@spinajs/authn-orm 0.0.0-stage → 3.0.0

package/lib/cjs/throttle/db-throttle.js

@@ -0,0 +1,192 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbAuthnThrottle = void 0;
+const node_crypto_1 = require("node:crypto");
+const contracts_1 = require("@spinajs/authn/contracts");
+const env_1 = require("@spinajs/authn/env");
+const store_throttle_1 = require("@spinajs/authn/store-throttle");
+const configuration_1 = require("@spinajs/configuration");
+require("@spinajs/authn/register-schema");
+const di_1 = require("@spinajs/di");
+const exceptions_1 = require("@spinajs/exceptions");
+const log_1 = require("@spinajs/log");
+const util_1 = require("@spinajs/util");
+const sql_js_1 = require("../support/sql.js");
+const db_throttle_store_js_1 = require("./db-throttle-store.js");
+// The hash key without authn.audit.hashKey.secret, which checkConfiguration accepts in development and test only.
+let processKey;
+/**
+ * Backoff per key, never a lock (A05, A06, H31), in `authn_throttle`, shared by every app instance. The rows, their
+ * compare-and-set claims and the purge are a `DbThrottleStore`.
+ *
+ * Every time decision compares in SQL against values computed in Node (`ctx.now`, or the clock in `succeed`),
+ * never SQL `now()`, and never against a datetime read back (lane note D10).
+ *
+ * Tested on sqlite and postgres. On MySQL and MSSQL the migration's `datetime` keeps whole seconds (MySQL) or
+ * about 3 ms (MSSQL): undo may then miss, which keeps the extra count (more throttling), and a `baseDelayMs`
+ * below one second is not supported there.
+ *
+ * `last_attempt_at` takes the caller's now, not the later of the two: with clocks skewed across instances, an
+ * account-ip row can outlive the ip run it counted in by that skew, and a later success subtracts it from the new run.
+ *
+ * The hash key check (`checkConfiguration`) runs when AuthnService resolves. A process that resolves this throttle
+ * without it (a worker, a CLI command) keys rows with a random key of the process when the key is unset.
+ */
+let DbAuthnThrottle = class DbAuthnThrottle extends store_throttle_1.StoreAuthnThrottle {
+    /**
+     * DI passes nothing: `authn.throttle` and `authn.audit.hashKey.secret` come from the configuration of the resolving
+     * container on first use (`init`). With `params` nothing is read from the configuration: the hash key is
+     * `options.hashKey`. The rows live on the connection of the `AuthnThrottle` model.
+     */
+    constructor(params, options = {}) {
+        super();
+        this.options = options;
+        if (params)
+            (0, env_1.checkThrottleParams)(params);
+        this.fromConfiguration = params === undefined;
+        this.fixedParams = params;
+        if (!this.fromConfiguration) {
+            this.loadedParams = this.fixedParams;
+            this.hmacKey = hashKeyOf(this.options.hashKey);
+        }
+    }
+    get params() {
+        if (!this.loadedParams)
+            throw new exceptions_1.InvalidOption('DbAuthnThrottle: params are read from the configuration; await init() first');
+        return this.loadedParams;
+    }
+    get throttleName() {
+        return 'DbAuthnThrottle';
+    }
+    /**
+     * The authn service calls it at boot with its Configuration. Without the hash key this throttle uses (`options.hashKey`
+     * or the `authn.audit.hashKey.secret` it reads) the rows are keyed with a random key of this process, which only a
+     * development or test env of the booting configuration accepts.
+     */
+    async checkConfiguration(booting) {
+        // A @Config read needs the container's Configuration resolved.
+        if (this.fromConfiguration)
+            await this.configurationContainer().resolve(configuration_1.Configuration);
+        if ((0, util_1.isNonEmptyString)(this.hashSecret()))
+            return;
+        const env = (0, env_1.authnAppEnv)(booting);
+        if (!(0, env_1.isLenientAuthnEnv)(env)) {
+            throw new exceptions_1.InvalidOption(`DbAuthnThrottle: authn.audit.hashKey.secret is not set; outside development and test (env ${JSON.stringify(env ?? 'unset')}) the throttle rows must be keyed with a secret of the app`);
+        }
+    }
+    /** Resolves the configuration; the first `attempt`, `peek` or `succeed` and every `purge` call it. */
+    async init() {
+        this.loading ??= this.load().catch((err) => {
+            this.loading = undefined;
+            throw err;
+        });
+        await this.loading;
+    }
+    /** The row key: base64url(HMAC-SHA256(hash key, `flow|kind|value`)); logins and addresses are personal data (SR-19). */
+    rowKey(flow, key) {
+        checkKey(key);
