@techelusive/nest-auth 0.0.0-stage → 0.2.1

package/dist/features/passwords/password.dto.js

@@ -0,0 +1,140 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenInput = exports.ChangePasswordInput = exports.ResetPasswordInput = exports.EmailOnlyInput = exports.SignInWithPasswordInput = exports.RegisterInput = void 0;
+const class_validator_1 = require("class-validator");
+const constants_1 = require("../../constants.js");
+/*
+ * Request bodies. These check the SHAPE of the input (types and lengths); the services check the
+ * MEANING (valid email, password rules, settings). Unknown fields are rejected by the validation pipe.
+ */
+/** POST /auth/register */
+class RegisterInput {
+    email;
+    password;
+    firstName;
+    lastName;
+    /** International format, e.g. +919876543210. */
+    phoneNumber;
+    acceptTerms;
+    acceptPrivacyPolicy;
+}
+exports.RegisterInput = RegisterInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.EMAIL_MAX_LENGTH),
+    __metadata("design:type", String)
+], RegisterInput.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PASSWORD_MAX_LENGTH),
+    __metadata("design:type", String)
+], RegisterInput.prototype, "password", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.DISPLAY_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], RegisterInput.prototype, "firstName", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.DISPLAY_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], RegisterInput.prototype, "lastName", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PHONE_NUMBER_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], RegisterInput.prototype, "phoneNumber", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], RegisterInput.prototype, "acceptTerms", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], RegisterInput.prototype, "acceptPrivacyPolicy", void 0);
+/** POST /auth/login */
+class SignInWithPasswordInput {
+    email;
+    password;
+}
+exports.SignInWithPasswordInput = SignInWithPasswordInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.EMAIL_MAX_LENGTH),
+    __metadata("design:type", String)
+], SignInWithPasswordInput.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PASSWORD_MAX_LENGTH),
+    __metadata("design:type", String)
+], SignInWithPasswordInput.prototype, "password", void 0);
+/** POST /auth/password/forgot, /auth/email/send-verification, /auth/email/send-otp, magic link */
+class EmailOnlyInput {
+    email;
+}
+exports.EmailOnlyInput = EmailOnlyInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.EMAIL_MAX_LENGTH),
+    __metadata("design:type", String)
+], EmailOnlyInput.prototype, "email", void 0);
+/** POST /auth/password/reset */
+class ResetPasswordInput {
+    /** The token from the reset link. */
+    token;
+    newPassword;
+}
+exports.ResetPasswordInput = ResetPasswordInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.RANDOM_TOKEN_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], ResetPasswordInput.prototype, "token", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PASSWORD_MAX_LENGTH),
+    __metadata("design:type", String)
+], ResetPasswordInput.prototype, "newPassword", void 0);
+/** POST /auth/password/change */
+class ChangePasswordInput {
+    /** Leave out only if the account has no password yet (signed up with Google etc.). */
+    currentPassword;
+    newPassword;
+}
+exports.ChangePasswordInput = ChangePasswordInput;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PASSWORD_MAX_LENGTH),
+    __metadata("design:type", String)
+], ChangePasswordInput.prototype, "currentPassword", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PASSWORD_MAX_LENGTH),
+    __metadata("design:type", String)
+], ChangePasswordInput.prototype, "newPassword", void 0);
+/** Any endpoint that receives a single token: verify email, magic link, refresh, reactivate... */
+class TokenInput {
+    token;
+}
+exports.TokenInput = TokenInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.RANDOM_TOKEN_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], TokenInput.prototype, "token", void 0);
+//# sourceMappingURL=password.dto.js.map

