@starci/hfs 5.2.0 → 5.4.0

package/templates/be/auth-lite/src/modules/domain/identity/account-directory.service.spec.ts

@@ -1,46 +1,46 @@
 // Managed by starci app sync (slot be.identity.sign-in); do not edit: run "npx starci app sync --execute".
 import "reflect-metadata"
 import { Test } from "@nestjs/testing"
-import { FakeClock, mockEntityManager } from "@starci/jest-preset"
-import { CLOCK } from "@modules/platform/clock"
+import { mockEntityManager } from "@starci/jest-preset"
 import { PRIMARY_ENTITY_MANAGER } from "@modules/platform/database"
-import { authUserRow as user } from "@tests/fixtures/builders/identity.builder"
-import { AuthUserEntity } from "./persistence/entities"
-import { IdentityAccountDirectoryService, isDisabled } from "./account-directory.service"
+import { accountByIdRow } from "@tests/fixtures/builders/identity.builder"
+import { IdentityAccountDirectoryService } from "./account-directory.service"
 
-const AT = "2026-02-03T04:05:06.000Z"
+const USER_BY_ID = 'SELECT * FROM "public"."be_auth_user_by_id"($1)'
 
-const build = async (rows: ReadonlyArray<AuthUserEntity | null>) => {
-    const entityManager = mockEntityManager({ findOne: rows.map((result) => [AuthUserEntity, result] as const) })
+const build = async (rows: unknown) => {
+    const entityManager = mockEntityManager({ query: [USER_BY_ID, rows] })
     const moduleRef = await Test.createTestingModule({
-        providers: [
-            IdentityAccountDirectoryService,
-            { provide: PRIMARY_ENTITY_MANAGER, useValue: entityManager },
-            { provide: CLOCK, useValue: new FakeClock(AT) },
-        ],
+        providers: [IdentityAccountDirectoryService, { provide: PRIMARY_ENTITY_MANAGER, useValue: entityManager }],
     }).compile()
-    return moduleRef.get(IdentityAccountDirectoryService)
+    return { directory: moduleRef.get(IdentityAccountDirectoryService), entityManager }
 }
 
 describe("IdentityAccountDirectoryService.find", () => {
-    it("answers the standing of a live account, a banned one, a deleted one and a missing one", async () => {
-        const subject = await build([user("live"), user("banned"), user("ban-ended"), user("deleted"), null])
-
-        expect(await subject.find("u-1")).toEqual({ id: "u-1", email: "a@example.test", disabled: false })
-        expect((await subject.find("u-1"))?.disabled).toBe(true)
-        expect((await subject.find("u-1"))?.disabled).toBe(false)
-        expect((await subject.find("u-1"))?.disabled).toBe(true)
-        expect(await subject.find("u-2")).toBeUndefined()
+    it("answers the standing of a live account through the door", async () => {
+        const { directory, entityManager } = await build([accountByIdRow("live")])
+
+        expect(await directory.find("u-1")).toEqual({ id: "u-1", email: "a@example.test", disabled: false })
+        expect(entityManager.query).toHaveBeenCalledWith(USER_BY_ID, ["u-1"])
+    })
+
+    it("answers a disabled account as disabled, and an account without an address with none", async () => {
+        const banned = await build([accountByIdRow("disabled")])
+        const addressless = await build([accountByIdRow("addressless")])
+
+        expect((await banned.directory.find("u-1"))?.disabled).toBe(true)
+        expect(await addressless.directory.find("u-1")).toEqual({ id: "u-1", email: null, disabled: false })
+    })
+
+    it("answers undefined for an account that does not exist", async () => {
+        const { directory } = await build([])
+
+        expect(await directory.find("u-2")).toBeUndefined()
     })
-})
 
-describe("isDisabled", () => {
-    it("is true for a deleted account and for a ban that has not ended", () => {
-        const now = new Date(AT)
+    it("refuses a door answer that is not the account shape", async () => {
+        const { directory } = await build([{ id: "u-1", email: "a@example.test", disabled: "no" }])
 
