@tinyrack/issuary-server 0.21.0 → 0.22.0

package/dist/lib/config/resolved.d.ts

@@ -123,6 +123,7 @@ export declare const IssuaryRuntimeConfigSchema: z.ZodObject<{
         session_secret: z.ZodString;
         hash_secret: z.ZodString;
         pbkdf2_iterations: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>>;
+        retire_legacy_v1_credentials: z.ZodDefault<z.ZodBoolean>;
     }, z.z.core.$strict>;
     cleanup: z.ZodDefault<z.ZodObject<{
         revoked_tokens: z.ZodDefault<z.ZodObject<{

package/dist/lib/config/resolved.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolved.d.ts","sourceRoot":"","sources":["../../../src/lib/config/resolved.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAsBpB,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA0CM,CAAC;AAE9C,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,0BAA0B,CAClC,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
+{"version":3,"file":"resolved.d.ts","sourceRoot":"","sources":["../../../src/lib/config/resolved.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAsBpB,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBA0CM,CAAC;AAE9C,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,0BAA0B,CAClC,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/lib/config/security.d.ts

@@ -1,11 +1,13 @@
 import z from 'zod';
 export declare const SECURITY_CONFIG_DEFAULT: {
     pbkdf2_iterations: number;
+    retire_legacy_v1_credentials: boolean;
 };
 export declare const SecurityConfigSchema: z.ZodObject<{
     session_secret: z.ZodString;
     hash_secret: z.ZodString;
     pbkdf2_iterations: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>>;
+    retire_legacy_v1_credentials: z.ZodDefault<z.ZodBoolean>;
 }, z.z.core.$strict>;
 export type SecurityConfig = z.infer<typeof SecurityConfigSchema>;
 //# sourceMappingURL=security.d.ts.map

package/dist/lib/config/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAIpB,eAAO,MAAM,uBAAuB;;CAEnC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;oBA4D4C,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAIpB,eAAO,MAAM,uBAAuB;;;CAGnC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;oBAkE4C,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/lib/config/security.js

@@ -3,6 +3,7 @@ import { zz } from "../../schemas/provider.js";
 import { fromBase64Url } from "../base64url.js";
 export const SECURITY_CONFIG_DEFAULT = {
     pbkdf2_iterations: 600000,
+    retire_legacy_v1_credentials: false,
 };
 export const SecurityConfigSchema = z
     .object({
@@ -59,6 +60,10 @@ export const SecurityConfigSchema = z
         .pipe(zz.coerceInt().pipe(z.number().int().min(1)))
         .default(SECURITY_CONFIG_DEFAULT.pbkdf2_iterations)
         .describe('Number of PBKDF2 iterations for password hashing.'),
+    retire_legacy_v1_credentials: z
+        .boolean()
+        .default(SECURITY_CONFIG_DEFAULT.retire_legacy_v1_credentials)
+        .describe('Irreversibly retire v1 password, client-secret, recovery-code, and OAuth-code hashes at startup.'),
 })
     .strict()
     .describe('Security configuration for secrets and cryptographic settings.');

package/dist/lib/config/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,iBAAiB,EAAE,MAAM;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yJAAyJ,CAC1J;SACA,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,2EAA2E;aAC9E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,2DAA2D;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,8EAA8E,UAAU,WAAW,KAAK,CAAC,MAAM,kBAAkB;aAC3I,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,yDAAyD,CAAC;SACnE,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,wDAAwD;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC/B,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAClD,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC;SAClD,QAAQ,CAAC,mDAAmD,CAAC;CACjE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,gEAAgE,CAAC,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,iBAAiB,EAAE,MAAM;IACzB,4BAA4B,EAAE,KAAK;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yJAAyJ,CAC1J;SACA,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,2EAA2E;aAC9E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,2DAA2D;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,8EAA8E,UAAU,WAAW,KAAK,CAAC,MAAM,kBAAkB;aAC3I,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,yDAAyD,CAAC;SACnE,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,wDAAwD;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC/B,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAClD,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC;SAClD,QAAQ,CAAC,mDAAmD,CAAC;IAChE,4BAA4B,EAAE,CAAC;SAC5B,OAAO,EAAE;SACT,OAAO,CAAC,uBAAuB,CAAC,4BAA4B,CAAC;SAC7D,QAAQ,CACP,kGAAkG,CACnG;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,gEAAgE,CAAC,CAAC"}

package/dist/middleware/auth.d.ts

@@ -45,6 +45,14 @@ export declare const verifyPending2FASetupUser: <Optional extends boolean = fals
 }) => import("hono").MiddlewareHandler<{
     Variables: SessionEnv["Variables"] & ServicesEnv["Variables"] & VerifiedPending2FASetupUserEnv<Optional>["Variables"];
 }, string, {}, Response>;
+type VerifiedPasswordResetEnv = {
+    Variables: {
+        verifiedPasswordResetUser: UserEntity;
+    };
+};
+export declare const verifyPasswordResetUser: () => import("hono").MiddlewareHandler<{
+    Variables: SessionEnv["Variables"] & ServicesEnv["Variables"] & VerifiedPasswordResetEnv["Variables"];
+}, string, {}, Response>;
 type VerifiedPasskeyChallengeEnv = {
     Variables: {
         verifiedPasskeyChallenge: string;

