@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/core/AttachmentLinkService.js

@@ -1,5 +1,25 @@
 import { createHash } from 'crypto';
 import * as path from 'path';
+function supportsWorkspaceAssetLinkTargetType(db) {
+    try {
+        if (db.provider === 'postgres') {
+            const row = db.prepare(`
+                SELECT 1
+                FROM information_schema.columns
+                WHERE table_schema = current_schema()
+                  AND table_name = 'workspace_asset_links'
+                  AND column_name = 'target_type'
+                LIMIT 1
+            `).get();
+            return Boolean(row);
+        }
+        const columns = db.prepare(`PRAGMA table_info(workspace_asset_links)`).all();
+        return columns.some((column) => String(column.name || '').trim() === 'target_type');
+    }
+    catch {
+        return false;
+    }
+}
 function buildAttachmentDisplayName(attachment, fallbackNameRaw) {
     const caption = typeof attachment === 'string' ? '' : String(attachment.caption || '').trim();
     if (caption)
@@ -109,27 +129,49 @@ export function syncCanonicalTaskAttachmentLinksService(deps, taskId, workspaceI
     const normalizedWorkspaceId = deps.normalizeWorkspaceId(workspaceId);
     if (!normalizedTaskId)
         return;
-    deps.db.prepare(`
-        UPDATE workspace_asset_links
-        SET deleted_at = ?, updated_at = ?
-        WHERE tenant_id = ? AND workspace_id = ? AND task_id = ? AND deleted_at IS NULL
-    `).run(new Date().toISOString(), new Date().toISOString(), deps.tenantId, normalizedWorkspaceId, normalizedTaskId);
+    const supportsTargetType = supportsWorkspaceAssetLinkTargetType(deps.db);
+    if (supportsTargetType) {
+        deps.db.prepare(`
+            UPDATE workspace_asset_links
+            SET deleted_at = ?, updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND target_type = 'task' AND task_id = ? AND deleted_at IS NULL
+        `).run(new Date().toISOString(), new Date().toISOString(), deps.tenantId, normalizedWorkspaceId, normalizedTaskId);
+    }
+    else {
+        deps.db.prepare(`
+            UPDATE workspace_asset_links
+            SET deleted_at = ?, updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND task_id = ? AND deleted_at IS NULL
+        `).run(new Date().toISOString(), new Date().toISOString(), deps.tenantId, normalizedWorkspaceId, normalizedTaskId);
+    }
     const selectAsset = deps.db.prepare(`
         SELECT asset_id, kind
         FROM workspace_assets
         WHERE tenant_id = ? AND workspace_id = ? AND storage_key = ? AND deleted_at IS NULL
         LIMIT 1
     `);
-    const upsertLink = deps.db.prepare(`
-        INSERT INTO workspace_asset_links (
-            tenant_id, workspace_id, asset_id, task_id, role, display_name, sort_order, created_at, updated_at, deleted_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
-        ON CONFLICT (tenant_id, workspace_id, asset_id, task_id, role) DO UPDATE SET
-            display_name = excluded.display_name,
-            sort_order = excluded.sort_order,
-            updated_at = excluded.updated_at,
-            deleted_at = NULL
-    `);
+    const upsertLink = supportsTargetType
+        ? deps.db.prepare(`
+            INSERT INTO workspace_asset_links (
+                tenant_id, workspace_id, asset_id, target_type, task_id, role, display_name, sort_order, created_at, updated_at, deleted_at
+            ) VALUES (?, ?, ?, 'task', ?, ?, ?, ?, ?, ?, NULL)
+            ON CONFLICT (tenant_id, workspace_id, asset_id, task_id, role) DO UPDATE SET
+                target_type = excluded.target_type,
+                display_name = excluded.display_name,
+                sort_order = excluded.sort_order,
+                updated_at = excluded.updated_at,
+                deleted_at = NULL
+        `)
+        : deps.db.prepare(`
+            INSERT INTO workspace_asset_links (
+                tenant_id, workspace_id, asset_id, task_id, role, display_name, sort_order, created_at, updated_at, deleted_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
+            ON CONFLICT (tenant_id, workspace_id, asset_id, task_id, role) DO UPDATE SET
+                display_name = excluded.display_name,
+                sort_order = excluded.sort_order,
+                updated_at = excluded.updated_at,
+                deleted_at = NULL
+        `);
     attachments.forEach((attachment, index) => {
         const storageKey = normalizeAttachmentStorageKey(typeof attachment === 'string' ? attachment : attachment.path, typeof attachment === 'string' ? null : attachment.fsPath);
         if (!storageKey)

package/dist/core/AuthIdentityService.d.ts

@@ -0,0 +1,107 @@
+import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
+import type { UserAuthProvider, UserAuthIdentity } from './types.js';
+/**
+ * Manages user_auth_identities — the canonical source for login methods.