-        expect(isDisabled(user("deleted"), now)).toBe(true)
-        expect(isDisabled(user("banned"), now)).toBe(true)
-        expect(isDisabled(user("ban-ended"), now)).toBe(false)
-        expect(isDisabled(user("live"), now)).toBe(false)
+        await expect(directory.find("u-1")).rejects.toMatchObject({ code: "DATABASE_RETURNING_ROW_REJECTED" })
     })
 })

package/templates/be/auth-lite/src/modules/domain/identity/account-directory.service.ts

@@ -2,27 +2,18 @@
 import { Injectable } from "@nestjs/common"
 import type { EntityManager } from "typeorm"
 import type { AccountDirectory, AccountStanding } from "@modules/integrations/passport"
-import { InjectClock } from "@modules/platform/clock"
-import type { Clock } from "@modules/platform/clock"
 import { InjectPrimaryEntityManager } from "@modules/platform/database"
-import { AuthUserEntity } from "./persistence/entities"
-
-/** True when the account is deleted or banned at this instant. */
-export const isDisabled = (user: AuthUserEntity, now: Date): boolean =>
-    user.deletedAt !== null || (user.bannedUntil !== null && user.bannedUntil > now)
+import { accountDoors } from "./persistence/account-doors.port"
 
 @Injectable()
-/** The package's account directory over auth.users: whether an account still stands, for a refresh to go on. */
+/** The package's account directory over the account doors: whether an account still stands, for a refresh to go on. */
 export class IdentityAccountDirectoryService implements AccountDirectory {
-    constructor(
-        @InjectPrimaryEntityManager() private readonly entityManager: EntityManager,
-        @InjectClock() private readonly clock: Clock,
-    ) {}
+    constructor(@InjectPrimaryEntityManager() private readonly entityManager: EntityManager) {}
 
-    /** The standing of one account, or undefined when it does not exist. */
+    /** The standing of one account (disabled is decided by the database clock), or undefined when it does not exist. */
     async find(userId: string): Promise<AccountStanding | undefined> {
-        const user = await this.entityManager.findOne(AuthUserEntity, { where: { id: userId } })
-        if (user === null) return undefined
-        return { id: user.id, email: user.email, disabled: isDisabled(user, this.clock.now()) }
+        const account = await accountDoors.userById(this.entityManager, userId)
+        if (account === undefined) return undefined
+        return { id: account.id, email: account.email, disabled: account.disabled }
     }
 }

package/templates/be/auth-lite/src/modules/domain/identity/authenticator.service.spec.ts

@@ -8,16 +8,25 @@ import type { AuthPasswords, GoogleProfile, SignInBudget } from "@modules/integr
 import { CLOCK } from "@modules/platform/clock"
 import { PRIMARY_ENTITY_MANAGER } from "@modules/platform/database"
 import { IDS } from "@modules/platform/ids"
+import { LOGGER } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
 import { IdentityError, IdentityErrorCode } from "./errors/identity.error"
 import { IDENTITY_AUTH_PASSWORDS, IDENTITY_SIGN_IN_BUDGET } from "./identity.decorators"
-import { authUserRow as user } from "@tests/fixtures/builders/identity.builder"
+import { IdentitySignInLogEvent } from "./identity-sign-in.log-events"
+import { accountByEmailRow, accountByIdRow } from "@tests/fixtures/builders/identity.builder"
 import { IdentityAuthenticatorService } from "./authenticator.service"
-import { AuthIdentityEntity, AuthUserEntity } from "./persistence/entities"
+
+/** The statements callDbFunction sends for the account doors. */
+const USER_BY_EMAIL = 'SELECT * FROM "public"."be_auth_user_by_email"($1)'
+const USER_BY_ID = 'SELECT * FROM "public"."be_auth_user_by_id"($1)'
+const USER_BY_GOOGLE = 'SELECT * FROM "public"."be_auth_user_by_google"($1)'
+const CREATE_USER = 'SELECT * FROM "public"."be_auth_create_user"($1, $2, $3, $4, $5, $6)'
+const LINK_GOOGLE = 'SELECT * FROM "public"."be_auth_link_google"($1, $2, $3, $4)'
+const TOUCH_USER = 'SELECT * FROM "public"."be_auth_touch_user"($1, $2, $3, $4)'
 
