@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/core/AttachmentLinkService.d.ts

@@ -2,6 +2,7 @@ import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
 export type AttachmentLinkInput = string | {
     path: string;
     fsPath?: string;
+    assetId?: string | null;
     caption?: string;
     displayName?: string;
     originalFilename?: string;
@@ -12,4 +13,6 @@ export interface AttachmentLinkServiceDeps {
     tenantId: string;
     normalizeWorkspaceId: (workspaceId: string) => string;
 }
+export type AttachmentLinkTargetType = 'task' | 'initiative' | 'workstream';
+export declare function syncCanonicalAttachmentLinksForTargetService(deps: AttachmentLinkServiceDeps, targetType: AttachmentLinkTargetType, targetId: string, workspaceId: string, attachments: AttachmentLinkInput[]): void;
 export declare function syncCanonicalTaskAttachmentLinksService(deps: AttachmentLinkServiceDeps, taskId: string, workspaceId: string, attachments: AttachmentLinkInput[]): void;

package/dist/core/AttachmentLinkService.js

@@ -1,5 +1,25 @@
 import { createHash } from 'crypto';
 import * as path from 'path';
+function supportsWorkspaceAssetLinkTargetType(db) {
+    try {
+        if (db.provider === 'postgres') {
+            const row = db.prepare(`
+                SELECT 1
+                FROM information_schema.columns
+                WHERE table_schema = current_schema()
+                  AND table_name = 'workspace_asset_links'
+                  AND column_name = 'target_type'
+                LIMIT 1
+            `).get();
+            return Boolean(row);
+        }
+        const columns = db.prepare(`PRAGMA table_info(workspace_asset_links)`).all();
+        return columns.some((column) => String(column.name || '').trim() === 'target_type');
+    }
+    catch {
+        return false;
+    }
+}
 function buildAttachmentDisplayName(attachment, fallbackNameRaw) {
     const caption = typeof attachment === 'string' ? '' : String(attachment.caption || '').trim();
     if (caption)
@@ -43,6 +63,25 @@ function normalizeAttachmentStorageKey(pathValue, fsPathValue) {
     }
     return null;
 }
+function extractAttachmentAssetId(attachment) {
+    const explicitAssetId = typeof attachment === 'string'
+        ? ''
+        : String(attachment.assetId || '').trim();
+    if (explicitAssetId)
+        return explicitAssetId;
+    const pathValue = typeof attachment === 'string'
+        ? attachment.trim()
+        : String(attachment.path || '').trim();
+    const match = pathValue.match(/^\/api\/taskforce\/documents\/([^/?#]+)\/content(?:[?#].*)?$/);
+    if (!match)
+        return null;
+    try {
+        return decodeURIComponent(match[1]).trim() || null;
+    }
+    catch {
+        return match[1].trim() || null;
+    }
+}
 function ensureExternalReferenceAsset(deps, storageKeyRaw, workspaceId, attachment) {
     const storageKey = String(storageKeyRaw || '').trim();
     const normalizedWorkspaceId = deps.normalizeWorkspaceId(workspaceId);
@@ -104,44 +143,89 @@ function ensureExternalReferenceAsset(deps, storageKeyRaw, workspaceId, attachme
     `).run(assetId, deps.tenantId, normalizedWorkspaceId, 'file', logicalName, logicalName, mimeType, 'external', storageKey, urlHash, Buffer.byteLength(storageKey, 'utf8'), null, null, 1, 'clean', null, null, null, timestamp, timestamp);
     return assetId;
 }
-export function syncCanonicalTaskAttachmentLinksService(deps, taskId, workspaceId, attachments) {
-    const normalizedTaskId = String(taskId || '').trim();
+export function syncCanonicalAttachmentLinksForTargetService(deps, targetType, targetId, workspaceId, attachments) {
+    const normalizedTargetId = String(targetId || '').trim();
     const normalizedWorkspaceId = deps.normalizeWorkspaceId(workspaceId);
-    if (!normalizedTaskId)
+    if (!normalizedTargetId)
         return;
-    deps.db.prepare(`
-        UPDATE workspace_asset_links
-        SET deleted_at = ?, updated_at = ?
