@tinyrack/issuary-server 0.20.0

package/dist/services/container.d.ts

@@ -0,0 +1,229 @@
+import { type IssuaryRuntimeConfig } from '../lib/config/index.ts';
+import type { Logger } from '../lib/logger.ts';
+import { type ConfigSeedMode } from '../seeders/config.seeder.ts';
+import { CleanupService } from './cleanup.service.ts';
+import { EmailService } from './email.service.ts';
+import { JwtService } from './jwt.service.ts';
+import { MikroService } from './mikro.service.ts';
+import { OAuthAuthorizeService } from './oauth-authorize.service.ts';
+import { OAuthClientService } from './oauth-client.service.ts';
+import { OAuthConnectService } from './oauth-connect.service.ts';
+import { OAuthTokenService } from './oauth-token.service.ts';
+import { PasskeyService } from './passkey.service.ts';
+import { PasswordAuthService } from './password-auth.service.ts';
+import { PasswordResetService } from './password-reset.service.ts';
+import { SchedulerService } from './scheduler.service.ts';
+import { SecurityService } from './security.service.ts';
+import { TermsService } from './terms.service.ts';
+import { TotpService } from './totp.service.ts';
+import { UserService } from './user.service.ts';
+import { UserConsentService } from './user-consent.service.ts';
+export interface InitializeServicesOptions {
+    seedConfig?: ConfigSeedMode;
+}
+export declare function initializeServices(config: IssuaryRuntimeConfig, logger: Logger, options?: InitializeServicesOptions): Promise<{
+    services: {
+        config: {
+            server: {
+                public_origin: string;
+                listen_port: number;
+                trust_proxy: string | number | boolean | string[];
+            };
+            tokens: {
+                access_token_ttl: number;
+                refresh_token_ttl: number;
+                key_rotation: {
+                    enabled: boolean;
+                    interval_days: number;
+                    overlap_days: number;
+                };
+            };
+            i18n: {
+                supported_languages: ("en" | "ko" | "ja")[];
+                default_language: "en" | "ko" | "ja" | "auto";
+                fallback_language: "en" | "ko" | "ja";
+            };
+            branding: {
+                background_url: string;
+                title: Record<string, string>;
+                subtitle: Record<string, string>;
+                icon_url?: string | undefined;
+            };
+            registration: {
+                enabled: boolean;
+                allowed_email_patterns: string[];
+                email_verification_required: boolean;
+                signup_notice: Record<string, string>;
+            };
+            account_deletion: {
+                enabled: boolean;
+                retention: string;
+            };
+            admin: {
+                enabled: boolean;
+            };
+            logging: {
+                level: "error" | "trace" | "debug" | "info" | "warn" | "fatal" | "silent";
+                format: "json" | "pretty";
+            };
+            openapi: {
+                enabled: boolean;
+                title: string;
+                description: string;
+                ui_title: string;
+            };
+            auth: {
+                password: {
+                    enabled: boolean;
+                    two_factor: {
+                        enrollment_required: boolean;
+                    };
+                    totp: {
+                        enabled: boolean;
+                        issuer: string;
+                    };
+                    policy: {
+                        min_length: number;
+                        max_length: number;
+                    };
+                };
+                passkey: {
+                    enabled: boolean;
+                    rp_id?: string | undefined;
+                    origins?: string[] | undefined;
+                };
+                account_selection: {
+                    enabled: boolean;
+                    mode: "always" | "oidc_prompt" | "disabled" | "smart";
+                    remember_accounts: {
+                        enabled: boolean;
+                        max_accounts: number;
+                        ttl: string;
+                    };
+                    allow_add_account: boolean;
+                    allow_remove_account: boolean;
+                    login_hint: {
+                        behavior: "prefer" | "ignore" | "require_match";
+                    };
+                    prompt_none_error: "login_required" | "account_selection_required";
+                };
+            };
+            security: {
+                session_secret: string;