 const NEW_ID = "00000000-0000-4000-8000-000000000001"
 const AT = "2026-02-03T04:05:06.000Z"
 const NOW = new Date(AT)
-const BEFORE = new Date("2026-02-03T04:00:00.000Z")
 
 const profile = (patch: Partial<GoogleProfile> = {}): GoogleProfile => ({
     subject: "g-1",
@@ -28,11 +37,16 @@ const profile = (patch: Partial<GoogleProfile> = {}): GoogleProfile => ({
     ...patch,
 })
 
-const build = async (entityManager: MockEntityManager, matches = true) => {
+type Stubs = ReadonlyArray<readonly [string, unknown]>
+
+const build = async (answers: Stubs, matches = true) => {
+    const entityManager: MockEntityManager = answers.length === 0 ? mockEntityManager() : mockEntityManager({ query: answers })
+    fakeTransaction(entityManager)
     const passwords = mock<AuthPasswords>()
     passwords.verify.mockResolvedValue(matches)
     const budget = mock<SignInBudget>()
     budget.counted.mockImplementation(async (_kind, _address, check) => (await check()).value)
+    const logger = mock<Logger>()
     const moduleRef = await Test.createTestingModule({
         providers: [
             IdentityAuthenticatorService,
@@ -41,105 +55,155 @@ const build = async (entityManager: MockEntityManager, matches = true) => {
             { provide: IDENTITY_SIGN_IN_BUDGET, useValue: budget },
             { provide: CLOCK, useValue: new FakeClock(AT) },
             { provide: IDS, useValue: fakeIds() },
+            { provide: LOGGER, useValue: logger },
         ],
     }).compile()
-    return { subject: moduleRef.get(IdentityAuthenticatorService), passwords, budget }
+    return { subject: moduleRef.get(IdentityAuthenticatorService), entityManager, passwords, budget, logger }
 }
 
 const refusal = (code: string): unknown => expect.objectContaining({ code })
 
 describe("IdentityAuthenticatorService.verifyPassword", () => {
-    it("answers the person of a right pair, normalising the address, and records the sign-in", async () => {
-        const entityManager = mockEntityManager({ findOne: [AuthUserEntity, user()], update: [AuthUserEntity, {}] })
-        const { subject, passwords, budget } = await build(entityManager)
+    it("answers the person of a right pair, normalising the address, and records the sign-in through the door", async () => {
+        const { subject, entityManager, passwords, budget } = await build([
+            [USER_BY_EMAIL, [accountByEmailRow()]],
+            [TOUCH_USER, []],
+        ])
 
         expect(await subject.verifyPassword("  A@Example.test ", "correct horse")).toEqual({ userId: "u-1", email: "a@example.test" })
 
         expect(budget.counted).toHaveBeenCalledWith("login", "a@example.test", expect.any(Function))
         expect(passwords.verify).toHaveBeenCalledWith("correct horse", "hash")
-        expect(entityManager.update).toHaveBeenCalledWith(AuthUserEntity, { id: "u-1" }, { lastSignInAt: NOW })
+        expect(entityManager.query).toHaveBeenCalledWith(USER_BY_EMAIL, ["a@example.test"])
+        expect(entityManager.query).toHaveBeenCalledWith(TOUCH_USER, ["u-1", NOW, false, "{}"])
     })
 