+        if (!this.hmacKey)
+            throw new exceptions_1.InvalidOption('DbAuthnThrottle: the hash key is read from the configuration; await init() first');
+        return (0, node_crypto_1.createHmac)('sha256', this.hmacKey)
+            .update(`${flow}|${String(key.kind)}|${key.value}`, 'utf8')
+            .digest('base64url');
+    }
+    /** Deletes up to one batch of stale rows (idle for resetAfterSeconds and delaying nobody); returns how many went. */
+    async purge(now = new Date()) {
+        const nowMs = (0, sql_js_1.checkedMs)(now, 'DbAuthnThrottle.purge: now');
+        return (await this.dbStore()).purge(nowMs);
+    }
+    store() {
+        return this.dbStore();
+    }
+    keyId(flow, key) {
+        return this.rowKey(flow, key);
+    }
+    // The Throttle checks only the keys a flow uses; here a bad key fails attempt and succeed even when the flow ignores its kind, and in a reset.
+    checkKeys(keys) {
+        for (const key of keys)
+            checkKey(key);
+    }
+    // checkedMs also bounds the date to what the datetime columns hold.
+    nowMs(ctx, method) {
+        return (0, sql_js_1.checkedMs)(ctx?.now, `DbAuthnThrottle.${method}: ctx.now`);
+    }
+    /** Protected seam: override to wrap or replace the store (tests use it to interleave or fail statements). */
+    createStore(options) {
+        return new db_throttle_store_js_1.DbThrottleStore(options);
+    }
+    async dbStore() {
+        await this.init();
+        this.rows ??= this.createStore({ resetAfterMs: this.params.resetAfterSeconds * 1000 });
+        return this.rows;
+    }
+    // Read once and frozen: Configuration hands out live objects, and the rows assume fixed limits.
+    snapshotConfigured() {
+        if (!this.ConfiguredParams)
+            throw new exceptions_1.InvalidOperation('authn.throttle is unset: AUTHN_CONFIGURATION_SCHEMA is not registered');
+        const { service: _service, maxRows: _maxRows, memory: _memory, ...params } = structuredClone(this.ConfiguredParams);
+        (0, env_1.checkThrottleParams)(params);
+        return (0, util_1.deepFreeze)(params);
+    }
+    /** The key `init` uses: `options.hashKey` when given, else the configured one when there is a configuration. */
+    hashSecret() {
+        return this.options.hashKey !== undefined || !this.fromConfiguration ? this.options.hashKey : this.ConfiguredHashSecret;
+    }
+    configurationContainer() {
+        if (!this.Container)
+            throw new exceptions_1.InvalidOperation('DbAuthnThrottle: built without params and not by DI, so it has no configuration');
+        return this.Container;
+    }
+    async load() {
+        if (this.fromConfiguration) {
+            // A @Config read needs the container's Configuration resolved.
+            await this.configurationContainer().resolve(configuration_1.Configuration);
+            this.loadedParams = this.fixedParams ?? this.snapshotConfigured();
+            const secret = this.hashSecret();
+            this.hmacKey = hashKeyOf(secret);
+            if (!(0, util_1.isNonEmptyString)(secret)) {
+                this.Log.warnOnce('random-hash-key', 'DbAuthnThrottle: authn.audit.hashKey.secret is not set, so throttle rows are keyed with a random key of this process: their counts end with the process and are not shared with other instances');
+            }
+        }
+    }
+};
+exports.DbAuthnThrottle = DbAuthnThrottle;
+__decorate([
+    (0, configuration_1.Config)('authn.throttle'),
+    __metadata("design:type", Object)
+], DbAuthnThrottle.prototype, "ConfiguredParams", void 0);
+__decorate([
+    (0, configuration_1.Config)('authn.audit.hashKey.secret'),
+    __metadata("design:type", Object)
+], DbAuthnThrottle.prototype, "ConfiguredHashSecret", void 0);
+__decorate([
+    (0, log_1.Logger)('authn-orm'),
+    __metadata("design:type", log_1.Log)
+], DbAuthnThrottle.prototype, "Log", void 0);
+__decorate([
+    (0, di_1.Autoinject)(di_1.Container),
+    __metadata("design:type", Object)
+], DbAuthnThrottle.prototype, "Container", void 0);
+exports.DbAuthnThrottle = DbAuthnThrottle = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)(contracts_1.AuthnThrottle),
+    __metadata("design:paramtypes", [Object, Object])
+], DbAuthnThrottle);
+function checkKey(key) {
+    if (typeof key?.value !== 'string') {
+        throw new exceptions_1.InvalidArgument(`DbAuthnThrottle: the value of a ${JSON.stringify(String(key?.kind))} key must be a string`);
+    }
+}
+function hashKeyOf(secret) {
+    return (0, util_1.isNonEmptyString)(secret) ? Buffer.from(secret, 'utf8') : (processKey ??= (0, node_crypto_1.randomBytes)(32));
+}
+//# sourceMappingURL=db-throttle.js.map