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,KAAK,eAAe,CAAC,QAAQ,SAAS,OAAO,IAAI;IAC/C,SAAS,EAAE;QACT,YAAY,EAAE,QAAQ,SAAS,IAAI,GAC/B,YAAY,GAAG,SAAS,GACxB,YAAY,CAAC;KAClB,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,QAAQ,SAAS,OAAO,GAAG,KAAK,EAAE,UAAU;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;eAEc,UAAU,CAAC,WAAW,CAAC,GAChC,WAAW,CAAC,WAAW,CAAC,GACxB,eAAe,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;wBAgCxC,CAAC;AAEL,eAAO,MAAM,YAAY;eAEV,UAAU,CAAC,WAAW,CAAC,GAChC,WAAW,CAAC,WAAW,CAAC,GACxB,eAAe,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;wBA2BrC,CAAC;AAEL,KAAK,yBAAyB,CAAC,QAAQ,SAAS,OAAO,IAAI;IACzD,SAAS,EAAE;QACT,sBAAsB,EAAE,QAAQ,SAAS,IAAI,GACzC,kBAAkB,GAAG,SAAS,GAC9B,kBAAkB,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,SAAS,OAAO,GAAG,KAAK,EAChC,UAAU;IACV,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;eAEc,UAAU,CAAC,WAAW,CAAC,GAChC,WAAW,CAAC,WAAW,CAAC,GACxB,yBAAyB,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;wBAgClD,CAAC;AAEL,KAAK,8BAA8B,CAAC,QAAQ,SAAS,OAAO,IAAI;IAC9D,SAAS,EAAE;QACT,2BAA2B,EAAE,QAAQ,SAAS,IAAI,GAC9C,uBAAuB,GAAG,SAAS,GACnC,uBAAuB,CAAC;KAC7B,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,QAAQ,SAAS,OAAO,GAAG,KAAK,EAChC,UAAU;IACV,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;eAEc,UAAU,CAAC,WAAW,CAAC,GAChC,WAAW,CAAC,WAAW,CAAC,GACxB,8BAA8B,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;wBA6BvD,CAAC;AAEL,KAAK,2BAA2B,GAAG;IACjC,SAAS,EAAE;QACT,wBAAwB,EAAE,MAAM,CAAC;KAClC,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,sBAAsB;eAEpB,UAAU,CAAC,WAAW,CAAC,GAChC,2BAA2B,CAAC,WAAW,CAAC;wBAU1C,CAAC;AAEL,KAAK,gBAAgB,CAAC,QAAQ,SAAS,OAAO,IAAI;IAChD,SAAS,EAAE;QACT,aAAa,EAAE,QAAQ,SAAS,IAAI,GAChC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,GAC7C,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;KACvC,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,QAAQ,SAAS,OAAO,GAAG,KAAK,EAAE,UAAU;IACtE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;eAEc,UAAU,CAAC,WAAW,CAAC,GAChC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;wBAczC,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,CAAC;CAClB;AAYD,KAAK,eAAe,CAAC,QAAQ,SAAS,OAAO,IAAI;IAC/C,SAAS,EAAE;QACT,YAAY,EAAE,QAAQ,SAAS,IAAI,GAC/B,YAAY,GAAG,SAAS,GACxB,YAAY,CAAC;KAClB,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,QAAQ,SAAS,OAAO,GAAG,KAAK,EAAE,UAAU;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;eAEc,UAAU,CAAC,WAAW,CAAC,GAChC,WAAW,CAAC,WAAW,CAAC,GACxB,eAAe,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;wBAyCxC,CAAC;AAEL,eAAO,MAAM,YAAY;eAEV,UAAU,CAAC,WAAW,CAAC,GAChC,WAAW,CAAC,WAAW,CAAC,GACxB,eAAe,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;wBA+BrC,CAAC;AAEL,KAAK,yBAAyB,CAAC,QAAQ,SAAS,OAAO,IAAI;IACzD,SAAS,EAAE;QACT,sBAAsB,EAAE,QAAQ,SAAS,IAAI,GACzC,kBAAkB,GAAG,SAAS,GAC9B,kBAAkB,CAAC;KACxB,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,SAAS,OAAO,GAAG,KAAK,EAChC,UAAU;IACV,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;eAEc,UAAU,CAAC,WAAW,CAAC,GAChC,WAAW,CAAC,WAAW,CAAC,GACxB,yBAAyB,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;wBAyClD,CAAC;AAEL,KAAK,8BAA8B,CAAC,QAAQ,SAAS,OAAO,IAAI;IAC9D,SAAS,EAAE;QACT,2BAA2B,EAAE,QAAQ,SAAS,IAAI,GAC9C,uBAAuB,GAAG,SAAS,GACnC,uBAAuB,CAAC;KAC7B,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,QAAQ,SAAS,OAAO,GAAG,KAAK,EAChC,UAAU;IACV,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;eAEc,UAAU,CAAC,WAAW,CAAC,GAChC,WAAW,CAAC,WAAW,CAAC,GACxB,8BAA8B,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;wBAsCvD,CAAC;AAEL,KAAK,wBAAwB,GAAG;IAC9B,SAAS,EAAE;QACT,yBAAyB,EAAE,UAAU,CAAC;KACvC,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,uBAAuB;eAErB,UAAU,CAAC,WAAW,CAAC,GAChC,WAAW,CAAC,WAAW,CAAC,GACxB,wBAAwB,CAAC,WAAW,CAAC;wBA2BvC,CAAC;AAEL,KAAK,2BAA2B,GAAG;IACjC,SAAS,EAAE;QACT,wBAAwB,EAAE,MAAM,CAAC;KAClC,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,sBAAsB;eAEpB,UAAU,CAAC,WAAW,CAAC,GAChC,2BAA2B,CAAC,WAAW,CAAC;wBAU1C,CAAC;AAEL,KAAK,gBAAgB,CAAC,QAAQ,SAAS,OAAO,IAAI;IAChD,SAAS,EAAE;QACT,aAAa,EAAE,QAAQ,SAAS,IAAI,GAChC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,GAC7C,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;KACvC,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,QAAQ,SAAS,OAAO,GAAG,KAAK,EAAE,UAAU;IACtE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;eAEc,UAAU,CAAC,WAAW,CAAC,GAChC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;wBAczC,CAAC"}

