@tinyrack/issuary-server 0.30.0 → 0.32.1

package/dist/services/password-reset.service.js

@@ -1,4 +1,5 @@
 import { e } from '../schemas/error.js';
+import { withUserSecurity } from './user-security.service.js';
 export class PasswordResetService {
     mikro;
     passwordAuthService;
@@ -11,11 +12,14 @@ export class PasswordResetService {
      * Invalidates all previous unused tokens
      */
     async generateToken(params) {
-        const token = await this.mikro.passwordReset.generateToken({
-            userSub: params.userSub,
-            expiresInHours: params.expiresInHours || 1,
+        return withUserSecurity(this.mikro, params.userSub, async (user) => {
+            const token = await this.mikro.passwordReset.generateToken({
+                userSub: params.userSub,
+                userEpoch: user.token_epoch,
+                expiresInHours: params.expiresInHours || 1,
+            });
+            return token;
         });
-        return token;
     }
     /**
      * Request password reset for an email
@@ -37,18 +41,33 @@ export class PasswordResetService {
      * Verifies token and updates user password
      */
     async resetPassword(params) {
-        const resetEntity = await this.mikro.passwordReset.verifyToken(params.token);
-        if (!resetEntity) {
-            throw new e.InvalidPasswordResetToken.Error();
-        }
-        const user = await resetEntity.user.loadOrFail({
-            failHandler: () => new e.UserNotFound.Error(),
+        const candidate = await this.mikro.passwordReset.findOne({
+            token: params.token,
+            used: false,
+            revoked_at: null,
+            expiresAt: { $gt: new Date() },
         });
-        if (user.managed_by === 'config') {
-            throw new e.UserNotEditable.Error();
-        }
-        await this.passwordAuthService.replacePassword(user, params.password);
-        return user;
+        if (!candidate)
+            throw new e.InvalidPasswordResetToken.Error();
+        return withUserSecurity(this.mikro, candidate.user.sub, async (freshUser) => {
+            if (freshUser.deleted_at ||
+                candidate.user_epoch !== freshUser.token_epoch)
+                throw new e.InvalidPasswordResetToken.Error();
+            const resetEntity = await this.mikro.passwordReset.verifyToken(params.token);
+            if (!resetEntity) {
+                throw new e.InvalidPasswordResetToken.Error();
+            }
+            const user = await resetEntity.user.loadOrFail({
+                failHandler: () => new e.UserNotFound.Error(),
+            });
+            if (user.deleted_at)
+                throw new e.InvalidPasswordResetToken.Error();
+            if (user.managed_by === 'config') {
+                throw new e.UserNotEditable.Error();
+            }
+            await this.passwordAuthService.replacePassword(user, params.password);
+            return user;
+        }, { includeDeleted: true });
     }
 }
 //# sourceMappingURL=password-reset.service.js.map

package/dist/services/password-reset.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.service.js","sourceRoot":"","sources":["../../src/services/password-reset.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAIxC,MAAM,OAAO,oBAAoB;IACd,KAAK,CAAe;IACpB,mBAAmB,CAAsB;IAC1D,YACE,KAAmB,EACnB,mBAAwC;QAExC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAGnB;QACC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC;YACzD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC;SAC3C,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAC9C,EAAE,KAAK,EAAE,EACT;YACE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAGnB;QACC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAC5D,MAAM,CAAC,KAAK,CACb,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7C,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"password-reset.service.js","sourceRoot":"","sources":["../../src/services/password-reset.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAGxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,MAAM,OAAO,oBAAoB;IACd,KAAK,CAAe;IACpB,mBAAmB,CAAsB;IAC1D,YACE,KAAmB,EACnB,mBAAwC;QAExC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAGnB;QACC,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC;gBACzD,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,IAAI,CAAC,WAAW;gBAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC;aAC3C,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAC9C,EAAE,KAAK,EAAE,EACT;YACE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAGnB;QACC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;QAC9D,OAAO,gBAAgB,CACrB,IAAI,CAAC,KAAK,EACV,SAAS,CAAC,IAAI,CAAC,GAAG,EAClB,KAAK,EAAE,SAAS,EAAE,EAAE;YAClB,IACE,SAAS,CAAC,UAAU;gBACpB,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,WAAW;gBAE9C,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAC5D,MAAM,CAAC,KAAK,CACb,CAAC;YAEF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YAChD,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC7C,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;aAC9C,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YAEnE,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEtE,OAAO,IAAI,CAAC;QACd,CAAC,EACD,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;IACJ,CAAC;CACF"}

package/dist/services/security.service.d.ts

@@ -1,10 +1,12 @@
 import type { IssuaryRuntimeConfig } from '../lib/config/index.ts';
-export type OpaquePurpose = 'oauth-code' | 'oauth-device-code' | 'oauth-device-user-code' | 'totp-recovery';
+export type OpaquePurpose = 'oauth-client-authentication' | 'oauth-code' | 'oauth-device-code' | 'oauth-device-user-code' | 'totp-recovery' | 'auth-budget' | 'mail-queue';
 export declare class SecurityService {
     private readonly hashMasterSecret;
     private readonly pbkdf2Iterations;
     private readonly purposeKeyCache;
     constructor(config: IssuaryRuntimeConfig);
+    sealMailPayload(payload: string): Promise<string>;
+    openMailPayload(payload: string): Promise<string | null>;
     private resolvePurposeKey;
     private hashPbkdf2Secret;
     private verifyPbkdf2Secret;