     it("refuses an unknown address and a wrong password with the same code, and still spends the check on a decoy", async () => {
-        const unknown = await build(mockEntityManager({ findOne: [AuthUserEntity, null] }))
-        const wrong = await build(mockEntityManager({ findOne: [AuthUserEntity, user()] }), false)
+        const unknown = await build([[USER_BY_EMAIL, []]])
+        const wrong = await build([[USER_BY_EMAIL, [accountByEmailRow()]]], false)
 
         await expect(unknown.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.PairRefused))
         await expect(wrong.subject.verifyPassword("a@example.test", "pw")).rejects.toBeInstanceOf(IdentityError)
         expect(unknown.passwords.verify).toHaveBeenCalledWith("pw", "")
+        expect(wrong.entityManager.query).not.toHaveBeenCalledWith(TOUCH_USER, expect.anything())
     })
 
     it("compares an empty password for one bcrypt cannot read, an account without a hash against the decoy", async () => {
-        const { subject, passwords } = await build(mockEntityManager({ findOne: [AuthUserEntity, user("passwordless")] }), false)
+        const { subject, passwords } = await build([[USER_BY_EMAIL, [accountByEmailRow("passwordless")]]], false)
 
         await expect(subject.verifyPassword("a@example.test", "x".repeat(100))).rejects.toBeInstanceOf(IdentityError)
 
         expect(passwords.verify).toHaveBeenCalledWith("", "")
     })
 
-    it("refuses a banned or deleted account and an unconfirmed one after the password was right", async () => {
-        const banned = await build(mockEntityManager({ findOne: [AuthUserEntity, user("banned")] }))
-        const unconfirmed = await build(mockEntityManager({ findOne: [AuthUserEntity, user("unconfirmed")] }))
-        const addressless = await build(mockEntityManager({ findOne: [AuthUserEntity, user("addressless")] }))
+    it("refuses a disabled account and an unconfirmed one after the password was right, recording no sign-in", async () => {
+        const disabled = await build([[USER_BY_EMAIL, [accountByEmailRow("disabled")]]])
+        const unconfirmed = await build([[USER_BY_EMAIL, [accountByEmailRow("unconfirmed")]]])
 
-        await expect(banned.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.AccountDisabled))
+        await expect(disabled.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.AccountDisabled))
         await expect(unconfirmed.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.EmailNotConfirmed))
-        await expect(addressless.subject.verifyPassword("a@example.test", "pw")).rejects.toEqual(refusal(IdentityErrorCode.EmailNotConfirmed))
+        expect(disabled.entityManager.query).not.toHaveBeenCalledWith(TOUCH_USER, expect.anything())
+        expect(unconfirmed.entityManager.query).not.toHaveBeenCalledWith(TOUCH_USER, expect.anything())
     })
 })
 
 describe("IdentityAuthenticatorService.signInWithGoogle", () => {
-    it("refuses a profile without a verified address", async () => {
-        const { subject } = await build(mockEntityManager())
+    it("refuses a profile without a verified address, and calls no door", async () => {
+        const { subject, entityManager } = await build([])
 
         await expect(subject.signInWithGoogle(profile({ emailVerified: false }))).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
         await expect(subject.signInWithGoogle(profile({ email: null }))).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
+        expect(entityManager.query).not.toHaveBeenCalled()
     })
 
-    it("signs in the account a Google subject is already linked to", async () => {
-        const linked: AuthIdentityEntity = { id: "i-1", providerId: "g-1", userId: "u-1", identityData: {}, provider: "google", lastSignInAt: null, createdAt: BEFORE, updatedAt: BEFORE }
-        const entityManager = mockEntityManager({ findOne: [[AuthIdentityEntity, linked], [AuthUserEntity, user("unconfirmed")]], update: [AuthUserEntity, {}] })
-        fakeTransaction(entityManager)
-        const { subject } = await build(entityManager)
+    it("signs in the account a Google subject is already linked to, confirming its mailbox", async () => {
+        const { subject, entityManager } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: "u-1" }]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+            [USER_BY_ID, [accountByIdRow()]],
+        ])
 
         expect(await subject.signInWithGoogle(profile())).toEqual({ userId: "u-1", email: "a@example.test" })
 
