@tinyrack/issuary-server 0.30.0 → 0.32.1

package/dist/services/totp.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"totp.service.js","sourceRoot":"","sources":["../../src/services/totp.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,MAAM,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAiBxC,2CAA2C;AAC3C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAChE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,MAAM,OAAO,WAAW;IACL,KAAK,CAAe;IACpB,MAAM,CAAuB;IAC7B,eAAe,CAAkB;IAClD,YACE,KAAmB,EACnB,MAA4B,EAC5B,eAAgC;QAEhC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;OAEG;IACI,cAAc;QACnB,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAa,EAAE,MAAc;QACrD,OAAO,WAAW,CAAC;YACjB,MAAM,EACJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;YAClC,KAAK,EAAE,KAAK;YACZ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,WAAW,CAAC,KAAa,EAAE,MAAc;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YACtC,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,MAAc;QACjC,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,UAAU,CAAC,IAAgB;QACtC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEvE,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,YAAY,EAAE,QAAQ,IAAI,YAAY,EAAE,kBAAkB,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAE5D,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,yBAAyB;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtC,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO;YACL,MAAM;YACN,UAAU;YACV,aAAa;SACd,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAa;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,0DAA0D;QAC1D,uDAAuD;QACvD,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,mDAAmD;QACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;YAC/C,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE7D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,OAAO,CAClB,MAAc,EACd,KAAa,EACb,OAGC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,6EAA6E;QAC7E,IAAI,OAAO,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClE,MAAM,IAAI,CAAC,CAAC,4BAA4B,CAAC,KAAK,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAa;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACI,0BAA0B;QAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC3B,GAAG,CACF,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CACvE;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,KAAK,CAAC,IAAI,CACf,EAAE,MAAM,EAAE,oBAAoB,GAAG,0BAA0B,EAAE,EAC7D,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CACX,IAAI,CAAC,KAAK,CACR,KAAK,GAAG,0BAA0B,EAClC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,0BAA0B,CACzC,CACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAAgB;QACjD,qCAAqC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAEtB,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;YACpD,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QAEH,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CACzD,eAAe,EACf,IAAI,CACL,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC;gBACpD,IAAI,EAAE,SAAS,CAAC,GAAG;gBACnB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE1C,sDAAsD;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,eAAe,GACnB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAErE,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CACzD,eAAe,EACf,cAAc,CACf,CAAC;QACF,MAAM,YAAY,GAChB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,8BAA8B,CAClE,MAAM,EACN,QAAQ,CACT,CAAC;QAEJ,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC;QACzB,YAAY,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAClC,MAAc,EACd,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAC9C;YACE,GAAG,EAAE,MAAM;SACZ,EACD;YACE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CACF,CAAC;QAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"totp.service.js","sourceRoot":"","sources":["../../src/services/totp.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,MAAM,MAAM,QAAQ,CAAC;AAI5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAGxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAe9D,2CAA2C;AAC3C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAChE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,MAAM,OAAO,WAAW;IACL,KAAK,CAAe;IACpB,MAAM,CAAuB;IAC7B,eAAe,CAAkB;IAClD,YACE,KAAmB,EACnB,MAA4B,EAC5B,eAAgC;QAEhC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;OAEG;IACI,cAAc;QACnB,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAa,EAAE,MAAc;QACrD,OAAO,WAAW,CAAC;YACjB,MAAM,EACJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;YAClC,KAAK,EAAE,KAAK;YACZ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,WAAW,CAAC,KAAa,EAAE,MAAc;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YACtC,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,KAAa,EACb,IAAqB;QAErB,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC;YAC1C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CACpD;YACE,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE;gBACH,EAAE,cAAc,EAAE,IAAI,EAAE;gBACxB,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;aAC7C;SACF,EACD,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CACpC,CAAC;QACF,IAAI,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,MAAc;QACjC,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY,CAAC,IAAgB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAE5D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,UAAU,CACrB,IAAgB,EAChB,QAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GACzC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAChE,IAAI,GAAG,SAAS,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEvE,2EAA2E;YAC3E,qEAAqE;YACrE,IAAI,YAAY,EAAE,QAAQ,IAAI,YAAY,EAAE,kBAAkB,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACzC,CAAC;YAED,mEAAmE;YACnE,oEAAoE;YACpE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEhE,yBAAyB;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACtC,IAAI,EAAE,IAAI,CAAC,GAAG;gBACd,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAE5B,OAAO;gBACL,MAAM;gBACN,UAAU;gBACV,aAAa;aACd,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAa;QACpD,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACnC,CAAC;YAED,2EAA2E;YAC3E,4EAA4E;YAC5E,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACzC,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAErC,0DAA0D;YAC1D,uDAAuD;YACvD,6CAA6C;YAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAE5B,mDAAmD;YACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC/C,GAAG,EAAE,MAAM;aACZ,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAE7D,OAAO,aAAa,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACnC,CAAC;YAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACzC,CAAC;YAED,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,KAAa;QAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YACrC,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAErC,6EAA6E;YAC7E,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB;gBACxD,CAAC,CACC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;oBAChC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAC1D,EACD,CAAC;gBACD,MAAM,IAAI,CAAC,CAAC,4BAA4B,CAAC,KAAK,EAAE,CAAC;YACnD,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAa;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACI,0BAA0B;QAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC3B,GAAG,CACF,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CACvE;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,KAAK,CAAC,IAAI,CACf,EAAE,MAAM,EAAE,oBAAoB,GAAG,0BAA0B,EAAE,EAC7D,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CACX,IAAI,CAAC,KAAK,CACR,KAAK,GAAG,0BAA0B,EAClC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,0BAA0B,CACzC,CACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAAgB;QACjD,qCAAqC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAEtB,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;YACpD,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QAEH,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CACzD,eAAe,EACf,IAAI,CACL,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC;gBACpD,IAAI,EAAE,SAAS,CAAC,GAAG;gBACnB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE1C,sDAAsD;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,eAAe,GACnB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAErE,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CACzD,eAAe,EACf,cAAc,CACf,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,CACjE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAClD,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CACpC,CAAC;QACF,IAAI,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAClC,MAAc,EACd,KAAa;QAEb,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YACrC,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAErC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAC9C;gBACE,GAAG,EAAE,MAAM;aACZ,EACD;gBACE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;aAC9C,CACF,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/services/user-consent.service.d.ts