package/dist/middleware/auth.js

@@ -1,5 +1,10 @@
 import { createMiddleware } from 'hono/factory';
 import { e, IssuaryError } from "../schemas/error.js";
+const PASSWORD_RESET_SESSION_TTL_SECONDS = 10 * 60;
+function clearRetiredUserSessions(sessionHelper, userSub) {
+    sessionHelper.clearAuthSessions();
+    sessionHelper.removeRememberedUserSession(userSub);
+}
 export const verifyAuth = (options) => createMiddleware(async (c, next) => {
     const services = c.var.services;
     const sessionHelper = c.var.session;
@@ -14,6 +19,15 @@ export const verifyAuth = (options) => createMiddleware(async (c, next) => {
     }
     try {
         const userEntity = await services.mikro.user.findBySub(session.sub);
+        if (userEntity.password_reset_required) {
+            clearRetiredUserSessions(sessionHelper, userEntity.sub);
+            if (options?.optional) {
+                c.set('verifiedUser', undefined);
+                await next();
+                return;
+            }
+            throw new e.PasswordResetRequired.Error();
+        }
         c.set('verifiedUser', {
             user: userEntity,
             authenticatedAt: session.authenticated_at,
@@ -42,6 +56,10 @@ export const requireAdmin = () => createMiddleware(async (c, next) => {
     }
     try {
         const userEntity = await services.mikro.user.findBySub(session.sub);
+        if (userEntity.password_reset_required) {
+            clearRetiredUserSessions(sessionHelper, userEntity.sub);
+            throw new e.PasswordResetRequired.Error();
+        }
         if (userEntity.role !== 'admin') {
             throw new e.Forbidden.Error();
         }
@@ -73,6 +91,15 @@ export const verifyPending2FAUser = (options) => createMiddleware(async (c, next
     }
     try {
         const userEntity = await services.mikro.user.findBySub(session.sub);
+        if (userEntity.password_reset_required) {
+            clearRetiredUserSessions(sessionHelper, userEntity.sub);
+            if (options?.optional) {
+                c.set('verifiedPending2FAUser', undefined);
+                await next();
+                return;
+            }
+            throw new e.PasswordResetRequired.Error();
+        }
         c.set('verifiedPending2FAUser', {
             user: userEntity,
             authenticatedAt: session.authenticated_at,
@@ -106,6 +133,15 @@ export const verifyPending2FASetupUser = (options) => createMiddleware(async (c,
     }
     try {
         const userEntity = await services.mikro.user.findBySub(session.sub);
+        if (userEntity.password_reset_required) {
+            clearRetiredUserSessions(sessionHelper, userEntity.sub);
+            if (options?.optional) {
+                c.set('verifiedPending2FASetupUser', undefined);
+                await next();
+                return;
+            }
+            throw new e.PasswordResetRequired.Error();
+        }
         c.set('verifiedPending2FASetupUser', { user: userEntity });
     }
     catch (err) {
@@ -122,6 +158,34 @@ export const verifyPending2FASetupUser = (options) => createMiddleware(async (c,
     }
     await next();
 });
+export const verifyPasswordResetUser = () => createMiddleware(async (c, next) => {
+    const sessionHelper = c.var.session;
+    const session = sessionHelper.get('passwordReset');
+    if (!session) {
+        throw new e.Unauthorized.Error();
+    }
+    const sessionAge = Math.floor(Date.now() / 1000) - session.verified_at;
+    if (sessionAge < 0 || sessionAge > PASSWORD_RESET_SESSION_TTL_SECONDS) {
+        sessionHelper.set('passwordReset', undefined);
+        throw new e.Unauthorized.Error();
+    }
+    try {
+        const userEntity = await c.var.services.mikro.user.findBySub(session.sub);
+        if (!userEntity.password_reset_required) {
+            sessionHelper.set('passwordReset', undefined);
+            throw new e.Unauthorized.Error();
+        }
+        c.set('verifiedPasswordResetUser', userEntity);
+    }
+    catch (err) {
+        if (err instanceof IssuaryError && err.code === 'USER_NOT_FOUND') {
+            sessionHelper.set('passwordReset', undefined);
+            throw new e.Unauthorized.Error();
+        }
+        throw err;
+    }
+    await next();
+});
 export const verifyPasskeyChallenge = () => createMiddleware(async (c, next) => {
     const sessionHelper = c.var.session;
     const challenge = sessionHelper.get('passkey_challenge');

