@things-factory/auth-base 10.1.4 → 10.1.7

package/dist-server/service/role-template/role-template.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRoleTemplate = registerRoleTemplate;
+exports.roleTemplates = roleTemplates;
+exports.roleTemplateById = roleTemplateById;
+exports.computedRoleTemplates = computedRoleTemplates;
+exports.allRoleTemplates = allRoleTemplates;
+exports.unknownTemplateGrants = unknownTemplateGrants;
+exports.reportUnknownTemplateGrants = reportUnknownTemplateGrants;
+const env_1 = require("@things-factory/env");
+const REGISTRY = 'ROLE_TEMPLATES';
+process[REGISTRY] = {};
+function registry() {
+    return process[REGISTRY];
+}
+/**
+ * Declares a role template. Call it from the application's server entry.
+ *
+ * Categories are not checked here: registration runs while modules load, before the
+ * schema is built and therefore before `process['PRIVILEGES']` exists. The name check
+ * happens at boot instead (`reportUnknownTemplateGrants`).
+ */
+function registerRoleTemplate(template) {
+    if (!template?.id || !template?.name) {
+        throw new Error('A role template needs both an id and a name.');
+    }
+    if (!Array.isArray(template.grants)) {
+        throw new Error(`Role template "${template.id}" has no grants. Write \`grants: []\` if this seat is meant to ` +
+            'open nothing — leaving it out is indistinguishable from forgetting, and the screen cannot ' +
+            'tell an administrator which one it is.');
+    }
+    for (const grant of template.grants) {
+        if (!grant?.category || !Array.isArray(grant.axes) || grant.axes.length === 0) {
+            throw new Error(`Role template "${template.id}" has a grant without a category or with no axes. ` +
+                'Axes are always listed one by one.');
+        }
+        /*
+         * Across the nine roles operato-plant declares, no role is granted `mutation` on a
+         * category without `query` on the same category — you cannot fix what you cannot see.
+         * A template that does so is almost certainly a slip, so say it out loud rather than
+         * silently granting a half-usable seat.
+         */
+        if (grant.axes.includes('mutation') && !grant.axes.includes('query')) {
+            env_1.logger.warn(`[role-template] "${template.id}" grants ${grant.category}:mutation without ${grant.category}:query. ` +
+                'Someone who may change a thing but not see it can rarely use either.');
+        }
+    }
+    if (registry()[template.id]) {
+        throw new Error(`Role template "${template.id}" is declared twice.`);
+    }
+    registry()[template.id] = { ...template };
+}
+function roleTemplates() {
+    return Object.values(registry());
+}
+function roleTemplateById(id) {
+    return registry()[id];
+}
+/**
+ * The two templates the framework can build without knowing a single category name.
+ *
+ * Everything else has to be declared by an application: a job title spans modules
+ * (a production lead uses worklist *and* order *and* ops-master) and no one package knows
+ * that. These two are different — they are defined over whatever is declared, so they can
+ * be computed from the registry `@privilege` fills.
+ */
+function computedRoleTemplates() {
+    const declared = Object.values(process['PRIVILEGES'] || {});
+    const axesOf = new Map();
+    for (const [category, axis] of declared) {
+        if (!axesOf.has(category)) {
+            axesOf.set(category, new Set());
+        }
+        axesOf.get(category).add(axis);
+    }
+    const categories = [...axesOf.keys()].sort();
+    /*
+     * No description on either of these.
+     *
+     * They carried i18n keys, which the seeding path stored verbatim onto the role and the
+     * list then drew as the description. And a static sentence would be worse than what the
+     * screen already computes from `grants` — "opens 30 things across 30 modules" is exact
+     * and moves when the installation does.
+     */
+    const viewer = {
+        id: 'framework.viewer',
+        name: 'VIEWER',
+        grants: categories.filter(category => axesOf.get(category).has('query')).map(category => ({ category, axes: ['query'] }))
+    };
+    /*
+     * The one place that widens on purpose.
+     *
+     * Everywhere else an unenumerated axis is a defect waiting for the day a new axis is
+     * declared. Here "everything that exists" is the meaning of the template, so picking up
+     * a newly declared axis is correct rather than accidental.
+     */
+    const administrator = {
+        id: 'framework.administrator',
+        name: 'ADMINISTRATOR',
+        grants: categories.map(category => ({ category, axes: [...axesOf.get(category)].sort() }))
+    };
+    return [viewer, administrator];
+}
+/** Every template this installation offers — declared by apps, plus the computed two. */
+function allRoleTemplates() {
+    return [...computedRoleTemplates(), ...roleTemplates()];
+}
+/**
+ * Names a template mentions that this installation does not declare.
+ *
+ * A template that survives a category rename becomes a role that grants nothing, and that
+ * is the quietest way this design can fail — the administrator picks "quality inspector",
+ * gets a role, and it opens no doors. operato-plant's seed already does this for its own
+ * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same
+ * check moved to where templates are declared.
+ */
+function unknownTemplateGrants(template) {
+    const declared = process['PRIVILEGES'] || {};
+    return template.grants.flatMap(grant => grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]).map(axis => `${grant.category}:${axis}`));
+}
+function reportUnknownTemplateGrants() {
+    const unknown = roleTemplates().flatMap(template => unknownTemplateGrants(template).map(grant => `${template.id} → ${grant}`));
+    if (unknown.length) {
+        env_1.logger.warn(`[role-template] ${unknown.length} grants name privileges this installation does not declare — ` +
+            `${unknown.join(', ')}. Privilege definitions come from @privilege at boot, so either the query ` +
+            'is not installed here or the name has moved. A role seeded from such a template opens nothing.');
+    }
+}
+//# sourceMappingURL=role-template.js.map

package/dist-server/service/role-template/role-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-template.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template.ts"],"names":[],"mappings":";;AAmGA,oDAwCC;AAED,sCAEC;AAED,4CAEC;AAUD,sDAyCC;AAGD,4CAEC;AAWD,sDAMC;AAED,kEAYC;AA1OD,6CAA4C;AAoF5C,MAAM,QAAQ,GAAG,gBAAgB,CAAA;AAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;AAEtB,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,QAAsB;IACzD,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,iEAAiE;YAC5F,4FAA4F;YAC5F,wCAAwC,CAC3C,CAAA;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,oDAAoD;gBAC/E,oCAAoC,CACvC,CAAA;QACH,CAAC;QAED;;;;;WAKG;QACH,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,YAAM,CAAC,IAAI,CACT,oBAAoB,QAAQ,CAAC,EAAE,YAAY,KAAK,CAAC,QAAQ,qBAAqB,KAAK,CAAC,QAAQ,UAAU;gBACpG,sEAAsE,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAA;IACtE,CAAC;IAED,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;AAC3C,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,QAAQ,GAAuB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE7C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE5C;;;;;;;OAOG;IACH,MAAM,MAAM,GAAiB;QAC3B,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;KAC3H,CAAA;IAED;;;;;;OAMG;IACH,MAAM,aAAa,GAAiB;QAClC,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;KAC5F,CAAA;IAED,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAChC,CAAC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,GAAG,qBAAqB,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAsB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAE5C,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAC3G,CAAA;AACH,CAAC;AAED,SAAgB,2BAA2B;IACzC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CACjD,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC,CAC1E,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,YAAM,CAAC,IAAI,CACT,mBAAmB,OAAO,CAAC,MAAM,+DAA+D;YAC9F,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E;YACjG,gGAAgG,CACnG,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["import { logger } from '@things-factory/env'\n\n/**\n * Role templates — the seeds an application offers so a new domain does not start with\n * zero roles.