package/lib/cjs/throttle/db-throttle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-throttle.js","sourceRoot":"","sources":["../../../src/throttle/db-throttle.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAsD;AAEtD,wDAAyD;AACzD,4CAAyF;AAEzF,kEAAmE;AAEnE,0DAA+D;AAC/D,0CAAwC;AACxC,oCAA8F;AAC9F,oDAAuF;AACvF,sCAA2C;AAC3C,wCAA6D;AAG7D,8CAA8C;AAC9C,iEAAyD;AAGzD,kHAAkH;AAClH,IAAI,UAA8B,CAAC;AAOnC;;;;;;;;;;;;;;;;GAgBG;AAGI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,mCAAkB;IAqBrD;;;;OAIG;IACH,YAAY,MAAuB,EAAmB,OAAO,GAAsB,EAAE;QACnF,KAAK,EAAE,CAAC;uBAD4C,OAAO;QAE3D,IAAI,MAAM;YAAE,IAAA,yBAAmB,EAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,MAAM,KAAK,SAAS,CAAC;QAC9C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;YACrC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,IAAW,MAAM;QACf,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,0BAAa,CAAC,6EAA6E,CAAC,CAAC;QAC/H,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAuB,YAAY;QACjC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAAC,OAA0B;QACxD,+DAA+D;QAC/D,IAAI,IAAI,CAAC,iBAAiB;YAAE,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,OAAO,CAAC,6BAAa,CAAC,CAAC;QACvF,IAAI,IAAA,uBAAgB,EAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAAE,OAAO;QAChD,MAAM,GAAG,GAAG,IAAA,iBAAW,EAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,IAAA,uBAAiB,EAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,0BAAa,CAAC,6FAA6F,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,4DAA4D,CAAC,CAAC;QACnN,CAAC;IACH,CAAC;IAED,sGAAsG;IAC/F,KAAK,CAAC,IAAI;QACf,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAClD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,wHAAwH;IACjH,MAAM,CAAC,IAAkB,EAAE,GAAgB;QAChD,QAAQ,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,0BAAa,CAAC,kFAAkF,CAAC,CAAC;QAC/H,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;aACtC,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC;aAC1D,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;IAED,qHAAqH;IAC9G,KAAK,CAAC,KAAK,CAAC,GAAG,GAAS,IAAI,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAES,KAAK;QACb,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAES,KAAK,CAAC,IAAkB,EAAE,GAAgB;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,+IAA+I;IAC5H,SAAS,CAAC,IAA4B;QACvD,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,oEAAoE;IACjD,KAAK,CAAC,GAAiB,EAAE,MAAc;QACxD,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,MAAM,WAAW,CAAC,CAAC;IACnE,CAAC;IAED,6GAA6G;IACnG,WAAW,CAAC,OAA+B;QACnD,OAAO,IAAI,sCAAe,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,EAAE,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,gGAAgG;IACxF,kBAAkB;QACxB,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,6BAAgB,CAAC,uEAAuE,CAAC,CAAC;QAChI,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAA8E,CAAC;QACjM,IAAA,yBAAmB,EAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,IAAA,iBAAU,EAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,gHAAgH;IACxG,UAAU;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;IAC1H,CAAC;IAEO,sBAAsB;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,6BAAgB,CAAC,iFAAiF,CAAC,CAAC;QACnI,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,OAAO,CAAC,6BAAa,CAAC,CAAC;YAC3D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,IAAA,uBAAgB,EAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,EAAC,iMAAiM,CAAC,CAAC;YACzO,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAA;;AA9IW;IADT,IAAA,sBAAM,EAAC,gBAAgB,CAAC;;yDACkB;AAGjC;IADT,IAAA,sBAAM,EAAC,4BAA4B,CAAC;;6DACqB;AAGhD;IADT,IAAA,YAAM,EAAC,WAAW,CAAC;8BACL,SAAG;4CAAC;AAGT;IADT,IAAA,eAAU,EAAC,cAAS,CAAC;;kDACU;0BAXrB,eAAe;IAF3B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,yBAAa,CAAC;;GACb,eAAe,CAgJ3B;AAED,SAAS,QAAQ,CAAC,GAAgB;IAChC,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,4BAAe,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACzH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAe;IAChC,OAAO,IAAA,uBAAgB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC"}