package/dist/services/security.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.service.d.ts","sourceRoot":"","sources":["../../src/services/security.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAmBnE,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,mBAAmB,GACnB,wBAAwB,GACxB,eAAe,CAAC;AAepB,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAE1E,YAAmB,MAAM,EAAE,oBAAoB,EAQ9C;YAEa,iBAAiB;YAiBjB,gBAAgB;YAyBhB,kBAAkB;IAyBnB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3D;IAEY,cAAc,CACzB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAElB;IAEY,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAEY,kBAAkB,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAElB;IAEY,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CASjB;CACF"}
+{"version":3,"file":"security.service.d.ts","sourceRoot":"","sources":["../../src/services/security.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAqBnE,MAAM,MAAM,aAAa,GACrB,6BAA6B,GAC7B,YAAY,GACZ,mBAAmB,GACnB,wBAAwB,GACxB,eAAe,GACf,aAAa,GACb,YAAY,CAAC;AAkBjB,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAE1E,YAAmB,MAAM,EAAE,oBAAoB,EAQ9C;IAEY,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK7D;IACY,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKpE;YAEa,iBAAiB;YAiBjB,gBAAgB;YAyBhB,kBAAkB;IAyBnB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3D;IAEY,cAAc,CACzB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAElB;IAEY,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAEY,kBAAkB,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAElB;IAEY,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CASjB;CACF"}

package/dist/services/security.service.js

@@ -1,5 +1,5 @@
-import { fromBase64Url } from '../lib/base64url.js';
-import { derivePbkdf2Bytes, derivePurposeKeyBytes, formatOpaqueHash, formatPbkdf2Hash, getRandomBytes, parsePbkdf2Hash, signOpaqueValue, timingSafeEqualBytes, } from '../lib/crypto.js';
+import { bytesToHex, fromBase64Url } from '../lib/base64url.js';
+import { decrypt, derivePbkdf2Bytes, derivePurposeKeyBytes, encrypt, formatOpaqueHash, formatPbkdf2Hash, getRandomBytes, parsePbkdf2Hash, signOpaqueValue, timingSafeEqualBytes, } from '../lib/crypto.js';
 const PBKDF2_ALGORITHM = 'pbkdf2-sha256';
 const HMAC_ALGORITHM = 'hmac-sha256';
 const CURRENT_HASH_FORMAT_VERSION = 2;
@@ -11,9 +11,12 @@ const HASH_POLICY = {
         password: 'password-v2',
         'client-secret': 'client-secret-v2',
         'oauth-code': 'oauth-code-v2',
+        'oauth-client-authentication': 'oauth-client-authentication-v1',
         'oauth-device-code': 'oauth-device-code-v2',
         'oauth-device-user-code': 'oauth-device-user-code-v2',
         'totp-recovery': 'totp-recovery-v2',
+        'auth-budget': 'auth-budget-v1',
+        'mail-queue': 'mail-queue-v1',
     },
 };
 export class SecurityService {
@@ -28,6 +31,12 @@ export class SecurityService {
         this.hashMasterSecret = decodedSecret;
         this.pbkdf2Iterations = config.security.pbkdf2_iterations;
     }
+    async sealMailPayload(payload) {
+        return encrypt(payload, bytesToHex(await this.resolvePurposeKey('mail-queue')));
+    }
+    async openMailPayload(payload) {
+        return decrypt(payload, bytesToHex(await this.resolvePurposeKey('mail-queue')));
+    }
     async resolvePurposeKey(purpose) {
         const cached = this.purposeKeyCache.get(purpose);
         if (cached) {