\n *\n * ── Why this is a boot registry and not a table ───────────────────────────────\n * A template is a declaration. Copying it into rows per domain gives 100 domains x 3\n * templates = 300 rows, and once the code changes the template there is nowhere to ask\n * which of the two is true: the declaration, or the row that was written from an older\n * one. `@privilege` lives in the boot registry for the same reason.\n *\n * ── What a template is not ───────────────────────────────────────────────────\n * It is a seed, not a role. Once it has been used the resulting role belongs to the\n * administrator: the template is never re-applied and never overwrites. Nothing is written\n * onto the role to remember where it came from — what an administrator would want from\n * that (\"the template gained two privileges, here they are\") is the template's current\n * grants against the role's current privileges, and that is computed rather than stored.\n *\n * ── A role is one thing seen from three sides ────────────────────────────────\n * operato-plant uses roles as privilege bundles; operato-twin uses them as the seat an\n * approval line points at (`worklist` resolves an approver of type `Role` by id). Those\n * are not two concepts. A role is a seat in the organisation: what it opens, who fills it,\n * and whether approvals route to it. Splitting them would put two QUALITY-INSPECTORs in\n * one plant and force every person into both.\n */\n\n/** One module and the axes this template grants on it. Axes are always enumerated. */\nexport type RoleTemplateGrant = {\n  /** `@privilege(category:)` — what is guarded, not the package name. */\n  category: string\n  /**\n   * `query` / `mutation` / ... — listed one by one.\n   *\n   * There is deliberately no `'all'`. A template written as \"everything\" would widen on\n   * its own the day a new axis is declared, with nobody having touched it. The single\n   * place that may widen is the framework-computed administrator template, which means\n   * \"whatever exists now\" by definition.\n   */\n  axes: string[]\n}\n\nexport type RoleTemplate = {\n  /** Declaration key, namespaced by the declaring app: `plant.quality-inspector`. */\n  id: string\n  /**\n   * The role name created in the domain: `QUALITY-INSPECTOR`.\n   *\n   * Two apps may declare the same name on purpose — that is one seat, and the privileges\n   * become the union. The name is also a stored identifier: approval lines hold the role's\n   * id, so renaming here creates a second role and leaves the approval line pointing at\n   * the first. Renaming is a migration, not a template edit.\n   */\n  name: string\n  /**\n   * Plain text, not an i18n key.\n   *\n   * `createRoleFromTemplate` copies this onto the role it seeds, and the role list draws\n   * the role's description as a value — so a key written here reaches the screen as\n   * `label.role-template.administrator`. That is exactly what the framework's own two\n   * templates did until 2026-09-11.\n   *\n   * operato-plant had it right from the start: \"검사 기준과 처분을 정하는 자리\".\n   */\n  description?: string\n  /**\n   * Required, and may be empty.\n   *\n   * `[]` is a statement: this seat opens nothing, it exists for approval routing. A\n   * missing `grants` is a different thing — someone forgot — and is rejected here, so the\n   * screen can tell \"opens nothing on purpose\" from \"nothing was written down\".\n   */\n  grants: RoleTemplateGrant[]\n}\n\n/**\n * Registered form of a template.\n *\n * Identical to the declaration today. It stays a separate name because the registry is\n * what every reader goes through, and giving it its own type keeps a later addition from\n * rippling into every call site.\n */\nexport type RegisteredRoleTemplate = RoleTemplate\n\nconst REGISTRY = 'ROLE_TEMPLATES'\n\nprocess[REGISTRY] = {}\n\nfunction registry(): Record<string, RegisteredRoleTemplate> {\n  return process[REGISTRY]\n}\n\n/**\n * Declares a role template. Call it from the application's server entry.\n *\n * Categories are not checked here: registration runs while modules load, before the\n * schema is built and therefore before `process['PRIVILEGES']` exists. The name check\n * happens at boot instead (`reportUnknownTemplateGrants`).\n */\nexport function registerRoleTemplate(template: RoleTemplate): void {\n  if (!template?.id || !template?.name) {\n    throw new Error('A role template needs both an id and a name.')\n  }\n\n  if (!Array.isArray(template.grants)) {\n    throw new Error(\n      `Role template \"${template.id}\" has no grants. Write \\`grants: []\\` if this seat is meant to ` +\n        'open nothing — leaving it out is indistinguishable from forgetting, and the screen cannot ' +\n        'tell an administrator which one it is.'\n    )\n  }\n\n  for (const grant of template.grants) {\n    if (!grant?.category || !Array.isArray(grant.axes) || grant.axes.length === 0) {\n      throw new Error(\n        `Role template \"${template.id}\" has a grant without a category or with no axes. ` +\n          'Axes are always listed one by one.'\n      )\n    }\n\n    /*\n     * Across the nine roles operato-plant declares, no role is granted `mutation` on a\n     * category without `query` on the same category — you cannot fix what you cannot see.\n     * A template that does so is almost certainly a slip, so say it out loud rather than\n     * silently granting a half-usable seat.\n     */\n    if (grant.axes.includes('mutation') && !grant.axes.includes('query')) {\n      logger.warn(\n        `[role-template] \"${template.id}\" grants ${grant.category}:mutation without ${grant.category}:query. ` +\n          'Someone who may change a thing but not see it can rarely use either.'\n      )\n    }\n  }\n\n  if (registry()[template.id]) {\n    throw new Error(`Role template \"${template.id}\" is declared twice.`)\n  }\n\n  registry()[template.id] = { ...template }\n}\n\nexport function roleTemplates(): RegisteredRoleTemplate[] {\n  return Object.values(registry())\n}\n\nexport function roleTemplateById(id: string): RegisteredRoleTemplate | undefined {\n  return registry()[id]\n}\n\n/**\n * The two templates the framework can build without knowing a single category name.\n *\n * Everything else has to be declared by an application: a job title spans modules\n * (a production lead uses worklist *and* order *and* ops-master) and no one package knows\n * that. These two are different — they are defined over whatever is declared, so they can\n * be computed from the registry `@privilege` fills.\n */\nexport function computedRoleTemplates(): RegisteredRoleTemplate[] {\n  const declared: [string, string][] = Object.values(process['PRIVILEGES'] || {})\n  const axesOf = new Map<string, Set<string>>()\n\n  for (const [category, axis] of declared) {\n    if (!axesOf.has(category)) {\n      axesOf.set(category, new Set())\n    }\n    axesOf.get(category)!.add(axis)\n  }\n\n  const categories = [...axesOf.keys()].sort()\n\n  /*\n   * No description on either of these.