package/lib/cjs/throttle/index.d.ts

@@ -0,0 +1,6 @@
+export type { BackoffParams, ThrottleFlowParams, ThrottleParams } from '@spinajs/authn/contracts';
+export { DbAuthnThrottle } from './db-throttle.js';
+export type { DbThrottleOptions } from './db-throttle.js';
+export { DbThrottleStore } from './db-throttle-store.js';
+export type { DbThrottleStoreOptions } from './db-throttle-store.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/throttle/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/throttle/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC"}

package/lib/cjs/throttle/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbThrottleStore = exports.DbAuthnThrottle = void 0;
+var db_throttle_js_1 = require("./db-throttle.js");
+Object.defineProperty(exports, "DbAuthnThrottle", { enumerable: true, get: function () { return db_throttle_js_1.DbAuthnThrottle; } });
+var db_throttle_store_js_1 = require("./db-throttle-store.js");
+Object.defineProperty(exports, "DbThrottleStore", { enumerable: true, get: function () { return db_throttle_store_js_1.DbThrottleStore; } });
+//# sourceMappingURL=index.js.map

package/lib/cjs/throttle/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/throttle/index.ts"],"names":[],"mappings":";;;AACA,mDAAmD;AAA1C,iHAAA,eAAe,OAAA;AAExB,+DAAyD;AAAhD,uHAAA,eAAe,OAAA"}

package/lib/mjs/audit/db-audit-sink.d.ts

@@ -0,0 +1,11 @@
+import { AuthnEventSink } from '@spinajs/authn/contracts';
+import type { AuthnEvent } from '@spinajs/authn/contracts';
+/**
+ * One `authn_audit` row per event (SR-11). Nothing in an event makes the write fail, so a sink never fails a call
+ * whose work is already done (D4 over D1): free text longer than its column is cut, and an identity or actor that
+ * does not fit its column leaves the column null and goes whole into `data` (`identityRef`, `actorRef`).
+ */
+export declare class DbAuthnAuditSink extends AuthnEventSink {
+    publish(e: AuthnEvent): Promise<void>;
+}
+//# sourceMappingURL=db-audit-sink.d.ts.map

package/lib/mjs/audit/db-audit-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-audit-sink.d.ts","sourceRoot":"","sources":["../../../src/audit/db-audit-sink.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,0BAA0B,CAAC;AA0BtF;;;;GAIG;AACH,qBAEa,gBAAiB,SAAQ,cAAc;IACrC,OAAO,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BjD;CACF"}