-        expect(entityManager.insert).not.toHaveBeenCalled()
-        expect(entityManager.update).toHaveBeenCalledWith(AuthUserEntity, { id: "u-1" }, { lastSignInAt: NOW, emailConfirmedAt: NOW })
+        expect(entityManager.query).not.toHaveBeenCalledWith(USER_BY_EMAIL, expect.anything())
+        expect(entityManager.query).not.toHaveBeenCalledWith(CREATE_USER, expect.anything())
+        expect(entityManager.query).toHaveBeenCalledWith(TOUCH_USER, ["u-1", NOW, true, expect.stringContaining('"full_name":"A"')])
     })
 
-    it("links an existing account by its verified address and keeps its confirmation date", async () => {
-        const entityManager = mockEntityManager({ findOne: [[AuthIdentityEntity, null], [AuthUserEntity, user()]], insert: [AuthIdentityEntity, {}], update: [AuthUserEntity, {}] })
-        fakeTransaction(entityManager)
-        const { subject } = await build(entityManager)
+    it("links an existing account by its verified address", async () => {
+        const { subject, entityManager } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: null }]],
+            [USER_BY_EMAIL, [accountByEmailRow()]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+            [USER_BY_ID, [accountByIdRow()]],
+        ])
 
         expect(await subject.signInWithGoogle(profile())).toEqual({ userId: "u-1", email: "a@example.test" })
 
-        expect(entityManager.insert).toHaveBeenCalledWith(AuthIdentityEntity, expect.objectContaining({ id: NEW_ID, providerId: "g-1", userId: "u-1", provider: "google" }))
-        expect(entityManager.update).toHaveBeenCalledWith(AuthUserEntity, { id: "u-1" }, { lastSignInAt: NOW, emailConfirmedAt: BEFORE })
+        expect(entityManager.query).toHaveBeenCalledWith(USER_BY_EMAIL, ["a@example.test"])
+        expect(entityManager.query).toHaveBeenCalledWith(LINK_GOOGLE, ["u-1", "g-1", expect.stringContaining('"sub":"g-1"'), NOW])
+        expect(entityManager.query).not.toHaveBeenCalledWith(CREATE_USER, expect.anything())
     })
 
-    it("creates the account of a new person and links their Google identity", async () => {
-        const entityManager = mockEntityManager({
-            findOne: [[AuthIdentityEntity, null], [AuthUserEntity, null], [AuthUserEntity, user("created")]],
-            insert: [[AuthUserEntity, {}], [AuthIdentityEntity, {}]],
-            update: [AuthUserEntity, {}],
-        })
-        fakeTransaction(entityManager)
-        const { subject } = await build(entityManager)
+})
+
+describe("IdentityAuthenticatorService.signInWithGoogle (new accounts and refusals)", () => {
+    it("creates the account of a new person, links their Google identity and logs the id alone", async () => {
+        const { subject, entityManager, logger } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: null }]],
+            [USER_BY_EMAIL, []],
+            [CREATE_USER, [{ be_auth_create_user: NEW_ID }]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+            [USER_BY_ID, [accountByIdRow("live", NEW_ID)]],
+        ])
 
         expect(await subject.signInWithGoogle(profile())).toEqual({ userId: NEW_ID, email: "a@example.test" })
 
-        expect(entityManager.insert).toHaveBeenCalledWith(AuthUserEntity, expect.objectContaining({ id: NEW_ID, email: "a@example.test", encryptedPassword: null, emailConfirmedAt: NOW }))
+        expect(entityManager.query).toHaveBeenCalledWith(CREATE_USER, [NEW_ID, "a@example.test", null, true, expect.stringContaining('"full_name":"A"'), NOW])
+        expect(entityManager.query).toHaveBeenCalledWith(LINK_GOOGLE, [NEW_ID, "g-1", expect.stringContaining("g-1"), NOW])
+        expect(logger.info).toHaveBeenCalledWith(IdentitySignInLogEvent.AccountCreated, { userId: NEW_ID })
     })
 