\n   *\n   * They carried i18n keys, which the seeding path stored verbatim onto the role and the\n   * list then drew as the description. And a static sentence would be worse than what the\n   * screen already computes from `grants` — \"opens 30 things across 30 modules\" is exact\n   * and moves when the installation does.\n   */\n  const viewer: RoleTemplate = {\n    id: 'framework.viewer',\n    name: 'VIEWER',\n    grants: categories.filter(category => axesOf.get(category)!.has('query')).map(category => ({ category, axes: ['query'] }))\n  }\n\n  /*\n   * The one place that widens on purpose.\n   *\n   * Everywhere else an unenumerated axis is a defect waiting for the day a new axis is\n   * declared. Here \"everything that exists\" is the meaning of the template, so picking up\n   * a newly declared axis is correct rather than accidental.\n   */\n  const administrator: RoleTemplate = {\n    id: 'framework.administrator',\n    name: 'ADMINISTRATOR',\n    grants: categories.map(category => ({ category, axes: [...axesOf.get(category)!].sort() }))\n  }\n\n  return [viewer, administrator]\n}\n\n/** Every template this installation offers — declared by apps, plus the computed two. */\nexport function allRoleTemplates(): RegisteredRoleTemplate[] {\n  return [...computedRoleTemplates(), ...roleTemplates()]\n}\n\n/**\n * Names a template mentions that this installation does not declare.\n *\n * A template that survives a category rename becomes a role that grants nothing, and that\n * is the quietest way this design can fail — the administrator picks \"quality inspector\",\n * gets a role, and it opens no doors. operato-plant's seed already does this for its own\n * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same\n * check moved to where templates are declared.\n */\nexport function unknownTemplateGrants(template: RoleTemplate): string[] {\n  const declared = process['PRIVILEGES'] || {}\n\n  return template.grants.flatMap(grant =>\n    grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]).map(axis => `${grant.category}:${axis}`)\n  )\n}\n\nexport function reportUnknownTemplateGrants(): void {\n  const unknown = roleTemplates().flatMap(template =>\n    unknownTemplateGrants(template).map(grant => `${template.id} → ${grant}`)\n  )\n\n  if (unknown.length) {\n    logger.warn(\n      `[role-template] ${unknown.length} grants name privileges this installation does not declare — ` +\n        `${unknown.join(', ')}. Privilege definitions come from @privilege at boot, so either the query ` +\n        'is not installed here or the name has moved. A role seeded from such a template opens nothing.'\n    )\n  }\n}\n"]}

package/dist-server/service/user/user.d.ts

@@ -27,6 +27,7 @@ export declare class User {
     status: UserStatus;
     failCount: number;
     passwordUpdatedAt: Date;
+    lockedAt: Date;
     owner: boolean;
     credentials: WebAuthCredential[];
     usersAuthProviders: UsersAuthProviders[];

package/dist-server/service/user/user.js

@@ -13,6 +13,8 @@ const typeorm_1 = require("typeorm");
 const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
 const password_rule_js_1 = require("../../controllers/utils/password-rule.js");
+const account_lock_rule_js_1 = require("../../utils/account-lock-rule.js");
+const lock_duration_js_1 = require("../../utils/lock-duration.js");
 const auth_error_js_1 = require("../../errors/auth-error.js");
 const get_secret_js_1 = require("../../utils/get-secret.js");
 const role_js_1 = require("../role/role.js");
@@ -99,12 +101,23 @@ let User = User_1 = class User {
                         }
                     });
                 case UserStatus.LOCKED:
-                    throw new auth_error_js_1.AuthError({
-                        errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_LOCKED,
-                        detail: {
-                            email: user.email
-                        }
-                    });
+                    /*
+                     * 잠금이 아직 유효한지는 `utils/account-lock-rule.ts` 한 곳이 판정한다 — `signin` 과
+                     * 이 자리가 각자 판단하면 로그인은 되는데 요청은 거절되는 상태가 생긴다.
+                     *
+                     * **여기서는 행을 고치지 않는다.** 매 요청 지나는 경로라 쓰기를 얹지 않는다. 판정이
+                     * 「풀렸다」면 통과시키고, 행 정리(`ACTIVATED` · `failCount` 0 · `lockedAt` 비움)는
+                     * 다음 `signin` 이 한다.
+                     */
+                    if ((0, account_lock_rule_js_1.isAccountLocked)(user, new Date(), (0, lock_duration_js_1.lockDurationMinutes)())) {
+                        throw new auth_error_js_1.AuthError({
+                            errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_LOCKED,
+                            detail: {
+                                email: user.email
+                            }
+                        });
+                    }
+                    break;
                 case UserStatus.DELETED:
                     throw new auth_error_js_1.AuthError({
                         errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_DELETED
@@ -159,18 +172,31 @@ let User = User_1 = class User {
                         }
                     });
                 case UserStatus.LOCKED:
-                    throw new auth_error_js_1.AuthError({
-                        errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_LOCKED,
-                        detail: {
-                            email: user.email
-                        }
-                    });
+                    /*
+                     * 잠금이 아직 유효한지는 `utils/account-lock-rule.ts` 한 곳이 판정한다 — `signin` 과
+                     * 이 자리가 각자 판단하면 로그인은 되는데 요청은 거절되는 상태가 생긴다.
+                     *
+                     * **여기서는 행을 고치지 않는다.** 매 요청 지나는 경로라 쓰기를 얹지 않는다. 판정이
+                     * 「풀렸다」면 통과시키고, 행 정리(`ACTIVATED` · `failCount` 0 · `lockedAt` 비움)는
+                     * 다음 `signin` 이 한다.
+                     */
+                    if ((0, account_lock_rule_js_1.isAccountLocked)(user, new Date(), (0, lock_duration_js_1.lockDurationMinutes)())) {
+                        throw new auth_error_js_1.AuthError({
+                            errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_LOCKED,
+                            detail: {
+                                email: user.email
+                            }
+                        });
+                    }
+                    break;
                 case UserStatus.DELETED:
                     throw new auth_error_js_1.AuthError({
                         errorCode: auth_error_js_1.AuthError.ERROR_CODES.USER_DELETED
                     });
             }
-            const { defaultPassword } = env_1.config.get('password');
+            /* 설정이 없으면 `{}` 로 — 기본값 없이 구조 분해하면 `password` 를 설정하지 않은 배포에서
+               이 줄이 던진다. `password-rule.ts` 도 같은 자리에서 대비를 두고 있다. */
+            const { defaultPassword } = env_1.config.get('password', {});
             if (defaultPassword && user.password === this.encode(defaultPassword, user.salt)) {
                 user.status = UserStatus.PWD_RESET_REQUIRED;
             }
@@ -329,8 +355,24 @@ tslib_1.__decorate([
 tslib_1.__decorate([
     (0, typeorm_1.Column)({ nullable: true }),
     tslib_1.__metadata("design:type", Date // Last time the password was updated
+    /*
+     * When the account was locked, so the lock can lift on its own.
+     *
+     * The decision of whether a lock is still in effect lives in one place —
+     * `utils/account-lock-rule.ts` — because two callers ask: `signin`, and `checkAuth` on every
+     * request. A row locked before this column existed has no value here, and the rule keeps such a
+     * lock in effect rather than releasing it, so nothing opens quietly.
+     */
     )
 ], User.prototype, "passwordUpdatedAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({
+        nullable: true,
+        description: 'When the account was locked. With the configured lock duration this says when it lifts.'