+                hash_secret: string;
+                pbkdf2_iterations: number;
+            };
+            cleanup: {
+                revoked_tokens: {
+                    enabled: boolean;
+                    retention: string;
+                };
+                oauth_codes: {
+                    enabled: boolean;
+                    consumed_retention: string;
+                };
+                email_verifications: {
+                    enabled: boolean;
+                    retention: string;
+                };
+                password_resets: {
+                    enabled: boolean;
+                    retention: string;
+                };
+                pending_oauth_registrations: {
+                    enabled: boolean;
+                    retention: string;
+                };
+            };
+            terms: {
+                id: string;
+                required: boolean;
+                consent_mode: "explicit" | "implicit";
+                version: string;
+                content: Record<string, {
+                    title: string;
+                    type: "link";
+                    content: string;
+                } | {
+                    title: string;
+                    type: "text";
+                    content: string;
+                }>;
+            }[];
+            clients: {
+                id: string;
+                name: string;
+                client_id: string;
+                redirect_uris: string[];
+                post_logout_redirect_uris: string[];
+                web_origins: string[];
+                response_types: ("code" | "id_token")[];
+                grant_types: ("refresh_token" | "implicit" | "authorization_code" | "client_credentials" | "urn:ietf:params:oauth:grant-type:device_code")[];
+                scope: string;
+                skip_consent: boolean;
+                logo_uri?: string | undefined;
+                client_secret?: string | undefined;
+                account_selection?: {
+                    mode: "inherit" | "never" | "always" | "oidc_prompt" | "smart";
+                    allow_add_account?: boolean | undefined;
+                } | undefined;
+            }[];
+            users: {
+                sub: string;
+                email: string;
+                password: string;
+                role: "user" | "admin";
+            }[];
+            database: import("../lib/config/database.ts").DatabaseConfig;
+            identity_providers: {
+                id: string;
+                type: "github" | "google" | "apple" | "generic_oauth";
+                enabled: boolean;
+                display_name: string;
+                client_id: string;
+                client_secret: string;
+                authorization_url: string;
+                token_url: string;
+                userinfo_url: string | null;
+                scopes: string[];
+                email_conflict_strategy: "auto_link" | "require_link";
+                userinfo_mapping: {
+                    id: string;
+                    email: string;
+                    email_verified?: string | undefined;
+                    name?: string | undefined;
+                    picture?: string | undefined;
+                };
+                icon_url?: string | undefined;
+                jwks_url?: string | undefined;
+                issuer?: string | undefined;
+                email_url?: string | undefined;
+                response_mode?: string | undefined;
+            }[];
+            scheduler?: import("../lib/config/scheduler.ts").SchedulerRuntimeConfig | undefined;
+            frontend?: import("../lib/config/frontend.ts").FrontendConfig | undefined;
+            email?: import("../lib/config/email.ts").EmailConfig | undefined;
+        };
+        securityService: SecurityService;
+        mikro: MikroService;
+        scheduler: SchedulerService;
+        emailService: EmailService;
+        jwtService: JwtService;
+        passwordAuthService: PasswordAuthService;
+        passwordResetService: PasswordResetService;
+        termsService: TermsService;
+        userConsentService: UserConsentService;
+        oauthClientService: OAuthClientService;
+        totpService: TotpService;
+        passkeyService: PasskeyService;
+        userService: UserService;
+        oauthAuthorizeService: OAuthAuthorizeService;
+        oauthConnectService: OAuthConnectService;
+        oauthTokenService: OAuthTokenService;
+        cleanupService: CleanupService;
+    };
+    cleanup: () => Promise<void>;
+}>;
+export type InitResult = Awaited<ReturnType<typeof initializeServices>>;
+export type ServiceContainer = InitResult['services'];
+//# sourceMappingURL=container.d.ts.map