@@ -9,6 +9,18 @@ export declare class UserConsentService {
      * Check if user has already consented to the requested scopes for a client.
      */
     hasConsent(userSub: string, clientId: string, requestedScopes: string[]): Promise<boolean>;
+    /** Resolve grants before displaying, storing, or issuing requested scopes.
+     * OIDC Core §11: offline access needs explicit or preconfigured approval.
+     * An active, explicitly saved offline grant remains valid until revoked.
+     */
+    resolveScopes(params: {
+        userSub: string;
+        clientId: string;
+        requestedScopes: string[];
+        responseType: string;
+        prompt?: string | undefined;
+        skipConsent?: boolean | undefined;
+    }): Promise<string[]>;
     /**
      * Determine if consent screen is required based on:
      * - User's existing consent

package/dist/services/user-consent.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-consent.service.d.ts","sourceRoot":"","sources":["../../src/services/user-consent.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,YAAmB,KAAK,EAAE,YAAY,EAErC;IAED;;OAEG;IACU,UAAU,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAMlB;IAED;;;;;;OAMG;IACU,eAAe,CAAC,MAAM,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;QAC9C,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBnB;IAED;;OAEG;IACU,YAAY,CAAC,MAAM,EAAE;QAChC,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAQ7B;CACF"}
+{"version":3,"file":"user-consent.service.d.ts","sourceRoot":"","sources":["../../src/services/user-consent.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,YAAmB,KAAK,EAAE,YAAY,EAErC;IAED;;OAEG;IACU,UAAU,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAMlB;IAED;;;OAGG;IACU,aAAa,CAAC,MAAM,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAcpB;IAED;;;;;;OAMG;IACU,eAAe,CAAC,MAAM,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;QAC9C,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBnB;IAED;;OAEG;IACU,YAAY,CAAC,MAAM,EAAE;QAChC,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAQ7B;CACF"}