package/lib/mjs/audit/db-audit-sink.js

@@ -0,0 +1,70 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { randomUUID } from 'node:crypto';
+import { AuthnEventSink } from '@spinajs/authn/contracts';
+import { Injectable, PerChildInstance } from '@spinajs/di';
+import { ormReady } from '@spinajs/orm';
+import { identityKey } from '../identity.js';
+import { AuthnAudit } from '../models/AuthnAudit.js';
+import { checkedMs, cutText, instant } from '../support/sql.js';
+import { columnValues } from '../support/values.js';
+function keyOrNull(ref) {
+    if (!ref)
+        return null;
+    try {
+        return identityKey(ref);
+    }
+    catch {
+        return null;
+    }
+}
+function json(value) {
+    try {
+        return JSON.stringify(value, (_k, v) => (typeof v === 'bigint' ? v.toString() : v));
+    }
+    catch {
+        return JSON.stringify({ unserialisable: true });
+    }
+}
+/**
+ * One `authn_audit` row per event (SR-11). Nothing in an event makes the write fail, so a sink never fails a call
+ * whose work is already done (D4 over D1): free text longer than its column is cut, and an identity or actor that
+ * does not fit its column leaves the column null and goes whole into `data` (`identityRef`, `actorRef`).
+ */
+let DbAuthnAuditSink = class DbAuthnAuditSink extends AuthnEventSink {
+    async publish(e) {
+        const identity = keyOrNull(e.identity);
+        const actor = keyOrNull(e.actor);
+        const extra = {
+            ...(e.identity && identity === null ? { identityRef: { type: e.identity.type, id: e.identity.id } } : {}),
+            ...(e.actor && actor === null ? { actorRef: { type: e.actor.type, id: e.actor.id } } : {}),
+        };
+        const data = e.data === undefined && Object.keys(extra).length === 0 ? undefined : { ...(e.data ?? {}), ...extra };
+        const at = instant(checkedMs(e.at, 'DbAuthnAuditSink.publish: e.at'));
+        await ormReady();
+        await AuthnAudit.insert(columnValues({
+            id: randomUUID(),
+            at,
+            type: cutText(e.type, 32),
+            outcome: cutText(e.outcome, 8),
+            identity,
+            actor,
+            strategy: cutText(e.strategy, 64),
+            reason: cutText(e.reason, 64),
+            ip: cutText(e.ip, 64),
+            user_agent: cutText(e.userAgent, 255),
+            session: cutText(e.session, 64),
+            data: data === undefined ? null : json(data),
+        }));
+    }
+};
+DbAuthnAuditSink = __decorate([
+    PerChildInstance(),
+    Injectable(AuthnEventSink)
+], DbAuthnAuditSink);
+export { DbAuthnAuditSink };
+//# sourceMappingURL=db-audit-sink.js.map

package/lib/mjs/audit/db-audit-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-audit-sink.js","sourceRoot":"","sources":["../../../src/audit/db-audit-sink.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,SAAS,SAAS,CAAC,GAA2C;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;GAIG;AAGI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,cAAc;IAC3C,KAAK,CAAC,OAAO,CAAC,CAAa;QAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;QACnH,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC,CAAC;QACtE,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,UAAU,CAAC,MAAM,CACrB,YAAY,CAAa;YACvB,EAAE,EAAE,UAAU,EAAE;YAChB,EAAE;YACF,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7B,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC;YACrC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/B,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7C,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AA5BY,gBAAgB;IAF5B,gBAAgB,EAAE;IAClB,UAAU,CAAC,cAAc,CAAC;GACd,gBAAgB,CA4B5B"}

package/lib/mjs/audit/index.d.ts

@@ -0,0 +1,2 @@
+export { DbAuthnAuditSink } from './db-audit-sink.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}

package/lib/mjs/audit/index.js

@@ -0,0 +1,2 @@
+export { DbAuthnAuditSink } from './db-audit-sink.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}