package/dist/services/security.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.service.js","sourceRoot":"","sources":["../../src/services/security.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAUpC,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,qBAAqB;IAC9B,aAAa,EAAE;QACb,QAAQ,EAAE,aAAa;QACvB,eAAe,EAAE,kBAAkB;QACnC,YAAY,EAAE,eAAe;QAC7B,mBAAmB,EAAE,sBAAsB;QAC3C,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,kBAAkB;KACF;CACpC,CAAC;AAEF,MAAM,OAAO,eAAe;IACT,gBAAgB,CAAa;IAC7B,gBAAgB,CAAS;IACzB,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IAE1E,YAAmB,MAA4B;QAC7C,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC;QACtC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,OAAgB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CACtC,UAAU,CAAC,MAAM,EACjB,IAAI,CAAC,gBAAgB,EACrB,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,EAClC,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,OAAsB,EACtB,MAAc;QAEd,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,MAAM,EACN,UAAU,EACV,MAAM,EACN,IAAI,EACJ,IAAI,CAAC,gBAAgB,EACrB,wBAAwB,CACzB,CAAC;QAEF,OAAO,gBAAgB,CAAC;YACtB,SAAS,EAAE,gBAAgB;YAC3B,OAAO,EAAE,2BAA2B;YACpC,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,IAAI;YACJ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,OAAsB,EACtB,IAAY,EACZ,MAAc;QAEd,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAEvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,2BAA2B,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,MAAM,EACN,UAAU,EACV,MAAM,EACN,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,UAAU,EACjB,wBAAwB,CACzB,CAAC;QAEF,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,QAAgB;QACxC,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,IAAY,EACZ,QAAgB;QAEhB,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QAChD,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,IAAY,EACZ,YAAoB;QAEpB,OAAO,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,OAAsB,EACtB,KAAa;QAEb,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,gBAAgB,CAAC;YACtB,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,2BAA2B;YACpC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"security.service.js","sourceRoot":"","sources":["../../src/services/security.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,qBAAqB,EACrB,OAAO,EACP,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAapC,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,qBAAqB;IAC9B,aAAa,EAAE;QACb,QAAQ,EAAE,aAAa;QACvB,eAAe,EAAE,kBAAkB;QACnC,YAAY,EAAE,eAAe;QAC7B,6BAA6B,EAAE,gCAAgC;QAC/D,mBAAmB,EAAE,sBAAsB;QAC3C,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,kBAAkB;QACnC,aAAa,EAAE,gBAAgB;QAC/B,YAAY,EAAE,eAAe;KACI;CACpC,CAAC;AAEF,MAAM,OAAO,eAAe;IACT,gBAAgB,CAAa;IAC7B,gBAAgB,CAAS;IACzB,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IAE1E,YAAmB,MAA4B;QAC7C,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC;QACtC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,OAAe;QAC1C,OAAO,OAAO,CACZ,OAAO,EACP,UAAU,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC;IACM,KAAK,CAAC,eAAe,CAAC,OAAe;QAC1C,OAAO,OAAO,CACZ,OAAO,EACP,UAAU,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,OAAgB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CACtC,UAAU,CAAC,MAAM,EACjB,IAAI,CAAC,gBAAgB,EACrB,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,EAClC,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,OAAsB,EACtB,MAAc;QAEd,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,MAAM,EACN,UAAU,EACV,MAAM,EACN,IAAI,EACJ,IAAI,CAAC,gBAAgB,EACrB,wBAAwB,CACzB,CAAC;QAEF,OAAO,gBAAgB,CAAC;YACtB,SAAS,EAAE,gBAAgB;YAC3B,OAAO,EAAE,2BAA2B;YACpC,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,IAAI;YACJ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,OAAsB,EACtB,IAAY,EACZ,MAAc;QAEd,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAEvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,2BAA2B,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,MAAM,EACN,UAAU,EACV,MAAM,EACN,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,UAAU,EACjB,wBAAwB,CACzB,CAAC;QAEF,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,QAAgB;QACxC,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,IAAY,EACZ,QAAgB;QAEhB,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QAChD,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,IAAY,EACZ,YAAoB;QAEpB,OAAO,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,OAAsB,EACtB,KAAa;QAEb,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,gBAAgB,CAAC;YACtB,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,2BAA2B;YACpC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/services/terms-policy.service.d.ts

@@ -0,0 +1,7 @@
+import { type EntityManager } from '@mikro-orm/core';
+export type TermsPolicyAccess = 'read' | 'write';
+/** Initialize before serving requests, even when config seeding is disabled. */
+export declare function initializeTermsPolicy(em: EntityManager): Promise<void>;
+/** Acquire before user/session/client locks; the transaction owns its lifetime. */
+export declare function lockTermsPolicy(em: EntityManager, access: TermsPolicyAccess): Promise<void>;
+//# sourceMappingURL=terms-policy.service.d.ts.map

package/dist/services/terms-policy.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms-policy.service.d.ts","sourceRoot":"","sources":["../../src/services/terms-policy.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,iBAAiB,CAAC;AAKpE,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,gFAAgF;AAChF,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAM5E;AAED,mFAAmF;AACnF,wBAAsB,eAAe,CACnC,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAuBf"}

package/dist/services/terms-policy.service.js

@@ -0,0 +1,26 @@
+import { LockMode, raw } from '@mikro-orm/core';
+import { PostgreSqlPlatform } from '@mikro-orm/postgresql';
+import { BootstrapStateEntitySchema } from '../entities/bootstrap-state.entity.js';
+const TERMS_POLICY_LOCK = 'terms-policy-lock';
+/** Initialize before serving requests, even when config seeding is disabled. */
+export async function initializeTermsPolicy(em) {
+    await em.upsert(BootstrapStateEntitySchema, { id: TERMS_POLICY_LOCK, value: '1' }, { onConflictFields: ['id'], onConflictAction: 'ignore' });
+}
+/** Acquire before user/session/client locks; the transaction owns its lifetime. */
+export async function lockTermsPolicy(em, access) {
+    if (!em.isInTransaction())
+        throw new Error('Terms policy requires a transaction');
+    if (em.getPlatform() instanceof PostgreSqlPlatform) {
+        await em.findOneOrFail(BootstrapStateEntitySchema, { id: TERMS_POLICY_LOCK }, {
+            refresh: true,
+            lockMode: access === 'read'
+                ? LockMode.PESSIMISTIC_READ
+                : LockMode.PESSIMISTIC_WRITE,
+        });
+        return;
+    }
+    const changed = await em.nativeUpdate(BootstrapStateEntitySchema, { id: TERMS_POLICY_LOCK }, { value: raw('value') });
+    if (changed !== 1)
+        throw new Error('Terms policy lock is not initialized');
+}
+//# sourceMappingURL=terms-policy.service.js.map

