@tinyrack/issuary-server 0.31.0 → 0.32.2

package/dist/services/mail-queue.service.js

@@ -0,0 +1,223 @@
+import { RequestContext } from '@mikro-orm/core';
+import { z } from 'zod';
+import { BackgroundJobEntitySchema } from '../entities/background-job.entity.js';
+import { DatabaseBackgroundJobStore } from '../entrypoints/scheduler/database.js';
+import { DistributedBackgroundJobRunner, PermanentBackgroundJobError, } from '../entrypoints/scheduler/distributed-runner.js';
+import { e } from '../schemas/error.js';
+import { withUserSecurity } from './user-security.service.js';
+const JOB_ID = 'security.mail';
+const Envelope = z.object({ id: z.uuid(), sealed: z.string() });
+const MailRequest = z.object({
+    kind: z.enum(['verification', 'password-reset']),
+    email: z.email(),
+    requestedAt: z.number(),
+    locale: z.enum(['ko', 'en', 'ja']).optional(),
+    userSub: z.string().optional(),
+    token: z.string().optional(),
+    userEpoch: z.string().optional(),
+});
+export class MailQueueService {
+    instanceId = `mail:${crypto.randomUUID()}`;
+    runner;
+    handle;
+    config;
+    mikro;
+    emailService;
+    security;
+    logger;
+    constructor(config, mikro, emailService, security, logger) {
+        this.config = config;
+        this.mikro = mikro;
+        this.emailService = emailService;
+        this.security = security;
+        this.logger = logger;
+    }
+    start() {
+        if (!this.config.email || this.handle)
+            return;
+        this.runner = new DistributedBackgroundJobRunner({
+            name: 'Security mail',
+            pollIntervalMs: 5000,
+            lockTtlMs: 60000,
+            retryDelayMs: 1000,
+            maxAttempts: 3,
+            retentionMs: 604800000,
+            instanceId: this.instanceId,
+            logger: this.logger,
+            store: new DatabaseBackgroundJobStore(this.mikro, [JOB_ID], true),
+            jobs: [
+                {
+                    id: JOB_ID,
+                    name: 'Authentication email',
+                    handler: (payload, context) => RequestContext.create(this.mikro.orm.em, () => this.process(payload, context.signal)),
+                },
+            ],
+        });
+        this.handle = this.runner.start();
+    }
+    async stop() {
+        await this.handle?.stop();
+        this.handle = undefined;
+    }
+    /** Explicit drain for embedded workers and deterministic tests; no polling sleeps. */
+    async runPending() {
+        await this.runner?.runPending();
+    }
+    async enqueue(kind, email, locale, userSub) {
+        if (!this.config.email)
+            throw new e.EmailNotActivated.Error();
+        const now = new Date();
+        const id = crypto.randomUUID();
+        const sealed = await this.security.sealMailPayload(JSON.stringify({
+            kind,
+            email,
+            locale,
+            userSub,
+            requestedAt: now.getTime(),
+        }));
+        // Use the request's transaction, unlike a detached scheduler enqueue.