package/lib/mjs/identity.d.ts

@@ -0,0 +1,6 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+/** `${type}:${id}`, the form `identity` and `actor` columns hold (D1). Never truncates: too long throws. */
+export declare function identityKey(ref: IdentityRef, maxLength?: number): string;
+/** Splits at the first `:`; the id may contain more. */
+export declare function parseIdentityKey(key: string): IdentityRef;
+//# sourceMappingURL=identity.d.ts.map

package/lib/mjs/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAI5D,4GAA4G;AAC5G,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,SAAM,GAAG,MAAM,CAWrE;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAMzD"}

package/lib/mjs/identity.js

@@ -0,0 +1,23 @@
+import { InvalidArgument } from '@spinajs/exceptions';
+import { _check_arg, _is_string, _non_empty } from '@spinajs/util';
+/** `${type}:${id}`, the form `identity` and `actor` columns hold (D1). Never truncates: too long throws. */
+export function identityKey(ref, maxLength = 100) {
+    _check_arg(_is_string(_non_empty()))(ref?.type, 'identity type');
+    if (ref.type.includes(':')) {
+        throw new InvalidArgument(`identity type "${ref.type}" contains ":"`);
+    }
+    const key = `${ref.type}:${ref.id}`;
+    if (key.length > maxLength) {
+        throw new InvalidArgument(`identity key of type "${ref.type}" is ${key.length} characters long, the column holds ${maxLength}`);
+    }
+    return key;
+}
+/** Splits at the first `:`; the id may contain more. */
+export function parseIdentityKey(key) {
+    const at = key.indexOf(':');
+    if (at <= 0) {
+        throw new InvalidArgument('identity key is not of the form <type>:<id>');
+    }
+    return { type: key.slice(0, at), id: key.slice(at + 1) };
+}
+//# sourceMappingURL=identity.js.map

package/lib/mjs/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEnE,4GAA4G;AAC5G,MAAM,UAAU,WAAW,CAAC,GAAgB,EAAE,SAAS,GAAG,GAAG;IAC3D,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACjE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,kBAAkB,GAAG,CAAC,IAAI,gBAAgB,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,yBAAyB,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,sCAAsC,SAAS,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC"}

package/lib/mjs/index.d.ts

@@ -0,0 +1,10 @@
+export * from './migrations/index.js';
+export * from './models/index.js';
+export * from './identity.js';
+export * from './throttle/index.js';
+export * from './secrets/index.js';
+export * from './links/index.js';
+export * from './nonces/index.js';
+export * from './mfa/index.js';
+export * from './audit/index.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}

package/lib/mjs/index.js

@@ -0,0 +1,10 @@
+export * from './migrations/index.js';
+export * from './models/index.js';
+export * from './identity.js';
+export * from './throttle/index.js';
+export * from './secrets/index.js';
+export * from './links/index.js';
+export * from './nonces/index.js';
+export * from './mfa/index.js';
+export * from './audit/index.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}

package/lib/mjs/links/db-link-store.d.ts

@@ -0,0 +1,13 @@
+import { IdentityLinkStore } from '@spinajs/authn/contracts';
+import type { ExternalSubject, IdentityLink, IdentityRef } from '@spinajs/authn/contracts';
+/** `authn_identity`: external subjects linked to identities (A19). Values longer than their columns throw (D1). */
+export declare class DbIdentityLinkStore extends IdentityLinkStore {
+    find(provider: string, subject: string): Promise<IdentityLink | null>;
+    list(identity: IdentityRef): Promise<readonly IdentityLink[]>;
+    /** A duplicate (provider, subject) rejects with `ResourceDuplicated` (the unique index decides). */
+    link(identity: IdentityRef, external: ExternalSubject): Promise<IdentityLink>;
+    unlink(id: string): Promise<void>;
+    /** Sets `last_used_at` (default now); true when the link exists. */
+    touch(id: string, at?: Date): Promise<boolean>;
+}
+//# sourceMappingURL=db-link-store.d.ts.map