package/dist/services/terms-policy.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms-policy.service.js","sourceRoot":"","sources":["../../src/services/terms-policy.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,QAAQ,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAEnF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAG9C,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAiB;IAC3D,MAAM,EAAE,CAAC,MAAM,CACb,0BAA0B,EAC1B,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EACrC,EAAE,gBAAgB,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAiB,EACjB,MAAyB;IAEzB,IAAI,CAAC,EAAE,CAAC,eAAe,EAAE;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,kBAAkB,EAAE,CAAC;QACnD,MAAM,EAAE,CAAC,aAAa,CACpB,0BAA0B,EAC1B,EAAE,EAAE,EAAE,iBAAiB,EAAE,EACzB;YACE,OAAO,EAAE,IAAI;YACb,QAAQ,EACN,MAAM,KAAK,MAAM;gBACf,CAAC,CAAC,QAAQ,CAAC,gBAAgB;gBAC3B,CAAC,CAAC,QAAQ,CAAC,iBAAiB;SACjC,CACF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CACnC,0BAA0B,EAC1B,EAAE,EAAE,EAAE,iBAAiB,EAAE,EACzB,EAAE,KAAK,EAAE,GAAG,CAAS,OAAO,CAAC,EAAE,CAChC,CAAC;IACF,IAAI,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/services/terms.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terms.service.d.ts","sourceRoot":"","sources":["../../src/services/terms.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,KAAK,WAAW,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,CAAC;IAC5C,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,UAAU,GAAG,UAAU,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACtC;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,YAAmB,KAAK,EAAE,YAAY,EAErC;IAED;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAEpD;IAED;;OAEG;IACI,mBAAmB,CACxB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,GACX,oBAAoB,GAAG,IAAI,CAe7B;IAED;;OAEG;IACU,yBAAyB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAmC9B;IAED;;;;OAIG;IACI,4BAA4B,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAMxE;IAED;;;OAGG;IACU,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAyBtE;IAED;;;OAGG;IACU,cAAc,CAAC,MAAM,EAAE;QAClC,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,KAAK,CAAC;YACd,OAAO,EAAE,MAAM,CAAC;YAChB,MAAM,EAAE,OAAO,CAAC;YAChB,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;SACnD,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;KACvB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CA2BpC;IAED;;;;;OAKG;IACU,sBAAsB,CAAC,MAAM,EAAE;QAC1C,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;KACvB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAmBpC;IAED;;;;OAIG;IACU,gBAAgB,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAG3E;IAED;;;;;OAKG;IACU,wBAAwB,CACnC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,EACrD,KAAK,CAAC,EAAE,WAAW,EAAE,GACpB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAqBrD;IAED;;;OAGG;IACU,yBAAyB,CAAC,MAAM,EAAE;QAC7C,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACvD,GAAG,OAAO,CAAC;QACV,UAAU,EAAE;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,YAAY,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QACvD,OAAO,EAAE,sBAAsB,EAAE,CAAC;KACnC,CAAC,CAgCD;CACF"}
+{"version":3,"file":"terms.service.d.ts","sourceRoot":"","sources":["../../src/services/terms.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,KAAK,WAAW,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,CAAC;IAC5C,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,UAAU,GAAG,UAAU,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACtC;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,YAAmB,KAAK,EAAE,YAAY,EAErC;IAED;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAEpD;IAED;;OAEG;IACI,mBAAmB,CACxB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,GACX,oBAAoB,GAAG,IAAI,CAe7B;IAED;;OAEG;IACU,yBAAyB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAmC9B;IAED;;;;OAIG;IACI,4BAA4B,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAQxE;IAED;;;OAGG;IACU,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAyBtE;IAED;;;OAGG;IACU,cAAc,CAAC,MAAM,EAAE;QAClC,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,KAAK,CAAC;YACd,OAAO,EAAE,MAAM,CAAC;YAChB,MAAM,EAAE,OAAO,CAAC;YAChB,WAAW,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;SACnD,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;KACvB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CA2BpC;IAED;;;;;OAKG;IACU,sBAAsB,CAAC,MAAM,EAAE;QAC1C,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;KACvB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAmBpC;IAED;;;;OAIG;IACU,gBAAgB,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAG3E;IAED;;;;;OAKG;IACU,wBAAwB,CACnC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,EACrD,KAAK,CAAC,EAAE,WAAW,EAAE,GACpB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAqBrD;IAED;;;OAGG;IACU,yBAAyB,CAAC,MAAM,EAAE;QAC7C,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACvD,GAAG,OAAO,CAAC;QACV,UAAU,EAAE;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,YAAY,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QACvD,OAAO,EAAE,sBAAsB,EAAE,CAAC;KACnC,CAAC,CAgCD;CACF"}