+        await this.mikro.em.insert(BackgroundJobEntitySchema, {
+            id,
+            jobId: JOB_ID,
+            payload: JSON.stringify({ id, sealed }),
+            status: 'pending',
+            availableAt: now,
+            lockedBy: null,
+            lockedUntil: null,
+            attemptCount: 0,
+            maxAttempts: 3,
+            lastError: null,
+            completedAt: null,
+            created_at: now,
+            updated_at: now,
+        });
+        return id;
+    }
+    async process(payload, signal) {
+        const envelope = Envelope.safeParse(payload);
+        if (!envelope.success)
+            throw new Error('MAIL_PAYLOAD_INVALID');
+        const jobId = envelope.data.id;
+        try {
+            const clear = await this.security.openMailPayload(envelope.data.sealed);
+            if (!clear)
+                throw new Error('MAIL_PAYLOAD_INVALID');
+            const request = MailRequest.parse(JSON.parse(clear));
+            const candidate = await this.mikro.user.findOne({
+                email: request.email,
+                deleted_at: null,
+            });
+            if (!candidate ||
+                candidate.created_at.getTime() > request.requestedAt ||
+                (!request.userSub &&
+                    candidate.created_at.getTime() === request.requestedAt) ||
+                (!request.token &&
+                    candidate.updated_at.getTime() > request.requestedAt) ||
+                (!request.userSub &&
+                    candidate.updated_at.getTime() === request.requestedAt) ||
+                (request.userSub && request.userSub !== candidate.sub))
+                return;
+            const prepared = await withUserSecurity(this.mikro, candidate.sub, async (user) => {
+                if (user.email !== request.email ||
+                    (!request.token &&
+                        user.updated_at.getTime() > request.requestedAt) ||
+                    (request.token && request.userEpoch !== user.token_epoch) ||
+                    (!request.userSub &&
+                        user.updated_at.getTime() === request.requestedAt))
+                    return null;
+                if (request.kind === 'verification'
+                    ? user.email_verified
+                    : user.managed_by !== 'database')
+                    return null;
+                if (!request.token && Date.now() - request.requestedAt > 3600000)
+                    return null;
+                let token = request.token;
+                if (!token) {
+                    const generated = request.kind === 'verification'
+                        ? await this.mikro.emailVerification.generateToken({
+                            userSub: user.sub,
+                            userEpoch: user.token_epoch,
+                        })
+                        : await this.mikro.passwordReset.generateToken({
+                            userSub: user.sub,
+                            userEpoch: user.token_epoch,
+                        });
+                    token = generated.token;
+                    await this.mikro.em.flush();
+                    const sealed = await this.security.sealMailPayload(JSON.stringify({
+                        ...request,
+                        userSub: user.sub,
+                        userEpoch: user.token_epoch,
+                        token,
+                    }));
+                    const updated = await this.mikro.em.nativeUpdate(BackgroundJobEntitySchema, {
+                        id: jobId,
+                        lockedBy: this.instanceId,
+                        status: 'running',
+                        lockedUntil: { $gt: new Date() },
+                    }, { payload: JSON.stringify({ id: jobId, sealed }) });
+                    if (updated !== 1)
+                        throw new Error('MAIL_LEASE_LOST');
+                }
+                const active = request.kind === 'verification'
+                    ? await this.mikro.emailVerification.count({
+                        user: user.sub,