package/dist/features/passwords/password.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.dto.js","sourceRoot":"","sources":["../../../src/features/passwords/password.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA6E;AAC7E,2CAMqB;AAErB;;;GAGG;AAEH,0BAA0B;AAC1B,MAAa,aAAa;IAExB,KAAK,CAAS;IAGd,QAAQ,CAAS;IAGjB,SAAS,CAAU;IAGnB,QAAQ,CAAU;IAElB,gDAAgD;IAEhD,WAAW,CAAU;IAGrB,WAAW,CAAW;IAGtB,mBAAmB,CAAW;CAC/B;AAtBD,sCAsBC;AApBC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,4BAAgB,CAAC;;4CAC1B;AAGd;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,+BAAmB,CAAC;;+CAC1B;AAGjB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,mCAAuB,CAAC;;gDAC1C;AAGnB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,mCAAuB,CAAC;;+CAC3C;AAIlB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;kDAC9C;AAGrB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,2BAAS,GAAE;;kDACJ;AAGtB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,2BAAS,GAAE;;0DACI;AAGhC,uBAAuB;AACvB,MAAa,uBAAuB;IAElC,KAAK,CAAS;IAGd,QAAQ,CAAS;CAClB;AAND,0DAMC;AAJC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,4BAAgB,CAAC;;sDAC1B;AAGd;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,+BAAmB,CAAC;;yDAC1B;AAGnB,kGAAkG;AAClG,MAAa,cAAc;IAEzB,KAAK,CAAS;CACf;AAHD,wCAGC;AADC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,4BAAgB,CAAC;;6CAC1B;AAGhB,gCAAgC;AAChC,MAAa,kBAAkB;IAC7B,qCAAqC;IAErC,KAAK,CAAS;IAGd,WAAW,CAAS;CACrB;AAPD,gDAOC;AAJC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;iDACvC;AAGd;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,+BAAmB,CAAC;;uDACvB;AAGtB,iCAAiC;AACjC,MAAa,mBAAmB;IAC9B,sFAAsF;IAEtF,eAAe,CAAU;IAGzB,WAAW,CAAS;CACrB;AAPD,kDAOC;AAJC;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,+BAAmB,CAAC;;4DAChC;AAGzB;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,+BAAmB,CAAC;;wDACvB;AAGtB,kGAAkG;AAClG,MAAa,UAAU;IAErB,KAAK,CAAS;CACf;AAHD,gCAGC;AADC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;yCACvC"}

package/dist/features/sessions/session.service.d.ts

@@ -0,0 +1,132 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RequestContext } from '../../common/request-context.js';
+import { type SessionEndReason } from '../../constants.js';
+import { SessionEntity, UserEntity } from '../../database/entities/index.js';
+import { AuthEventsService } from '../events/auth-events.service.js';
+import { AuthSettings } from '../settings/settings.types.js';
+import { SigningKeysService } from '../signing-keys/signing-keys.service.js';
+import { AccessTokenClaims, SignInMethod, TokenSet } from './session.types';
+/**
+ * Sessions (one per signed-in device) and the tokens that belong to them.
+ *
+ * - Access token: a signed JWT that lives a few minutes. Your API checks it on every request.
+ * - Refresh token: a random string that works ONCE to get a new pair of tokens. If an already-used
+ *   refresh token comes back, someone copied it, so we end that session to protect the user.
+ */
+export declare class SessionService {
+    private readonly signingKeys;
+    private readonly events;
+    private readonly logger;
+    private readonly database;
+    /** Token "iss" and "aud": your API's URL. */
+    readonly issuer: string;
+    /** Short cache of "is this session still allowed?" answers, so the database isn't hit on every request. */
+    private readonly sessionCheckCache;
+    constructor(options: AuthOptions, signingKeys: SigningKeysService, events: AuthEventsService);
+    /**
+     * Starts a session for a user who has just proven who they are, and returns their first tokens.
+     *
+     * @param user - The user signing in.
+     * @param signInMethod - How they signed in (goes into the token's "amr" claim).
+     * @param usedTwoFactor - Whether a second factor was used.
+     * @param request - The device's IP and user agent, shown in the user's device list.
+     * @param settings - The current settings (session and token lifetimes).
+     * @returns The access token, refresh token and session id.
+     */
+    startSession(user: UserEntity, signInMethod: SignInMethod, usedTwoFactor: boolean, request: RequestContext, settings: AuthSettings): Promise<TokenSet>;
+    /**
+     * Swaps a refresh token for a new access token and a new refresh token.
+     * Each refresh token works exactly once; a second use ends the whole session.
+     *
+     * @param refreshToken - The "rt_..." token the client sent.
+     * @param request - Who is asking (for the audit log if the token was reused).
+     * @param settings - The current settings.
+     * @returns A new set of tokens for the same session.
+     * @throws AuthError INVALID_TOKEN when the token is unknown, used, expired, its session has
+     *   ended, or the account is no longer active.
+     */
+    refreshSession(refreshToken: unknown, request: RequestContext, settings: AuthSettings): Promise<TokenSet>;
+    /**
+     * Checks an access token's signature, issuer, audience and expiry.
+     * This does not check whether the session was ended since; see `isSessionStillAllowed`.
+     *
+     * @param accessToken - The token from the Authorization header.