-        WHERE tenant_id = ? AND workspace_id = ? AND task_id = ? AND deleted_at IS NULL
-    `).run(new Date().toISOString(), new Date().toISOString(), deps.tenantId, normalizedWorkspaceId, normalizedTaskId);
+    const supportsTargetType = supportsWorkspaceAssetLinkTargetType(deps.db);
+    const safeTargetType = targetType === 'initiative' || targetType === 'workstream'
+        ? targetType
+        : 'task';
+    const nowIso = new Date().toISOString();
+    if (supportsTargetType) {
+        deps.db.prepare(`
+            UPDATE workspace_asset_links
+            SET deleted_at = ?, updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND target_type = ? AND task_id = ? AND deleted_at IS NULL
+        `).run(nowIso, nowIso, deps.tenantId, normalizedWorkspaceId, safeTargetType, normalizedTargetId);
+    }
+    else {
+        if (safeTargetType !== 'task')
+            return;
+        deps.db.prepare(`
+            UPDATE workspace_asset_links
+            SET deleted_at = ?, updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND task_id = ? AND deleted_at IS NULL
+        `).run(nowIso, nowIso, deps.tenantId, normalizedWorkspaceId, normalizedTargetId);
+    }
     const selectAsset = deps.db.prepare(`
         SELECT asset_id, kind
         FROM workspace_assets
         WHERE tenant_id = ? AND workspace_id = ? AND storage_key = ? AND deleted_at IS NULL
         LIMIT 1
     `);
-    const upsertLink = deps.db.prepare(`
-        INSERT INTO workspace_asset_links (
-            tenant_id, workspace_id, asset_id, task_id, role, display_name, sort_order, created_at, updated_at, deleted_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
-        ON CONFLICT (tenant_id, workspace_id, asset_id, task_id, role) DO UPDATE SET
-            display_name = excluded.display_name,
-            sort_order = excluded.sort_order,
-            updated_at = excluded.updated_at,
-            deleted_at = NULL
+    const selectAssetById = deps.db.prepare(`
+        SELECT asset_id, kind
+        FROM workspace_assets
+        WHERE tenant_id = ? AND workspace_id = ? AND asset_id = ? AND deleted_at IS NULL
+        LIMIT 1
     `);
+    const upsertLink = supportsTargetType
+        ? deps.db.prepare(`
+            INSERT INTO workspace_asset_links (
+                tenant_id, workspace_id, asset_id, target_type, task_id, role, display_name, sort_order, created_at, updated_at, deleted_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
+            ON CONFLICT (tenant_id, workspace_id, asset_id, task_id, role) DO UPDATE SET
+                target_type = excluded.target_type,
+                display_name = excluded.display_name,
+                sort_order = excluded.sort_order,
+                updated_at = excluded.updated_at,
+                deleted_at = NULL
+        `)
+        : deps.db.prepare(`
+            INSERT INTO workspace_asset_links (
+                tenant_id, workspace_id, asset_id, task_id, role, display_name, sort_order, created_at, updated_at, deleted_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
+            ON CONFLICT (tenant_id, workspace_id, asset_id, task_id, role) DO UPDATE SET
+                display_name = excluded.display_name,
+                sort_order = excluded.sort_order,
+                updated_at = excluded.updated_at,
+                deleted_at = NULL
+        `);
     attachments.forEach((attachment, index) => {
         const storageKey = normalizeAttachmentStorageKey(typeof attachment === 'string' ? attachment : attachment.path, typeof attachment === 'string' ? null : attachment.fsPath);
-        if (!storageKey)
+        const attachmentAssetId = extractAttachmentAssetId(attachment);
+        if (!storageKey && !attachmentAssetId)
             return;
-        const row = selectAsset.get(deps.tenantId, normalizedWorkspaceId, storageKey);
+        const row = (storageKey
+            ? selectAsset.get(deps.tenantId, normalizedWorkspaceId, storageKey)
+            : null)
+            || (attachmentAssetId
+                ? selectAssetById.get(deps.tenantId, normalizedWorkspaceId, attachmentAssetId)
+                : null);
+        const isExternalStorageKey = typeof storageKey === 'string' && /^https?:\/\//i.test(storageKey);
+        const hasExplicitFileStorageKey = typeof storageKey === 'string'
+            && typeof attachment !== 'string'
+            && typeof attachment.fsPath === 'string'
+            && attachment.fsPath.trim().length > 0;
         const assetId = String(row?.asset_id || '').trim()