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AA0BtD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAmC,OAE5D,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAkB,CAAC,CAAC;YAC1C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE;YACpB,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAkB,CAAC,CAAC;gBAC1C,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,EAAE,CAC/B,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAChC,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE;YACpB,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAElC,OAED,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAkB,CAAC,CAAC;YACpD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE;YAC9B,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAkB,CAAC,CAAC;gBACpD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAEvC,OAED,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,SAAkB,CAAC,CAAC;YACzD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;YAChD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,SAAkB,CAAC,CAAC;gBACzD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAQL,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,gBAAgB,CAGb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,WAAW,GAAG,CAAmC,OAE7D,EAAE,EAAE,CACH,gBAAgB,CAGb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,SAAkB,CAAC,CAAC;YAC3C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAkBtD,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,CAAC;AAEnD,SAAS,wBAAwB,CAC/B,aAAiD,EACjD,OAAe;IAEf,aAAa,CAAC,iBAAiB,EAAE,CAAC;IAClC,aAAa,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAUD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAmC,OAE5D,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAkB,CAAC,CAAC;YAC1C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,uBAAuB,EAAE,CAAC;YACvC,wBAAwB,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAkB,CAAC,CAAC;gBAC1C,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE;YACpB,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAkB,CAAC,CAAC;gBAC1C,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,EAAE,CAC/B,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,uBAAuB,EAAE,CAAC;YACvC,wBAAwB,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAChC,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE;YACpB,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAElC,OAED,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAkB,CAAC,CAAC;YACpD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,uBAAuB,EAAE,CAAC;YACvC,wBAAwB,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAkB,CAAC,CAAC;gBACpD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE;YAC9B,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAkB,CAAC,CAAC;gBACpD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAEvC,OAED,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,SAAkB,CAAC,CAAC;YACzD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,uBAAuB,EAAE,CAAC;YACvC,wBAAwB,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,SAAkB,CAAC,CAAC;gBACzD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;YAChD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,SAAkB,CAAC,CAAC;gBACzD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAQL,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAC1C,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IACvE,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,kCAAkC,EAAE,CAAC;QACtE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC;YACxC,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACjE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAQL,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,gBAAgB,CAGb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,WAAW,GAAG,CAAmC,OAE7D,EAAE,EAAE,CACH,gBAAgB,CAGb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,SAAkB,CAAC,CAAC;YAC3C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC"}

package/dist/middleware/session.d.ts

@@ -72,6 +72,14 @@ export interface SessionData {
     pending2FASetup?: {
         sub: string;
     };
+    /**
+     * Restricted session created after passkey verification for a user whose
+     * legacy password was retired. It authorizes only setting a new password.
+     */
+    passwordReset?: {
+        sub: string;
+        verified_at: number;
+    };
     /**
      * Temporary state for external OAuth provider flows (social login/register/link).
      * Stored when redirecting to the OAuth provider (authorize endpoint) and
@@ -101,6 +109,7 @@ export interface SessionHelper {
     removeRememberedUserSession(userSub: string): boolean;
     setPending2FASession(userSub: string, authenticatedAt?: number): void;
     setPending2FASetupSession(userSub: string): void;
+    setPasswordResetSession(userSub: string): void;
     clearAuthSessions(): void;
 }
 export declare function sessionMiddleware(cookieSecret: string, isSecure: boolean, rememberedAccountsOptions?: RememberedAccountsOptions): import("hono").MiddlewareHandler<SessionEnv, string, {}, Response>;

package/dist/middleware/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG;IAAE,SAAS,EAAE;QAAE,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,CAAC;AAInE,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAqCD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,MAAM,IAAI,IAAI,CAAC;IACf,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5C,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtE,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,OAAO,EACjB,yBAAyB,CAAC,EAAE,yBAAyB,sEA8LtD"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG;IAAE,SAAS,EAAE;QAAE,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,CAAC;AAInE,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAqCD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,MAAM,IAAI,IAAI,CAAC;IACf,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5C,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtE,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,OAAO,EACjB,yBAAyB,CAAC,EAAE,yBAAyB,sEAgNtD"}