+ * One Taskforce account can have at most one identity per provider.
+ */
+export declare class AuthIdentityService {
+    private readonly db;
+    private readonly tenantId;
+    constructor(db: DatabaseAdapter, tenantId: string);
+    private generateIdentityId;
+    /**
+     * Creates a password identity for a user. Throws if one already exists.
+     */
+    createPasswordIdentity(userId: string, password: string): string;
+    /**
+     * Upserts a password identity — creates if absent, replaces hash if present.
+     * Used by password-reset and invite-accept flows.
+     */
+    setPasswordIdentity(userId: string, password: string): string;
+    /**
+     * Verifies email + password against the identity table.
+     * Returns {userId, identityId} or null.
+     * Also checks users.is_disabled.
+     */
+    authenticatePasswordIdentity(email: string, password: string): {
+        userId: string;
+        identityId: string;
+    } | null;
+    /**
+     * Finds the user associated with a provider identity.
+     */
+    findUserByProviderIdentity(input: {
+        provider: UserAuthProvider;
+        providerSubject: string;
+    }): {
+        userId: string;
+        identityId: string;
+    } | null;
+    /**
+     * Links a social provider identity to an existing user.
+     * Throws if the user already has an identity for that provider.
+     */
+    linkProviderIdentity(input: {
+        userId: string;
+        provider: UserAuthProvider;
+        providerSubject: string;
+        providerEmail?: string | null;
+        providerEmailVerified?: boolean | null;
+        displayNameSnapshot?: string | null;
+        avatarUrlSnapshot?: string | null;
+        metadataJson?: string | null;
+    }): string;
+    listIdentitiesForUser(userId: string): UserAuthIdentity[];
+    hasAnyActiveIdentity(userId: string): boolean;
+    /**
+     * Unlinks a provider identity from a user.
+     * Rejects if it is the last active identity (would lock the user out).
+     */
+    unlinkProviderIdentity(input: {
+        userId: string;
+        provider: UserAuthProvider;
+    }): boolean;
+    /**
+     * Creates an OAuth state record in auth_oauth_states.
+     *
+     * Returns the opaque `state` token (stored in the redirect URL as `?state=`),
+     * the PKCE `codeVerifier` (sent to the provider on token exchange),
+     * the PKCE `codeChallenge` (sent to the provider on the auth redirect),
+     * and a `nonce` (needed for Apple's id_token nonce binding).
+     */
+    createOAuthState(input: {
+        provider: string;
+        flowMode: string;
+        userId?: string | null;
+        inviteToken?: string | null;
+        returnTo?: string | null;
+        createdIp?: string | null;
+    }): {
+        state: string;
+        codeVerifier: string;
+        codeChallenge: string;
+        nonce: string;
+    };
+    /**
+     * Atomically consumes an OAuth state token.
+     *
+     * Returns the state row if it exists, is unexpired, and has not been consumed.
+     * Returns null if the token is invalid, expired, or already consumed.