package/dist/services/user-consent.service.js

@@ -9,6 +9,24 @@ export class UserConsentService {
     async hasConsent(userSub, clientId, requestedScopes) {
         return this.mikro.userConsent.hasConsent(userSub, clientId, requestedScopes);
     }
+    /** Resolve grants before displaying, storing, or issuing requested scopes.
+     * OIDC Core §11: offline access needs explicit or preconfigured approval.
+     * An active, explicitly saved offline grant remains valid until revoked.
+     */
+    async resolveScopes(params) {
+        const scopes = [...new Set(params.requestedScopes)];
+        if (!scopes.includes('offline_access'))
+            return scopes;
+        const permitsOffline = params.responseType === 'code' &&
+            (params.skipConsent ||
+                params.prompt?.split(' ').includes('consent') ||
+                (await this.hasConsent(params.userSub, params.clientId, [
+                    'offline_access',
+                ])));
+        return permitsOffline
+            ? scopes
+            : scopes.filter((scope) => scope !== 'offline_access');
+    }
     /**
      * Determine if consent screen is required based on:
      * - User's existing consent
@@ -19,7 +37,7 @@ export class UserConsentService {
     async requiresConsent(params) {
         const { userSub, clientId, requestedScopes, prompt, skipConsent } = params;
         // If prompt=consent, always show consent screen
-        if (prompt === 'consent') {
+        if (prompt?.split(' ').includes('consent')) {
             return true;
         }
         if (skipConsent) {

package/dist/services/user-consent.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-consent.service.js","sourceRoot":"","sources":["../../src/services/user-consent.service.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,kBAAkB;IACZ,KAAK,CAAe;IACrC,YAAmB,KAAmB;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU,CACrB,OAAe,EACf,QAAgB,EAChB,eAAyB;QAEzB,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CACtC,OAAO,EACP,QAAQ,EACR,eAAe,CAChB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,eAAe,CAAC,MAM5B;QACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;QAE3E,gDAAgD;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,8DAA8D;QAC9D,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,UAAU,CAC9C,OAAO,EACP,QAAQ,EACR,eAAe,CAChB,CAAC;QAEF,8EAA8E;QAC9E,OAAO,CAAC,kBAAkB,CAAC;IAC7B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,MAIzB;QACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAE7C,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;YACzC,OAAO;YACP,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"user-consent.service.js","sourceRoot":"","sources":["../../src/services/user-consent.service.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,kBAAkB;IACZ,KAAK,CAAe;IACrC,YAAmB,KAAmB;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU,CACrB,OAAe,EACf,QAAgB,EAChB,eAAyB;QAEzB,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CACtC,OAAO,EACP,QAAQ,EACR,eAAe,CAChB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,aAAa,CAAC,MAO1B;QACC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,OAAO,MAAM,CAAC;QAEtD,MAAM,cAAc,GAClB,MAAM,CAAC,YAAY,KAAK,MAAM;YAC9B,CAAC,MAAM,CAAC,WAAW;gBACjB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC7C,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACtD,gBAAgB;iBACjB,CAAC,CAAC,CAAC,CAAC;QACT,OAAO,cAAc;YACnB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,eAAe,CAAC,MAM5B;QACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;QAE3E,gDAAgD;QAChD,IAAI,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,8DAA8D;QAC9D,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,UAAU,CAC9C,OAAO,EACP,QAAQ,EACR,eAAe,CAChB,CAAC;QAEF,8EAA8E;QAC9E,OAAO,CAAC,kBAAkB,CAAC;IAC7B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,YAAY,CAAC,MAIzB;QACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAE7C,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC;YACzC,OAAO;YACP,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/services/user-security.service.d.ts

@@ -0,0 +1,15 @@
+import { UserEntity } from '../entities/user.entity.js';
+import type { IssuaryRuntimeConfig } from '../lib/config/index.js';
+import type { MikroService } from './mikro.service.js';
+export declare function isSecurityConflict(error: unknown): boolean;
+/** The write precedes every policy read, including on SQLite's deferred transactions. */
+export declare function withUserSecurity<T>(mikro: MikroService, sub: string, operation: (user: UserEntity) => Promise<T>, options?: {
+    includeDeleted?: boolean;
+}): Promise<T>;
+export declare function authenticationMethods(mikro: MikroService, config: IssuaryRuntimeConfig, user: UserEntity): Promise<{
+    oauth: number;
+    passkeys: number;
+    totp: boolean;
+    password: boolean;
+}>;
+//# sourceMappingURL=user-security.service.d.ts.map

package/dist/services/user-security.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-security.service.d.ts","sourceRoot":"","sources":["../../src/services/user-security.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAgB1D;AAED,yFAAyF;AACzF,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EAC3C,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,UAAU;;;;;GAuBjB"}