package/dist/services/terms.service.js

@@ -68,7 +68,8 @@ export class TermsService {
      */
     getPendingFromLocalizedTerms(terms) {
         return terms
-            .filter((t) => t.required && (!t.userConsent || t.userConsent.requiresUpdate))
+            .filter((t) => t.required &&
+            (!t.userConsent?.agreed || t.userConsent.requiresUpdate))
             .map((t) => t.id);
     }
     /**
@@ -84,7 +85,7 @@ export class TermsService {
                 continue;
             }
             const consent = consentsMap.get(term.id);
-            if (!consent) {
+            if (!consent?.agreed) {
                 pending.push(term.id);
                 continue;
             }

package/dist/services/terms.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"terms.service.js","sourceRoot":"","sources":["../../src/services/terms.service.ts"],"names":[],"mappings":"AAiDA,MAAM,OAAO,YAAY;IACN,KAAK,CAAe;IACrC,YAAmB,KAAmB;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACI,mBAAmB,CACxB,IAAiB,EACjB,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,CAAC;QAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CACpC,MAAqB,EACrB,IAAY;QAEZ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,IAAI,WAAW,GAAG,IAAI,GAAG,EAAkC,CAAC;QAC5D,IAAI,MAAM,EAAE,CAAC;YACX,WAAW;gBACT,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEzC,IAAI,WAAW,GAA4B,IAAI,CAAC;YAChD,IAAI,OAAO,EAAE,CAAC;gBACZ,WAAW,GAAG;oBACZ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,aAAa,EAAE,OAAO,CAAC,YAAY;oBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO;iBACtD,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE;gBAChC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM;gBAC7B,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;gBAC/B,WAAW;aACZ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,4BAA4B,CAAC,KAA0B;QAC5D,OAAO,KAAK;aACT,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CACtE;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,uBAAuB,CAAC,MAAc;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAElE,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YAED,2BAA2B;YAC3B,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,cAAc,CAAC,MAQ3B;QACC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ;aAC5B,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,IAAI,CAAC,OAAO;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,6DAA6D;gBAC7D,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;aACrD,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,sBAAsB,CAAC,MAGnC;QACC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAE5D,2DAA2D;QAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;QAExE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,OAAO,EAAE,CAAC,CAAC,EAAE;gBACb,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,UAAmB;aACjC,CAAC,CAAC;YACH,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAAqB;QACjD,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,wBAAwB,CACnC,QAAqD,EACrD,KAAqB;QAErB,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACxD,0DAA0D;QAC1D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,UAAU,CAClD,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjE,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC;YAChC,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,yBAAyB,CAAC,MAGtC;QAIC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CACpD,MAAM,CAAC,QAAQ,EACf,KAAK,CACN,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrC,CAAC;QAED,2BAA2B;QAC3B,MAAM,eAAe,GACnB,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC;gBACxB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK;aACN,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QAET,2BAA2B;QAC3B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC;YACxD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK;SACN,CAAC,CAAC;QAEH,OAAO;YACL,UAAU;YACV,OAAO,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,eAAe,CAAC;SAClD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"terms.service.js","sourceRoot":"","sources":["../../src/services/terms.service.ts"],"names":[],"mappings":"AAiDA,MAAM,OAAO,YAAY;IACN,KAAK,CAAe;IACrC,YAAmB,KAAmB;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACI,mBAAmB,CACxB,IAAiB,EACjB,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,CAAC;QAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CACpC,MAAqB,EACrB,IAAY;QAEZ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,IAAI,WAAW,GAAG,IAAI,GAAG,EAAkC,CAAC;QAC5D,IAAI,MAAM,EAAE,CAAC;YACX,WAAW;gBACT,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEzC,IAAI,WAAW,GAA4B,IAAI,CAAC;YAChD,IAAI,OAAO,EAAE,CAAC;gBACZ,WAAW,GAAG;oBACZ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,aAAa,EAAE,OAAO,CAAC,YAAY;oBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO;iBACtD,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE;gBAChC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM;gBAC7B,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;gBAC/B,WAAW;aACZ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,4BAA4B,CAAC,KAA0B;QAC5D,OAAO,KAAK;aACT,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAC3D;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,uBAAuB,CAAC,MAAc;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAElE,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YAED,2BAA2B;YAC3B,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,cAAc,CAAC,MAQ3B;QACC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ;aAC5B,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,IAAI,CAAC,OAAO;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,6DAA6D;gBAC7D,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;aACrD,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,sBAAsB,CAAC,MAGnC;QACC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAE5D,2DAA2D;QAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;QAExE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,OAAO,EAAE,CAAC,CAAC,EAAE;gBACb,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,UAAmB;aACjC,CAAC,CAAC;YACH,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAAqB;QACjD,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,wBAAwB,CACnC,QAAqD,EACrD,KAAqB;QAErB,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACxD,0DAA0D;QAC1D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,UAAU,CAClD,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjE,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC;YAChC,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,yBAAyB,CAAC,MAGtC;QAIC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CACpD,MAAM,CAAC,QAAQ,EACf,KAAK,CACN,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrC,CAAC;QAED,2BAA2B;QAC3B,MAAM,eAAe,GACnB,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC;gBACxB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK;aACN,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QAET,2BAA2B;QAC3B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC;YACxD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK;SACN,CAAC,CAAC;QAEH,OAAO;YACL,UAAU;YACV,OAAO,EAAE,CAAC,GAAG,eAAe,EAAE,GAAG,eAAe,CAAC;SAClD,CAAC;IACJ,CAAC;CACF"}