+     * @returns The token's claims (user id, session id, roles...).
+     * @throws AuthError INVALID_TOKEN when any check fails.
+     */
+    verifyAccessToken(accessToken: string): Promise<AccessTokenClaims>;
+    /**
+     * Checks that the session has not been ended and its user is ACTIVE.
+     * Answers are cached for a few seconds, so signing out or suspending takes effect almost at once
+     * without a database query on every request.
+     *
+     * @param sessionId - The "sid" claim from the access token.
+     * @param userId - The "sub" claim from the access token.
+     * @returns True when requests from this session should still be accepted.
+     */
+    isSessionStillAllowed(sessionId: string, userId: string): Promise<boolean>;
+    /**
+     * Ends one session.
+     *
+     * @param sessionId - The session to end.
+     * @param reason - Why it ended (stored, and shown in the audit log).
+     * @param userId - When given, the session is only ended if it belongs to this user.
+     * @returns False if nothing was ended (unknown, already ended, or someone else's session).
+     */
+    revokeSession(sessionId: string, reason: SessionEndReason, userId?: string): Promise<boolean>;
+    /**
+     * Ends every session of a user, e.g. after a password change.
+     *
+     * @param userId - The user to sign out.
+     * @param reason - Why the sessions ended.
+     * @param keepSessionId - When given, this session (the device making the request) stays signed in.
+     * @returns How many sessions were ended.
+     */
+    revokeAllSessions(userId: string, reason: SessionEndReason, keepSessionId?: string): Promise<number>;
+    /**
+     * Lists the user's signed-in devices, most recently used first.
+     *
+     * @param userId - The user.
+     * @returns The sessions that have not ended or expired.
+     */
+    listActiveSessions(userId: string): Promise<SessionEntity[]>;
+    /**
+     * Switches the organization a device is working in, and returns a fresh access token that carries it
+     * (in the "org_id" and "org_role" claims).
+     *
+     * @param sessionId - The device's session.
+     * @param organizationId - The organization to switch to, or null for none.
+     * @param settings - The current settings.
+     * @returns A new access token and its lifetime in seconds.
+     */
+    switchActiveOrganization(sessionId: string, organizationId: string | null, settings: AuthSettings): Promise<{
+        accessToken: string;
+        expiresIn: number;
+    }>;
+    /**
+     * Creates a new access token and a new refresh token for a session.
+     *
+     * @param user - The session's user.
+     * @param session - The session the tokens belong to.
+     * @param settings - The current settings (token lifetimes).
+     * @returns The full token set to send to the client.
+     */
+    private issueTokens;
+    /**
+     * Signs an access token with the user's roles, how they signed in, and the active organization.
+     *
+     * @param user - The session's user.
+     * @param session - The session the token belongs to.
+     * @param settings - The current settings (access token lifetime).
+     * @returns The signed token and its lifetime in seconds.
+     */
+    private createAccessToken;
+    /**
+     * An already-used refresh token came back: it was copied. End the session; the real user simply
+     * signs in again. Does nothing if the token was never ours.
+     *
+     * @param tokenHash - The hash of the token that was sent.
+     * @param request - Who sent it (for the audit log).
+     */
+    private handleRefreshTokenReuse;
+}

package/dist/features/sessions/session.service.js

@@ -0,0 +1,308 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionService = void 0;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const typeorm_1 = require("typeorm");
+const auth_error_1 = require("../../common/auth-error.js");
+const jwt_1 = require("../../common/crypto/jwt.js");
+const random_secrets_1 = require("../../common/crypto/random-secrets.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const auth_events_service_1 = require("../events/auth-events.service.js");
+const signing_keys_service_1 = require("../signing-keys/signing-keys.service.js");
+const time_1 = require("../../common/time.js");
+/**
+ * Sessions (one per signed-in device) and the tokens that belong to them.
+ *
+ * - Access token: a signed JWT that lives a few minutes. Your API checks it on every request.
+ * - Refresh token: a random string that works ONCE to get a new pair of tokens. If an already-used
+ *   refresh token comes back, someone copied it, so we end that session to protect the user.
+ */
+let SessionService = class SessionService {
+    signingKeys;
+    events;
+    logger = new common_1.Logger(constants_1.LOG_CONTEXT.sessions);
+    database;
+    /** Token "iss" and "aud": your API's URL. */
+    issuer;
+    /** Short cache of "is this session still allowed?" answers, so the database isn't hit on every request. */
+    sessionCheckCache = new Map();
+    constructor(options, signingKeys, events) {
+        this.signingKeys = signingKeys;
+        this.events = events;
+        this.database = options.dataSource;
+        this.issuer = options.issuer.replace(constants_1.TRAILING_SLASHES_PATTERN, '');
+    }
+    /**
+     * Starts a session for a user who has just proven who they are, and returns their first tokens.