package/lib/mjs/links/db-link-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-link-store.d.ts","sourceRoot":"","sources":["../../../src/links/db-link-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAiB3F,mHAAmH;AACnH,qBAEa,mBAAoB,SAAQ,iBAAiB;IAC3C,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAOjF;IAEY,IAAI,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAKzE;IAED,oGAAoG;IACvF,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgBzF;IAEY,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7C;IAED,oEAAoE;IACvD,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAKtE;CACF"}

package/lib/mjs/links/db-link-store.js

@@ -0,0 +1,85 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { randomUUID } from 'node:crypto';
+import { IdentityLinkStore } from '@spinajs/authn/contracts';
+import { Injectable, PerChildInstance } from '@spinajs/di';
+import { InvalidArgument, ResourceDuplicated } from '@spinajs/exceptions';
+import { UniqueViolation, ormReady } from '@spinajs/orm';
+import { AuthnIdentity } from '../models/AuthnIdentity.js';
+import { checkedMs, checkedText, dateOf, instant } from '../support/sql.js';
+import { columnValues } from '../support/values.js';
+const LINK_COLUMNS = ['id', 'identity_type', 'identity_id', 'provider', 'subject', 'email', 'linked_at', 'last_used_at'];
+function identityParts(ref) {
+    const type = checkedText(ref?.type, 16, 'DbIdentityLinkStore: identity type');
+    if (type.includes(':'))
+        throw new InvalidArgument(`DbIdentityLinkStore: identity type "${type}" contains ":"`);
+    return { type, id: checkedText(ref.id, 64, 'DbIdentityLinkStore: identity id') };
+}
+/** `authn_identity`: external subjects linked to identities (A19). Values longer than their columns throw (D1). */
+let DbIdentityLinkStore = class DbIdentityLinkStore extends IdentityLinkStore {
+    async find(provider, subject) {
+        await ormReady();
+        const rows = await AuthnIdentity.query().columns(LINK_COLUMNS).where('provider', provider).where('subject', subject);
+        // MySQL and MSSQL default collations ignore case (and accents or trailing spaces): a subject differing only that
+        // way must not sign in as another account.
+        const exact = rows.find((r) => r.provider === provider && r.subject === subject);
+        return exact ? toLink(exact) : null;
+    }
+    async list(identity) {
+        const { type, id } = identityParts(identity);
+        await ormReady();
+        const rows = await AuthnIdentity.query().columns(LINK_COLUMNS).where('identity_type', type).where('identity_id', id).orderBy('linked_at');
+        return rows.filter((r) => r.identity_type === type && r.identity_id === id).map(toLink);
+    }
+    /** A duplicate (provider, subject) rejects with `ResourceDuplicated` (the unique index decides). */
+    async link(identity, external) {
+        const { type, id } = identityParts(identity);
+        const provider = checkedText(external?.provider, 128, 'DbIdentityLinkStore: provider');
+        const subject = checkedText(external.subject, 255, 'DbIdentityLinkStore: subject');
+        const email = external.email === undefined || external.email === null ? undefined : checkedText(external.email, 255, 'DbIdentityLinkStore: email', true);
+        const nowMs = checkedMs(new Date(), 'DbIdentityLinkStore.link: the clock');
+        await ormReady();
+        const linkId = randomUUID();
+        try {
+            await AuthnIdentity.insert(columnValues({ id: linkId, identity_type: type, identity_id: id, provider, subject, email: email ?? null, email_verified: external.emailVerified === true, attributes: null, linked_at: instant(nowMs), last_used_at: null }));
+        }
+        catch (err) {
+            if (err instanceof UniqueViolation)
+                throw new ResourceDuplicated(`DbIdentityLinkStore: (${provider}, subject) is already linked`, err);
+            throw err;
+        }
+        return { id: linkId, identity: { type, id }, provider, subject, ...(email !== undefined ? { email } : {}), linkedAt: new Date(nowMs) };
+    }
+    async unlink(id) {
+        await ormReady();
+        await AuthnIdentity.destroy().where('id', id);
+    }
+    /** Sets `last_used_at` (default now); true when the link exists. */
+    async touch(id, at = new Date()) {
+        const ms = checkedMs(at, 'DbIdentityLinkStore.touch: at');
+        await ormReady();
+        const { RowsAffected } = await AuthnIdentity.update({ last_used_at: instant(ms) }).where('id', id);
+        return RowsAffected === 1;
+    }
+};
+DbIdentityLinkStore = __decorate([
+    PerChildInstance(),
+    Injectable(IdentityLinkStore)
+], DbIdentityLinkStore);
+export { DbIdentityLinkStore };
+function toLink(r) {
+    return {
+        id: r.id,
+        identity: { type: r.identity_type, id: r.identity_id },
+        provider: r.provider,
+        subject: r.subject,
+        ...(r.email !== null && r.email !== undefined ? { email: r.email } : {}),
+        linkedAt: dateOf(r.linked_at),
+        ...(r.last_used_at ? { lastUsedAt: dateOf(r.last_used_at) } : {}),
+    };
+}
+//# sourceMappingURL=db-link-store.js.map