+     * Once consumed, the same token will return null on any subsequent call.
+     */
+    consumeOAuthState(state: string): OAuthStateRecord | null;
+}
+export interface OAuthStateRecord {
+    state: string;
+    tenantId: string;
+    provider: string;
+    flowMode: string;
+    userId: string | null;
+    inviteToken: string | null;
+    returnTo: string | null;
+    pkceVerifier: string | null;
+    nonce: string | null;
+    expiresAt: string;
+    createdAt: string;
+    createdIp: string | null;
+}

package/dist/core/AuthIdentityService.js

@@ -0,0 +1,284 @@
+import { randomBytes, createHash } from 'crypto';
+import { TaskforceRuleError } from './types.js';
+import { hashPassword, verifyPassword, generateUuidV7 } from './shared.js';
+import { validatePasswordPolicy } from '../shared/passwordPolicy.js';
+function mapRow(row) {
+    return {
+        id: row.id,
+        tenantId: row.tenant_id,
+        userId: row.user_id,
+        provider: row.provider,
+        providerSubject: row.provider_subject,
+        providerEmail: row.provider_email,
+        providerEmailVerified: row.provider_email_verified === null ? null : Boolean(row.provider_email_verified),
+        displayNameSnapshot: row.display_name_snapshot,
+        avatarUrlSnapshot: row.avatar_url_snapshot,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        lastLoginAt: row.last_login_at,
+        linkedAt: row.linked_at,
+        disabledAt: row.disabled_at,
+    };
+}
+/**
+ * Manages user_auth_identities — the canonical source for login methods.
+ * One Taskforce account can have at most one identity per provider.
+ */
+export class AuthIdentityService {
+    db;
+    tenantId;
+    constructor(db, tenantId) {
+        this.db = db;
+        this.tenantId = tenantId;
+    }
+    generateIdentityId() {
+        return `identity-${generateUuidV7()}`;
+    }
+    // ─── Password identity ─────────────────────────────────────────────────────
+    /**
+     * Creates a password identity for a user. Throws if one already exists.
+     */
+    createPasswordIdentity(userId, password) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId)
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        const validation = validatePasswordPolicy(password);
+        if (!validation.ok) {
+            throw new TaskforceRuleError(validation.message || 'Password does not meet the password policy.', 400, validation.code || 'PASSWORD_TOO_SHORT');
+        }
+        const existing = this.db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = 'password'
+            LIMIT 1
+        `).get(this.tenantId, normalizedUserId);
+        if (existing?.id) {
+            throw new TaskforceRuleError('Password identity already exists for this user', 409, 'IDENTITY_ALREADY_EXISTS');
+        }
+        const now = new Date().toISOString();
+        const identityId = this.generateIdentityId();
+        this.db.prepare(`
+            INSERT INTO user_auth_identities
+                (id, tenant_id, user_id, provider, password_hash, created_at, updated_at, linked_at)
+            VALUES (?, ?, ?, 'password', ?, ?, ?, ?)
+        `).run(identityId, this.tenantId, normalizedUserId, hashPassword(password), now, now, now);
+        return identityId;
+    }
+    /**
+     * Upserts a password identity — creates if absent, replaces hash if present.
+     * Used by password-reset and invite-accept flows.
+     */
+    setPasswordIdentity(userId, password) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId)
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        const validation = validatePasswordPolicy(password);
+        if (!validation.ok) {
+            throw new TaskforceRuleError(validation.message || 'Password does not meet the password policy.', 400, validation.code || 'PASSWORD_TOO_SHORT');
+        }
+        const now = new Date().toISOString();
+        const existing = this.db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = 'password'
+            LIMIT 1
+        `).get(this.tenantId, normalizedUserId);
+        if (existing?.id) {
+            this.db.prepare(`
+                UPDATE user_auth_identities
+                SET password_hash = ?, updated_at = ?, disabled_at = NULL
+                WHERE tenant_id = ? AND id = ?