+     *
+     * @param user - The user signing in.
+     * @param signInMethod - How they signed in (goes into the token's "amr" claim).
+     * @param usedTwoFactor - Whether a second factor was used.
+     * @param request - The device's IP and user agent, shown in the user's device list.
+     * @param settings - The current settings (session and token lifetimes).
+     * @returns The access token, refresh token and session id.
+     */
+    async startSession(user, signInMethod, usedTwoFactor, request, settings) {
+        const now = new Date();
+        const session = await this.database.getRepository(entities_1.SessionEntity).save({
+            userId: user.id,
+            signInMethod,
+            usedTwoFactor,
+            ipAddress: request.ipAddress,
+            userAgent: request.userAgent,
+            lastUsedAt: now,
+            expiresAt: new Date(now.getTime() + settings.tokens.sessionDays * constants_1.DAY_IN_SECONDS * constants_1.SECOND_IN_MILLISECONDS),
+        });
+        return this.issueTokens(user, session, settings);
+    }
+    /**
+     * Swaps a refresh token for a new access token and a new refresh token.
+     * Each refresh token works exactly once; a second use ends the whole session.
+     *
+     * @param refreshToken - The "rt_..." token the client sent.
+     * @param request - Who is asking (for the audit log if the token was reused).
+     * @param settings - The current settings.
+     * @returns A new set of tokens for the same session.
+     * @throws AuthError INVALID_TOKEN when the token is unknown, used, expired, its session has
+     *   ended, or the account is no longer active.
+     */
+    async refreshSession(refreshToken, request, settings) {
+        if (!(0, random_secrets_1.hasRandomTokenFormat)(refreshToken, constants_1.TOKEN_PREFIX.refreshToken))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidRefreshToken);
+        const tokenHash = (0, random_secrets_1.sha256Hex)(refreshToken);
+        // Mark the token used in a single UPDATE: if two requests race, only one gets a row back.
+        const markAsUsed = await this.database
+            .createQueryBuilder()
+            .update(entities_1.RefreshTokenEntity)
+            .set({ usedAt: () => 'now()' })
+            .where('token_hash = :tokenHash AND used_at IS NULL AND expires_at > now()', { tokenHash })
+            // returning() takes entity property names; the raw rows use column names (session_id).
+            .returning(['sessionId'])
+            .execute();
+        const sessionId = markAsUsed.raw[0]?.session_id;
+        if (!sessionId) {
+            await this.handleRefreshTokenReuse(tokenHash, request);
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidRefreshToken);
+        }
+        const session = await this.database.getRepository(entities_1.SessionEntity).findOne({
+            where: { id: sessionId, revokedAt: (0, typeorm_1.IsNull)(), expiresAt: (0, typeorm_1.MoreThan)(new Date()) },
+        });
+        if (!session)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidRefreshToken);
+        // The account may have been suspended or deactivated since the last refresh.
+        const user = await this.database.getRepository(entities_1.UserEntity).findOne({ where: { id: session.userId } });
+        if (!user || user.status !== constants_1.ACCOUNT_STATUS.active) {
+            await this.revokeSession(session.id, constants_1.SESSION_END_REASON.accountNotActive);
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidRefreshToken);
+        }
+        await this.database.getRepository(entities_1.SessionEntity).update({ id: session.id }, { lastUsedAt: new Date() });
+        return this.issueTokens(user, session, settings);
+    }
+    /**
+     * Checks an access token's signature, issuer, audience and expiry.
+     * This does not check whether the session was ended since; see `isSessionStillAllowed`.
+     *
+     * @param accessToken - The token from the Authorization header.
+     * @returns The token's claims (user id, session id, roles...).
+     * @throws AuthError INVALID_TOKEN when any check fails.
+     */
+    async verifyAccessToken(accessToken) {
+        const { publicKeysById } = await this.signingKeys.getSigningKeys();
+        const claims = (0, jwt_1.verifyJwt)(accessToken, (keyId) => publicKeysById.get(keyId), {
+            allowedAlgorithm: constants_1.SIGNING_ALGORITHM,
+            expectedIssuers: [this.issuer],
+            expectedAudiences: [this.issuer],
+            expectedTokenType: constants_1.ACCESS_TOKEN_JWT_TYPE,
+        });
+        if (!claims || typeof claims.sub !== 'string' || typeof claims.sid !== 'string')
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidAccessToken);
+        return claims;
+    }
+    /**
+     * Checks that the session has not been ended and its user is ACTIVE.