+                        user_epoch: user.token_epoch,
+                        token,
+                        verified: false,
+                        revoked_at: null,
+                        expiresAt: { $gt: new Date() },
+                    })
+                    : await this.mikro.passwordReset.count({
+                        user: user.sub,
+                        user_epoch: user.token_epoch,
+                        token,
+                        used: false,
+                        revoked_at: null,
+                        expiresAt: { $gt: new Date() },
+                    });
+                return active === 1
+                    ? {
+                        token,
+                        email: user.email,
+                        locale: request.locale,
+                        messageId: `<${jobId}@${new URL(this.config.server.public_origin).hostname}>`,
+                    }
+                    : null;
+            });
+            if (!prepared || signal?.aborted)
+                return;
+            const lease = await this.mikro.backgroundJob.count({
+                id: jobId,
+                lockedBy: this.instanceId,
+                status: 'running',
+                lockedUntil: { $gt: new Date() },
+            });
+            if (lease !== 1)
+                return;
+            this.logger.info({
+                jobId,
+                state: 'sending',
+                queueAgeMs: Date.now() - request.requestedAt,
+            }, 'Authentication mail');
+            if (request.kind === 'verification')
+                await this.emailService.sendVerificationEmail(prepared);
+            else
+                await this.emailService.sendPasswordResetEmail(prepared);
+        }
+        catch (error) {
+            const responseCode = error instanceof Error ? Reflect.get(error, 'responseCode') : undefined;
+            const permanent = typeof responseCode === 'number' &&
+                responseCode >= 500 &&
+                responseCode < 600;
+            const code = permanent
+                ? 'MAIL_PERMANENT_FAILURE'
+                : 'MAIL_DELIVERY_FAILED';
+            this.logger.warn({ jobId, code }, 'Authentication mail failed');
+            if (permanent)
+                throw new PermanentBackgroundJobError(code);
+            throw new Error(code);
+        }
+    }
+}
+//# sourceMappingURL=mail-queue.service.js.map

package/dist/services/mail-queue.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-queue.service.js","sourceRoot":"","sources":["../../src/services/mail-queue.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,gDAAgD,CAAC;AAOxD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAIxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,MAAM,MAAM,GAAG,eAAe,CAAC;AAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAgB;IACV,UAAU,GAAG,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IACpD,MAAM,CAA6C;IACnD,MAAM,CAA8B;IAC3B,MAAM,CAAuB;IAC7B,KAAK,CAAe;IACpB,YAAY,CAAe;IAC3B,QAAQ,CAAkB;IAC1B,MAAM,CAAS;IAChC,YACE,MAA4B,EAC5B,KAAmB,EACnB,YAA0B,EAC1B,QAAyB,EACzB,MAAc;QAEd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,8BAA8B,CAAC;YAC/C,IAAI,EAAE,eAAe;YACrB,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,IAAI;YAClB,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;YACjE,IAAI,EAAE;gBACJ;oBACE,EAAE,EAAE,MAAM;oBACV,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAC5B,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CACtC;iBACJ;aACF;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,sFAAsF;IACtF,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAuC,EACvC,KAAa,EACb,MAAe,EACf,OAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAChD,IAAI,CAAC,SAAS,CAAC;YACb,IAAI;YACJ,KAAK;YACL,MAAM;YACN,OAAO;YACP,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE;SAC3B,CAAC,CACH,CAAC;QACF,sEAAsE;QACtE,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,yBAAyB,EAAE;YACpD,EAAE;YACF,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;YACvC,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,GAAG;YAChB