+            `).run(hashPassword(password), now, this.tenantId, existing.id);
+            return existing.id;
+        }
+        const identityId = this.generateIdentityId();
+        this.db.prepare(`
+            INSERT INTO user_auth_identities
+                (id, tenant_id, user_id, provider, password_hash, created_at, updated_at, linked_at)
+            VALUES (?, ?, ?, 'password', ?, ?, ?, ?)
+        `).run(identityId, this.tenantId, normalizedUserId, hashPassword(password), now, now, now);
+        return identityId;
+    }
+    /**
+     * Verifies email + password against the identity table.
+     * Returns {userId, identityId} or null.
+     * Also checks users.is_disabled.
+     */
+    authenticatePasswordIdentity(email, password) {
+        const normalizedEmail = String(email || '').trim().toLowerCase();
+        if (!normalizedEmail || !password)
+            return null;
+        const user = this.db.prepare(`
+            SELECT id FROM users
+            WHERE tenant_id = ? AND email = ? AND COALESCE(is_disabled, 0) = 0
+            LIMIT 1
+        `).get(this.tenantId, normalizedEmail);
+        if (!user?.id)
+            return null;
+        const identity = this.db.prepare(`
+            SELECT id, password_hash FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = 'password' AND disabled_at IS NULL
+            LIMIT 1
+        `).get(this.tenantId, user.id);
+        if (!identity?.id || !identity.password_hash)
+            return null;
+        if (!verifyPassword(password, identity.password_hash))
+            return null;
+        // Update last_login_at
+        this.db.prepare(`
+            UPDATE user_auth_identities SET last_login_at = ? WHERE tenant_id = ? AND id = ?
+        `).run(new Date().toISOString(), this.tenantId, identity.id);
+        return { userId: user.id, identityId: identity.id };
+    }
+    // ─── Social identity ───────────────────────────────────────────────────────
+    /**
+     * Finds the user associated with a provider identity.
+     */
+    findUserByProviderIdentity(input) {
+        const row = this.db.prepare(`
+            SELECT id, user_id FROM user_auth_identities
+            WHERE tenant_id = ? AND provider = ? AND provider_subject = ? AND disabled_at IS NULL
+            LIMIT 1
+        `).get(this.tenantId, input.provider, input.providerSubject);
+        if (!row?.id || !row.user_id)
+            return null;
+        return { userId: row.user_id, identityId: row.id };
+    }
+    /**
+     * Links a social provider identity to an existing user.
+     * Throws if the user already has an identity for that provider.
+     */
+    linkProviderIdentity(input) {
+        const normalizedUserId = String(input.userId || '').trim();
+        if (!normalizedUserId)
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        if (input.provider === 'password') {
+            throw new TaskforceRuleError('Use setPasswordIdentity for password provider', 400, 'INVALID_PROVIDER');
+        }
+        const existing = this.db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = ?
+            LIMIT 1
+        `).get(this.tenantId, normalizedUserId, input.provider);
+        if (existing?.id) {
+            throw new TaskforceRuleError(`${input.provider} identity already linked to this account`, 409, 'IDENTITY_ALREADY_EXISTS');
+        }
+        const now = new Date().toISOString();
+        const identityId = this.generateIdentityId();
+        this.db.prepare(`
+            INSERT INTO user_auth_identities
+                (id, tenant_id, user_id, provider, provider_subject, provider_email,
+                 provider_email_verified, display_name_snapshot, avatar_url_snapshot,
+                 metadata_json, created_at, updated_at, linked_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(identityId, this.tenantId, normalizedUserId, input.provider, input.providerSubject, input.providerEmail ?? null, input.providerEmailVerified === null || input.providerEmailVerified === undefined
+            ? null
+            : (input.providerEmailVerified ? 1 : 0), input.displayNameSnapshot ?? null, input.avatarUrlSnapshot ?? null, input.metadataJson ?? null, now, now, now);
+        return identityId;
+    }
+    // ─── Listing and unlinking ──────────────────────────────────────────────────
+    listIdentitiesForUser(userId) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId)
+            return [];
+        const rows = this.db.prepare(`
+            SELECT * FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND disabled_at IS NULL
+            ORDER BY created_at ASC
+        `).all(this.tenantId, normalizedUserId);
+        return rows.map(mapRow);
+    }
+    hasAnyActiveIdentity(userId) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId)
+            return false;
+        const row = this.db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND disabled_at IS NULL
+            LIMIT 1
+        `).get(this.tenantId, normalizedUserId);
+        return Boolean(row?.id);
+    }
+    /**
+     * Unlinks a provider identity from a user.