+     * Answers are cached for a few seconds, so signing out or suspending takes effect almost at once
+     * without a database query on every request.
+     *
+     * @param sessionId - The "sid" claim from the access token.
+     * @param userId - The "sub" claim from the access token.
+     * @returns True when requests from this session should still be accepted.
+     */
+    async isSessionStillAllowed(sessionId, userId) {
+        const cached = this.sessionCheckCache.get(sessionId);
+        if (cached && Date.now() - cached.checkedAt < constants_1.SESSION_CHECK_CACHE_SECONDS * constants_1.SECOND_IN_MILLISECONDS)
+            return cached.isAllowed;
+        const matchingRows = await this.database
+            .getRepository(entities_1.SessionEntity)
+            .createQueryBuilder('session')
+            .innerJoin(entities_1.UserEntity, 'user', 'user.id = session.user_id')
+            .where('session.id = :sessionId AND session.user_id = :userId', { sessionId, userId })
+            .andWhere('session.revoked_at IS NULL AND session.expires_at > now()')
+            .andWhere('user.status = :activeStatus', { activeStatus: constants_1.ACCOUNT_STATUS.active })
+            .getCount();
+        const isAllowed = matchingRows === 1;
+        this.sessionCheckCache.set(sessionId, { isAllowed, checkedAt: Date.now() });
+        if (this.sessionCheckCache.size > constants_1.SESSION_CHECK_CACHE_MAX_ENTRIES)
+            this.sessionCheckCache.clear();
+        return isAllowed;
+    }
+    /**
+     * Ends one session.
+     *
+     * @param sessionId - The session to end.
+     * @param reason - Why it ended (stored, and shown in the audit log).
+     * @param userId - When given, the session is only ended if it belongs to this user.
+     * @returns False if nothing was ended (unknown, already ended, or someone else's session).
+     */
+    async revokeSession(sessionId, reason, userId) {
+        const result = await this.database
+            .getRepository(entities_1.SessionEntity)
+            .update({ id: sessionId, revokedAt: (0, typeorm_1.IsNull)(), ...(userId ? { userId } : {}) }, { revokedAt: new Date(), revokedReason: reason });
+        this.sessionCheckCache.delete(sessionId);
+        const wasRevoked = (result.affected ?? 0) > 0;
+        if (wasRevoked) {
+            await this.events.record({ name: constants_1.AUTH_EVENTS.sessionRevoked, userId: userId ?? null, details: { sessionId, reason } });
+        }
+        return wasRevoked;
+    }
+    /**
+     * Ends every session of a user, e.g. after a password change.
+     *
+     * @param userId - The user to sign out.
+     * @param reason - Why the sessions ended.
+     * @param keepSessionId - When given, this session (the device making the request) stays signed in.
+     * @returns How many sessions were ended.
+     */
+    async revokeAllSessions(userId, reason, keepSessionId) {
+        const result = await this.database
+            .getRepository(entities_1.SessionEntity)
+            .update({ userId, revokedAt: (0, typeorm_1.IsNull)(), ...(keepSessionId ? { id: (0, typeorm_1.Not)(keepSessionId) } : {}) }, { revokedAt: new Date(), revokedReason: reason });
+        this.sessionCheckCache.clear();
+        return result.affected ?? 0;
+    }
+    /**
+     * Lists the user's signed-in devices, most recently used first.
+     *
+     * @param userId - The user.
+     * @returns The sessions that have not ended or expired.
+     */
+    listActiveSessions(userId) {
+        return this.database.getRepository(entities_1.SessionEntity).find({
+            where: { userId, revokedAt: (0, typeorm_1.IsNull)(), expiresAt: (0, typeorm_1.MoreThan)(new Date()) },
+            order: { lastUsedAt: constants_1.SORT_ORDER.newestFirst },
+        });
+    }
+    /**
+     * Switches the organization a device is working in, and returns a fresh access token that carries it
+     * (in the "org_id" and "org_role" claims).
+     *
+     * @param sessionId - The device's session.
+     * @param organizationId - The organization to switch to, or null for none.
+     * @param settings - The current settings.