package/dist/services/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/services/container.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,oBAAoB,EAC5B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiHxC;AAED,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC;AACxE,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC"}

package/dist/services/container.js

@@ -0,0 +1,82 @@
+import { isSchedulerConfigResolver, } from "../lib/config/index.js";
+import { seedConfigIfNeeded, } from "../seeders/config.seeder.js";
+import { CleanupService } from "./cleanup.service.js";
+import { EmailService } from "./email.service.js";
+import { JwtService } from "./jwt.service.js";
+import { MikroService } from "./mikro.service.js";
+import { OAuthAuthorizeService } from "./oauth-authorize.service.js";
+import { OAuthClientService } from "./oauth-client.service.js";
+import { OAuthConnectService } from "./oauth-connect.service.js";
+import { OAuthTokenService } from "./oauth-token.service.js";
+import { PasskeyService } from "./passkey.service.js";
+import { PasswordAuthService } from "./password-auth.service.js";
+import { PasswordResetService } from "./password-reset.service.js";
+import { SchedulerService } from "./scheduler.service.js";
+import { SecurityService } from "./security.service.js";
+import { TermsService } from "./terms.service.js";
+import { TotpService } from "./totp.service.js";
+import { UserService } from "./user.service.js";
+import { UserConsentService } from "./user-consent.service.js";
+export async function initializeServices(config, logger, options = {}) {
+    const securityService = new SecurityService(config);
+    // 1. Initialize MikroORM
+    const mikroLogger = logger.child({ service: 'mikro' });
+    const mikro = await MikroService.initialize(config, mikroLogger);
+    // 2. Bootstrap: seed config users/clients
+    const seeded = await seedConfigIfNeeded(mikro.orm.em.fork(), config, securityService, options.seedConfig);
+    logger.info({
+        users: config.users.length,
+        clients: config.clients.length,
+        seeded,
+    }, 'Bootstrap complete');
+    // 3. Create services (respecting dependency order)
+    const emailLogger = logger.child({ service: 'email' });
+    const emailService = new EmailService(config, mikro, emailLogger);
+    const jwtService = new JwtService(config, mikro);
+    const passwordAuthService = new PasswordAuthService(mikro, securityService, config.auth.password.policy);
+    const passwordResetService = new PasswordResetService(mikro, passwordAuthService);
+    const termsService = new TermsService(mikro);
+    const userConsentService = new UserConsentService(mikro);
+    const oauthClientService = new OAuthClientService(mikro, securityService);
+    const totpService = new TotpService(mikro, config, securityService);
+    const passkeyService = new PasskeyService(mikro, config);
+    const userService = new UserService(mikro, config, emailService, passwordAuthService, termsService);
+    const oauthAuthorizeService = new OAuthAuthorizeService(config, mikro, oauthClientService, userConsentService, securityService, jwtService);
+    const oauthConnectService = new OAuthConnectService(config, userService, mikro, termsService);
+    const oauthTokenService = new OAuthTokenService(config, mikro, userService, oauthClientService, jwtService, securityService);
+    const cleanupService = new CleanupService(config, mikro, jwtService);
+    // 4. Scheduler
+    const schedulerLogger = logger.child({ service: 'scheduler' });
+    const schedulerConfig = config.scheduler
+        ? isSchedulerConfigResolver(config.scheduler)
+            ? config.scheduler({ mikro })
+            : config.scheduler
+        : undefined;
+    const scheduler = new SchedulerService(schedulerConfig, cleanupService, schedulerLogger);
+    const services = {
+        config,
+        securityService,
+        mikro,
+        scheduler,
+        emailService,
+        jwtService,
+        passwordAuthService,
+        passwordResetService,
+        termsService,
+        userConsentService,
+        oauthClientService,
+        totpService,
+        passkeyService,
+        userService,
+        oauthAuthorizeService,
+        oauthConnectService,
+        oauthTokenService,
+        cleanupService,
+    };
+    const cleanup = async () => {
+        await scheduler.stop();
+        await mikro.close();
+    };
+    return { services, cleanup };
+}
+//# sourceMappingURL=container.js.map