+     * Rejects if it is the last active identity (would lock the user out).
+     */
+    unlinkProviderIdentity(input) {
+        const normalizedUserId = String(input.userId || '').trim();
+        if (!normalizedUserId)
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        const identities = this.listIdentitiesForUser(normalizedUserId);
+        if (identities.length <= 1) {
+            throw new TaskforceRuleError('Cannot remove the last login method. Add another login method first.', 409, 'LAST_IDENTITY_REQUIRED');
+        }
+        const target = identities.find(i => i.provider === input.provider);
+        if (!target)
+            return false;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE user_auth_identities
+            SET disabled_at = ?, updated_at = ?
+            WHERE tenant_id = ? AND id = ?
+        `).run(now, now, this.tenantId, target.id);
+        return true;
+    }
+    // ─── OAuth state machine ───────────────────────────────────────────────────
+    /**
+     * Creates an OAuth state record in auth_oauth_states.
+     *
+     * Returns the opaque `state` token (stored in the redirect URL as `?state=`),
+     * the PKCE `codeVerifier` (sent to the provider on token exchange),
+     * the PKCE `codeChallenge` (sent to the provider on the auth redirect),
+     * and a `nonce` (needed for Apple's id_token nonce binding).
+     */
+    createOAuthState(input) {
+        const state = randomBytes(32).toString('base64url');
+        const codeVerifier = randomBytes(32).toString('base64url');
+        const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');
+        const nonce = randomBytes(16).toString('base64url');
+        const now = new Date().toISOString();
+        const expiresAt = new Date(Date.now() + 10 * 60 * 1000).toISOString(); // 10 min
+        this.db.prepare(`
+            INSERT INTO auth_oauth_states
+                (state, tenant_id, provider, flow_mode, user_id, invite_token, return_to,
+                 pkce_verifier, nonce, expires_at, created_at, created_ip)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(state, this.tenantId, input.provider, input.flowMode, input.userId ?? null, input.inviteToken ?? null, input.returnTo ?? null, codeVerifier, nonce, expiresAt, now, input.createdIp ?? null);
+        return { state, codeVerifier, codeChallenge, nonce };
+    }
+    /**
+     * Atomically consumes an OAuth state token.
+     *
+     * Returns the state row if it exists, is unexpired, and has not been consumed.
+     * Returns null if the token is invalid, expired, or already consumed.
+     * Once consumed, the same token will return null on any subsequent call.
+     */
+    consumeOAuthState(state) {
+        const now = new Date().toISOString();
+        const row = this.db.prepare(`
+            SELECT state, tenant_id, provider, flow_mode, user_id, invite_token, return_to,
+                   pkce_verifier, nonce, expires_at, consumed_at, created_at, created_ip
+            FROM auth_oauth_states
+            WHERE state = ? AND tenant_id = ? AND consumed_at IS NULL AND expires_at > ?
+            LIMIT 1
+        `).get(state, this.tenantId, now);
+        if (!row)
+            return null;
+        this.db.prepare(`
+            UPDATE auth_oauth_states SET consumed_at = ?
+            WHERE state = ? AND tenant_id = ?