-    it("refuses a disabled account and an account that cannot be read back", async () => {
-        const disabled = mockEntityManager({ findOne: [[AuthIdentityEntity, null], [AuthUserEntity, user("deleted")]], insert: [AuthIdentityEntity, {}], update: [AuthUserEntity, {}] })
-        fakeTransaction(disabled)
-        const missing = mockEntityManager({ findOne: [[AuthIdentityEntity, null], [AuthUserEntity, null]], insert: [[AuthUserEntity, {}], [AuthIdentityEntity, {}]], update: [AuthUserEntity, {}] })
-        fakeTransaction(missing)
+    it("fills only the profile keys the Google profile has", async () => {
+        const { subject, entityManager } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: "u-1" }]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+            [USER_BY_ID, [accountByIdRow()]],
+        ])
+
+        await subject.signInWithGoogle(profile({ name: null, picture: "https://img.example.test/a.png" }))
 
-        await expect((await build(disabled)).subject.signInWithGoogle(profile())).rejects.toEqual(refusal(IdentityErrorCode.AccountDisabled))
-        await expect((await build(missing)).subject.signInWithGoogle(profile())).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
+        const keys = { avatar_url: "https://img.example.test/a.png", picture: "https://img.example.test/a.png", email: "A@Example.test", email_verified: true }
+        expect(entityManager.query).toHaveBeenCalledWith(TOUCH_USER, ["u-1", NOW, true, JSON.stringify(keys)])
+    })
+
+    it("refuses when the create door answers no account", async () => {
+        const { subject, entityManager } = await build([
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: null }]],
+            [USER_BY_EMAIL, []],
+            [CREATE_USER, []],
+        ])
+
+        await expect(subject.signInWithGoogle(profile())).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
+        expect(entityManager.query).not.toHaveBeenCalledWith(LINK_GOOGLE, expect.anything())
+    })
+
+    it("refuses a disabled account and an account that cannot be read back", async () => {
+        const linked: Stubs = [
+            [USER_BY_GOOGLE, [{ be_auth_user_by_google: "u-1" }]],
+            [LINK_GOOGLE, []],
+            [TOUCH_USER, []],
+        ]
+        const disabled = await build([...linked, [USER_BY_ID, [accountByIdRow("disabled")]]])
+        const gone = await build([...linked, [USER_BY_ID, []]])
+        const addressless = await build([...linked, [USER_BY_ID, [accountByIdRow("addressless")]]])
+
+        await expect(disabled.subject.signInWithGoogle(profile())).rejects.toEqual(refusal(IdentityErrorCode.AccountDisabled))
+        await expect(gone.subject.signInWithGoogle(profile())).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
+        await expect(addressless.subject.signInWithGoogle(profile())).rejects.toEqual(refusal(PassportErrorCode.GoogleRejected))
     })
 })

package/templates/be/auth-lite/src/modules/domain/identity/authenticator.service.ts

@@ -8,15 +8,26 @@ import type { Clock } from "@modules/platform/clock"
 import { InjectPrimaryEntityManager } from "@modules/platform/database"
 import { InjectIds } from "@modules/platform/ids"
 import type { Ids } from "@modules/platform/ids"
-import { isDisabled } from "./account-directory.service"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
 import { IdentityError, IdentityErrorCode } from "./errors/identity.error"
 import { InjectAuthPasswords, InjectSignInBudget } from "./identity.decorators"
-import { AuthIdentityEntity, AuthUserEntity } from "./persistence/entities"
+import { IdentitySignInLogEvent } from "./identity-sign-in.log-events"
+import { accountDoors } from "./persistence/account-doors.port"
 