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAgB,EAAE,MAAoB;QAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IACE,CAAC,SAAS;gBACV,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,WAAW;gBACpD,CAAC,CAAC,OAAO,CAAC,OAAO;oBACf,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC;gBACzD,CAAC,CAAC,OAAO,CAAC,KAAK;oBACb,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;gBACvD,CAAC,CAAC,OAAO,CAAC,OAAO;oBACf,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC;gBACzD,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,GAAG,CAAC;gBAEtD,OAAO;YACT,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,IAAI,CAAC,KAAK,EACV,SAAS,CAAC,GAAG,EACb,KAAK,EAAE,IAAI,EAAE,EAAE;gBACb,IACE,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;oBAC5B,CAAC,CAAC,OAAO,CAAC,KAAK;wBACb,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;oBAClD,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,WAAW,CAAC;oBACzD,CAAC,CAAC,OAAO,CAAC,OAAO;wBACf,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC;oBAEpD,OAAO,IAAI,CAAC;gBACd,IACE,OAAO,CAAC,IAAI,KAAK,cAAc;oBAC7B,CAAC,CAAC,IAAI,CAAC,cAAc;oBACrB,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU;oBAElC,OAAO,IAAI,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,WAAW,GAAG,OAAO;oBAC9D,OAAO,IAAI,CAAC;gBACd,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,SAAS,GACb,OAAO,CAAC,IAAI,KAAK,cAAc;wBAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,CAAC;4BAC/C,OAAO,EAAE,IAAI,CAAC,GAAG;4BACjB,SAAS,EAAE,IAAI,CAAC,WAAW;yBAC5B,CAAC;wBACJ,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC;4BAC3C,OAAO,EAAE,IAAI,CAAC,GAAG;4BACjB,SAAS,EAAE,IAAI,CAAC,WAAW;yBAC5B,CAAC,CAAC;oBACT,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;oBACxB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAChD,IAAI,CAAC,SAAS,CAAC;wBACb,GAAG,OAAO;wBACV,OAAO,EAAE,IAAI,CAAC,GAAG;wBACjB,SAAS,EAAE,IAAI,CAAC,WAAW;wBAC3B,KAAK;qBACN,CAAC,CACH,CAAC;oBACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAC9C,yBAAyB,EACzB;wBACE,EAAE,EAAE,KAAK;wBACT,QAAQ,EAAE,IAAI,CAAC,UAAU;wBACzB,MAAM,EAAE,SAAS;wBACjB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;qBACjC,EACD,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CACnD,CAAC;oBACF,IAAI,OAAO,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,KAAK,cAAc;oBAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC;wBACvC,IAAI,EAAE,IAAI,CAAC,GAAG;wBACd,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,KAAK;wBACL,QAAQ,EAAE,KAAK;wBACf,UAAU,EAAE,IAAI;wBAChB,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;qBAC/B,CAAC;oBACJ,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC;wBACnC,IAAI,EAAE,IAAI,CAAC,GAAG;wBACd,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,KAAK;wBACL,IAAI,EAAE,KAAK;wBACX,UAAU,EAAE,IAAI;wBAChB,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;qBAC/B,CAAC,CAAC;gBACT,OAAO,MAAM,KAAK,CAAC;oBACjB,CAAC,CAAC;wBACE,KAAK;wBACL,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,SAAS,EAAE,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,GAAG;qBAC9E;oBACH,CAAC,CAAC,IAAI,CAAC;YACX,CAAC,CACF,CAAC;YACF,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO;YACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC;gBACjD,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,IAAI,CAAC,UAAU;gBACzB,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;aACjC,CAAC,CAAC;YACH,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;gBACE,KAAK;gBACL,KAAK,EAAE,SAAS;gBAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,WAAW;aAC7C,EACD,qBAAqB,CACtB,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;gBACjC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;;gBACrD,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,MAAM,SAAS,GACb,OAAO,YAAY,KAAK,QAAQ;gBAChC,YAAY,IAAI,GAAG;gBACnB,YAAY,GAAG,GAAG,CAAC;YACrB,MAAM,IAAI,GAAG,SAAS;gBACpB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,sBAAsB,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC;YAChE,IAAI,SAAS;gBAAE,MAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF"}