package/dist/services/user-security.service.js

@@ -0,0 +1,57 @@
+import { raw } from '@mikro-orm/core';
+import { UserEntity } from '../entities/user.entity.js';
+import { e } from '../schemas/error.js';
+export function isSecurityConflict(error) {
+    if (!(error instanceof Error))
+        return false;
+    const code = Reflect.get(error, 'code');
+    return ([
+        'SQLITE_BUSY',
+        'SQLITE_BUSY_SNAPSHOT',
+        'SQLITE_LOCKED',
+        '40001',
+        '40P01',
+        '55P03',
+    ].includes(String(code)) ||
+        /database (?:is )?locked|serialization failure|deadlock detected/i.test(error.message));
+}
+/** The write precedes every policy read, including on SQLite's deferred transactions. */
+export async function withUserSecurity(mikro, sub, operation, options = {}) {
+    try {
+        return await mikro.em.transactional(async (em) => {
+            const changed = await em.nativeUpdate(UserEntity, { sub, ...(options.includeDeleted ? {} : { deleted_at: null }) }, { security_revision: raw('security_revision + 1') });
+            if (changed !== 1)
+                throw new e.UserNotFound.Error();
+            const user = await em.findOneOrFail(UserEntity, { sub }, { populate: ['password_hash'], refresh: true });
+            return operation(user);
+        });
+    }
+    catch (error) {
+        if (isSecurityConflict(error))
+            throw new e.ConcurrentSecurityChange.Error();
+        throw error;
+    }
+}
+export async function authenticationMethods(mikro, config, user) {
+    const providers = config.identity_providers
+        .filter((provider) => provider.enabled)
+        .map((provider) => provider.id);
+    const oauth = providers.length
+        ? await mikro.userOAuth.count({
+            user: user.sub,
+            provider_name: { $in: providers },
+        })
+        : 0;
+    const passkeys = config.auth.passkey.enabled
+        ? await mikro.userPasskey.countByUserSub(user.sub)
+        : 0;
+    const totp = config.auth.password.totp.enabled &&
+        (await mikro.userTotp.isRegistered(user.sub));
+    return {
+        oauth,
+        passkeys,
+        totp,
+        password: config.auth.password.enabled && user.hasPassword(),
+    };
+}
+//# sourceMappingURL=user-security.service.js.map

package/dist/services/user-security.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-security.service.js","sourceRoot":"","sources":["../../src/services/user-security.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAGxC,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,CACL;QACE,aAAa;QACb,sBAAsB;QACtB,eAAe;QACf,OAAO;QACP,OAAO;QACP,OAAO;KACR,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,kEAAkE,CAAC,IAAI,CACrE,KAAK,CAAC,OAAO,CACd,CACF,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAmB,EACnB,GAAW,EACX,SAA2C,EAC3C,OAAO,GAAiC,EAAE;IAE1C,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC/C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CACnC,UAAU,EACV,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,EAChE,EAAE,iBAAiB,EAAE,GAAG,CAAS,uBAAuB,CAAC,EAAE,CAC5D,CAAC;YACF,IAAI,OAAO,KAAK,CAAC;gBAAE,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,aAAa,CACjC,UAAU,EACV,EAAE,GAAG,EAAE,EACP,EAAE,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAC/C,CAAC;YACF,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;QAC5E,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAmB,EACnB,MAA4B,EAC5B,IAAgB;IAEhB,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB;SACxC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM;QAC5B,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1B,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,aAAa,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;SAClC,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;QAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAClD,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO;QACjC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE;KAC7D,CAAC;AACJ,CAAC"}

package/dist/services/user.service.d.ts

@@ -4,17 +4,17 @@ import type { UserEntity } from '../entities/user.entity.ts';
 import type { IssuaryRuntimeConfig } from '../lib/config/index.ts';
 import type { Locale } from '../lib/locale.ts';
 import type { r } from '../schemas/response.ts';
-import type { EmailService } from './email.service.ts';
+import type { MailQueueService } from './mail-queue.service.js';
 import type { MikroService } from './mikro.service.ts';
 import type { PasswordAuthService } from './password-auth.service.ts';
 import type { TermsService } from './terms.service.ts';
 export declare class UserService {
     private readonly mikro;
     private readonly config;
-    private readonly emailService;
+    private readonly mailQueue;
     private readonly passwordAuthService;
     private readonly termsService?;
-    constructor(mikro: MikroService, config: IssuaryRuntimeConfig, emailService: EmailService, passwordAuthService: PasswordAuthService, termsService?: TermsService);
+    constructor(mikro: MikroService, config: IssuaryRuntimeConfig, mailQueue: MailQueueService, passwordAuthService: PasswordAuthService, termsService?: TermsService);
     userEntityToSessionUser(user: Loaded<UserEntity, 'password_hash' | 'passkeys' | 'totps', '*', never>): Promise<z.infer<typeof r.UserSession>>;
     getSessionUserBySub(userSub: string): Promise<z.infer<typeof r.UserSession>>;
     buildSessionUser(params: {
@@ -80,7 +80,9 @@ export declare class UserService {
             agreed: boolean;
         }>;
         locale?: Locale | undefined;
-    }): Promise<z.infer<typeof r.UserSession>>;
+    }): Promise<z.infer<typeof r.UserSession> & {
+        token_epoch: string;
+    }>;
     /**
      * @description
      * Request account deletion (soft delete).