package/dist/middleware/session.js

@@ -76,6 +76,7 @@ export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOpti
                 const reauthenticationRequestFingerprint = data.reauthentication?.request_fingerprint;
                 delete data.pending2FAUser;
                 delete data.pending2FASetup;
+                delete data.passwordReset;
                 delete data.oauth;
                 delete data.passkey_challenge;
                 data.user = {
@@ -115,6 +116,7 @@ export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOpti
                 }
                 delete data.pending2FAUser;
                 delete data.pending2FASetup;
+                delete data.passwordReset;
                 delete data.oauth;
                 delete data.passkey_challenge;
                 data.user = {
@@ -144,6 +146,7 @@ export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOpti
             },
             setPending2FASession(userSub, authenticatedAt) {
                 delete data.pending2FASetup;
+                delete data.passwordReset;
                 delete data.oauth;
                 delete data.passkey_challenge;
                 data.pending2FAUser = {
@@ -153,15 +156,30 @@ export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOpti
             },
             setPending2FASetupSession(userSub) {
                 delete data.pending2FAUser;
+                delete data.passwordReset;
                 delete data.oauth;
                 delete data.passkey_challenge;
                 data.pending2FASetup = { sub: userSub };
             },
+            setPasswordResetSession(userSub) {
+                delete data.user;
+                delete data.accounts;
+                delete data.reauthentication;
+                delete data.pending2FAUser;
+                delete data.pending2FASetup;
+                delete data.oauth;
+                delete data.passkey_challenge;
+                data.passwordReset = {
+                    sub: userSub,
+                    verified_at: nowSeconds(),
+                };
+            },
             clearAuthSessions() {
                 delete data.user;
                 delete data.reauthentication;
                 delete data.pending2FAUser;
                 delete data.pending2FASetup;
+                delete data.passwordReset;
             },
         });
         await next();

package/dist/middleware/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAQ1C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAQD,SAAS,gCAAgC,CACvC,OAA8C;IAE9C,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;QACjC,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,+BAA+B;QACpE,KAAK,EAAE,OAAO,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA0B,EAC1B,OAA4D;IAE5D,MAAM,UAAU,GACd,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC7E,MAAM,aAAa,GACjB,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC,MAAM,CACb,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,IAAI,UAAU,CAC/D,CAAC;IACR,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAsGD,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,QAAiB,EACjB,yBAAqD;IAErD,MAAM,iBAAiB,GAAG,gCAAgC,CACxD,yBAAyB,CAC1B,CAAC;IACF,OAAO,gBAAgB,CAAa,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,WAAW,GAAgB,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,iDAAiD;oBACjD,+CAA+C;oBAC/C,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAgB,IAAI,KAAK,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;gBACrB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,cAAc,CAAC,MAAM,EAAE,IAAI;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,uBAAuB,CAC5C,IAAI,CAAC,QAAQ,EACb,iBAAiB,CAClB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;YACjC,CAAC;QACH,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,GAAG,CAA8B,GAAM;gBACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,GAAG,CAA8B,GAAM,EAAE,KAAqB;gBAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,MAAM;gBACJ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,cAAc,CAAC,OAAe,EAAE,eAAwB;gBACtD,MAAM,QAAQ,GAAG,eAAe,IAAI,UAAU,EAAE,CAAC;gBACjD,MAAM,kCAAkC,GACtC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;gBAC7C,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,CAAC,gBAAgB,GAAG;oBACtB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,kCAAkC,EAAE,CAAC;oBACvC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB;wBACvC,kCAAkC,CAAC;gBACvC,CAAC;gBACD,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;oBACF,IAAI,CAAC,QAAQ,GAAG;wBACd,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC;wBAChE;4BACE,GAAG,EAAE,OAAO;4BACZ,gBAAgB,EAAE,QAAQ;4BAC1B,YAAY,EAAE,QAAQ;yBACvB;qBACF,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,QAAQ,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,OAAe;gBAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,OAAO,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;gBACzC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;iBAC3C,CAAC;gBACF,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,KAAK,CAAC,GAAG,KAAK,OAAO;oBACnB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE;oBAC1C,CAAC,CAAC,KAAK,CACV,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,2BAA2B,CAAC,OAAe;gBACzC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;gBACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CACrC,CAAC;gBACF,IAAI,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,oBAAoB,CAAC,OAAe,EAAE,eAAwB;gBAC5D,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,cAAc,GAAG;oBACpB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,eAAe,IAAI,UAAU,EAAE;iBAClD,CAAC;YACJ,CAAC;YACD,yBAAyB,CAAC,OAAe;gBACvC,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,iBAAiB;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;YAC9B,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,YAAY,CACb,CAAC;gBACF,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;oBACjC,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAQ1C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAQD,SAAS,gCAAgC,CACvC,OAA8C;IAE9C,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;QACjC,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,+BAA+B;QACpE,KAAK,EAAE,OAAO,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA0B,EAC1B,OAA4D;IAE5D,MAAM,UAAU,GACd,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC7E,MAAM,aAAa,GACjB,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC,MAAM,CACb,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,IAAI,UAAU,CAC/D,CAAC;IACR,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AA+GD,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,QAAiB,EACjB,yBAAqD;IAErD,MAAM,iBAAiB,GAAG,gCAAgC,CACxD,yBAAyB,CAC1B,CAAC;IACF,OAAO,gBAAgB,CAAa,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,WAAW,GAAgB,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,iDAAiD;oBACjD,+CAA+C;oBAC/C,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAgB,IAAI,KAAK,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;gBACrB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,cAAc,CAAC,MAAM,EAAE,IAAI;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,uBAAuB,CAC5C,IAAI,CAAC,QAAQ,EACb,iBAAiB,CAClB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;YACjC,CAAC;QACH,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,GAAG,CAA8B,GAAM;gBACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,GAAG,CAA8B,GAAM,EAAE,KAAqB;gBAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,MAAM;gBACJ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,cAAc,CAAC,OAAe,EAAE,eAAwB;gBACtD,MAAM,QAAQ,GAAG,eAAe,IAAI,UAAU,EAAE,CAAC;gBACjD,MAAM,kCAAkC,GACtC,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;gBAC7C,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,aAAa,CAAC;gBAC1B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,CAAC,gBAAgB,GAAG;oBACtB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,kCAAkC,EAAE,CAAC;oBACvC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB;wBACvC,kCAAkC,CAAC;gBACvC,CAAC;gBACD,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;oBACF,IAAI,CAAC,QAAQ,GAAG;wBACd,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC;wBAChE;4BACE,GAAG,EAAE,OAAO;4BACZ,gBAAgB,EAAE,QAAQ;4BAC1B,YAAY,EAAE,QAAQ;yBACvB;qBACF,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,QAAQ,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,OAAe;gBAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,OAAO,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;gBACzC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,aAAa,CAAC;gBAC1B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;iBAC3C,CAAC;gBACF,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,KAAK,CAAC,GAAG,KAAK,OAAO;oBACnB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE;oBAC1C,CAAC,CAAC,KAAK,CACV,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,2BAA2B,CAAC,OAAe;gBACzC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;gBACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CACrC,CAAC;gBACF,IAAI,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,oBAAoB,CAAC,OAAe,EAAE,eAAwB;gBAC5D,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,aAAa,CAAC;gBAC1B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,cAAc,GAAG;oBACpB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,eAAe,IAAI,UAAU,EAAE;iBAClD,CAAC;YACJ,CAAC;YACD,yBAAyB,CAAC,OAAe;gBACvC,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,aAAa,CAAC;gBAC1B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,uBAAuB,CAAC,OAAe;gBACrC,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,QAAQ,CAAC;gBACrB,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,aAAa,GAAG;oBACnB,GAAG,EAAE,OAAO;oBACZ,WAAW,EAAE,UAAU,EAAE;iBAC1B,CAAC;YACJ,CAAC;YACD,iBAAiB;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC7B,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,aAAa,CAAC;YAC5B,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,YAAY,CACb,CAAC;gBACF,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;oBACjC,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/migrations/postgres/Migration20260825110000_add_password_reset_required.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260825110000_add_password_reset_required extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260825110000_add_password_reset_required.d.ts.map