package/dist/services/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/services/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA4B,EAC5B,MAAc,EACd,UAAqC,EAAE;IAEvC,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAEpD,yBAAyB;IACzB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEjE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EACnB,MAAM,EACN,eAAe,EACf,OAAO,CAAC,UAAU,CACnB,CAAC;IACF,MAAM,CAAC,IAAI,CACT;QACE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAC9B,MAAM;KACP,EACD,oBAAoB,CACrB,CAAC;IAEF,mDAAmD;IACnD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CACjD,KAAK,EACL,eAAe,EACf,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAC5B,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CACnD,KAAK,EACL,mBAAmB,CACpB,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,WAAW,CACjC,KAAK,EACL,MAAM,EACN,YAAY,EACZ,mBAAmB,EACnB,YAAY,CACb,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CACrD,MAAM,EACN,KAAK,EACL,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,UAAU,CACX,CAAC;IACF,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CACjD,MAAM,EACN,WAAW,EACX,KAAK,EACL,YAAY,CACb,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC7C,MAAM,EACN,KAAK,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,eAAe,CAChB,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAErE,eAAe;IACf,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS;QACtC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS;QACpB,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,IAAI,gBAAgB,CACpC,eAAe,EACf,cAAc,EACd,eAAe,CAChB,CAAC;IAEF,MAAM,QAAQ,GAAG;QACf,MAAM;QACN,eAAe;QACf,KAAK;QACL,SAAS;QACT,YAAY;QACZ,UAAU;QACV,mBAAmB;QACnB,oBAAoB;QACpB,YAAY;QACZ,kBAAkB;QAClB,kBAAkB;QAClB,WAAW;QACX,cAAc;QACd,WAAW;QACX,qBAAqB;QACrB,mBAAmB;QACnB,iBAAiB;QACjB,cAAc;KACf,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/services/email.service.d.ts

@@ -0,0 +1,69 @@
+import type { IEmailVerificationEntity } from '../entities/email-verification.entity.ts';
+import type { UserEntity } from '../entities/user.entity.ts';
+import type { IssuaryRuntimeConfig } from '../lib/config/index.ts';
+import { type Locale } from '../lib/locale.ts';
+import type { Logger } from '../lib/logger.ts';
+import type { MikroService } from './mikro.service.ts';
+export declare class EmailService {
+    private readonly transporter;
+    private readonly config;
+    private readonly mikro;
+    private readonly logger;
+    constructor(config: IssuaryRuntimeConfig, mikro: MikroService, logger: Logger);
+    /**
+     * Get the localized application name from branding.title config.
+     * Falls back through: specified locale -> fallback_language -> DEFAULT_LOCALE -> 'Issuary'
+     */
+    private getAppName;
+    sendVerificationEmail(params: {
+        email: string;
+        token: string;
+        locale?: Locale | undefined;
+    }): Promise<void>;
+    sendVerificationEmailAsync(params: {
+        email: string;
+        token: string;
+        locale?: Locale | undefined;
+    }): void;
+    sendPasswordResetEmail(params: {
+        email: string;
+        token: string;
+        locale?: Locale | undefined;
+    }): Promise<void>;
+    /**
+     * Send password reset email asynchronously (fire-and-forget)
+     * Logs errors but does not throw
+     */
+    sendPasswordResetEmailAsync(params: {
+        email: string;
+        token: string;
+        locale?: Locale | undefined;
+    }): void;
+    /**
+     * Generate email verification token for a user.
+     * Invalidates all previous unverified tokens.
+     * Throws EmailNotActivated if SMTP is not configured.
+     */
+    generateToken(params: {
+        userSub: string;
+        expiresInHours?: number;
+    }): Promise<IEmailVerificationEntity>;
+    /**
+     * Verify email with token.
+     * Marks user's email as verified.
+     * Throws EmailNotActivated if SMTP is not configured.
+     */
+    verifyEmail(token: string): Promise<UserEntity>;
+    /**
+     * Resend verification email.
+     * Generates new token and returns it.
+     * Throws EmailNotActivated if SMTP is not configured.
+     */
+    resendVerification(email: string): Promise<IEmailVerificationEntity>;
+    /**
+     * Check if user has pending verification.
+     * Throws EmailNotActivated if SMTP is not configured.
+     */
+    hasPendingVerification(userSub: string): Promise<boolean>;
+}
+//# sourceMappingURL=email.service.d.ts.map