-            || ((/^https?:\/\//i.test(storageKey) || (typeof attachment !== 'string' && typeof attachment.fsPath === 'string' && attachment.fsPath.trim().length > 0))
+            || (isExternalStorageKey || hasExplicitFileStorageKey
                 ? ensureExternalReferenceAsset(deps, storageKey, normalizedWorkspaceId, attachment)
                 : '');
         if (!assetId)
             return;
-        const role = /^https?:\/\//i.test(storageKey)
+        const role = isExternalStorageKey
             ? 'reference'
             : String(row?.kind || '').trim() === 'image'
                 ? 'image'
@@ -150,8 +234,11 @@ export function syncCanonicalTaskAttachmentLinksService(deps, taskId, workspaceI
             ? null
             : (typeof attachment === 'string'
                 ? null
-                : buildAttachmentDisplayName(attachment, /^https?:\/\//i.test(storageKey) ? null : path.basename(storageKey)));
+                : buildAttachmentDisplayName(attachment, isExternalStorageKey || !storageKey ? null : path.basename(storageKey)));
         const timestamp = typeof attachment === 'string' ? new Date().toISOString() : (attachment.timestamp || new Date().toISOString());
-        upsertLink.run(deps.tenantId, normalizedWorkspaceId, assetId, normalizedTaskId, role, displayName, index, timestamp, timestamp);
+        upsertLink.run(deps.tenantId, normalizedWorkspaceId, assetId, safeTargetType, normalizedTargetId, role, displayName, index, timestamp, timestamp);
     });
 }
+export function syncCanonicalTaskAttachmentLinksService(deps, taskId, workspaceId, attachments) {
+    syncCanonicalAttachmentLinksForTargetService(deps, 'task', taskId, workspaceId, attachments);
+}

package/dist/core/AuthIdentityService.d.ts

@@ -0,0 +1,107 @@
+import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
+import type { UserAuthProvider, UserAuthIdentity } from './types.js';
+/**
+ * Manages user_auth_identities — the canonical source for login methods.
+ * One Taskforce account can have at most one identity per provider.
+ */
+export declare class AuthIdentityService {
+    private readonly db;
+    private readonly tenantId;
+    constructor(db: DatabaseAdapter, tenantId: string);
+    private generateIdentityId;
+    /**
+     * Creates a password identity for a user. Throws if one already exists.
+     */
+    createPasswordIdentity(userId: string, password: string): string;
+    /**
+     * Upserts a password identity — creates if absent, replaces hash if present.
+     * Used by password-reset and invite-accept flows.
+     */
+    setPasswordIdentity(userId: string, password: string): string;
+    /**
+     * Verifies email + password against the identity table.
+     * Returns {userId, identityId} or null.
+     * Also checks users.is_disabled.
+     */
+    authenticatePasswordIdentity(email: string, password: string): {
+        userId: string;
+        identityId: string;
+    } | null;
+    /**
+     * Finds the user associated with a provider identity.
+     */
+    findUserByProviderIdentity(input: {
+        provider: UserAuthProvider;
+        providerSubject: string;
+    }): {
+        userId: string;
+        identityId: string;
+    } | null;
+    /**
+     * Links a social provider identity to an existing user.
+     * Throws if the user already has an identity for that provider.
+     */
+    linkProviderIdentity(input: {
+        userId: string;
+        provider: UserAuthProvider;
+        providerSubject: string;
+        providerEmail?: string | null;
+        providerEmailVerified?: boolean | null;
+        displayNameSnapshot?: string | null;
+        avatarUrlSnapshot?: string | null;
+        metadataJson?: string | null;
+    }): string;
+    listIdentitiesForUser(userId: string): UserAuthIdentity[];
+    hasAnyActiveIdentity(userId: string): boolean;
+    /**
+     * Unlinks a provider identity from a user.
+     * Rejects if it is the last active identity (would lock the user out).
+     */
+    unlinkProviderIdentity(input: {
+        userId: string;
+        provider: UserAuthProvider;
+    }): boolean;
+    /**
+     * Creates an OAuth state record in auth_oauth_states.
+     *
+     * Returns the opaque `state` token (stored in the redirect URL as `?state=`),
+     * the PKCE `codeVerifier` (sent to the provider on token exchange),
+     * the PKCE `codeChallenge` (sent to the provider on the auth redirect),
+     * and a `nonce` (needed for Apple's id_token nonce binding).