+    }),
+    tslib_1.__metadata("design:type", Date)
+], User.prototype, "lockedAt", void 0);
 tslib_1.__decorate([
     (0, type_graphql_1.Field)({ nullable: true, description: 'Whether the user is the owner of the domain (not persisted in DB).' }),
     tslib_1.__metadata("design:type", Boolean)

package/dist-server/service/user/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../server/service/user/user.ts"],"names":[],"mappings":";AAAA,iGAAiG;AACjG,mGAAmG;;;;;AAEnG,4DAA2B;AAC3B,wEAA8B;AAC9B,+CAA+D;AAC/D,qDAAqD;AACrD,qCAagB;AAEhB,6CAA4C;AAC5C,iDAA+G;AAE/G,+EAAiF;AACjF,8DAAsD;AACtD,6DAAkD;AAClD,6CAAsC;AACtC,4DAAqD;AACrD,0FAAiF;AACjF,6FAAoF;AAEpF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAA;AAEpC,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,IAAI,CAAA;AAEhF,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,iCAAmB,CAAA;IACnB,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,4DAA8C,CAAA,CAAC,wDAAwD;AACzG,CAAC,EAPW,UAAU,0BAAV,UAAU,QAOrB;AAaM,IAAM,IAAI,YAAV,MAAM,IAAI;IA6Hf,8BAA8B;IAC9B,KAAK,CAAC,IAAI,CAAC,OAAQ;QACjB,IAAI,EAAE,SAAS,GAAG,oBAAoB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAExD,IAAI,IAAI,GAAG;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;QAED,OAAO,MAAM,sBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAM,EAAE;YAClC,SAAS;YACT,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,GAAG;QACzC,IAAA,yCAAsB,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,mBAAmB;IACnB,MAAM,CAAC,YAAY;QACjB,OAAO,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;IAED,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAI;QAClC,OAAO,gBAAM;aACV,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,sBAAM,CAAC;aACpC,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,QAAQ,CAAC,CAAA;IACrB,CAAC;IAED,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI;QAClC,OAAO,CACL,MAAM;YACJ,gBAAM;iBACH,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,sBAAM,CAAC;iBACpC,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC,QAAQ,CAAC;YACrB,MAAM;gBACJ,gBAAM;qBACH,UAAU,CAAC,MAAM,EAAE,IAAI,IAAI,sBAAM,CAAC;qBAClC,MAAM,CAAC,QAAQ,CAAC;qBAChB,MAAM,CAAC,QAAQ,CAAC,CACtB,CAAA;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO;QACrC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC,CAAA;QACtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAC/B,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;aACC,CAAC;YACJ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,UAAU,CAAC,QAAQ;oBACtB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;wBACnD,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,MAAM;oBACpB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;wBAC5C,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,OAAO;oBACrB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;qBAC9C,CAAC,CAAA;YACN,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO;QAC5B,2BAA2B;QAC3B,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAEtC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC,CAAA;QACtC,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACb,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI;aACZ,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,QAAQ,EAAE;gBACnB,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI;aACZ,CAAC,CAAA;YAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;oBAC9B,KAAK,EAAE;wBACL,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC;qBACvB;oBACD,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;oBACrC,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;aACC,CAAC;YACJ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,UAAU,CAAC,QAAQ;oBACtB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;wBACnD,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,MAAM;oBACpB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;wBAC5C,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,OAAO;oBACrB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;qBAC9C,CAAC,CAAA;YACN,CAAC;YAED,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAElD,IAAI,eAAe,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAA;YAC7C,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,QAAgB,EAAE,MAAc,EAAE,IAAU;QACvF,MAAM,YAAY,GAAG,IAAA,qBAAa,EAAC,wBAAS,CAAC;aAC1C,kBAAkB,CAAC,WAAW,CAAC;aAC/B,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC;aAC/B,KAAK,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC;aACrD,QAAQ,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC;aACtD,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAErD,IAAA,oCAA4B,EAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAA;QAE5C,OAAO,MAAM,GAAG,CAAC,CAAA;IACnB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAU,EAAE,MAAc;QAC3D,MAAM,YAAY,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC;aACrC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC;aACvC,iBAAiB,CAAC,iBAAiB,EAAE,WAAW,CAAC;aACjD,MAAM,CAAC,CAAC,6BAA6B,EAAE,gCAAgC,CAAC,CAAC;aACzE,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAElD,IAAA,oCAA4B,EAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,MAAM,YAAY;aAC9B,OAAO,CAAC,oBAAoB,CAAC;aAC7B,UAAU,CAAC,gBAAgB,CAAC;aAC5B,UAAU,EAAE,CAAA;QAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACxF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACnB,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC,EAAE,EAAE,CAAC,CAAA;QAEN,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAiB,EAAE,QAAgB,EAAE,IAAU;QAClF,MAAM,EAAE,uBAAuB,EAAE,GAAG,gEAAa,iCAAiC,GAAC,CAAA;QAEnF,OAAO,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;CACF,CAAA;AA7VY,oBAAI;AAGN;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;gCACnD;AAInB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;;sCACxD;AAIhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;;kCACrD;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;yCACpE;AAKnB;IAHC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAC1B,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACpC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAM,CAAC,EAAE,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;qCACxF;AAIlB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;;mCACrE;AAeb;IAbC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC;QACN,QAAQ,EAAE,IAAI;QACd,IAAI,EACF,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACpD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,MAAM,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;;sCACc;AAKhB;IAHC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;IAC5C,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;mCACxD;AAId;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;sCAC7F;AAIhB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;;uCACrF;AAIjB;IAFC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kCACf;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;;oCACxE;AAKd;IAHC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;mCAC3F;AAiBb;IAfC,IAAA,gBAAM,EAAC;QACN,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACnF,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAChH,MAAM,EAAE,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QAC9G,OAAO,EAAE,UAAU,CAAC,QAAQ;KAC7B,CAAC;IACD,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;;oCAC5D;AAGlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;uCACxB;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCACR,IAAI,CAAC,qCAAqC;;+CAAtC;AAGvB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;mCAC/F;AAGd;IADC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,0CAAiB,EAAE,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;;yCAClC;AAOhC;IALC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,4CAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;IAClF,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,4CAAkB,CAAC,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,uDAAuD;KACrE,CAAC;;gDACsC;AAIxC;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;sCACrE,IAAI;qCAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;uCACxB;AAIjB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;sCAC1E,IAAI;qCAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;uCACxB;AAIjB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;sCAC5E,IAAI;uCAAA;AAIf;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;sCACjF,IAAI;IAEf,8BAA8B;;uCAFf;eA3HJ,IAAI;IAXhB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,WAAW,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAChD,MAAM,EAAE,IAAI;KACb,CAAC;IACD,IAAA,eAAK,EAAC,WAAW,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QACnD,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,wBAAwB;KAChC,CAAC;IACD,IAAA,yBAAU,EAAC;QACV,WAAW,EAAE,oGAAoG;KAClH,CAAC;GACW,IAAI,CA6VhB","sourcesContent":["// This file defines the User entity and its GraphQL schema for authentication and authorization.