+     * @returns A new access token and its lifetime in seconds.
+     */
+    async switchActiveOrganization(sessionId, organizationId, settings) {
+        const session = await this.database.getRepository(entities_1.SessionEntity).findOneOrFail({ where: { id: sessionId } });
+        session.activeOrganizationId = organizationId;
+        await this.database.getRepository(entities_1.SessionEntity).update({ id: sessionId }, { activeOrganizationId: organizationId });
+        const user = await this.database.getRepository(entities_1.UserEntity).findOneOrFail({ where: { id: session.userId } });
+        return this.createAccessToken(user, session, settings);
+    }
+    /**
+     * Creates a new access token and a new refresh token for a session.
+     *
+     * @param user - The session's user.
+     * @param session - The session the tokens belong to.
+     * @param settings - The current settings (token lifetimes).
+     * @returns The full token set to send to the client.
+     */
+    async issueTokens(user, session, settings) {
+        const { accessToken, expiresIn } = await this.createAccessToken(user, session, settings);
+        const { plainToken: refreshToken, tokenHash } = (0, random_secrets_1.createRandomToken)(constants_1.TOKEN_PREFIX.refreshToken);
+        const refreshTokenLifetimeMs = settings.tokens.refreshTokenDays * constants_1.DAY_IN_SECONDS * constants_1.SECOND_IN_MILLISECONDS;
+        // A refresh token never outlives its session.
+        const refreshTokenExpiresAt = new Date(Math.min(Date.now() + refreshTokenLifetimeMs, session.expiresAt.getTime()));
+        await this.database.getRepository(entities_1.RefreshTokenEntity).insert({ sessionId: session.id, tokenHash, expiresAt: refreshTokenExpiresAt });
+        return {
+            accessToken,
+            expiresIn,
+            refreshToken,
+            refreshTokenExpiresAt: refreshTokenExpiresAt.toISOString(),
+            sessionId: session.id,
+        };
+    }
+    /**
+     * Signs an access token with the user's roles, how they signed in, and the active organization.
+     *
+     * @param user - The session's user.
+     * @param session - The session the token belongs to.
+     * @param settings - The current settings (access token lifetime).
+     * @returns The signed token and its lifetime in seconds.
+     */
+    async createAccessToken(user, session, settings) {
+        const { currentKey } = await this.signingKeys.getSigningKeys();
+        const issuedAt = (0, time_1.currentUnixTimeSeconds)();
+        const expiresIn = settings.tokens.accessTokenMinutes * constants_1.MINUTE_IN_SECONDS;
+        const organizationMembership = session.activeOrganizationId
+            ? await this.database.getRepository(entities_1.OrganizationMemberEntity).findOne({
+                where: { organizationId: session.activeOrganizationId, userId: user.id },
+            })
+            : null;
+        const claims = {
+            iss: this.issuer,
+            aud: this.issuer,
+            sub: user.id,
+            sid: session.id,
+            roles: user.roles,
+            amr: session.usedTwoFactor ? [session.signInMethod, constants_1.TWO_FACTOR_AMR_VALUE] : [session.signInMethod],
+            ...(organizationMembership ? { org_id: organizationMembership.organizationId, org_role: organizationMembership.role } : {}),
+            iat: issuedAt,
+            exp: issuedAt + expiresIn,
+            jti: (0, node_crypto_1.randomUUID)(),
+        };
+        return { accessToken: (0, jwt_1.signJwt)(claims, currentKey, constants_1.ACCESS_TOKEN_JWT_TYPE), expiresIn };
+    }
+    /**
+     * An already-used refresh token came back: it was copied. End the session; the real user simply
+     * signs in again. Does nothing if the token was never ours.
+     *
+     * @param tokenHash - The hash of the token that was sent.
+     * @param request - Who sent it (for the audit log).