+        `).run(now, state, this.tenantId);
+        return {
+            state: row.state,
+            tenantId: row.tenant_id,
+            provider: row.provider,
+            flowMode: row.flow_mode,
+            userId: row.user_id ?? null,
+            inviteToken: row.invite_token ?? null,
+            returnTo: row.return_to ?? null,
+            pkceVerifier: row.pkce_verifier ?? null,
+            nonce: row.nonce ?? null,
+            expiresAt: row.expires_at,
+            createdAt: row.created_at,
+            createdIp: row.created_ip ?? null,
+        };
+    }
+}

package/dist/core/AuthTokenService.d.ts

@@ -1,5 +1,6 @@
 import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
 import type { AuthTokenPurpose, AuthTokenInspection } from './types.js';
+import type { AuthIdentityService } from './AuthIdentityService.js';
 /**
  * Handles one-time auth token lifecycle (email verification, password reset, invite acceptance)
  * and the thin read/write helpers for email-verification and password state.
@@ -7,7 +8,10 @@ import type { AuthTokenPurpose, AuthTokenInspection } from './types.js';
 export declare class AuthTokenService {
     private readonly db;
     private readonly tenantId;
+    private identityService;
     constructor(db: DatabaseAdapter, tenantId: string);
+    /** Called by Taskforce after AuthIdentityService is initialized to avoid circular construction. */
+    setIdentityService(svc: AuthIdentityService): void;
     private generateEntityId;
     createOneTimeAuthToken(userId: string, purpose: AuthTokenPurpose, ttlSeconds: number, workspaceId?: string | null): string;
     consumeOneTimeAuthToken(token: string, purpose: AuthTokenPurpose): {

package/dist/core/AuthTokenService.js

@@ -1,6 +1,7 @@
 import { randomBytes } from 'crypto';
 import { TaskforceRuleError } from './types.js';
 import { hashAuthToken, hashPassword, generateUuidV7 } from './shared.js';
+import { validatePasswordPolicy } from '../shared/passwordPolicy.js';
 /**
  * Handles one-time auth token lifecycle (email verification, password reset, invite acceptance)
  * and the thin read/write helpers for email-verification and password state.
@@ -8,10 +9,15 @@ import { hashAuthToken, hashPassword, generateUuidV7 } from './shared.js';
 export class AuthTokenService {
     db;
     tenantId;
+    identityService = null;
     constructor(db, tenantId) {
         this.db = db;
         this.tenantId = tenantId;
     }
+    /** Called by Taskforce after AuthIdentityService is initialized to avoid circular construction. */
+    setIdentityService(svc) {
+        this.identityService = svc;
+    }
     generateEntityId(prefix) {
         return `${prefix}-${generateUuidV7()}`;
     }
@@ -190,18 +196,40 @@ export class AuthTokenService {
     }
     resetPasswordWithToken(input) {
         const password = String(input.password || '');
-        if (!password || password.length < 8) {
-            throw new TaskforceRuleError('Password must be at least 8 characters', 400, 'PASSWORD_TOO_SHORT');
+        const inspected = this.inspectOneTimeAuthToken(input.token, 'password_reset');
+        if (inspected.state !== 'valid' || !inspected.userId)
+            return false;
+        const user = this.db.prepare(`
+            SELECT email, display_name
+            FROM users
+            WHERE tenant_id = ? AND id = ?
+            LIMIT 1
+        `).get(this.tenantId, inspected.userId);
+        const validation = validatePasswordPolicy(password, {
+            email: user?.email || null,
+            displayName: user?.display_name || null
+        });
+        if (!validation.ok) {
+            throw new TaskforceRuleError(validation.message || 'Password does not meet the password policy.', 400, validation.code || 'PASSWORD_TOO_SHORT');
         }
         const consumed = this.consumeOneTimeAuthToken(input.token, 'password_reset');
         if (!consumed?.userId)
             return false;
         const now = new Date().toISOString();
+        if (this.identityService) {
+            this.identityService.setPasswordIdentity(consumed.userId, password);
+        }
+        else {
+            // Fallback path — should not occur in normal operation (identityService always set).