package/dist/services/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../src/services/user.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAA2B;IACzD,YACE,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,oBAAoB,EAC5B,YAAY,EAAE,YAAY,EAC1B,mBAAmB,EAAE,mBAAmB,EACxC,YAAY,CAAC,EAAE,YAAY,EAO5B;IAEY,uBAAuB,CAClC,IAAI,EAAE,MAAM,CACV,UAAU,EACV,eAAe,GAAG,UAAU,GAAG,OAAO,EACtC,GAAG,EACH,KAAK,CACN,GACA,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAWxC;IAEY,mBAAmB,CAC9B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAGxC;IAEY,gBAAgB,CAAC,MAAM,EAAE;QACpC,IAAI,EAAE,IAAI,CACR,UAAU,EACV,KAAK,GAAG,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAC3D,GAAG;YACF,WAAW,IAAI,OAAO,CAAC;SACxB,CAAC;QACF,cAAc,EAAE,OAAO,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAmBzC;IAEY,yBAAyB,CACpC,IAAI,EAAE,MAAM,CACV,UAAU,EACV,eAAe,GAAG,UAAU,GAAG,OAAO,EACtC,GAAG,EACH,KAAK,CACN,GACA,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAMtC;IAEY,cAAc,CAAC,MAAM,EAAE;QAClC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,OAAO,CAAC;QACxB,SAAS,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;QACjD,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;QACtC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACpC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAChC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;QACnD,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;KACxC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAmDnD;IAEY,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAG3E;IAEY,eAAe,CAAC,MAAM,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;QACtC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KACrC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAUvC;IAEY,eAAe,CAAC,MAAM,EAAE;QACnC,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;QACtC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KACrC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAkCvC;IAEY,eAAe,CAAC,MAAM,EAAE;QACnC,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAevC;IAEY,gBAAgB,CAC3B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAUtC;IAEY,uBAAuB,CAAC,MAAM,EAAE;QAC3C,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,MAAM,CAAC,EACH;YACE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3B,cAAc,EAAE,OAAO,CAAC;YACxB,SAAS,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;YACjD,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;YACtC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;SACrC,GACD,SAAS,CAAC;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC,CAuCD;IAEY,QAAQ,CAAC,MAAM,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAiFzC;IAED;;;;OAIG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QACrD,UAAU,EAAE,IAAI,CAAC;KAClB,CAAC,CAkBD;IAEM,6BAA6B,CAAC,QAAQ,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;KACtC,GAAG,OAAO,CAMV;IAED;;OAEG;IACI,oBAAoB,CAAC,QAAQ,EAAE;QACpC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;KACtC,GAAG,OAAO,CAKV;IAEY,wBAAwB,CACnC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAcjC;IAED;;;OAGG;IACI,2BAA2B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAS3D;CACF"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../src/services/user.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAEhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIvD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAA2B;IACzD,YACE,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,gBAAgB,EAC3B,mBAAmB,EAAE,mBAAmB,EACxC,YAAY,CAAC,EAAE,YAAY,EAO5B;IAEY,uBAAuB,CAClC,IAAI,EAAE,MAAM,CACV,UAAU,EACV,eAAe,GAAG,UAAU,GAAG,OAAO,EACtC,GAAG,EACH,KAAK,CACN,GACA,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAWxC;IAEY,mBAAmB,CAC9B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAGxC;IAEY,gBAAgB,CAAC,MAAM,EAAE;QACpC,IAAI,EAAE,IAAI,CACR,UAAU,EACV,KAAK,GAAG,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAC3D,GAAG;YACF,WAAW,IAAI,OAAO,CAAC;SACxB,CAAC;QACF,cAAc,EAAE,OAAO,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAmBzC;IAEY,yBAAyB,CACpC,IAAI,EAAE,MAAM,CACV,UAAU,EACV,eAAe,GAAG,UAAU,GAAG,OAAO,EACtC,GAAG,EACH,KAAK,CACN,GACA,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAMtC;IAEY,cAAc,CAAC,MAAM,EAAE;QAClC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,OAAO,CAAC;QACxB,SAAS,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;QACjD,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;QACtC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACpC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAChC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;QACnD,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;KACxC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAmDnD;IAEY,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAG3E;IAEY,eAAe,CAAC,MAAM,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;QACtC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KACrC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAUvC;IAEY,eAAe,CAAC,MAAM,EAAE;QACnC,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;QACtC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KACrC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAiDvC;IAEY,eAAe,CAAC,MAAM,EAAE;QACnC,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAkBvC;IAEY,gBAAgB,CAC3B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAkBtC;IAEY,uBAAuB,CAAC,MAAM,EAAE;QAC3C,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,MAAM,CAAC,EACH;YACE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3B,cAAc,EAAE,OAAO,CAAC;YACxB,SAAS,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;YACjD,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;YACtC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;SACrC,GACD,SAAS,CAAC;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC,CA2CD;IAEY,QAAQ,CAAC,MAAM,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAqFnE;IAED;;;;OAIG;IACU,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QACrD,UAAU,EAAE,IAAI,CAAC;KAClB,CAAC,CAqBD;IAEM,6BAA6B,CAAC,QAAQ,EAAE;QAC7C,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;KACtC,GAAG,OAAO,CAMV;IAED;;OAEG;IACI,oBAAoB,CAAC,QAAQ,EAAE;QACpC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;KACtC,GAAG,OAAO,CAKV;IAEY,wBAAwB,CACnC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAcjC;IAED;;;OAGG;IACI,2BAA2B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAS3D;CACF"}