package/dist/services/totp.service.d.ts

@@ -35,6 +35,7 @@ export declare class TotpService {
      * Verify a TOTP token against a secret
      */
     verifyToken(token: string, secret: string): boolean;
+    private consumeToken;
     /**
      * Generate a TOTP token for a secret (used for testing)
      */
@@ -43,7 +44,8 @@ export declare class TotpService {
      * Start TOTP setup for a user
      * Creates or updates unverified TOTP record
      */
-    startSetup(user: UserEntity): Promise<TotpSetupData>;
+    prepareSetup(user: UserEntity): Promise<TotpSetupData>;
+    startSetup(user: UserEntity, prepared?: TotpSetupData): Promise<TotpSetupData>;
     /**
      * Verify and complete TOTP setup.
      * Also generates recovery codes upon successful verification.
@@ -60,10 +62,7 @@ export declare class TotpService {
      * Disable TOTP for a user
      * Also deletes all recovery codes
      */
-    disable(userId: string, token: string, options: {
-        secondFactorRequired: boolean;
-        hasOtherSecondFactor: boolean;
-    }): Promise<void>;
+    disable(userId: string, token: string): Promise<void>;
     verifyForAuth(userId: string, token: string): Promise<void>;
     /**
      * Generate a single recovery code in the format XXXX-XXXX-XXXX-XXXX.

package/dist/services/totp.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"totp.service.d.ts","sourceRoot":"","sources":["../../src/services/totp.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;CACvB;AAQD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,YACE,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,oBAAoB,EAC5B,eAAe,EAAE,eAAe,EAKjC;IAED;;OAEG;IACI,cAAc,IAAI,MAAM,CAE9B;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ/D;IAED;;OAEG;IACU,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/D;IAED;;OAEG;IACI,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUzD;IAED;;OAEG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3C;IAED;;;OAGG;IACU,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAiChE;IAED;;;;;OAKG;IACU,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA6BzE;IAED;;;OAGG;IACU,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYvD;IAED;;;OAGG;IACU,OAAO,CAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;QACP,oBAAoB,EAAE,OAAO,CAAC;QAC9B,oBAAoB,EAAE,OAAO,CAAC;KAC/B,GACA,OAAO,CAAC,IAAI,CAAC,CAiBf;IAEY,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvE;IAED;;OAEG;IACI,0BAA0B,IAAI,MAAM,CAe1C;IAED;;;;;OAKG;IACU,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA8BtE;IAED;;;OAGG;IACU,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiC3E;IAEY,uBAAuB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBnB;CACF"}
+{"version":3,"file":"totp.service.d.ts","sourceRoot":"","sources":["../../src/services/totp.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;CACvB;AAQD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,YACE,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,oBAAoB,EAC5B,eAAe,EAAE,eAAe,EAKjC;IAED;;OAEG;IACI,cAAc,IAAI,MAAM,CAE9B;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ/D;IAED;;OAEG;IACU,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/D;IAED;;OAEG;IACI,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUzD;YAEa,YAAY;IAyB1B;;OAEG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3C;IAED;;;OAGG;IACU,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAMlE;IAEY,UAAU,CACrB,IAAI,EAAE,UAAU,EAChB,QAAQ,CAAC,EAAE,aAAa,GACvB,OAAO,CAAC,aAAa,CAAC,CAoCxB;IAED;;;;;OAKG;IACU,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA6BzE;IAED;;;OAGG;IACU,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcvD;IAED;;;OAGG;IACU,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBjE;IAEY,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvE;IAED;;OAEG;IACI,0BAA0B,IAAI,MAAM,CAe1C;IAED;;;;;OAKG;IACU,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA8BtE;IAED;;;OAGG;IACU,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB3E;IAEY,uBAAuB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;CACF"}