-const GOOGLE = "google"
+/** A Google profile whose email Google verified, so it has one. */
+type VerifiedProfile = GoogleProfile & { readonly email: string }
+
+/** The profile keys a Google sign-in may fill on the account; they never overwrite what the person already set. */
+const profileKeysOf = (profile: VerifiedProfile): Record<string, string | boolean> => ({
+    ...(profile.name === null ? {} : { full_name: profile.name, name: profile.name }),
+    ...(profile.picture === null ? {} : { avatar_url: profile.picture, picture: profile.picture }),
+    email: profile.email,
+    email_verified: profile.emailVerified,
+})
 
 @Injectable()
-/** The two sign-in decisions: is this email and password right, and which account does this Google profile stand for. */
+/** The two sign-in decisions over the account doors: is this email and password right, and which account does this Google profile stand for. */
 export class IdentityAuthenticatorService implements AuthAuthenticator {
     constructor(
         @InjectPrimaryEntityManager() private readonly entityManager: EntityManager,
@@ -24,72 +35,50 @@ export class IdentityAuthenticatorService implements AuthAuthenticator {
         @InjectSignInBudget() private readonly budget: SignInBudget,
         @InjectClock() private readonly clock: Clock,
         @InjectIds() private readonly ids: Ids,
+        @InjectLogger() private readonly logger: Logger,
     ) {}
 
     /** Verifies the pair. An unknown address and a wrong password answer the same refusal; only wrong passwords count against the budget. */
     async verifyPassword(email: string, password: string): Promise<AuthSubject> {
         const address = normalizeEmail(email)
-        const user = await this.budget.counted("login", address, async () => {
-            const found = await this.entityManager.findOne(AuthUserEntity, { where: { email: address, isAnonymous: false } })
-            const matches = await this.passwords.verify(isPresentablePassword(password) ? password : "", found?.encryptedPassword ?? "")
-            return { passed: found !== null && matches, value: found !== null && matches ? found : null }
+        const account = await this.budget.counted("login", address, async () => {
+            const found = await accountDoors.userByEmail(this.entityManager, address)
+            const matches = await this.passwords.verify(isPresentablePassword(password) ? password : "", found?.encrypted_password ?? "")
+            return { passed: found !== undefined && matches, value: found !== undefined && matches ? found : undefined }
         })
-        if (user === null) throw new IdentityError({ code: IdentityErrorCode.PairRefused })
-        const now = this.clock.now()
-        if (isDisabled(user, now)) throw new IdentityError({ code: IdentityErrorCode.AccountDisabled })
-        if (user.emailConfirmedAt === null || user.email === null) throw new IdentityError({ code: IdentityErrorCode.EmailNotConfirmed })
-        await this.entityManager.update(AuthUserEntity, { id: user.id }, { lastSignInAt: now })
-        return { userId: user.id, email: user.email }
+        if (account === undefined) throw new IdentityError({ code: IdentityErrorCode.PairRefused })
+        if (account.disabled) throw new IdentityError({ code: IdentityErrorCode.AccountDisabled })
+        if (account.email_confirmed_at === null) throw new IdentityError({ code: IdentityErrorCode.EmailNotConfirmed })
+        await accountDoors.touchUser(this.entityManager, account.id, this.clock.now(), false, "{}")
+        return { userId: account.id, email: account.email }
     }
 