+     */
+    async handleRefreshTokenReuse(tokenHash, request) {
+        const reusedToken = await this.database.getRepository(entities_1.RefreshTokenEntity).findOne({ where: { tokenHash, usedAt: (0, typeorm_1.Not)((0, typeorm_1.IsNull)()) } });
+        if (!reusedToken)
+            return;
+        const session = await this.database.getRepository(entities_1.SessionEntity).findOne({ where: { id: reusedToken.sessionId } });
+        if (!session || !(await this.revokeSession(session.id, constants_1.SESSION_END_REASON.refreshTokenReused)))
+            return;
+        this.logger.warn(`A used refresh token was presented again; session ${session.id} has been ended`);
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.refreshTokenReused,
+            userId: session.userId,
+            request,
+            details: { sessionId: session.id },
+        });
+    }
+};
+exports.SessionService = SessionService;
+exports.SessionService = SessionService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, signing_keys_service_1.SigningKeysService,
+        auth_events_service_1.AuthEventsService])
+], SessionService);
+//# sourceMappingURL=session.service.js.map

package/dist/features/sessions/session.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.service.js","sourceRoot":"","sources":["../../../src/features/sessions/session.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,6CAAyC;AACzC,qCAA4D;AAE5D,oDAAgD;AAChD,6CAAyD;AACzD,mEAAoG;AAEpG,2CAmBqB;AACrB,kDAA8G;AAC9G,+EAA0E;AAE1E,uFAAkF;AAElF,wCAAuD;AAEvD;;;;;;GAMG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAUN;IACA;IAVF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;IAC1C,QAAQ,CAAa;IACtC,6CAA6C;IACpC,MAAM,CAAS;IACxB,2GAA2G;IAC1F,iBAAiB,GAAG,IAAI,GAAG,EAAqD,CAAC;IAElG,YAC8B,OAAoB,EAC/B,WAA+B,EAC/B,MAAyB;QADzB,gBAAW,GAAX,WAAW,CAAoB;QAC/B,WAAM,GAAN,MAAM,CAAmB;QAE1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,oCAAwB,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAChB,IAAgB,EAChB,YAA0B,EAC1B,aAAsB,EACtB,OAAuB,EACvB,QAAsB;QAEtB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,IAAI,CAAC;YACpE,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,YAAY;YACZ,aAAa;YACb,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,0BAAc,GAAG,kCAAsB,CAAC;SAC3G,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,cAAc,CAAC,YAAqB,EAAE,OAAuB,EAAE,QAAsB;QACzF,IAAI,CAAC,IAAA,qCAAoB,EAAC,YAAY,EAAE,wBAAY,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,mBAAmB,CAAC,CAAC;QACzH,MAAM,SAAS,GAAG,IAAA,0BAAS,EAAC,YAAY,CAAC,CAAC;QAE1C,0FAA0F;QAC1F,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ;aACnC,kBAAkB,EAAE;aACpB,MAAM,CAAC,6BAAkB,CAAC;aAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;aAC9B,KAAK,CAAC,oEAAoE,EAAE,EAAE,SAAS,EAAE,CAAC;YAC3F,uFAAuF;aACtF,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC;aACxB,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAuB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC;QAEpE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,OAAO,CAAC;YACvE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,SAAS,EAAE,IAAA,kBAAQ,EAAC,IAAI,IAAI,EAAE,CAAC,EAAE;SAC/E,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,mBAAmB,CAAC,CAAC;QAEnE,6EAA6E;QAC7E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,8BAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC1E,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,WAAmB;QACzC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,IAAA,eAAS,EAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YAC1E,gBAAgB,EAAE,6BAAiB;YACnC,eAAe,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAC9B,iBAAiB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAChC,iBAAiB,EAAE,iCAAqB;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,kBAAkB,CAAC,CAAC;QACrI,OAAO,MAA2B,CAAC;IACrC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CAAC,SAAiB,EAAE,MAAc;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,uCAA2B,GAAG,kCAAsB;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC;QAE5H,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ;aACrC,aAAa,CAAC,wBAAa,CAAC;aAC5B,kBAAkB,CAAC,SAAS,CAAC;aAC7B,SAAS,CAAC,qBAAU,EAAE,MAAM,EAAE,2BAA2B,CAAC;aAC1D,KAAK,CAAC,uDAAuD,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;aACrF,QAAQ,CAAC,2DAA2D,CAAC;aACrE,QAAQ,CAAC,6BAA6B,EAAE,EAAE,YAAY,EAAE,0BAAc,CAAC,MAAM,EAAE,CAAC;aAChF,QAAQ,EAAE,CAAC;QAEd,MAAM,SAAS,GAAG,YAAY,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,2CAA+B;YAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAClG,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,MAAwB,EAAE,MAAe;QAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ;aAC/B,aAAa,CAAC,wBAAa,CAAC;aAC5B,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;QACnI,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,MAAwB,EAAE,aAAsB;QACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ;aAC/B,aAAa,CAAC,wBAAa,CAAC;aAC5B,MAAM,CACL,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAA,aAAG,EAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACrF,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