+     */
+    createOAuthState(input: {
+        provider: string;
+        flowMode: string;
+        userId?: string | null;
+        inviteToken?: string | null;
+        returnTo?: string | null;
+        createdIp?: string | null;
+    }): {
+        state: string;
+        codeVerifier: string;
+        codeChallenge: string;
+        nonce: string;
+    };
+    /**
+     * Atomically consumes an OAuth state token.
+     *
+     * Returns the state row if it exists, is unexpired, and has not been consumed.
+     * Returns null if the token is invalid, expired, or already consumed.
+     * Once consumed, the same token will return null on any subsequent call.
+     */
+    consumeOAuthState(state: string): OAuthStateRecord | null;
+}
+export interface OAuthStateRecord {
+    state: string;
+    tenantId: string;
+    provider: string;
+    flowMode: string;
+    userId: string | null;
+    inviteToken: string | null;
+    returnTo: string | null;
+    pkceVerifier: string | null;
+    nonce: string | null;
+    expiresAt: string;
+    createdAt: string;
+    createdIp: string | null;
+}

package/dist/core/AuthIdentityService.js

@@ -0,0 +1,284 @@
+import { randomBytes, createHash } from 'crypto';
+import { TaskforceRuleError } from './types.js';
+import { hashPassword, verifyPassword, generateUuidV7 } from './shared.js';
+import { validatePasswordPolicy } from '../shared/passwordPolicy.js';
+function mapRow(row) {
+    return {
+        id: row.id,
+        tenantId: row.tenant_id,
+        userId: row.user_id,
+        provider: row.provider,
+        providerSubject: row.provider_subject,
+        providerEmail: row.provider_email,
+        providerEmailVerified: row.provider_email_verified === null ? null : Boolean(row.provider_email_verified),
+        displayNameSnapshot: row.display_name_snapshot,
+        avatarUrlSnapshot: row.avatar_url_snapshot,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        lastLoginAt: row.last_login_at,
+        linkedAt: row.linked_at,
+        disabledAt: row.disabled_at,
+    };
+}
+/**
+ * Manages user_auth_identities — the canonical source for login methods.
+ * One Taskforce account can have at most one identity per provider.
+ */
+export class AuthIdentityService {
+    db;
+    tenantId;
+    constructor(db, tenantId) {
+        this.db = db;
+        this.tenantId = tenantId;
+    }
+    generateIdentityId() {
+        return `identity-${generateUuidV7()}`;
+    }
+    // ─── Password identity ─────────────────────────────────────────────────────
+    /**
+     * Creates a password identity for a user. Throws if one already exists.
+     */
+    createPasswordIdentity(userId, password) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId)
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        const validation = validatePasswordPolicy(password);
+        if (!validation.ok) {
+            throw new TaskforceRuleError(validation.message || 'Password does not meet the password policy.', 400, validation.code || 'PASSWORD_TOO_SHORT');
+        }
+        const existing = this.db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = 'password'
+            LIMIT 1
+        `).get(this.tenantId, normalizedUserId);
+        if (existing?.id) {
+            throw new TaskforceRuleError('Password identity already exists for this user', 409, 'IDENTITY_ALREADY_EXISTS');
+        }
+        const now = new Date().toISOString();
+        const identityId = this.generateIdentityId();
+        this.db.prepare(`
+            INSERT INTO user_auth_identities
+                (id, tenant_id, user_id, provider, password_hash, created_at, updated_at, linked_at)
+            VALUES (?, ?, ?, 'password', ?, ?, ?, ?)
+        `).run(identityId, this.tenantId, normalizedUserId, hashPassword(password), now, now, now);
+        return identityId;
+    }
+    /**
+     * Upserts a password identity — creates if absent, replaces hash if present.
+     * Used by password-reset and invite-accept flows.
+     */
+    setPasswordIdentity(userId, password) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId)
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        const validation = validatePasswordPolicy(password);
+        if (!validation.ok) {
+            throw new TaskforceRuleError(validation.message || 'Password does not meet the password policy.', 400, validation.code || 'PASSWORD_TOO_SHORT');
+        }
+        const now = new Date().toISOString();
+        const existing = this.db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = 'password'
+            LIMIT 1
+        `).get(this.tenantId, normalizedUserId);
+        if (existing?.id) {
+            this.db.prepare(`
+                UPDATE user_auth_identities
+                SET password_hash = ?, updated_at = ?, disabled_at = NULL
+                WHERE tenant_id = ? AND id = ?