     /** Finds the account a Google subject is linked to, else links by a verified email, else creates the account. */
     async signInWithGoogle(profile: GoogleProfile): Promise<AuthSubject> {
         if (profile.email === null || !profile.emailVerified) throw new PassportError({ code: PassportErrorCode.GoogleRejected })
         const address = normalizeEmail(profile.email)
+        const verified: VerifiedProfile = { ...profile, email: profile.email }
         const now = this.clock.now()
-        const user = await this.entityManager.transaction(async (scoped) => {
-            const linked = await scoped.findOne(AuthIdentityEntity, { where: { provider: GOOGLE, providerId: profile.subject } })
-            const known =
-                (linked === null ? null : await scoped.findOne(AuthUserEntity, { where: { id: linked.userId } })) ??
-                (await scoped.findOne(AuthUserEntity, { where: { email: address, isAnonymous: false } }))
-            const person = known ?? (await this.create(scoped, address, now))
-            if (linked === null) {
-                await scoped.insert(AuthIdentityEntity, {
-                    id: this.ids.next(),
-                    providerId: profile.subject,
-                    userId: person.id,
-                    provider: GOOGLE,
-                    identityData: { sub: profile.subject, email: address, name: profile.name, picture: profile.picture, email_verified: true },
-                    lastSignInAt: now,
-                    createdAt: now,
-                    updatedAt: now,
-                })
-            }
-            await scoped.update(AuthUserEntity, { id: person.id }, { lastSignInAt: now, emailConfirmedAt: person.emailConfirmedAt ?? now })
-            return person
+        const userId = await this.entityManager.transaction(async (scoped) => {
+            const linked = await accountDoors.userByGoogle(scoped, profile.subject)
+            const byEmail = linked === null ? await accountDoors.userByEmail(scoped, address) : undefined
+            const id = linked ?? byEmail?.id ?? (await this.createFor(scoped, address, verified, now))
+            const identityData = { sub: profile.subject, email: address, name: profile.name, picture: profile.picture, email_verified: true }
+            await accountDoors.linkGoogle(scoped, id, profile.subject, JSON.stringify(identityData), now)
+            await accountDoors.touchUser(scoped, id, now, true, JSON.stringify(profileKeysOf(verified)))
+            return id
         })
-        if (isDisabled(user, now)) throw new IdentityError({ code: IdentityErrorCode.AccountDisabled })
-        return { userId: user.id, email: address }
+        const account = await accountDoors.userById(this.entityManager, userId)
+        if (account?.email === undefined || account.email === null) throw new PassportError({ code: PassportErrorCode.GoogleRejected })
+        if (account.disabled) throw new IdentityError({ code: IdentityErrorCode.AccountDisabled })
+        return { userId: account.id, email: account.email }
     }
 
-    private async create(scoped: EntityManager, address: string, now: Date): Promise<AuthUserEntity> {
+    private async createFor(scoped: EntityManager, address: string, profile: VerifiedProfile, now: Date): Promise<string> {
         const id = this.ids.next()
-        await scoped.insert(AuthUserEntity, {
-            id,
-            aud: "authenticated",
-            role: "authenticated",
-            email: address,
-            encryptedPassword: null,
-            emailConfirmedAt: now,
-            lastSignInAt: now,
-            bannedUntil: null,
-            deletedAt: null,
-            isAnonymous: false,
-            createdAt: now,
-            updatedAt: now,
-        })
-        const created = await scoped.findOne(AuthUserEntity, { where: { id } })
-        if (created === null) throw new PassportError({ code: PassportErrorCode.GoogleRejected })
+        const created = await accountDoors.createUser(scoped, { id, email: address, hash: null, confirmed: true, meta: JSON.stringify(profileKeysOf(profile)), now })
+        if (created === undefined) throw new PassportError({ code: PassportErrorCode.GoogleRejected })
+        this.logger.info(IdentitySignInLogEvent.AccountCreated, { userId: created })
         return created
     }
 }

package/templates/be/auth-lite/src/modules/domain/identity/identity-email.log-events.ts

@@ -0,0 +1,6 @@
+// Managed by starci app sync (slot be.identity.sign-in); do not edit: run "npx starci app sync --execute".
+/** Log events owned by the email doors of sign-in. */
+export enum IdentityEmailLogEvent {
+    /** A confirmation or reset mail could not be sent; the door still answers as if it was, so an address is never confirmed or denied. */
+    MailFailed = "identity.email.mail_failed",
+}