package/dist/services/totp.service.js

@@ -2,6 +2,7 @@ import { generateSecret, generateSync, generateURI, verifySync } from 'otplib';
 import qrcode from 'qrcode';
 import { getRandomBytes } from '../lib/crypto.js';
 import { e } from '../schemas/error.js';
+import { withUserSecurity } from './user-security.service.js';
 /** Number of recovery codes to generate */
 const RECOVERY_CODE_COUNT = 8;
 const RECOVERY_CODE_ALPHABET = 'ABCDEFGHJKMNPQRSTVWXYZ23456789';
@@ -54,6 +55,25 @@ export class TotpService {
             throw new e.InvalidTotpCode.Error();
         }
     }
+    async consumeToken(token, totp) {
+        const result = verifySync({
+            token,
+            secret: totp.secret,
+            epochTolerance: 1,
+        });
+        if (!result.valid || !('timeStep' in result))
+            throw new e.InvalidTotpCode.Error();
+        const changed = await this.mikro.userTotp.nativeUpdate({
+            id: totp.id,
+            secret: totp.secret,
+            $or: [
+                { last_used_step: null },
+                { last_used_step: { $lt: result.timeStep } },
+            ],
+        }, { last_used_step: result.timeStep });
+        if (changed !== 1)
+            throw new e.InvalidTotpCode.Error();
+    }
     /**
      * Generate a TOTP token for a secret (used for testing)
      */
@@ -64,34 +84,42 @@ export class TotpService {
      * Start TOTP setup for a user
      * Creates or updates unverified TOTP record
      */
-    async startSetup(user) {
-        const existingTotp = await this.mikro.userTotp.findByUserSub(user.sub);
-        // Only throw if TOTP is fully registered (verified AND recovery confirmed)
-        // If user verified but didn't confirm recovery codes, allow re-setup
-        if (existingTotp?.verified && existingTotp?.recovery_confirmed) {
-            throw new e.TotpAlreadyEnabled.Error();
-        }
+    async prepareSetup(user) {
         const secret = this.generateSecret();
         const otpauthUrl = this.generateOtpAuthUrl(user.email, secret);
         const qrCodeDataUrl = await this.generateQrCode(otpauthUrl);
-        // If there's an existing unverified TOTP, delete it first to avoid
-        // unique constraint violation (handles race conditions and retries)
-        if (existingTotp) {
-            await this.mikro.userTotp.nativeDelete({ user: { sub: user.sub } });
-            this.mikro.em.clear();
-        }
-        // Create new TOTP record
-        const totp = this.mikro.userTotp.create({
-            user: user.sub,
-            secret: secret,
+        return { secret, otpauthUrl, qrCodeDataUrl };
+    }
+    async startSetup(user, prepared) {
+        const { secret, otpauthUrl, qrCodeDataUrl } = prepared ?? (await this.prepareSetup(user));
+        return withUserSecurity(this.mikro, user.sub, async (freshUser) => {
+            user = freshUser;
+            const existingTotp = await this.mikro.userTotp.findByUserSub(user.sub);
+            // Only throw if TOTP is fully registered (verified AND recovery confirmed)
+            // If user verified but didn't confirm recovery codes, allow re-setup
+            if (existingTotp?.verified && existingTotp?.recovery_confirmed) {
+                throw new e.TotpAlreadyEnabled.Error();
+            }
+            // If there's an existing unverified TOTP, delete it first to avoid
+            // unique constraint violation (handles race conditions and retries)
+            if (existingTotp) {
+                await this.mikro.userTotp.nativeDelete({ user: { sub: user.sub } });
+                this.mikro.em.clear();
+            }
+            await this.mikro.userTotpRecoveryCode.deleteByUserSub(user.sub);
+            // Create new TOTP record
+            const totp = this.mikro.userTotp.create({
+                user: user.sub,
+                secret: secret,
+            });
+            this.mikro.em.persist(totp);
+            await this.mikro.em.flush();
+            return {
+                secret,
+                otpauthUrl,
+                qrCodeDataUrl,
+            };
         });
-        this.mikro.em.persist(totp);
-        await this.mikro.em.flush();
-        return {
-            secret,
-            otpauthUrl,
-            qrCodeDataUrl,
-        };
     }
     /**
      * Verify and complete TOTP setup.
@@ -100,70 +128,74 @@ export class TotpService {
      * @returns Array of plain-text recovery codes (shown only once)
      */
     async verifySetup(userId, token) {
-        const totp = await this.mikro.userTotp.findByUserSub(userId);
-        if (!totp) {
-            throw new e.TotpNotSetup.Error();
-        }
-        // Only throw if TOTP is fully registered (verified AND recovery confirmed)
-        // If user verified but didn't confirm recovery codes, allow re-verification
-        if (totp.verified && totp.recovery_confirmed) {
-            throw new e.TotpAlreadyEnabled.Error();
-        }
-        if (!this.verifyToken(token, totp.secret)) {
-            throw new e.InvalidTotpCode.Error();
-        }
-        // Flush verified status before generating recovery codes,
-        // because generateRecoveryCodes calls em.clear() which
-        // would discard the pending verified change.
-        totp.verified = true;
-        await this.mikro.em.flush();
-        // Generate recovery codes on TOTP setup completion
-        const user = await this.mikro.user.findOneOrFail({
-            sub: userId,
+        return withUserSecurity(this.mikro, userId, async () => {
+            const totp = await this.mikro.userTotp.findByUserSub(userId);
+            if (!totp) {
+                throw new e.TotpNotSetup.Error();
+            }
+            // Only throw if TOTP is fully registered (verified AND recovery confirmed)