package/dist/migrations/postgres/Migration20260825110000_add_password_reset_required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260825110000_add_password_reset_required.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260825110000_add_password_reset_required.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,mDAAoD,SAAQ,SAAS;IACvE,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtC"}

package/dist/migrations/postgres/Migration20260825110000_add_password_reset_required.js

@@ -0,0 +1,11 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260825110000_add_password_reset_required extends Migration {
+    up() {
+        this.addSql(`alter table "user" add column "password_reset_required" boolean not null default false;`);
+        this.addSql(`comment on column "user"."password_reset_required" is 'Whether the user must set a new password before authentication';`);
+    }
+    down() {
+        this.addSql(`alter table "user" drop column "password_reset_required";`);
+    }
+}
+//# sourceMappingURL=Migration20260825110000_add_password_reset_required.js.map

package/dist/migrations/postgres/Migration20260825110000_add_password_reset_required.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260825110000_add_password_reset_required.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260825110000_add_password_reset_required.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,mDAAoD,SAAQ,SAAS;IACvE,EAAE;QACT,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yHAAyH,CAC1H,CAAC;IACJ,CAAC;IAEQ,IAAI;QACX,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/migrations/postgres/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AASvF,eAAO,MAAM,mBAAmB,4CAS/B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAUvF,eAAO,MAAM,mBAAmB,4CAU/B,CAAC"}

package/dist/migrations/postgres/index.js

@@ -6,6 +6,7 @@ import { Migration20260620025358_add_oauth_client_skip_consent } from './Migrati
 import { Migration20260624190500_add_oauth_device_denied_at } from './Migration20260624190500_add_oauth_device_denied_at.js';
 import { Migration20260624223000_add_oauth_device_poll_state } from './Migration20260624223000_add_oauth_device_poll_state.js';
 import { Migration20260626103000_allow_revoked_token_without_user } from './Migration20260626103000_allow_revoked_token_without_user.js';
+import { Migration20260825110000_add_password_reset_required } from './Migration20260825110000_add_password_reset_required.js';
 export const POSTGRES_MIGRATIONS = [
     Migration20260509171036_initial,
     Migration20260512120000_add_scheduler_jobs,
@@ -15,5 +16,6 @@ export const POSTGRES_MIGRATIONS = [
     Migration20260624190500_add_oauth_device_denied_at,
     Migration20260624223000_add_oauth_device_poll_state,
     Migration20260626103000_allow_revoked_token_without_user,
+    Migration20260825110000_add_password_reset_required,
 ];
 //# sourceMappingURL=index.js.map

package/dist/migrations/postgres/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,wDAAwD,EAAE,MAAM,+DAA+D,CAAC;AAEzI,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,wDAAwD;CACzD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,wDAAwD,EAAE,MAAM,+DAA+D,CAAC;AACzI,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAE/H,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,wDAAwD;IACxD,mDAAmD;CACpD,CAAC"}

package/dist/migrations/sqlite/Migration20260825110000_add_password_reset_required.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260825110000_add_password_reset_required extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260825110000_add_password_reset_required.d.ts.map

package/dist/migrations/sqlite/Migration20260825110000_add_password_reset_required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260825110000_add_password_reset_required.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260825110000_add_password_reset_required.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,mDAAoD,SAAQ,SAAS;IACvE,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAKtC"}

package/dist/migrations/sqlite/Migration20260825110000_add_password_reset_required.js