CACjD,CAAC;QACJ,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,MAAc;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,IAAI,CAAC;YACrD,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,SAAS,EAAE,IAAA,kBAAQ,EAAC,IAAI,IAAI,EAAE,CAAC,EAAE;YACvE,KAAK,EAAE,EAAE,UAAU,EAAE,sBAAU,CAAC,WAAW,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,wBAAwB,CAAC,SAAiB,EAAE,cAA6B,EAAE,QAAsB;QACrG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7G,OAAO,CAAC,oBAAoB,GAAG,cAAc,CAAC;QAC9C,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC,CAAC;QACrH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5G,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CAAC,IAAgB,EAAE,OAAsB,EAAE,QAAsB;QACxF,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEzF,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,IAAA,kCAAiB,EAAC,wBAAY,CAAC,YAAY,CAAC,CAAC;QAC7F,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,CAAC,gBAAgB,GAAG,0BAAc,GAAG,kCAAsB,CAAC;QAC1G,8CAA8C;QAC9C,MAAM,qBAAqB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnH,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,6BAAkB,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAErI,OAAO;YACL,WAAW;YACX,SAAS;YACT,YAAY;YACZ,qBAAqB,EAAE,qBAAqB,CAAC,WAAW,EAAE;YAC1D,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iBAAiB,CAAC,IAAgB,EAAE,OAAsB,EAAE,QAAsB;QAC9F,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAA,6BAAsB,GAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,GAAG,6BAAiB,CAAC;QAEzE,MAAM,sBAAsB,GAAG,OAAO,CAAC,oBAAoB;YACzD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,mCAAwB,CAAC,CAAC,OAAO,CAAC;gBAClE,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;aACzE,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,MAAM,GAAsB;YAChC,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,GAAG,EAAE,IAAI,CAAC,MAAM;YAChB,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,GAAG,EAAE,OAAO,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,gCAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;YAClG,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC,cAAc,EAAE,QAAQ,EAAE,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3H,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,QAAQ,GAAG,SAAS;YACzB,GAAG,EAAE,IAAA,wBAAU,GAAE;SAClB,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,IAAA,aAAO,EAAC,MAAM,EAAE,UAAU,EAAE,iCAAqB,CAAC,EAAE,SAAS,EAAE,CAAC;IACxF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,uBAAuB,CAAC,SAAiB,EAAE,OAAuB;QAC9E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,6BAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAA,aAAG,EAAC,IAAA,gBAAM,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnI,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnH,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,8BAAkB,CAAC,kBAAkB,CAAC,CAAC;YAAE,OAAO;QAEvG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACnG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,kBAAkB;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO;YACP,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE;SACnC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AApSY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAUR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACG,yCAAkB;QACvB,uCAAiB;GAXjC,cAAc,CAoS1B"}

package/dist/features/sessions/session.types.d.ts

@@ -0,0 +1,34 @@
+import type { OrganizationRole } from '../../constants.js';
+/** How a user proved who they are (see SIGN_IN_METHOD in constants.ts). */
+export type { SignInMethod } from '../../constants.js';
+/** What the app gets after signing in or refreshing. */
+export interface TokenSet {
+    accessToken: string;
+    /** Seconds until the access token expires. */
+    expiresIn: number;
+    refreshToken: string;
+    refreshTokenExpiresAt: string;
+    sessionId: string;
+}
+/** What is inside an access token. Read it in your routes with @CurrentUser(). */
+export interface AccessTokenClaims {
+    /** Issuer: your API's URL. */
+    iss: string;
+    /** Audience: also your API's URL. */
+    aud: string;
+    /** The user's id. */
+    sub: string;
+    /** The session (device) id. */
+    sid: string;
+    /** App-wide roles, e.g. ["user"]. */
+    roles: string[];
+    /** How the user signed in, e.g. ["password", "two_factor"]. */
+    amr: string[];
+    /** Organization the user is working in on this device, if any. */
+    org_id?: string;
+    org_role?: OrganizationRole;
+    iat: number;
+    exp: number;
+    /** Unique token id. */
+    jti: string;
+}

package/dist/features/sessions/session.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=session.types.js.map

package/dist/features/sessions/session.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.types.js","sourceRoot":"","sources":["../../../src/features/sessions/session.types.ts"],"names":[],"mappings":""}

package/dist/features/settings/settings.defaults.d.ts

@@ -0,0 +1,2 @@
+/** The default settings live in constants.ts with every other fixed value. */
+export { DEFAULT_SETTINGS } from '../../constants.js';