!userId) {
+      throw new UnlinkNotifyRejection(400, "Kakao unlink webhook is missing user_id");
+    }
+    return {
+      providerUserId: userId,
+      reason: request.fields.referrer_type
+    };
   }
 };
 registerOAuthProvider(kakaoProvider);
@@ -9945,6 +9998,7 @@ registerOAuthProvider(kakaoProvider);
 // src/server/lib/oauth/naver-provider.ts
 init_config();
 import { ValidationError as ValidationError8 } from "@spfn/core/errors";
+import { createDecipheriv, createHash as createHash3, createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var NAVER_AUTH_URL = "https://nid.naver.com/oauth2.0/authorize";
 var NAVER_TOKEN_URL = "https://nid.naver.com/oauth2.0/token";
 var NAVER_USERINFO_URL = "https://openapi.naver.com/v1/nid/me";
@@ -9983,6 +10037,25 @@ async function requestNaverTokens(params) {
     expiresIn
   };
 }
+function deriveNaverUnlinkKey(clientSecret) {
+  return createHash3("md5").update(clientSecret).digest().subarray(0, 16);
+}
+function decodeBase64Url(value) {
+  return Buffer.from(value.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+}
+function decryptNaverUniqueId(encryptUniqueId, key) {
+  try {
+    const payload = decodeBase64Url(encryptUniqueId);
+    const decipher = createDecipheriv("aes-128-cbc", key, payload.subarray(0, 16));
+    const uniqueId = Buffer.concat([
+      decipher.update(payload.subarray(16)),
+      decipher.final()
+    ]).toString("utf8");
+    return uniqueId || null;
+  } catch {
+    return null;
+  }
+}
 var naverProvider = {
   id: "naver",
   isEnabled() {
@@ -10024,8 +10097,9 @@ var naverProvider = {
     return {
       providerUserId: profile.id,
       email: typeof profile.email === "string" ? profile.email : null,
-      // Naver returns an email address but no independently verified-email claim.
-      emailVerified: false,
+      // 네이버 프로필 이메일은 네이버 계정 이메일이거나 인증 절차를 거친 연락처
+      // 이메일이다 — 존재하면 검증된 것으로 취급한다(카카오와 같은 신뢰 수준).
+      emailVerified: typeof profile.email === "string",
       name: typeof profile.name === "string" ? profile.name : typeof profile.nickname === "string" ? profile.nickname : void 0,
       avatar: typeof profile.profile_image === "string" ? profile.profile_image : void 0
     };
@@ -10038,6 +10112,46 @@ var naverProvider = {
       client_secret: config2.clientSecret,
       refresh_token: refreshToken
     }));
+  },
+  // 네이버 연결 끊기 알림 규격은 성공 응답으로 204 No Content를 요구한다.
+  unlinkNotifyAckStatus: 204,
+  /**
+   * 네이버 연결 끊기 알림 검증
+   *
+   * 파라미터: clientId · encryptUniqueId · timestamp · signature.
+   * signature = base64url( HMAC-SHA256( "clientId=..&encryptUniqueId=..&timestamp=..", key ) ),
+   * encryptUniqueId = base64url( iv(16) + AES-128-CBC-PKCS5(uniqueId, key) ),
+   * key = md5(CLIENT_SECRET)[0..16].
+   *
+   * 복호화된 uniqueId는 프로필 API(/v1/nid/me)의 id와 동일한 이용자 고유 식별자다.
+   * 네이버는 실패 요청을 재시도하지 않으므로 재전송(replay) 방어는 검증 통과 후
+   * 삭제가 멱등이라는 점에 의존한다.