package/dist/services/mikro.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mikro.service.d.ts","sourceRoot":"","sources":["../../src/services/mikro.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAoB3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,0DAA0D,CAAC;AACnH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AACnG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAE5G,qBAAa,YAAY;IACvB,SAAgB,GAAG,EAAE,QAAQ,CAAC;IAC9B,SAAgB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,SAAgB,IAAI,EAAE,cAAc,CAAC;IACrC,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAC/C,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAC/C,SAAgB,eAAe,EAAE,yBAAyB,CAAC;IAC3D,SAAgB,WAAW,EAAE,qBAAqB,CAAC;IACnD,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,wBAAwB,EAAE,kCAAkC,CAAC;IAC7E,SAAgB,MAAM,EAAE,gBAAgB,CAAC;IACzC,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,WAAW,EAAE,qBAAqB,CAAC;IACnD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAC7D,SAAgB,QAAQ,EAAE,kBAAkB,CAAC;IAC7C,SAAgB,oBAAoB,EAAE,8BAA8B,CAAC;IACrE,SAAgB,WAAW,EAAE,qBAAqB,CAAC;IACnD,SAAgB,KAAK,EAAE,eAAe,CAAC;IACvC,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IAErD,OAAO,eA4BN;IAED,OAAoB,UAAU,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAQvB;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAElC;CACF"}
+{"version":3,"file":"mikro.service.d.ts","sourceRoot":"","sources":["../../src/services/mikro.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAoB3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,0DAA0D,CAAC;AACnH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AACnG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAG5G,qBAAa,YAAY;IACvB,SAAgB,GAAG,EAAE,QAAQ,CAAC;IAC9B,SAAgB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,SAAgB,IAAI,EAAE,cAAc,CAAC;IACrC,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAC/C,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAC/C,SAAgB,eAAe,EAAE,yBAAyB,CAAC;IAC3D,SAAgB,WAAW,EAAE,qBAAqB,CAAC;IACnD,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,wBAAwB,EAAE,kCAAkC,CAAC;IAC7E,SAAgB,MAAM,EAAE,gBAAgB,CAAC;IACzC,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,WAAW,EAAE,qBAAqB,CAAC;IACnD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAC7D,SAAgB,QAAQ,EAAE,kBAAkB,CAAC;IAC7C,SAAgB,oBAAoB,EAAE,8BAA8B,CAAC;IACrE,SAAgB,WAAW,EAAE,qBAAqB,CAAC;IACnD,SAAgB,KAAK,EAAE,eAAe,CAAC;IACvC,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IAErD,OAAO,eA4BN;IAED,OAAoB,UAAU,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CASvB;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAElC;CACF"}

package/dist/services/mikro.service.js

@@ -18,6 +18,7 @@ import { UserPasskeyEntitySchema } from '../entities/user-passkey.entity.js';
 import { UserTermsConsentEntity } from '../entities/user-terms-consent.entity.js';
 import { UserTotpEntitySchema } from '../entities/user-totp.entity.js';
 import { UserTotpRecoveryCodeEntitySchema } from '../entities/user-totp-recovery-code.entity.js';
+import { initializeTermsPolicy } from './terms-policy.service.js';
 export class MikroService {
     orm;
     em;
@@ -67,6 +68,7 @@ export class MikroService {
         logger.info('Initializing MikroORM...');
         const orm = await MikroORM.init(await config.database.getMikroOrmOptions());
         await config.database.initialize(orm);
+        await initializeTermsPolicy(orm.em.fork());
         logger.info('MikroORM initialized');
         return new MikroService(orm);
     }

package/dist/services/mikro.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mikro.service.js","sourceRoot":"","sources":["../../src/services/mikro.