\n// It includes user fields, status enum, and utility methods for password and privilege management.\n\nimport crypto from 'crypto'\nimport jwt from 'jsonwebtoken'\nimport { Directive, Field, ID, ObjectType } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport {\n  Column,\n  CreateDateColumn,\n  Entity,\n  ILike,\n  Index,\n  JoinTable,\n  ManyToMany,\n  ManyToOne,\n  OneToMany,\n  PrimaryGeneratedColumn,\n  RelationId,\n  UpdateDateColumn\n} from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { applyDomainInheritanceFilter, Domain, getRepository, InheritedValueType } from '@things-factory/shell'\n\nimport { validatePasswordByRule } from '../../controllers/utils/password-rule.js'\nimport { AuthError } from '../../errors/auth-error.js'\nimport { SECRET } from '../../utils/get-secret.js'\nimport { Role } from '../role/role.js'\nimport { Privilege } from '../privilege/privilege.js'\nimport { WebAuthCredential } from '../web-auth-credential/web-auth-credential.js'\nimport { UsersAuthProviders } from '../users-auth-providers/users-auth-providers.js'\n\nconst ORMCONFIG = config.get('ormconfig', {})\nconst DATABASE_TYPE = ORMCONFIG.type\n\nconst sessionExpirySeconds = Number(config.get('session/expirySeconds')) || '7d'\n\nexport enum UserStatus {\n  INACTIVE = 'inactive', // The user account is inactive and cannot log in.\n  ACTIVATED = 'activated', // The user account is active and can log in.\n  DELETED = 'deleted', // The user account has been deleted.\n  LOCKED = 'locked', // The user account is locked due to security reasons.\n  BANNED = 'banned', // The user account is banned from the system.\n  PWD_RESET_REQUIRED = 'password_reset_required' // The user must reset their password before logging in.\n}\n\n@Entity()\n@Index('ix_user_0', (user: User) => [user.email], {\n  unique: true\n})\n@Index('ix_user_1', (user: User) => [user.username], {\n  unique: true,\n  where: '\"username\" IS NOT NULL'\n})\n@ObjectType({\n  description: 'Represents a user account in the system, including authentication, roles, and domain associations.'\n})\nexport class User {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for the user.' })\n  readonly id: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Unique username for the user.' })\n  username: string\n\n  @Column()\n  @Field({ nullable: true, description: 'Full name of the user.' })\n  name: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Optional description or note about the user.' })\n  description: string\n\n  @ManyToMany(type => Domain)\n  @JoinTable({ name: 'users_domains' })\n  @Field(type => [Domain], { description: 'Domains (organizations, companies, etc.) the user belongs to.' })\n  domains?: Domain[]\n\n  @Column()\n  @Field(type => GraphQLEmailAddress, { description: 'Email address of the user.' })\n  email: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({\n    nullable: true,\n    type:\n      DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'longtext'\n        : DATABASE_TYPE == 'oracle'\n          ? 'clob'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined\n  })\n  password: string // Hashed password for authentication\n\n  @ManyToMany(type => Role, role => role.users)\n  @JoinTable({ name: 'users_roles' })\n  @Field(type => [Role], { description: 'Roles assigned to the user.' })\n  roles?: Role[]\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Type or category of the user (e.g., user, application, appliance).' })\n  userType: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Reference information for the user (external system, etc.).' })\n  reference: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({ nullable: true })\n  salt: string // Salt used for password hashing\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Locale or language preference for the user.' })\n  locale: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Single sign-on (SSO) identifier for federated authentication.' })\n  ssoId: string\n\n  @Column({\n    type:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'enum'\n        : DATABASE_TYPE == 'oracle'\n          ? 'varchar2'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    enum:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? UserStatus : undefined,\n    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,\n    default: UserStatus.INACTIVE\n  })\n  @Field(type => String, { description: 'Current status of the user account.' })\n  status: UserStatus\n\n  @Column({ type: 'smallint', default: 0 })\n  failCount: number // Number of failed login attempts\n\n  @Column({ nullable: true })\n  passwordUpdatedAt: Date // Last time the password was updated\n\n  @Field({ nullable: true, description: 'Whether the user is the owner of the domain (not persisted in DB).' })\n  owner: boolean /* should not be a column */\n\n  @OneToMany(() => WebAuthCredential, credential => credential.user)\n  credentials: WebAuthCredential[]\n\n  @OneToMany(() => UsersAuthProviders, usersAuthProviders => usersAuthProviders.user)\n  @Field(type => [UsersAuthProviders], {\n    nullable: true,\n    description: 'External authentication providers linked to the user.'\n  })\n  usersAuthProviders: UsersAuthProviders[]\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'User who created this user account.' })\n  creator: User\n\n  @RelationId((user: User) => user.creator)\n  creatorId: string\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'User who last updated this user account.' })\n  updater: User\n\n  @RelationId((user: User) => user.updater)\n  updaterId: string\n\n  @CreateDateColumn()\n  @Field({ nullable: true, description: 'Timestamp when the user account was created.' })\n  createdAt: Date\n\n  @UpdateDateColumn()\n  @Field({ nullable: true, description: 'Timestamp when the user account was last updated.' })\n  updatedAt: Date\n\n  /* signing for jsonwebtoken */\n  async sign(options?) {\n    var { expiresIn = sessionExpirySeconds } = options || {}\n\n    var user = {\n      username: this.username || this.email,\n      email: this.email\n    }\n\n    return await jwt.sign(user, SECRET, {\n      expiresIn,\n      issuer: 'hatiolab.com',\n      subject: 'user'\n    })\n  }\n\n  /* validate password through password rule */\n  static validatePasswordByRule(password, lng) {\n    validatePasswordByRule(password, lng)\n  }\n\n  /* generate salt */\n  static generateSalt() {\n    return crypto.randomBytes(16).toString('hex')\n  }\n\n  /* encode password */\n  static encode(password: string, salt) {\n    return crypto\n      .createHmac('sha256', salt || SECRET)\n      .update(password)\n      .digest('base64')\n  }\n\n  /* verify password */\n  static verify(hashed, password, salt) {\n    return (\n      hashed ==\n        crypto\n          .createHmac('sha256', salt || SECRET)\n          .update(password)\n          .digest('base64') ||\n      hashed ==\n        crypto\n          .createHmac('sha1', salt || SECRET)\n          .update(password)\n          .digest('base64')\n    )\n  }\n\n  static async checkAuthWithEmail(decoded) {\n    if (!decoded?.email) {\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    }\n\n    const repository = getRepository(User)\n    var user = await repository.findOne({\n      where: { email: decoded.email },\n      relations: ['domains'],\n      cache: true\n    })\n\n    if (!user)\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    else {\n      switch (user.status) {\n        case UserStatus.INACTIVE:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.LOCKED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.DELETED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_DELETED\n          })\n      }\n\n      return user\n    }\n  }\n\n  static async checkAuth(decoded) {\n    // id 는 하위호환성을 위해 단기적으로 유지함\n    const { id, username } = decoded || {}\n\n    if (!id && !username) {\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    }\n\n    const repository = getRepository(User)\n    if (id) {\n      var user = await repository.findOne({\n        where: { id },\n        relations: ['domains', 'credentials'],\n        cache: true\n      })\n    } else {\n      var user = await repository.findOne({\n        where: { username },\n        relations: ['domains', 'credentials'],\n        cache: true\n      })\n\n      if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n        user = await repository.findOne({\n          where: {\n            email: ILike(username)\n          },\n          relations: ['domains', 'credentials'],\n          cache: true\n        })\n      }\n    }\n\n    if (!user)\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    else {\n      switch (user.status) {\n        case UserStatus.INACTIVE:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.LOCKED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.DELETED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_DELETED\n          })\n      }\n\n      const { defaultPassword } = config.get('password')\n\n      if (defaultPassword && user.password === this.encode(defaultPassword, user.salt)) {\n        user.status = UserStatus.PWD_RESET_REQUIRED\n      }\n\n      return user\n    }\n  }\n\n  /**\n   * 역할은 부모 도메인으로부터 상속되므로, 권한 판정도 현재 도메인과 부모 도메인에 정의된\n   * 역할을 함께 본다 (상속 규약 단일 소스: `applyDomainInheritanceFilter`).