@@ -0,0 +1,10 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260825110000_add_password_reset_required extends Migration {
+    up() {
+        this.addSql(`alter table \`user\` add column \`password_reset_required\` integer not null default false;`);
+    }
+    down() {
+        this.addSql(`alter table \`user\` drop column \`password_reset_required\`;`);
+    }
+}
+//# sourceMappingURL=Migration20260825110000_add_password_reset_required.js.map

package/dist/migrations/sqlite/Migration20260825110000_add_password_reset_required.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260825110000_add_password_reset_required.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260825110000_add_password_reset_required.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,mDAAoD,SAAQ,SAAS;IACvE,EAAE;QACT,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAEQ,IAAI;QACX,IAAI,CAAC,MAAM,CACT,+DAA+D,CAChE,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/sqlite/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AASvF,eAAO,MAAM,iBAAiB,4CAS7B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAUvF,eAAO,MAAM,iBAAiB,4CAU7B,CAAC"}

package/dist/migrations/sqlite/index.js

@@ -6,6 +6,7 @@ import { Migration20260620025358_add_oauth_client_skip_consent } from './Migrati
 import { Migration20260624190500_add_oauth_device_denied_at } from './Migration20260624190500_add_oauth_device_denied_at.js';
 import { Migration20260624223000_add_oauth_device_poll_state } from './Migration20260624223000_add_oauth_device_poll_state.js';
 import { Migration20260626103000_allow_revoked_token_without_user } from './Migration20260626103000_allow_revoked_token_without_user.js';
+import { Migration20260825110000_add_password_reset_required } from './Migration20260825110000_add_password_reset_required.js';
 export const SQLITE_MIGRATIONS = [
     Migration20260509171226_initial,
     Migration20260512120000_add_scheduler_jobs,
@@ -15,5 +16,6 @@ export const SQLITE_MIGRATIONS = [
     Migration20260624190500_add_oauth_device_denied_at,
     Migration20260624223000_add_oauth_device_poll_state,
     Migration20260626103000_allow_revoked_token_without_user,
+    Migration20260825110000_add_password_reset_required,
 ];
 //# sourceMappingURL=index.js.map

package/dist/migrations/sqlite/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,wDAAwD,EAAE,MAAM,+DAA+D,CAAC;AAEzI,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,wDAAwD;CACzD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAC/H,OAAO,EAAE,wDAAwD,EAAE,MAAM,+DAA+D,CAAC;AACzI,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAE/H,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,wDAAwD;IACxD,mDAAmD;CACpD,CAAC"}

package/dist/repositories/oauth-code.repository.d.ts

@@ -14,10 +14,10 @@ export declare class OAuthCodeRepository extends EntityRepository<IOAuthCodeEnti
         /** OIDC: Time when End-User authentication occurred (Unix timestamp) */
         authTime?: number;
     }): Promise<IOAuthCodeEntity>;
-    findUnconsumedByClientAndCodeHash(clientId: string, codeHash: string): Promise<IOAuthCodeEntity | null>;
+    findUnconsumedByClientAndCodeHash(clientId: string, codeHash: string | string[]): Promise<IOAuthCodeEntity | null>;
     consumeAuthorizationCode(params: {
         clientId: string;
-        codeHash: string;
+        codeHash: string | string[];
         consumedAt: Date;
     }): Promise<IOAuthCodeEntity | null>;
 }

package/dist/repositories/oauth-code.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-code.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/oauth-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,kCAAkC,CAAC;AAE1C,qBAAa,mBAAoB,SAAQ,gBAAgB,CAAC,gBAAgB,CAAC;IACnE,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;QAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,wEAAwE;QACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAyBvB,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQ7B,wBAAwB,CAAC,MAAM,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAoBrC"}
+{"version":3,"file":"oauth-code.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/oauth-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,kCAAkC,CAAC;AAE1C,qBAAa,mBAAoB,SAAQ,gBAAgB,CAAC,gBAAgB,CAAC;IACnE,uBAAuB,CAAC,MAAM,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;QAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,wEAAwE;QACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAyBvB,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAC1B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAS7B,wBAAwB,CAAC,MAAM,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAuBrC"}