package/dist/services/user.service.js

@@ -1,14 +1,17 @@
 import { e } from '../schemas/error.js';
+import { invalidateUserAuthentication } from './authentication-epoch.js';
+import { lockTermsPolicy } from './terms-policy.service.js';
+import { withUserSecurity } from './user-security.service.js';
 export class UserService {
     mikro;
     config;
-    emailService;
+    mailQueue;
     passwordAuthService;
     termsService;
-    constructor(mikro, config, emailService, passwordAuthService, termsService) {
+    constructor(mikro, config, mailQueue, passwordAuthService, termsService) {
         this.mikro = mikro;
         this.config = config;
-        this.emailService = emailService;
+        this.mailQueue = mailQueue;
         this.passwordAuthService = passwordAuthService;
         this.termsService = termsService;
     }
@@ -115,59 +118,74 @@ export class UserService {
         return this.getAdminUser(user.sub);
     }
     async updateAdminUser(params) {
-        const user = await this.mikro.user.verifyBySub(params.sub);
-        if (params.sub === params.actorSub && params.role === 'user') {
-            throw new e.Forbidden.Error();
-        }
-        if (user.managed_by === 'config') {
-            throw new e.UserNotEditable.Error();
-        }
-        if (user.deleted_at) {
-            throw new e.UserNotFound.Error();
-        }
-        if (params.email !== undefined && params.email !== user.email) {
-            const existing = await this.mikro.user.findOne({
-                email: params.email,
-                sub: { $ne: params.sub },
-            });
-            if (existing) {
-                throw new e.EmailAlreadyExists.Error();
+        return withUserSecurity(this.mikro, params.sub, async (user) => {
+            const emailChanged = params.email !== undefined && params.email !== user.email;
+            if (params.sub === params.actorSub && params.role === 'user') {
+                throw new e.Forbidden.Error();
             }
-            user.email = params.email;
-        }
-        if (params.role !== undefined) {
-            user.role = params.role;
-        }
-        if (params.emailVerified !== undefined) {
-            user.email_verified = params.emailVerified;
-        }
-        await this.mikro.em.flush();
-        return this.getAdminUser(user.sub);
+            if (user.managed_by === 'config') {
+                throw new e.UserNotEditable.Error();
+            }
+            if (user.deleted_at) {
+                throw new e.UserNotFound.Error();
+            }
+            if (params.email !== undefined && params.email !== user.email) {
+                const existing = await this.mikro.user.findOne({
+                    email: params.email,
+                    sub: { $ne: params.sub },
+                });
+                if (existing) {
+                    throw new e.EmailAlreadyExists.Error();
+                }
+                await invalidateUserAuthentication(this.mikro.em, user);
+                user.email = params.email;
+                user.email_verified = false;
+            }
+            if (params.role !== undefined) {
+                if (user.role !== params.role) {
+                    await invalidateUserAuthentication(this.mikro.em, user);
+                }
+                user.role = params.role;
+            }
+            if (params.emailVerified !== undefined) {
+                user.email_verified = params.emailVerified;
+            }
+            await this.mikro.em.flush();
+            if (emailChanged && !user.email_verified && this.config.email)
+                await this.mailQueue.enqueue('verification', user.email, undefined, user.sub);
+            return this.getAdminUser(user.sub);
+        });
     }
     async deleteAdminUser(params) {
-        if (params.sub === params.actorSub) {
-            throw new e.Forbidden.Error();
-        }
-        const user = await this.mikro.user.verifyBySub(params.sub);
-        if (user.managed_by === 'config') {
-            throw new e.UserNotEditable.Error();
-        }
-        if (!user.deleted_at) {
-            user.deleted_at = new Date();
-            await this.mikro.em.flush();
-        }
-        return this.adminUserEntityToResponse(user);
+        return withUserSecurity(this.mikro, params.sub, async () => {
+            if (params.sub === params.actorSub) {
+                throw new e.Forbidden.Error();
+            }
+            const user = await this.mikro.user.verifyBySub(params.sub);
+            if (user.managed_by === 'config') {
+                throw new e.UserNotEditable.Error();
+            }
+            if (!user.deleted_at) {
+                await invalidateUserAuthentication(this.mikro.em, user);