\n   * 부모 역할이 형제 자식 도메인으로 번지지 않도록 하는 것은 체크인 게이트(`getUserDomains`)의\n   * 멤버십 조건이 담당한다.\n   */\n  static async hasPrivilege(privilege: string, category: string, domain: Domain, user: User): Promise<boolean> {\n    const queryBuilder = getRepository(Privilege)\n      .createQueryBuilder('privilege')\n      .innerJoin('privilege.roles', 'role')\n      .innerJoin('role.users', 'user')\n      .where('privilege.category = :category', { category })\n      .andWhere('privilege.name = :privilege', { privilege })\n      .andWhere('user.id = :userId', { userId: user.id })\n\n    applyDomainInheritanceFilter(queryBuilder, 'role', domain, InheritedValueType.Include)\n\n    const result = await queryBuilder.getCount()\n\n    return result > 0\n  }\n\n  static async getPrivilegesByDomain(user: User, domain: Domain): Promise<{ category: string; privilege: string }[]> {\n    const queryBuilder = getRepository(User)\n      .createQueryBuilder('user')\n      .leftJoinAndSelect('user.roles', 'role')\n      .leftJoinAndSelect('role.privileges', 'privilege')\n      .select(['privilege.name AS privilege', 'privilege.category AS category'])\n      .where('user.id = :userId', { userId: user.id })\n\n    applyDomainInheritanceFilter(queryBuilder, 'role', domain, InheritedValueType.Include)\n\n    const result = await queryBuilder\n      .orderBy('privilege.category')\n      .addOrderBy('privilege.name')\n      .getRawMany()\n\n    const distinct = result.reduce((acc, current) => {\n      const last = acc[acc.length - 1]\n      if (!last || last.privilege !== current.privilege || last.category !== current.category) {\n        acc.push(current)\n      }\n      return acc\n    }, [])\n\n    return distinct\n  }\n\n  /**\n   * 엔티티에서 조회 유틸을 정적으로 import 하면 순환 참조가 된다\n   * (user → get-user-domains → checkin-domain-facts → granted-role → role → user).\n   * 순환 참조 상태에서 엔티티 데코레이터가 평가되면 type-graphql 이 타입을 추론하지 못해\n   * 모듈 로드 자체가 실패하므로, 호출 시점에 지연 로드한다.\n   */\n  static async getDomainsWithPrivilege(privilege: string, category: string, user: User) {\n    const { getDomainsWithPrivilege } = await import('../../utils/get-user-domains.js')\n\n    return getDomainsWithPrivilege(user, privilege, category)\n  }\n}\n"]}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../server/service/user/user.ts"],"names":[],"mappings":";AAAA,iGAAiG;AACjG,mGAAmG;;;;;AAEnG,4DAA2B;AAC3B,wEAA8B;AAC9B,+CAA+D;AAC/D,qDAAqD;AACrD,qCAagB;AAEhB,6CAA4C;AAC5C,iDAA+G;AAE/G,+EAAiF;AACjF,2EAAkE;AAClE,mEAAkE;AAClE,8DAAsD;AACtD,6DAAkD;AAClD,6CAAsC;AACtC,4DAAqD;AACrD,0FAAiF;AACjF,6FAAoF;AAEpF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAA;AAEpC,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,IAAI,CAAA;AAEhF,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,iCAAmB,CAAA;IACnB,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,4DAA8C,CAAA,CAAC,wDAAwD;AACzG,CAAC,EAPW,UAAU,0BAAV,UAAU,QAOrB;AAaM,IAAM,IAAI,YAAV,MAAM,IAAI;IA4If,8BAA8B;IAC9B,KAAK,CAAC,IAAI,CAAC,OAAQ;QACjB,IAAI,EAAE,SAAS,GAAG,oBAAoB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAExD,IAAI,IAAI,GAAG;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;QAED,OAAO,MAAM,sBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAM,EAAE;YAClC,SAAS;YACT,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,GAAG;QACzC,IAAA,yCAAsB,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,mBAAmB;IACnB,MAAM,CAAC,YAAY;QACjB,OAAO,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;IAED,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAI;QAClC,OAAO,gBAAM;aACV,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,sBAAM,CAAC;aACpC,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,QAAQ,CAAC,CAAA;IACrB,CAAC;IAED,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI;QAClC,OAAO,CACL,MAAM;YACJ,gBAAM;iBACH,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,sBAAM,CAAC;iBACpC,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC,QAAQ,CAAC;YACrB,MAAM;gBACJ,gBAAM;qBACH,UAAU,CAAC,MAAM,EAAE,IAAI,IAAI,sBAAM,CAAC;qBAClC,MAAM,CAAC,QAAQ,CAAC;qBAChB,MAAM,CAAC,QAAQ,CAAC,CACtB,CAAA;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO;QACrC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC,CAAA;QACtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAC/B,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;aACC,CAAC;YACJ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,UAAU,CAAC,QAAQ;oBACtB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;wBACnD,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,MAAM;oBACpB;;;;;;;uBAOG;oBACH,IAAI,IAAA,sCAAe,EAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAA,sCAAmB,GAAE,CAAC,EAAE,CAAC;wBAC7D,MAAM,IAAI,yBAAS,CAAC;4BAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;4BAC5C,MAAM,EAAE;gCACN,KAAK,EAAE,IAAI,CAAC,KAAK;6BAClB;yBACF,CAAC,CAAA;oBACJ,CAAC;oBACD,MAAK;gBACP,KAAK,UAAU,CAAC,OAAO;oBACrB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;qBAC9C,CAAC,CAAA;YACN,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO;QAC5B,2BAA2B;QAC3B,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAEtC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC,CAAA;QACtC,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACb,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI;aACZ,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,QAAQ,EAAE;gBACnB,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI;aACZ,CAAC,CAAA;YAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;oBAC9B,KAAK,EAAE;wBACL,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC;qBACvB;oBACD,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;oBACrC,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;aACC,CAAC;YACJ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,UAAU,CAAC,QAAQ;oBACtB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;wBACnD,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,MAAM;oBACpB;;;;;;;uBAOG;oBACH,IAAI,IAAA,sCAAe,EAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAA,sCAAmB,GAAE,CAAC,EAAE,CAAC;wBAC7D,MAAM,IAAI,yBAAS,CAAC;4BAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;4BAC5C,MAAM,EAAE;gCACN,KAAK,EAAE,IAAI,CAAC,KAAK;6BAClB;yBACF,CAAC,CAAA;oBACJ,CAAC;oBACD,MAAK;gBACP,KAAK,UAAU,CAAC,OAAO;oBACrB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;qBAC9C,CAAC,CAAA;YACN,CAAC;YAED;mEACuD;YACvD,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;YAEtD,IAAI,eAAe,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAA;YAC7C,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,QAAgB,EAAE,MAAc,EAAE,IAAU;QACvF,MAAM,YAAY,GAAG,IAAA,qBAAa,EAAC,wBAAS,CAAC;aAC1C,kBAAkB,CAAC,WAAW,CAAC;aAC/B,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC;aAC/B,KAAK,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC;aACrD,QAAQ,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC;aACtD,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAErD,IAAA,oCAA4B,EAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAA;QAE5C,OAAO,MAAM,GAAG,CAAC,CAAA;IACnB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAU,EAAE,MAAc;QAC3D,MAAM,YAAY,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC;aACrC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC;aACvC,iBAAiB,CAAC,iBAAiB,EAAE,WAAW,CAAC;aACjD,MAAM,CAAC,CAAC,6BAA6B,EAAE,gCAAgC,CAAC,CAAC;aACzE,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAElD,IAAA,oCAA4B,EAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,MAAM,YAAY;aAC9B,OAAO,CAAC,oBAAoB,CAAC;aAC7B,UAAU,CAAC,gBAAgB,CAAC;aAC5B,UAAU,EAAE,CAAA;QAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACxF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACnB,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC,EAAE,EAAE,CAAC,CAAA;QAEN,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAiB,EAAE,QAAgB,EAAE,IAAU;QAClF,MAAM,EAAE,uBAAuB,EAAE,GAAG,gEAAa,iCAAiC,GAAC,CAAA;QAEnF,OAAO,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;CACF,CAAA;AApYY,oBAAI;AAGN;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;gCACnD;AAInB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;;sCACxD;AAIhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;;kCACrD;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;yCACpE;AAKnB;IAHC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAC1B,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACpC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAM,CAAC,EAAE,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;qCACxF;AAIlB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;;mCACrE;AAeb;IAbC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC;QACN,QAAQ,EAAE,IAAI;QACd,IAAI,EACF,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACpD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,MAAM,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;;sCACc;AAKhB;IAHC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;IAC5C,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;mCACxD;AAId;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;sCAC7F;AAIhB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;;uCACrF;AAIjB;IAFC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kCACf;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;;oCACxE;AAKd;IAHC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;mCAC3F;AAiBb;IAfC,IAAA,gBAAM,EAAC;QACN,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACnF,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAChH,MAAM,EAAE,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QAC9G,OAAO,EAAE,UAAU,CAAC,QAAQ;KAC7B,CAAC;IACD,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;;oCAC5D;AAGlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;uCACxB;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCACR,IAAI,CAAC,qCAAqC;IAE7D;;;;;;;OAOG;;+CAToB;AAevB;IALC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC;QACL,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,yFAAyF;KACvG,CAAC;sCACQ,IAAI;sCAAA;AAGd;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;mCAC/F;AAGd;IADC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,0CAAiB,EAAE,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;;yCAClC;AAOhC;IALC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,4CAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;IAClF,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,4CAAkB,CAAC,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,uDAAuD;KACrE,CAAC;;gDACsC;AAIxC;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;sCACrE,IAAI;qCAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;uCACxB;AAIjB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;sCAC1E,IAAI;qCAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;uCACxB;AAIjB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;sCAC5E,IAAI;uCAAA;AAIf;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;sCACjF,IAAI;IAEf,8BAA8B;;uCAFf;eA1IJ,IAAI;IAXhB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,WAAW,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAChD,MAAM,EAAE,IAAI;KACb,CAAC;IACD,IAAA,eAAK,EAAC,WAAW,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QACnD,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,wBAAwB;KAChC,CAAC;IACD,IAAA,yBAAU,EAAC;QACV,WAAW,EAAE,oGAAoG;KAClH,CAAC;GACW,IAAI,CAoYhB","sourcesContent":["// This file defines the User entity and its GraphQL schema for authentication and authorization.\n// It includes user fields, status enum, and utility methods for password and privilege management.\n\nimport crypto from 'crypto'\nimport jwt from 'jsonwebtoken'\nimport { Directive, Field, ID, ObjectType } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport {\n  Column,\n  CreateDateColumn,\n  Entity,\n  ILike,\n  Index,\n  JoinTable,\n  ManyToMany,\n  ManyToOne,\n  OneToMany,\n  PrimaryGeneratedColumn,\n  RelationId,\n  UpdateDateColumn\n} from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { applyDomainInheritanceFilter, Domain, getRepository, InheritedValueType } from '@things-factory/shell'\n\nimport { validatePasswordByRule } from '../../controllers/utils/password-rule.js'\nimport { isAccountLocked } from '../../utils/account-lock-rule.js'\nimport { lockDurationMinutes } from '../../utils/lock-duration.js'\nimport { AuthError } from '../../errors/auth-error.js'\nimport { SECRET } from '../../utils/get-secret.js'\nimport { Role } from '../role/role.js'\nimport { Privilege } from '../privilege/privilege.js'\nimport { WebAuthCredential } from '../web-auth-credential/web-auth-credential.js'\nimport { UsersAuthProviders } from '../users-auth-providers/users-auth-providers.js'\n\nconst ORMCONFIG = config.get('ormconfig', {})\nconst DATABASE_TYPE = ORMCONFIG.type\n\nconst sessionExpirySeconds = Number(config.get('session/expirySeconds')) || '7d'\n\nexport enum UserStatus {\n  INACTIVE = 'inactive', // The user account is inactive and cannot log in.\n  ACTIVATED = 'activated', // The user account is active and can log in.\n  DELETED = 'deleted', // The user account has been deleted.\n  LOCKED = 'locked', // The user account is locked due to security reasons.\n  BANNED = 'banned', // The user account is banned from the system.\n  PWD_RESET_REQUIRED = 'password_reset_required' // The user must reset their password before logging in.\n}\n\n@Entity()\n@Index('ix_user_0', (user: User) => [user.email], {\n  unique: true\n})\n@Index('ix_user_1', (user: User) => [user.username], {\n  unique: true,\n  where: '\"username\" IS NOT NULL'\n})\n@ObjectType({\n  description: 'Represents a user account in the system, including authentication, roles, and domain associations.'\n})\nexport class User {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for the user.' })\n  readonly id: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Unique username for the user.' })\n  username: string\n\n  @Column()\n  @Field({ nullable: true, description: 'Full name of the user.' })\n  name: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Optional description or note about the user.' })\n  description: string\n\n  @ManyToMany(type => Domain)\n  @JoinTable({ name: 'users_domains' })\n  @Field(type => [Domain], { description: 'Domains (organizations, companies, etc.) the user belongs to.' })\n  domains?: Domain[]\n\n  @Column()\n  @Field(type => GraphQLEmailAddress, { description: 'Email address of the user.' })\n  email: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({\n    nullable: true,\n    type:\n      DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'longtext'\n        : DATABASE_TYPE == 'oracle'\n          ? 'clob'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined\n  })\n  password: string // Hashed password for authentication\n\n  @ManyToMany(type => Role, role => role.users)\n  @JoinTable({ name: 'users_roles' })\n  @Field(type => [Role], { description: 'Roles assigned to the user.' })\n  roles?: Role[]\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Type or category of the user (e.g., user, application, appliance).' })\n  userType: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Reference information for the user (external system, etc.).' })\n  reference: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({ nullable: true })\n  salt: string // Salt used for password hashing\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Locale or language preference for the user.' })\n  locale: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Single sign-on (SSO) identifier for federated authentication.' })\n  ssoId: string\n\n  @Column({\n    type:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'enum'\n        : DATABASE_TYPE == 'oracle'\n          ? 'varchar2'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    enum:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? UserStatus : undefined,\n    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,\n    default: UserStatus.INACTIVE\n  })\n  @Field(type => String, { description: 'Current status of the user account.' })\n  status: UserStatus\n\n  @Column({ type: 'smallint', default: 0 })\n  failCount: number // Number of failed login attempts\n\n  @Column({ nullable: true })\n  passwordUpdatedAt: Date // Last time the password was updated\n\n  /*\n   * When the account was locked, so the lock can lift on its own.\n   *\n   * The decision of whether a lock is still in effect lives in one place —\n   * `utils/account-lock-rule.ts` — because two callers ask: `signin`, and `checkAuth` on every\n   * request. A row locked before this column existed has no value here, and the rule keeps such a\n   * lock in effect rather than releasing it, so nothing opens quietly.