package/dist/repositories/oauth-code.repository.js

@@ -22,16 +22,20 @@ export class OAuthCodeRepository extends EntityRepository {
         return entity;
     }
     async findUnconsumedByClientAndCodeHash(clientId, codeHash) {
+        const codeHashes = Array.isArray(codeHash) ? codeHash : [codeHash];
         return this.findOne({
             client: clientId,
-            codeHash,
+            codeHash: { $in: codeHashes },
             consumedAt: null,
         });
     }
     async consumeAuthorizationCode(params) {
+        const codeHashes = Array.isArray(params.codeHash)
+            ? params.codeHash
+            : [params.codeHash];
         const updated = await this.nativeUpdate({
             client: params.clientId,
-            codeHash: params.codeHash,
+            codeHash: { $in: codeHashes },
             consumedAt: null,
             expiredAt: { $gt: params.consumedAt },
         }, { consumedAt: params.consumedAt });
@@ -40,7 +44,7 @@ export class OAuthCodeRepository extends EntityRepository {
         }
         return this.findOne({
             client: params.clientId,
-            codeHash: params.codeHash,
+            codeHash: { $in: codeHashes },
         });
     }
 }

package/dist/repositories/oauth-code.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-code.repository.js","sourceRoot":"","sources":["../../src/repositories/oauth-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAMnD,MAAM,OAAO,mBAAoB,SAAQ,gBAAkC;IACzE,KAAK,CAAC,uBAAuB,CAAC,MAY7B;QACC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACzC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,MAAM;YACzD,SAAS;YACT,4EAA4E;YAC5E,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAEtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iCAAiC,CACrC,QAAgB,EAChB,QAAgB;QAEhB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAI9B;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC;YACE,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;SACtC,EACD,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAClC,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"oauth-code.repository.js","sourceRoot":"","sources":["../../src/repositories/oauth-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAMnD,MAAM,OAAO,mBAAoB,SAAQ,gBAAkC;IACzE,KAAK,CAAC,uBAAuB,CAAC,MAY7B;QACC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACzC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,MAAM;YACzD,SAAS;YACT,4EAA4E;YAC5E,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAEtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iCAAiC,CACrC,QAAgB,EAChB,QAA2B;QAE3B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;YAC7B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAI9B;QACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC;YACE,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;YAC7B,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;SACtC,EACD,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAClC,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/repositories/oauth-device-code.repository.d.ts

@@ -9,17 +9,17 @@ export declare class OAuthDeviceCodeRepository extends EntityRepository<IOAuthDe
         scope: string[];
         expiresInSeconds?: number;
     }): Promise<IOAuthDeviceCodeEntity>;
-    findPendingByUserCodeHash(userCodeHash: string): Promise<IOAuthDeviceCodeEntity | null>;
+    findPendingByUserCodeHash(userCodeHash: string | string[]): Promise<IOAuthDeviceCodeEntity | null>;
     approvePendingByUserCodeHash(params: {
-        userCodeHash: string;
+        userCodeHash: string | string[];
         userSub: string;
         approvedAt: Date;
     }): Promise<IOAuthDeviceCodeEntity | null>;
     denyPendingByUserCodeHash(params: {
-        userCodeHash: string;
+        userCodeHash: string | string[];
         deniedAt: Date;
     }): Promise<IOAuthDeviceCodeEntity | null>;
-    findByClientAndDeviceCodeHash(clientId: string, deviceCodeHash: string): Promise<IOAuthDeviceCodeEntity | null>;
+    findByClientAndDeviceCodeHash(clientId: string, deviceCodeHash: string | string[]): Promise<IOAuthDeviceCodeEntity | null>;
     recordPendingPoll(params: {
         id: string;
         polledAt: Date;

package/dist/repositories/oauth-device-code.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-device-code.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/oauth-device-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAItF,MAAM,MAAM,uBAAuB,GAAG,uBAAuB,GAAG,WAAW,CAAC;AAE5E,qBAAa,yBAA0B,SAAQ,gBAAgB,CAAC,sBAAsB,CAAC;IAC/E,yBAAyB,CAAC,MAAM,EAAE;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAe7B,yBAAyB,CAC7B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAUnC,4BAA4B,CAAC,MAAM,EAAE;QACzC,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAyBpC,yBAAyB,CAAC,MAAM,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,IAAI,CAAC;KAChB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAwBpC,6BAA6B,CACjC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQnC,iBAAiB,CAAC,MAAM,EAAE;QAC9B,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,IAAI,CAAC;KAChB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAiDrC,2BAA2B,CAC/B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,IAAI,GACf,OAAO,CAAC,OAAO,CAAC;CAcpB"}
+{"version":3,"file":"oauth-device-code.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/oauth-device-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAItF,MAAM,MAAM,uBAAuB,GAAG,uBAAuB,GAAG,WAAW,CAAC;AAE5E,qBAAa,yBAA0B,SAAQ,gBAAgB,CAAC,sBAAsB,CAAC;IAC/E,yBAAyB,CAAC,MAAM,EAAE;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAe7B,yBAAyB,CAC7B,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,GAC9B,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAanC,4BAA4B,CAAC,MAAM,EAAE;QACzC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IA4BpC,yBAAyB,CAAC,MAAM,EAAE;QACtC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC;KAChB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IA2BpC,6BAA6B,CACjC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,GAChC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAWnC,iBAAiB,CAAC,MAAM,EAAE;QAC9B,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,IAAI,CAAC;KAChB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAiDrC,2BAA2B,CAC/B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,IAAI,GACf,OAAO,CAAC,OAAO,CAAC;CAcpB"}