+            `).run(hashPassword(password), now, this.tenantId, existing.id);
+            return existing.id;
+        }
+        const identityId = this.generateIdentityId();
+        this.db.prepare(`
+            INSERT INTO user_auth_identities
+                (id, tenant_id, user_id, provider, password_hash, created_at, updated_at, linked_at)
+            VALUES (?, ?, ?, 'password', ?, ?, ?, ?)
+        `).run(identityId, this.tenantId, normalizedUserId, hashPassword(password), now, now, now);
+        return identityId;
+    }
+    /**
+     * Verifies email + password against the identity table.
+     * Returns {userId, identityId} or null.
+     * Also checks users.is_disabled.
+     */
+    authenticatePasswordIdentity(email, password) {
+        const normalizedEmail = String(email || '').trim().toLowerCase();
+        if (!normalizedEmail || !password)
+            return null;
+        const user = this.db.prepare(`
+            SELECT id FROM users
+            WHERE tenant_id = ? AND email = ? AND COALESCE(is_disabled, 0) = 0
+            LIMIT 1
+        `).get(this.tenantId, normalizedEmail);
+        if (!user?.id)
+            return null;
+        const identity = this.db.prepare(`
+            SELECT id, password_hash FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = 'password' AND disabled_at IS NULL
+            LIMIT 1
+        `).get(this.tenantId, user.id);
+        if (!identity?.id || !identity.password_hash)
+            return null;
+        if (!verifyPassword(password, identity.password_hash))
+            return null;
+        // Update last_login_at
+        this.db.prepare(`
+            UPDATE user_auth_identities SET last_login_at = ? WHERE tenant_id = ? AND id = ?
+        `).run(new Date().toISOString(), this.tenantId, identity.id);
+        return { userId: user.id, identityId: identity.id };
+    }
+    // ─── Social identity ───────────────────────────────────────────────────────
+    /**
+     * Finds the user associated with a provider identity.
+     */
+    findUserByProviderIdentity(input) {
+        const row = this.db.prepare(`
+            SELECT id, user_id FROM user_auth_identities
+            WHERE tenant_id = ? AND provider = ? AND provider_subject = ? AND disabled_at IS NULL
+            LIMIT 1
+        `).get(this.tenantId, input.provider, input.providerSubject);
+        if (!row?.id || !row.user_id)
+            return null;
+        return { userId: row.user_id, identityId: row.id };
+    }
+    /**
+     * Links a social provider identity to an existing user.
+     * Throws if the user already has an identity for that provider.
+     */
+    linkProviderIdentity(input) {
+        const normalizedUserId = String(input.userId || '').trim();
+        if (!normalizedUserId)
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        if (input.provider === 'password') {
+            throw new TaskforceRuleError('Use setPasswordIdentity for password provider', 400, 'INVALID_PROVIDER');
+        }
+        const existing = this.db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = ?
+            LIMIT 1
+        `).get(this.tenantId, normalizedUserId, input.provider);
+        if (existing?.id) {
+            throw new TaskforceRuleError(`${input.provider} identity already linked to this account`, 409, 'IDENTITY_ALREADY_EXISTS');
+        }
+        const now = new Date().toISOString();
+        const identityId = this.generateIdentityId();
+        this.db.prepare(`
+            INSERT INTO user_auth_identities
+                (id, tenant_id, user_id, provider, provider_subject, provider_email,
+                 provider_email_verified, display_name_snapshot, avatar_url_snapshot,
+                 metadata_json, created_at, updated_at, linked_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(identityId, this.tenantId, normalizedUserId, input.provider, input.providerSubject, input.providerEmail ?? null, input.providerEmailVerified === null || input.providerEmailVerified === undefined
+            ? null
+            : (input.providerEmailVerified ? 1 : 0), input.displayNameSnapshot ?? null, input.avatarUrlSnapshot ?? null, input.metadataJson ?? null, now, now, now);
+        return identityId;
+    }
+    // ─── Listing and unlinking ──────────────────────────────────────────────────
+    listIdentitiesForUser(userId) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId)
+            return [];
+        const rows = this.db.prepare(`
+            SELECT * FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND disabled_at IS NULL
+            ORDER BY created_at ASC
+        `).all(this.tenantId, normalizedUserId);
+        return rows.map(mapRow);
+    }
+    hasAnyActiveIdentity(userId) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId)
+            return false;
+        const row = this.db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND disabled_at IS NULL
+            LIMIT 1
+        `).get(this.tenantId, normalizedUserId);
+        return Boolean(row?.id);
+    }
+    /**
+     * Unlinks a provider identity from a user.