\n   */\n  @Column({ nullable: true })\n  @Field({\n    nullable: true,\n    description: 'When the account was locked. With the configured lock duration this says when it lifts.'\n  })\n  lockedAt: Date\n\n  @Field({ nullable: true, description: 'Whether the user is the owner of the domain (not persisted in DB).' })\n  owner: boolean /* should not be a column */\n\n  @OneToMany(() => WebAuthCredential, credential => credential.user)\n  credentials: WebAuthCredential[]\n\n  @OneToMany(() => UsersAuthProviders, usersAuthProviders => usersAuthProviders.user)\n  @Field(type => [UsersAuthProviders], {\n    nullable: true,\n    description: 'External authentication providers linked to the user.'\n  })\n  usersAuthProviders: UsersAuthProviders[]\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'User who created this user account.' })\n  creator: User\n\n  @RelationId((user: User) => user.creator)\n  creatorId: string\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'User who last updated this user account.' })\n  updater: User\n\n  @RelationId((user: User) => user.updater)\n  updaterId: string\n\n  @CreateDateColumn()\n  @Field({ nullable: true, description: 'Timestamp when the user account was created.' })\n  createdAt: Date\n\n  @UpdateDateColumn()\n  @Field({ nullable: true, description: 'Timestamp when the user account was last updated.' })\n  updatedAt: Date\n\n  /* signing for jsonwebtoken */\n  async sign(options?) {\n    var { expiresIn = sessionExpirySeconds } = options || {}\n\n    var user = {\n      username: this.username || this.email,\n      email: this.email\n    }\n\n    return await jwt.sign(user, SECRET, {\n      expiresIn,\n      issuer: 'hatiolab.com',\n      subject: 'user'\n    })\n  }\n\n  /* validate password through password rule */\n  static validatePasswordByRule(password, lng) {\n    validatePasswordByRule(password, lng)\n  }\n\n  /* generate salt */\n  static generateSalt() {\n    return crypto.randomBytes(16).toString('hex')\n  }\n\n  /* encode password */\n  static encode(password: string, salt) {\n    return crypto\n      .createHmac('sha256', salt || SECRET)\n      .update(password)\n      .digest('base64')\n  }\n\n  /* verify password */\n  static verify(hashed, password, salt) {\n    return (\n      hashed ==\n        crypto\n          .createHmac('sha256', salt || SECRET)\n          .update(password)\n          .digest('base64') ||\n      hashed ==\n        crypto\n          .createHmac('sha1', salt || SECRET)\n          .update(password)\n          .digest('base64')\n    )\n  }\n\n  static async checkAuthWithEmail(decoded) {\n    if (!decoded?.email) {\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    }\n\n    const repository = getRepository(User)\n    var user = await repository.findOne({\n      where: { email: decoded.email },\n      relations: ['domains'],\n      cache: true\n    })\n\n    if (!user)\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    else {\n      switch (user.status) {\n        case UserStatus.INACTIVE:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.LOCKED:\n          /*\n           * 잠금이 아직 유효한지는 `utils/account-lock-rule.ts` 한 곳이 판정한다 — `signin` 과\n           * 이 자리가 각자 판단하면 로그인은 되는데 요청은 거절되는 상태가 생긴다.\n           *\n           * **여기서는 행을 고치지 않는다.** 매 요청 지나는 경로라 쓰기를 얹지 않는다. 판정이\n           * 「풀렸다」면 통과시키고, 행 정리(`ACTIVATED` · `failCount` 0 · `lockedAt` 비움)는\n           * 다음 `signin` 이 한다.\n           */\n          if (isAccountLocked(user, new Date(), lockDurationMinutes())) {\n            throw new AuthError({\n              errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n              detail: {\n                email: user.email\n              }\n            })\n          }\n          break\n        case UserStatus.DELETED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_DELETED\n          })\n      }\n\n      return user\n    }\n  }\n\n  static async checkAuth(decoded) {\n    // id 는 하위호환성을 위해 단기적으로 유지함\n    const { id, username } = decoded || {}\n\n    if (!id && !username) {\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    }\n\n    const repository = getRepository(User)\n    if (id) {\n      var user = await repository.findOne({\n        where: { id },\n        relations: ['domains', 'credentials'],\n        cache: true\n      })\n    } else {\n      var user = await repository.findOne({\n        where: { username },\n        relations: ['domains', 'credentials'],\n        cache: true\n      })\n\n      if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n        user = await repository.findOne({\n          where: {\n            email: ILike(username)\n          },\n          relations: ['domains', 'credentials'],\n          cache: true\n        })\n      }\n    }\n\n    if (!user)\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    else {\n      switch (user.status) {\n        case UserStatus.INACTIVE:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.LOCKED:\n          /*\n           * 잠금이 아직 유효한지는 `utils/account-lock-rule.ts` 한 곳이 판정한다 — `signin` 과\n           * 이 자리가 각자 판단하면 로그인은 되는데 요청은 거절되는 상태가 생긴다.\n           *\n           * **여기서는 행을 고치지 않는다.** 매 요청 지나는 경로라 쓰기를 얹지 않는다. 판정이\n           * 「풀렸다」면 통과시키고, 행 정리(`ACTIVATED` · `failCount` 0 · `lockedAt` 비움)는\n           * 다음 `signin` 이 한다.\n           */\n          if (isAccountLocked(user, new Date(), lockDurationMinutes())) {\n            throw new AuthError({\n              errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n              detail: {\n                email: user.email\n              }\n            })\n          }\n          break\n        case UserStatus.DELETED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_DELETED\n          })\n      }\n\n      /* 설정이 없으면 `{}` 로 — 기본값 없이 구조 분해하면 `password` 를 설정하지 않은 배포에서\n         이 줄이 던진다. `password-rule.ts` 도 같은 자리에서 대비를 두고 있다. */\n      const { defaultPassword } = config.get('password', {})\n\n      if (defaultPassword && user.password === this.encode(defaultPassword, user.salt)) {\n        user.status = UserStatus.PWD_RESET_REQUIRED\n      }\n\n      return user\n    }\n  }\n\n  /**\n   * 역할은 부모 도메인으로부터 상속되므로, 권한 판정도 현재 도메인과 부모 도메인에 정의된\n   * 역할을 함께 본다 (상속 규약 단일 소스: `applyDomainInheritanceFilter`).\n   * 부모 역할이 형제 자식 도메인으로 번지지 않도록 하는 것은 체크인 게이트(`getUserDomains`)의\n   * 멤버십 조건이 담당한다.\n   */\n  static async hasPrivilege(privilege: string, category: string, domain: Domain, user: User): Promise<boolean> {\n    const queryBuilder = getRepository(Privilege)\n      .createQueryBuilder('privilege')\n      .innerJoin('privilege.roles', 'role')\n      .innerJoin('role.users', 'user')\n      .where('privilege.category = :category', { category })\n      .andWhere('privilege.name = :privilege', { privilege })\n      .andWhere('user.id = :userId', { userId: user.id })\n\n    applyDomainInheritanceFilter(queryBuilder, 'role', domain, InheritedValueType.Include)\n\n    const result = await queryBuilder.getCount()\n\n    return result > 0\n  }\n\n  static async getPrivilegesByDomain(user: User, domain: Domain): Promise<{ category: string; privilege: string }[]> {\n    const queryBuilder = getRepository(User)\n      .createQueryBuilder('user')\n      .leftJoinAndSelect('user.roles', 'role')\n      .leftJoinAndSelect('role.privileges', 'privilege')\n      .select(['privilege.name AS privilege', 'privilege.category AS category'])\n      .where('user.id = :userId', { userId: user.id })\n\n    applyDomainInheritanceFilter(queryBuilder, 'role', domain, InheritedValueType.Include)\n\n    const result = await queryBuilder\n      .orderBy('privilege.category')\n      .addOrderBy('privilege.name')\n      .getRawMany()\n\n    const distinct = result.reduce((acc, current) => {\n      const last = acc[acc.length - 1]\n      if (!last || last.privilege !== current.privilege || last.category !== current.category) {\n        acc.push(current)\n      }\n      return acc\n    }, [])\n\n    return distinct\n  }\n\n  /**\n   * 엔티티에서 조회 유틸을 정적으로 import 하면 순환 참조가 된다\n   * (user → get-user-domains → checkin-domain-facts → granted-role → role → user).\n   * 순환 참조 상태에서 엔티티 데코레이터가 평가되면 type-graphql 이 타입을 추론하지 못해\n   * 모듈 로드 자체가 실패하므로, 호출 시점에 지연 로드한다.\n   */\n  static async getDomainsWithPrivilege(privilege: string, category: string, user: User) {\n    const { getDomainsWithPrivilege } = await import('../../utils/get-user-domains.js')\n\n    return getDomainsWithPrivilege(user, privilege, category)\n  }\n}\n"]}