+            // If user verified but didn't confirm recovery codes, allow re-verification
+            if (totp.verified && totp.recovery_confirmed) {
+                throw new e.TotpAlreadyEnabled.Error();
+            }
+            await this.consumeToken(token, totp);
+            // Flush verified status before generating recovery codes,
+            // because generateRecoveryCodes calls em.clear() which
+            // would discard the pending verified change.
+            totp.verified = true;
+            await this.mikro.em.flush();
+            // Generate recovery codes on TOTP setup completion
+            const user = await this.mikro.user.findOneOrFail({
+                sub: userId,
+            });
+            const recoveryCodes = await this.generateRecoveryCodes(user);
+            return recoveryCodes;
         });
-        const recoveryCodes = await this.generateRecoveryCodes(user);
-        return recoveryCodes;
     }
     /**
      * Confirm TOTP setup by acknowledging recovery codes.
      * This marks the TOTP setup as fully complete.
      */
     async confirmSetup(userId) {
-        const totp = await this.mikro.userTotp.findVerifiedByUserSub(userId);
-        if (!totp) {
-            throw new e.TotpNotSetup.Error();
-        }
-        if (totp.recovery_confirmed) {
-            throw new e.TotpAlreadyEnabled.Error();
-        }
-        totp.recovery_confirmed = true;
-        await this.mikro.em.flush();
+        return withUserSecurity(this.mikro, userId, async () => {
+            const totp = await this.mikro.userTotp.findVerifiedByUserSub(userId);
+            if (!totp) {
+                throw new e.TotpNotSetup.Error();
+            }
+            if (totp.recovery_confirmed) {
+                throw new e.TotpAlreadyEnabled.Error();
+            }
+            totp.recovery_confirmed = true;
+            await this.mikro.em.flush();
+        });
     }
     /**
      * Disable TOTP for a user
      * Also deletes all recovery codes
      */
-    async disable(userId, token, options) {
-        const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
-        if (!totp) {
-            throw new e.TotpNotEnabled.Error();
-        }
-        if (!this.verifyToken(token, totp.secret)) {
-            throw new e.InvalidTotpCode.Error();
-        }
-        // Prevent disabling TOTP when 2FA is required and no other 2FA method exists
-        if (options.secondFactorRequired && !options.hasOtherSecondFactor) {
-            throw new e.CannotRemoveLastSecondFactor.Error();
-        }
-        await this.mikro.userTotp.deleteByUserSub(userId);
-        await this.mikro.userTotpRecoveryCode.deleteByUserSub(userId);
+    async disable(userId, token) {
+        return withUserSecurity(this.mikro, userId, async () => {
+            const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
+            if (!totp) {
+                throw new e.TotpNotEnabled.Error();
+            }
+            await this.consumeToken(token, totp);
+            // Prevent disabling TOTP when 2FA is required and no other 2FA method exists
+            if (this.config.auth.password.two_factor.enrollment_required &&
+                !(this.config.auth.passkey.enabled &&
+                    (await this.mikro.userPasskey.countByUserSub(userId)) > 0)) {
+                throw new e.CannotRemoveLastSecondFactor.Error();
+            }
+            await this.mikro.userTotp.deleteByUserSub(userId);
+            await this.mikro.userTotpRecoveryCode.deleteByUserSub(userId);
+        });
     }
     async verifyForAuth(userId, token) {
         const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
         if (!totp) {
             throw new e.TotpNotEnabled.Error();
         }
-        this.verifyToken(token, totp.secret);
+        await this.consumeToken(token, totp);
     }
     /**
      * Generate a single recovery code in the format XXXX-XXXX-XXXX-XXXX.
@@ -219,26 +251,24 @@ export class TotpService {
             throw new e.NoRecoveryCodesAvailable.Error();
         }
         const codeHash = await this.securityService.hashOpaqueToken('totp-recovery', normalizedCode);
-        const recoveryCode = await this.mikro.userTotpRecoveryCode.findUnusedByUserSubAndCodeHash(userId, codeHash);
-        if (!recoveryCode) {
+        const consumed = await this.mikro.userTotpRecoveryCode.nativeUpdate({ user: userId, code_hash: codeHash, used: false }, { used: true, used_at: new Date() });
+        if (consumed !== 1)
             throw new e.InvalidRecoveryCode.Error();
-        }
-        recoveryCode.used = true;
-        recoveryCode.used_at = new Date();
-        await this.mikro.em.flush();
     }
     async regenerateRecoveryCodes(userId, token) {
-        const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
-        if (!totp) {
-            throw new e.TotpNotEnabled.Error();
-        }
-        this.verifyToken(token, totp.secret);
-        const user = await this.mikro.user.findOneOrFail({
-            sub: userId,
-        }, {
-            failHandler: () => new e.UserNotFound.Error(),
+        return withUserSecurity(this.mikro, userId, async () => {
+            const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
+            if (!totp) {
+                throw new e.TotpNotEnabled.Error();
+            }
+            await this.consumeToken(token, totp);
+            const user = await this.mikro.user.findOneOrFail({
+                sub: userId,
+            }, {
+                failHandler: () => new e.UserNotFound.Error(),
+            });
+            return this.generateRecoveryCodes(user);
         });
-        return this.generateRecoveryCodes(user);
     }
 }
 //# sourceMappingURL=totp.service.js.map