+            this.db.prepare(`
+                UPDATE user_auth_identities
+                SET password_hash = ?, updated_at = ?, disabled_at = NULL
+                WHERE tenant_id = ? AND user_id = ? AND provider = 'password'
+            `).run(hashPassword(password), now, this.tenantId, consumed.userId);
+        }
         this.db.prepare(`
-            UPDATE users
-            SET password_hash = ?, auth_provider = ?, is_disabled = 0, updated_at = ?
-            WHERE tenant_id = ? AND id = ?
-        `).run(hashPassword(password), 'password', now, this.tenantId, consumed.userId);
+            UPDATE users SET is_disabled = 0, updated_at = ? WHERE tenant_id = ? AND id = ?
+        `).run(now, this.tenantId, consumed.userId);
         return true;
     }
 }

package/dist/core/AuthTokenService.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/AuthTokenService.test.js

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { TaskforceCore } from './Taskforce';
+function makeCore() {
+    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-auth-token-test-'));
+    const core = new TaskforceCore({
+        projectRoot,
+        storagePath: path.join(projectRoot, '.taskforce')
+    });
+    core.updateGlobalSettings({
+        billing: {
+            onboardingPolicy: {
+                mode: 'require_plan_selection',
+                planId: null
+            }
+        }
+    });
+    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'active' });
+    return {
+        core,
+        cleanup: () => {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    };
+}
+describe('Auth token lifecycle', () => {
+    it('keeps previously issued verification tokens valid until they are used or expire', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.registerPasswordUser({
+                email: 'verify@example.com',
+                password: 'ValidPassphrase123!',
+                displayName: 'Verify User',
+                betaAccess: true
+            });
+            const first = String(core.requestEmailVerification({ email: 'verify@example.com' }).token || '');
+            const second = String(core.requestEmailVerification({ email: 'verify@example.com' }).token || '');
+            expect(first).toMatch(/^[a-f0-9]{48}$/);
+            expect(second).toMatch(/^[a-f0-9]{48}$/);
+            expect(first).not.toBe(second);
+            expect(core.inspectOneTimeAuthToken(first, 'email_verification').state).toBe('valid');
+            expect(core.inspectOneTimeAuthToken(second, 'email_verification').state).toBe('valid');
+            expect(core.verifyEmailWithToken(first)).toBe(true);
+            expect(core.inspectOneTimeAuthToken(first, 'email_verification').state).toBe('used');
+            expect(core.inspectOneTimeAuthToken(second, 'email_verification').state).toBe('valid');
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('keeps previously issued password reset tokens valid until they are used or expire', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.registerPasswordUser({
+                email: 'reset@example.com',
+                password: 'ValidPassphrase123!',
+                displayName: 'Reset User',
+                betaAccess: true
+            });
+            const first = String(core.requestPasswordReset({ email: 'reset@example.com' }).token || '');
+            const second = String(core.requestPasswordReset({ email: 'reset@example.com' }).token || '');
+            expect(first).toMatch(/^[a-f0-9]{48}$/);
+            expect(second).toMatch(/^[a-f0-9]{48}$/);
+            expect(first).not.toBe(second);
+            expect(core.inspectOneTimeAuthToken(first, 'password_reset').state).toBe('valid');
+            expect(core.inspectOneTimeAuthToken(second, 'password_reset').state).toBe('valid');
+            expect(core.resetPasswordWithToken({ token: first, password: 'UpdatedPass456!' })).toBe(true);
+            expect(core.inspectOneTimeAuthToken(first, 'password_reset').state).toBe('used');
+            expect(core.inspectOneTimeAuthToken(second, 'password_reset').state).toBe('valid');
+        }
+        finally {
+            cleanup();
+        }
+    });
+});