package/dist/services/email.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.service.d.ts","sourceRoot":"","sources":["../../src/services/email.service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAEV,oBAAoB,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAkB,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAE9B,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM;IAchB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAeL,qBAAqB,CAAC,MAAM,EAAE;QACzC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BV,0BAA0B,CAAC,MAAM,EAAE;QACxC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B,GAAG,IAAI;IAMK,sBAAsB,CAAC,MAAM,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BjB;;;OAGG;IACI,2BAA2B,CAAC,MAAM,EAAE;QACzC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B,GAAG,IAAI;IAMR;;;;OAIG;IACU,aAAa,CAAC,MAAM,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAWrC;;;;OAIG;IACU,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAiB5D;;;;OAIG;IACU,kBAAkB,CAC7B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,CAAC;IAkBpC;;;OAGG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAWvE"}

package/dist/services/email.service.js

@@ -0,0 +1,164 @@
+import { renderPasswordResetEmail, renderVerificationEmail, } from "../emails/render.js";
+import { DEFAULT_LOCALE } from "../lib/locale.js";
+import { e } from "../schemas/error.js";
+export class EmailService {
+    transporter;
+    config;
+    mikro;
+    logger;
+    constructor(config, mikro, logger) {
+        this.config = config;
+        this.mikro = mikro;
+        this.logger = logger;
+        if (config.email) {
+            this.transporter = config.email.createTransport();
+            this.logger.info('Email transport initialized');
+        }
+        else {
+            this.transporter = null;
+            this.logger.warn('Email disabled: no email config');
+        }
+    }
+    /**
+     * Get the localized application name from branding.title config.
+     * Falls back through: specified locale -> fallback_language -> DEFAULT_LOCALE -> 'Issuary'
+     */
+    getAppName(locale) {
+        const title = this.config.branding.title;
+        if (!title) {
+            return 'Issuary';
+        }
+        const localeKey = locale ?? DEFAULT_LOCALE;
+        return (title[localeKey] ??
+            title[this.config.i18n.fallback_language] ??
+            title[DEFAULT_LOCALE] ??
+            'Issuary');
+    }
+    async sendVerificationEmail(params) {
+        if (!this.config.email || !this.transporter) {
+            throw new e.EmailNotActivated.Error();
+        }
+        const transporter = await this.transporter;
+        const verificationUrl = `${this.config.server.public_origin}/verify/email?token=${params.token}`;
+        const { html, text, subject } = await renderVerificationEmail({
+            verificationUrl,
+            token: params.token,
+            locale: params.locale,
+            appName: this.getAppName(params.locale),
+        });
+        await transporter.sendMail({
+            from: this.config.email.from,
+            to: params.email,
+            subject,
+            text,
+            html,
+        });
+        this.logger.info('Verification email sent');
+    }
+    sendVerificationEmailAsync(params) {
+        this.sendVerificationEmail(params).catch((err) => {
+            this.logger.error({ err }, 'Failed to send verification email');
+        });
+    }
+    async sendPasswordResetEmail(params) {
+        if (!this.config.email || !this.transporter) {
+            throw new e.EmailNotActivated.Error();
+        }
+        const transporter = await this.transporter;
+        const resetUrl = `${this.config.server.public_origin}/password/reset?token=${params.token}`;
+        const { html, text, subject } = await renderPasswordResetEmail({
+            resetUrl,
+            token: params.token,
+            locale: params.locale,
+            appName: this.getAppName(params.locale),
+        });
+        await transporter.sendMail({
+            from: this.config.email.from,
+            to: params.email,
+            subject,
+            text,
+            html,
+        });
+        this.logger.info('Password reset email sent');
+    }
+    /**
+     * Send password reset email asynchronously (fire-and-forget)
+     * Logs errors but does not throw
+     */
+    sendPasswordResetEmailAsync(params) {
+        this.sendPasswordResetEmail(params).catch((err) => {
+            this.logger.error({ err }, 'Failed to send password reset email');
+        });
+    }
+    /**
+     * Generate email verification token for a user.
+     * Invalidates all previous unverified tokens.
+     * Throws EmailNotActivated if SMTP is not configured.
+     */
+    async generateToken(params) {
+        if (!this.config.email) {
+            throw new e.EmailNotActivated.Error();
+        }
+        const token = await this.mikro.emailVerification.generateToken({
+            userSub: params.userSub,
+            expiresInHours: params.expiresInHours || 24,
+        });
+        return token;
+    }
+    /**
+     * Verify email with token.
+     * Marks user's email as verified.
+     * Throws EmailNotActivated if SMTP is not configured.
+     */
+    async verifyEmail(token) {
+        if (!this.config.email) {
+            throw new e.EmailNotActivated.Error();
+        }
+        const verification = await this.mikro.emailVerification.verifyToken(token);
+        if (!verification) {
+            throw new e.InvalidVerificationToken.Error();
+        }
+        const user = await verification.user.load();
+        if (!user) {
+            throw new e.UserNotFound.Error();
+        }
+        user.email_verified = true;
+        await this.mikro.em.flush();
+        return user;
+    }
+    /**
+     * Resend verification email.
+     * Generates new token and returns it.
+     * Throws EmailNotActivated if SMTP is not configured.
+     */
+    async resendVerification(email) {
+        if (!this.config.email) {
+            throw new e.EmailNotActivated.Error();
+        }
+        const user = await this.mikro.user.findOneOrFail({ email }, {
+            failHandler: () => new e.UserNotFound.Error(),
+        });
+        if (user.email_verified) {
+            throw new e.EmailAlreadyVerified.Error();
+        }
+        const token = await this.generateToken({ userSub: user.sub });
+        await this.mikro.em.flush();
+        return token;
+    }
+    /**
+     * Check if user has pending verification.
+     * Throws EmailNotActivated if SMTP is not configured.
+     */
+    async hasPendingVerification(userSub) {
+        if (!this.config.email) {
+            throw new e.EmailNotActivated.Error();
+        }
+        const count = await this.mikro.emailVerification.count({
+            user: { sub: userSub },
+            verified: false,
+            expiresAt: { $gt: new Date() },
+        });
+        return count > 0;
+    }
+}
+//# sourceMappingURL=email.service.js.map