+   */
+  async verifyUnlinkNotification(request) {
+    const clientId = env3.SPFN_AUTH_NAVER_CLIENT_ID;
+    const clientSecret = env3.SPFN_AUTH_NAVER_CLIENT_SECRET;
+    if (!clientId || !clientSecret) {
+      throw new UnlinkNotifyRejection(403, "Naver OAuth is not configured");
+    }
+    const { clientId: requestClientId, encryptUniqueId, timestamp: timestamp2, signature } = request.fields;
+    if (!requestClientId || !encryptUniqueId || !timestamp2 || !signature) {
+      throw new UnlinkNotifyRejection(400, "Naver unlink notification is missing required parameters");
+    }
+    if (requestClientId !== clientId) {
+      throw new UnlinkNotifyRejection(403, "Naver unlink notification clientId mismatch");
+    }
+    const key = deriveNaverUnlinkKey(clientSecret);
+    const baseString = `clientId=${requestClientId}&encryptUniqueId=${encryptUniqueId}&timestamp=${timestamp2}`;
+    const expected = createHmac("sha256", key).update(baseString).digest();
+    const actual = decodeBase64Url(signature);
+    if (expected.length !== actual.length || !timingSafeEqual2(expected, actual)) {
+      throw new UnlinkNotifyRejection(403, "Naver unlink notification signature mismatch");
+    }
+    const uniqueId = decryptNaverUniqueId(encryptUniqueId, key);
+    if (!uniqueId) {
+      throw new UnlinkNotifyRejection(400, "Naver encryptUniqueId cannot be decrypted");
+    }
+    return { providerUserId: uniqueId, reason: "NAVER_UNLINK" };
   }
 };
 registerOAuthProvider(naverProvider);
@@ -10110,6 +10224,7 @@ async function oauthCallbackService(params) {
       refreshToken: tokens.refreshToken ?? existingSocialAccount.refreshToken,
       tokenExpiresAt: tokenExpiryDate(tokens.expiresIn)
     });
+    await backfillVerifiedEmail(userId, identity);
   } else {
     const result = await createOrLinkUser(provider, identity, tokens, stateData.metadata);
     userId = result.userId;
@@ -10167,6 +10282,30 @@ async function assertActiveForOAuthSession(userId) {
   }
   throw new AccountDisabledError2({ status: user.status });
 }
+async function backfillVerifiedEmail(userId, identity) {
+  if (!identity.email || !identity.emailVerified) {
+    return;
+  }
+  const user = await usersRepository.findById(userId);
+  if (!user || user.email) {
+    return;
+  }
+  const emailOwner = await usersRepository.findByEmail(identity.email);
+  if (emailOwner && emailOwner.id !== userId) {
+    return;
+  }
+  try {
+    await usersRepository.updateById(userId, {
+      email: identity.email,
+      emailVerifiedAt: /* @__PURE__ */ new Date()
+    });
+  } catch (error) {
+    authLogger.service.warn("Verified-email backfill failed; continuing login", {
+      userId: String(userId),
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
 async function createOrLinkUser(provider, identity, tokens, metadata) {
   const existingUser = identity.email ? await usersRepository.findByEmail(identity.email) : null;
   let userId;
@@ -10265,6 +10404,25 @@ async function getGoogleAccessToken(userId) {
   });
   return tokens.access_token;
 }
+async function oauthUnlinkNotifyService(provider, notification) {
+  const oauthProvider = requireEnabledProvider(provider);
+  const ackStatus = oauthProvider.unlinkNotifyAckStatus ?? 200;
+  const account = await socialAccountsRepository.findByProviderAndProviderId(
+    provider,
+    notification.providerUserId
+  );
+  if (!account) {
+    return { ackStatus, handled: false };
+  }
+  await socialAccountsRepository.deleteById(account.id);
+  await oauthUnlinkedEvent.emit({
+    userId: String(account.userId),
+    provider,
+    providerUserId: notification.providerUserId,
+    reason: notification.reason
+  });
+  return { ackStatus, handled: true };
+}
 
 // src/server/services/oauth-native.service.ts