+     * Rejects if it is the last active identity (would lock the user out).
+     */
+    unlinkProviderIdentity(input) {
+        const normalizedUserId = String(input.userId || '').trim();
+        if (!normalizedUserId)
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        const identities = this.listIdentitiesForUser(normalizedUserId);
+        if (identities.length <= 1) {
+            throw new TaskforceRuleError('Cannot remove the last login method. Add another login method first.', 409, 'LAST_IDENTITY_REQUIRED');
+        }
+        const target = identities.find(i => i.provider === input.provider);
+        if (!target)
+            return false;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE user_auth_identities
+            SET disabled_at = ?, updated_at = ?
+            WHERE tenant_id = ? AND id = ?
+        `).run(now, now, this.tenantId, target.id);
+        return true;
+    }
+    // ─── OAuth state machine ───────────────────────────────────────────────────
+    /**
+     * Creates an OAuth state record in auth_oauth_states.
+     *
+     * Returns the opaque `state` token (stored in the redirect URL as `?state=`),
+     * the PKCE `codeVerifier` (sent to the provider on token exchange),
+     * the PKCE `codeChallenge` (sent to the provider on the auth redirect),
+     * and a `nonce` (needed for Apple's id_token nonce binding).
+     */
+    createOAuthState(input) {
+        const state = randomBytes(32).toString('base64url');
+        const codeVerifier = randomBytes(32).toString('base64url');
+        const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');
+        const nonce = randomBytes(16).toString('base64url');
+        const now = new Date().toISOString();
+        const expiresAt = new Date(Date.now() + 10 * 60 * 1000).toISOString(); // 10 min
+        this.db.prepare(`
+            INSERT INTO auth_oauth_states
+                (state, tenant_id, provider, flow_mode, user_id, invite_token, return_to,
+                 pkce_verifier, nonce, expires_at, created_at, created_ip)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(state, this.tenantId, input.provider, input.flowMode, input.userId ?? null, input.inviteToken ?? null, input.returnTo ?? null, codeVerifier, nonce, expiresAt, now, input.createdIp ?? null);
+        return { state, codeVerifier, codeChallenge, nonce };
+    }
+    /**
+     * Atomically consumes an OAuth state token.
+     *
+     * Returns the state row if it exists, is unexpired, and has not been consumed.
+     * Returns null if the token is invalid, expired, or already consumed.
+     * Once consumed, the same token will return null on any subsequent call.
+     */
+    consumeOAuthState(state) {
+        const now = new Date().toISOString();
+        const row = this.db.prepare(`
+            SELECT state, tenant_id, provider, flow_mode, user_id, invite_token, return_to,
+                   pkce_verifier, nonce, expires_at, consumed_at, created_at, created_ip
+            FROM auth_oauth_states
+            WHERE state = ? AND tenant_id = ? AND consumed_at IS NULL AND expires_at > ?
+            LIMIT 1
+        `).get(state, this.tenantId, now);
+        if (!row)
+            return null;
+        this.db.prepare(`
+            UPDATE auth_oauth_states SET consumed_at = ?
+            WHERE state = ? AND tenant_id = ?
+        `).run(now, state, this.tenantId);
+        return {
+            state: row.state,
+            tenantId: row.tenant_id,
+            provider: row.provider,
+            flowMode: row.flow_mode,
+            userId: row.user_id ?? null,
+            inviteToken: row.invite_token ?? null,
+            returnTo: row.return_to ?? null,
+            pkceVerifier: row.pkce_verifier ?? null,
+            nonce: row.nonce ?? null,
+            expiresAt: row.expires_at,
+            createdAt: row.created_at,
+            createdIp: row.created_ip ?? null,
+        };
+    }
+}

package/dist/core/AuthTokenService.d.ts

@@ -1,5 +1,6 @@
 import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
 import type { AuthTokenPurpose, AuthTokenInspection } from './types.js';
+import type { AuthIdentityService } from './AuthIdentityService.js';
 /**
  * Handles one-time auth token lifecycle (email verification, password reset, invite acceptance)
  * and the thin read/write helpers for email-verification and password state.