package/dist/services/email.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.service.js","sourceRoot":"","sources":["../../src/services/email.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,qBAAsB,CAAC;AAO9B,OAAO,EAAE,cAAc,EAAe,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAGxC,MAAM,OAAO,YAAY;IACN,WAAW,CAAiC;IAE5C,MAAM,CAAuB;IAC7B,KAAK,CAAe;IACpB,MAAM,CAAS;IAChC,YACE,MAA4B,EAC5B,KAAmB,EACnB,MAAc;QAEd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,MAAe;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,cAAc,CAAC;QAC3C,OAAO,CACL,KAAK,CAAC,SAAS,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;YACzC,KAAK,CAAC,cAAc,CAAC;YACrB,SAAS,CACV,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAAC,MAIlC;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;QAE3C,MAAM,eAAe,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,uBAAuB,MAAM,CAAC,KAAK,EAAE,CAAC;QAEjG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC;YAC5D,eAAe;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC,QAAQ,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;YAC5B,EAAE,EAAE,MAAM,CAAC,KAAK;YAChB,OAAO;YACP,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IAEM,0BAA0B,CAAC,MAIjC;QACC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,sBAAsB,CAAC,MAInC;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;QAE3C,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC;QAE5F,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAwB,CAAC;YAC7D,QAAQ;YACR,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC,QAAQ,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;YAC5B,EAAE,EAAE,MAAM,CAAC,KAAK;YAChB,OAAO;YACP,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACI,2BAA2B,CAAC,MAIlC;QACC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,MAG1B;QACC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC;YAC7D,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SAC5C,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CAAC,KAAa;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAC7B,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAC9C,EAAE,KAAK,EAAE,EACT;YACE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CACF,CAAC;QACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,sBAAsB,CAAC,OAAe;QACjD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC;YACrD,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;YACtB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;CACF"}