 init_repositories();
@@ -10293,6 +10451,7 @@ async function persistNativeLogin(identity, params) {
     let isNewUser = false;
     if (existing) {
       userId = existing.userId;
+      await backfillVerifiedEmail(userId, identity);
     } else {
       const result = await createOrLinkUser(params.provider, identity, void 0, params.metadata);
       userId = result.userId;
@@ -11558,6 +11717,56 @@ var oauthNative = route4.post("/_auth/oauth/:provider/native").input({
   const { params, body } = await c.data();
   return await oauthNativeService({ provider: params.provider, ...body });
 });
+async function collectUnlinkNotifyFields(raw) {
+  const fields = { ...raw.req.query() };
+  if (raw.req.method === "GET") {
+    return fields;
+  }
+  const contentType = raw.req.header("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    const body2 = await raw.req.json().catch(() => null);
+    for (const [key, value] of Object.entries(body2 ?? {})) {
+      if (typeof value === "string" || typeof value === "number") {
+        fields[key] = String(value);
+      }
+    }
+    return fields;
+  }
+  const body = await raw.req.parseBody().catch(() => ({}));
+  for (const [key, value] of Object.entries(body)) {
+    if (typeof value === "string") {
+      fields[key] = value;
+    }
+  }
+  return fields;
+}
+async function processUnlinkNotify(provider, raw) {
+  const oauthProvider = getOAuthProvider(provider);
+  if (!oauthProvider?.isEnabled() || !oauthProvider.verifyUnlinkNotification) {
+    return 404;
+  }
+  const request = {
+    authorization: raw.req.header("authorization") ?? null,
+    fields: await collectUnlinkNotifyFields(raw)
+  };
+  try {
+    const notification = await oauthProvider.verifyUnlinkNotification(request);
+    const result = await oauthUnlinkNotifyService(provider, notification);
+    return result.ackStatus;
+  } catch (error) {
+    return error instanceof UnlinkNotifyRejection ? error.status : 400;
+  }
+}
+var oauthUnlinkNotify = route4.post("/_auth/oauth/:provider/unlink-notify").input({ params: providerParams }).use([rateLimitPolicy4("oauth-unlink-notify", { limit: 300, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+  const { params } = await c.data();
+  const status = await processUnlinkNotify(params.provider, c.raw);
+  return status === 204 ? c.noContent() : c.json({}, status);
+});
+var oauthUnlinkNotifyGet = route4.get("/_auth/oauth/:provider/unlink-notify").input({ params: providerParams }).use([rateLimitPolicy4("oauth-unlink-notify", { limit: 300, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+  const { params } = await c.data();
+  const status = await processUnlinkNotify(params.provider, c.raw);
+  return status === 204 ? c.noContent() : c.json({}, status);
+});
 var oauthRouter = defineRouter4({
   oauthGoogleStart,
   oauthGoogleCallback,
@@ -11568,7 +11777,9 @@ var oauthRouter = defineRouter4({
   oauthProviderStart,
   oauthProviderCallback,
   getProviderOAuthUrl,
-  oauthNative
+  oauthNative,
+  oauthUnlinkNotify,
+  oauthUnlinkNotifyGet
 });
 
 // src/server/routes/admin/index.ts
@@ -11729,6 +11940,8 @@ var mainAuthRouter = defineRouter6({
   oauthProviderCallback,
   getProviderOAuthUrl,
   oauthNative,
+  oauthUnlinkNotify,
+  oauthUnlinkNotifyGet,
   // Invitation routes
   getInvitation,
   acceptInvitation: acceptInvitation2,
@@ -12130,6 +12343,7 @@ export {
   SocialAccountsRepository,
   TargetTypeSchema,
   USER_STATUSES,
+  UnlinkNotifyRejection,
   UserPermissionsRepository,
   UserProfilesRepository,
   UsersRepository,
@@ -12243,6 +12457,8 @@ export {
   oauthCallbackService,
   oauthNativeService,
   oauthStartService,
+  oauthUnlinkNotifyService,
+  oauthUnlinkedEvent,
   oneTimeTokenAuth,
   optionalAuth,
   parseDuration,