package/lib/mjs/links/db-link-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-link-store.js","sourceRoot":"","sources":["../../../src/links/db-link-store.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAEzH,SAAS,aAAa,CAAC,GAAgB;IACrC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,uCAAuC,IAAI,gBAAgB,CAAC,CAAC;IAC/G,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,kCAAkC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,mHAAmH;AAG5G,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,iBAAiB;IACjD,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAAe;QACjD,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrH,iHAAiH;QACjH,2CAA2C;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,QAAqB;QACrC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1I,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,oGAAoG;IAC7F,KAAK,CAAC,IAAI,CAAC,QAAqB,EAAE,QAAyB;QAChE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACzJ,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC3E,MAAM,QAAQ,EAAE,CAAC;QAEjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,MAAM,CAAC,YAAY,CAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3Q,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,QAAQ,8BAA8B,EAAE,GAAG,CAAC,CAAC;YACvI,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACzI,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAU;QAC5B,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,oEAAoE;IAC7D,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE;QAClD,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC1D,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AAhDY,mBAAmB;IAF/B,gBAAgB,EAAE;IAClB,UAAU,CAAC,iBAAiB,CAAC;GACjB,mBAAmB,CAgD/B;;AAED,SAAS,MAAM,CAAC,CAAgB;IAC9B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;QACtD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC"}

package/lib/mjs/links/index.d.ts

@@ -0,0 +1,2 @@
+export { DbIdentityLinkStore } from './db-link-store.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/links/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/links/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/lib/mjs/links/index.js

@@ -0,0 +1,2 @@
+export { DbIdentityLinkStore } from './db-link-store.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/links/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/links/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/lib/mjs/mfa/cipher.d.ts

@@ -0,0 +1,18 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+/** The MFA encryption key (`authn.mfa.encryptionKey.secret`) and its id, which `authn_mfa.key_id` stores. */
+export interface MfaKey {
+    /** Not enumerable, so it stays out of logs and JSON. */
+    readonly key: Buffer;
+    /** The first 16 characters of base64url(SHA-256(key)). */
+    readonly keyId: string;
+}
+/**
+ * Reads a 32-byte key given as 64 hex characters, base64 (44, or 43 unpadded) or base64url (43). Anything else
+ * throws `InvalidOption`; the message never contains the value.
+ */
+export declare function mfaKeyFrom(secret: string): MfaKey;
+/** AES-256-GCM under `key` with AAD `${identity}|${step}`; returns `v1.<iv>.<tag>.<ct>`, each part base64url. */
+export declare function encryptMfaSecret(key: MfaKey, identity: IdentityRef | string, step: string, plain: string): string;
+/** Throws `InvalidArgument` on a malformed text, another key, a changed text or another row's identity or step. */
+export declare function decryptMfaSecret(key: MfaKey, identity: IdentityRef | string, step: string, enc: string): string;
+//# sourceMappingURL=cipher.d.ts.map

package/lib/mjs/mfa/cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../../src/mfa/cipher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAY5D,6GAA6G;AAC7G,MAAM,WAAW,MAAM;IACrB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBjD;AAUD,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQjH;AAID,mHAAmH;AACnH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAmB/G"}