@@ -7,7 +8,10 @@ import type { AuthTokenPurpose, AuthTokenInspection } from './types.js';
 export declare class AuthTokenService {
     private readonly db;
     private readonly tenantId;
+    private identityService;
     constructor(db: DatabaseAdapter, tenantId: string);
+    /** Called by Taskforce after AuthIdentityService is initialized to avoid circular construction. */
+    setIdentityService(svc: AuthIdentityService): void;
     private generateEntityId;
     createOneTimeAuthToken(userId: string, purpose: AuthTokenPurpose, ttlSeconds: number, workspaceId?: string | null): string;
     consumeOneTimeAuthToken(token: string, purpose: AuthTokenPurpose): {

package/dist/core/AuthTokenService.js

@@ -1,6 +1,7 @@
 import { randomBytes } from 'crypto';
 import { TaskforceRuleError } from './types.js';
 import { hashAuthToken, hashPassword, generateUuidV7 } from './shared.js';
+import { validatePasswordPolicy } from '../shared/passwordPolicy.js';
 /**
  * Handles one-time auth token lifecycle (email verification, password reset, invite acceptance)
  * and the thin read/write helpers for email-verification and password state.
@@ -8,10 +9,15 @@ import { hashAuthToken, hashPassword, generateUuidV7 } from './shared.js';
 export class AuthTokenService {
     db;
     tenantId;
+    identityService = null;
     constructor(db, tenantId) {
         this.db = db;
         this.tenantId = tenantId;
     }
+    /** Called by Taskforce after AuthIdentityService is initialized to avoid circular construction. */
+    setIdentityService(svc) {
+        this.identityService = svc;
+    }
     generateEntityId(prefix) {
         return `${prefix}-${generateUuidV7()}`;
     }
@@ -190,18 +196,40 @@ export class AuthTokenService {
     }
     resetPasswordWithToken(input) {
         const password = String(input.password || '');
-        if (!password || password.length < 8) {
-            throw new TaskforceRuleError('Password must be at least 8 characters', 400, 'PASSWORD_TOO_SHORT');
+        const inspected = this.inspectOneTimeAuthToken(input.token, 'password_reset');
+        if (inspected.state !== 'valid' || !inspected.userId)
+            return false;
+        const user = this.db.prepare(`
+            SELECT email, display_name
+            FROM users
+            WHERE tenant_id = ? AND id = ?
+            LIMIT 1
+        `).get(this.tenantId, inspected.userId);
+        const validation = validatePasswordPolicy(password, {
+            email: user?.email || null,
+            displayName: user?.display_name || null
+        });
+        if (!validation.ok) {
+            throw new TaskforceRuleError(validation.message || 'Password does not meet the password policy.', 400, validation.code || 'PASSWORD_TOO_SHORT');
         }
         const consumed = this.consumeOneTimeAuthToken(input.token, 'password_reset');
         if (!consumed?.userId)
             return false;
         const now = new Date().toISOString();
+        if (this.identityService) {
+            this.identityService.setPasswordIdentity(consumed.userId, password);
+        }
+        else {
+            // Fallback path — should not occur in normal operation (identityService always set).
+            this.db.prepare(`
+                UPDATE user_auth_identities
+                SET password_hash = ?, updated_at = ?, disabled_at = NULL
+                WHERE tenant_id = ? AND user_id = ? AND provider = 'password'
+            `).run(hashPassword(password), now, this.tenantId, consumed.userId);
+        }
         this.db.prepare(`
-            UPDATE users
-            SET password_hash = ?, auth_provider = ?, is_disabled = 0, updated_at = ?
-            WHERE tenant_id = ? AND id = ?
-        `).run(hashPassword(password), 'password', now, this.tenantId, consumed.userId);
+            UPDATE users SET is_disabled = 0, updated_at = ? WHERE tenant_id = ? AND id = ?
+        `).run(now, this.tenantId, consumed.userId);
         return true;
     }
 }