+                user.deleted_at = new Date();
+                await this.mikro.em.flush();
+            }
+            return this.adminUserEntityToResponse(user);
+        });
     }
     async restoreAdminUser(sub) {
-        const user = await this.mikro.user.verifyBySubIncludingDeleted(sub);
-        if (user.managed_by === 'config') {
-            throw new e.UserNotEditable.Error();
-        }
-        if (user.deleted_at) {
-            user.deleted_at = null;
-            await this.mikro.em.flush();
-        }
-        return this.adminUserEntityToResponse(user);
+        return withUserSecurity(this.mikro, sub, async () => {
+            const user = await this.mikro.user.verifyBySubIncludingDeleted(sub);
+            if (user.managed_by === 'config') {
+                throw new e.UserNotEditable.Error();
+            }
+            if (user.deleted_at) {
+                await invalidateUserAuthentication(this.mikro.em, user);
+                user.deleted_at = null;
+                await this.mikro.em.flush();
+            }
+            return this.adminUserEntityToResponse(user);
+        }, { includeDeleted: true });
     }
     async bulkSetAdminUserDeleted(params) {
         const where = params.ids
@@ -191,7 +209,10 @@ export class UserService {
                 ];
             }
         }
-        const users = await this.mikro.user.find(where);
+        const users = await this.mikro.user.find(where, {
+            refresh: true,
+            orderBy: { sub: 'ASC' },
+        });
         const skipped = {};
         let changed = 0;
         for (const user of users) {
@@ -206,6 +227,7 @@ export class UserService {
                 skipped[reason] = (skipped[reason] ?? 0) + 1;
                 continue;
             }
+            await invalidateUserAuthentication(this.mikro.em, user);
             user.deleted_at = params.deleted ? new Date() : null;
             changed += 1;
         }
@@ -213,71 +235,68 @@ export class UserService {
         return { matched: users.length, changed, skipped };
     }
     async register(params) {
-        // 1. Validate explicit terms consent before user creation
-        // Load terms once and reuse across validation and recording
-        const terms = this.termsService
-            ? await this.termsService.getGlobalTerms()
-            : undefined;
-        if (this.termsService && terms) {
-            const explicitTerms = await this.termsService.getExplicitTerms(terms);
-            const hasRequiredExplicitTerms = explicitTerms.some((t) => t.required);
-            if (hasRequiredExplicitTerms) {
-                if (!params.consents || params.consents.length === 0) {
-                    throw new e.ValidationError.Error('Terms consent is required for registration');
-                }
-                const validation = await this.termsService.validateExplicitConsents(params.consents, terms);
-                if (!validation.valid) {
-                    throw new e.ValidationError.Error(`Missing required terms: ${validation.missingTerms.join(', ')}`);
+        const passwordHash = await this.passwordAuthService.prepareDatabasePassword(params.password);
+        return this.mikro.em.transactional(async () => {
+            await lockTermsPolicy(this.mikro.em, 'read');
+            // 1. Validate explicit terms consent before user creation
+            // Load terms once and reuse across validation and recording
+            const terms = this.termsService
+                ? await this.termsService.getGlobalTerms()
+                : undefined;
+            if (this.termsService && terms) {
+                const explicitTerms = await this.termsService.getExplicitTerms(terms);
+                const hasRequiredExplicitTerms = explicitTerms.some((t) => t.required);
+                if (hasRequiredExplicitTerms) {
+                    if (!params.consents || params.consents.length === 0) {
+                        throw new e.ValidationError.Error('Terms consent is required for registration');
+                    }
+                    const validation = await this.termsService.validateExplicitConsents(params.consents, terms);
+                    if (!validation.valid) {
+                        throw new e.ValidationError.Error(`Missing required terms: ${validation.missingTerms.join(', ')}`);
+                    }
                 }
             }
-        }
-        // 2. Register the user
-        const user = await this.passwordAuthService.createDatabaseUser({
-            email: params.email,
-            password: params.password,
-        });
-        // 3. Generate email verification token and send email
-        if (this.config.email) {
-            const verification = await this.emailService.generateToken({
-                userSub: user.sub,
-            });
-            await this.mikro.em.flush();
-            this.emailService.sendVerificationEmailAsync({
-                email: user.email,
-                token: verification.token,
-                locale: params.locale,
+            // 2. Register the user
+            const user = await this.mikro.user.register({
+                email: params.email,
+                passwordHash,
             });
-        }
-        // 4. Record terms consent after successful registration
-        if (this.termsService && terms) {
-            // Record explicit consents provided by user
-            if (params.consents && params.consents.length > 0) {
-                await this.termsService.recordConsents({
+            // 3. Generate email verification token and send email
+            if (this.config.email) {
+                await this.mailQueue.enqueue('verification', user.email, params.locale, user.sub);
+            }
+            // 4. Record terms consent after successful registration
+            if (this.termsService && terms) {
+                // Record explicit consents provided by user
+                if (params.consents && params.consents.length > 0) {
+                    await this.termsService.recordConsents({
+                        userSub: user.sub,
+                        consents: params.consents,
+                        terms,
+                    });
+                }
+                // Record implicit consents for terms with implicit consent mode
+                await this.termsService.recordImplicitConsents({
                     userSub: user.sub,
-                    consents: params.consents,
                     terms,
                 });
             }
-            // Record implicit consents for terms with implicit consent mode
-            await this.termsService.recordImplicitConsents({
-                userSub: user.sub,
-                terms,
-            });
-        }
-        // 5. Return session info
-        return {
-            sub: user.sub,
-            managed_by: 'database',
-            email: user.email,
-            role: user.role,
-            email_verified: user.email_verified,
-            email_verification_required: this.userEmailVerificationRequired(user),
-            has_password: user.hasPassword(),
-            totp_registered: false,
-            totp_recovery_codes_missing: false,
-            second_factor_required: this.user2FASetupRequired(user),
-            passkey_count: 0,
-        };
+            // 5. Return session info
+            return {
+                sub: user.sub,
+                token_epoch: user.token_epoch,
+                managed_by: 'database',
+                email: user.email,
+                role: user.role,
+                email_verified: user.email_verified,
+                email_verification_required: this.userEmailVerificationRequired(user),
+                has_password: user.hasPassword(),
+                totp_registered: false,
+                totp_recovery_codes_missing: false,
+                second_factor_required: this.user2FASetupRequired(user),
+                passkey_count: 0,
+            };
+        });
     }
     /**
      * @description
@@ -285,17 +304,20 @@ export class UserService {
      * Config-managed users cannot be deleted.
      */
     async requestDeletion(userSub) {
-        // Check if user exists and is not config-managed
-        const user = await this.mikro.user.findOneOrFail({ sub: userSub, deleted_at: null }, { failHandler: () => new e.UserNotFound.Error() });
-        if (user.managed_by === 'config') {
-            throw new e.UserNotEditable.Error();
-        }
-        // Soft delete the user
-        user.deleted_at = new Date();
-        await this.mikro.em.flush();
-        return {
-            deleted_at: user.deleted_at,
-        };
+        return withUserSecurity(this.mikro, userSub, async () => {
+            // Check if user exists and is not config-managed
+            const user = await this.mikro.user.findOneOrFail({ sub: userSub, deleted_at: null }, { failHandler: () => new e.UserNotFound.Error() });
+            if (user.managed_by === 'config') {
+                throw new e.UserNotEditable.Error();
+            }
+            // Soft delete the user
+            await invalidateUserAuthentication(this.mikro.em, user);
+            user.deleted_at = new Date();
+            await this.mikro.em.flush();
+            return {
+                deleted_at: user.deleted_at,
+            };
+        });
     }
     userEmailVerificationRequired(userLike) {
         return (userLike.managed_by !== 'config' &&