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,oCAAoC,EAAE,MAAM,kDAAkD,CAAC;AACxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAuBjG,MAAM,OAAO,YAAY;IACP,GAAG,CAAW;IACd,EAAE,CAAiB;IACnB,IAAI,CAAiB;IACrB,SAAS,CAAsB;IAC/B,SAAS,CAAsB;IAC/B,eAAe,CAA4B;IAC3C,WAAW,CAAwB;IACnC,iBAAiB,CAA8B;IAC/C,aAAa,CAA0B;IACvC,wBAAwB,CAAqC;IAC7D,MAAM,CAAmB;IACzB,YAAY,CAAyB;IACrC,aAAa,CAA0B;IACvC,YAAY,CAAyB;IACrC,WAAW,CAAwB;IACnC,gBAAgB,CAA6B;IAC7C,QAAQ,CAAqB;IAC7B,oBAAoB,CAAiC;IACrD,WAAW,CAAwB;IACnC,KAAK,CAAkB;IACvB,YAAY,CAAyB;IAErD,YAAoB,GAAa;QAC/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAC3C,6BAA6B,CAC9B,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;QACrE,IAAI,CAAC,wBAAwB,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAClD,oCAAoC,CACrC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;QACnE,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC3D,IAAI,CAAC,oBAAoB,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAC9C,gCAAgC,CACjC,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IACrE,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,UAAU,CAC5B,MAA4B,EAC5B,MAAc;QAEd,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAEpC,OAAO,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"mikro.service.js","sourceRoot":"","sources":["../../src/services/mikro.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,oCAAoC,EAAE,MAAM,kDAAkD,CAAC;AACxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAsBjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,OAAO,YAAY;IACP,GAAG,CAAW;IACd,EAAE,CAAiB;IACnB,IAAI,CAAiB;IACrB,SAAS,CAAsB;IAC/B,SAAS,CAAsB;IAC/B,eAAe,CAA4B;IAC3C,WAAW,CAAwB;IACnC,iBAAiB,CAA8B;IAC/C,aAAa,CAA0B;IACvC,wBAAwB,CAAqC;IAC7D,MAAM,CAAmB;IACzB,YAAY,CAAyB;IACrC,aAAa,CAA0B;IACvC,YAAY,CAAyB;IACrC,WAAW,CAAwB;IACnC,gBAAgB,CAA6B;IAC7C,QAAQ,CAAqB;IAC7B,oBAAoB,CAAiC;IACrD,WAAW,CAAwB;IACnC,KAAK,CAAkB;IACvB,YAAY,CAAyB;IAErD,YAAoB,GAAa;QAC/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAC3C,6BAA6B,CAC9B,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;QACrE,IAAI,CAAC,wBAAwB,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAClD,oCAAoC,CACrC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;QACnE,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;QAC3D,IAAI,CAAC,oBAAoB,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAC9C,gCAAgC,CACjC,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IACrE,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,UAAU,CAC5B,MAA4B,EAC5B,MAAc;QAEd,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAE3C,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAEpC,OAAO,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/services/oauth-authorize.service.d.ts

@@ -2,6 +2,7 @@ import type z from 'zod';
 import type { IssuaryRuntimeConfig } from '../lib/config/index.ts';
 import type { AccountSelectionSession, ReauthenticationSession } from '../middleware/session.ts';
 import type { f } from '../schemas/field.ts';
+import type { AuthorizationProof } from './authorization-browser.service.js';
 import type { JwtService } from './jwt.service.ts';
 import type { MikroService } from './mikro.service.ts';
 import type { OAuthClientService } from './oauth-client.service.ts';
@@ -74,6 +75,8 @@ export declare class OAuthAuthorizeService {
      */
     authorize(params: {
         query: AuthorizeParams;
+        completeAuthorization?: (proof: AuthorizationProof, operation: () => Promise<AuthorizeResult>) => Promise<AuthorizeResult>;
+        authenticationEpochs?: Record<string, string>;
         userSession?: {
             sub: string;
             /** OIDC: Time when End-User authentication occurred (Unix timestamp) */

package/dist/services/oauth-authorize.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-authorize.service.d.ts","sourceRoot":"","sources":["../../src/services/oauth-authorize.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAOpE;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,iDAAiD;IACjD,qBAAqB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACrD,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAC9C,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,8CAA8C;IAC9C,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IAChD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IACnC,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IAC/B,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,YACE,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,YAAY,EACnB,kBAAkB,EAAE,kBAAkB,EACtC,kBAAkB,EAAE,kBAAkB,EACtC,eAAe,EAAE,eAAe,EAChC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,YAAY,EAS3B;IAED;;OAEG;IACU,SAAS,CAAC,MAAM,EAAE;QAC7B,KAAK,EAAE,eAAe,CAAC;QACvB,WAAW,CAAC,EAAE;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,wEAAwE;YACxE,gBAAgB,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF,kBAAkB,CAAC,EAAE,KAAK,CAAC;YACzB,GAAG,EAAE,MAAM,CAAC;YACZ,gBAAgB,EAAE,MAAM,CAAC;YACzB,YAAY,EAAE,MAAM,CAAC;YACrB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;SAC5B,CAAC,CAAC;QACH,iBAAiB,CAAC,EAAE,CAClB,OAAO,EAAE,MAAM,KACZ,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;QACxD,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;QAC9D,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;QAC9D,0BAA0B,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,CAAC;QACtE,0BAA0B,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,CAAC;QACtE,4BAA4B,CAAC,EAAE,MAAM,IAAI,CAAC;KAC3C,GAAG,OAAO,CAAC,eAAe,CAAC,CAyX3B;IAED,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,6BAA6B;IAwBrC,OAAO,CAAC,6BAA6B;IAQrC,OAAO,CAAC,iCAAiC;IAYzC,OAAO,CAAC,oCAAoC;IAY5C,OAAO,CAAC,iCAAiC;IAkBzC,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,uCAAuC;IA2B/C,OAAO,CAAC,uCAAuC;IA4B/C,OAAO,CAAC,6CAA6C;IAYrD,OAAO,CAAC,sCAAsC;YAsDhC,wBAAwB;IA6BtC,OAAO,CAAC,WAAW;IAyCnB,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,wBAAwB;IA2BhC,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,8BAA8B;IAiBtC;;;;;;OAMG;YACW,6BAA6B;IAwB3C,OAAO,CAAC,mBAAmB;IA2B3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAyC7B,OAAO,CAAC,6BAA6B;IAgBrC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA+C/B,OAAO,CAAC,2BAA2B;IA2BnC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAwB7B,OAAO,CAAC,6BAA6B;YAqCvB,4BAA4B;IA8E1C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAwBxB;;OAEG;YACW,yBAAyB;CAqDxC"}
+{"version":3,"file":"oauth-authorize.service.d.ts","sourceRoot":"","sources":["../../src/services/oauth-authorize.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAOpE;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,iDAAiD;IACjD,qBAAqB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACrD,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAC9C,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAClC,8CAA8C;IAC9C,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IAChD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IACnC,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IAC/B,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,YACE,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,YAAY,EACnB,kBAAkB,EAAE,kBAAkB,EACtC,kBAAkB,EAAE,kBAAkB,EACtC,eAAe,EAAE,eAAe,EAChC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,YAAY,EAS3B;IAED;;OAEG;IACU,SAAS,CAAC,MAAM,EAAE;QAC7B,KAAK,EAAE,eAAe,CAAC;QACvB,qBAAqB,CAAC,EAAE,CACtB,KAAK,EAAE,kBAAkB,EACzB,SAAS,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,KACtC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC9B,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,WAAW,CAAC,EAAE;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,wEAAwE;YACxE,gBAAgB,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF,kBAAkB,CAAC,EAAE,KAAK,CAAC;YACzB,GAAG,EAAE,MAAM,CAAC;YACZ,gBAAgB,EAAE,MAAM,CAAC;YACzB,YAAY,EAAE,MAAM,CAAC;YACrB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;SAC5B,CAAC,CAAC;QACH,iBAAiB,CAAC,EAAE,CAClB,OAAO,EAAE,MAAM,KACZ,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;QACxD,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;QAC9D,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;QAC9D,0BAA0B,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,CAAC;QACtE,0BAA0B,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,CAAC;QACtE,4BAA4B,CAAC,EAAE,MAAM,IAAI,CAAC;KAC3C,GAAG,OAAO,CAAC,eAAe,CAAC,CA6Z3B;IAED,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,6BAA6B;IAyBrC,OAAO,CAAC,6BAA6B;IAQrC,OAAO,CAAC,iCAAiC;IAYzC,OAAO,CAAC,oCAAoC;IAY5C,OAAO,CAAC,iCAAiC;IAkBzC,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,uCAAuC;IA2B/C,OAAO,CAAC,uCAAuC;IA4B/C,OAAO,CAAC,6CAA6C;IAYrD,OAAO,CAAC,sCAAsC;YAuDhC,wBAAwB;IA6BtC,OAAO,CAAC,WAAW;IAyCnB,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,wBAAwB;IA2BhC,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,8BAA8B;IAiBtC;;;;;;OAMG;YACW,6BAA6B;IAwB3C,OAAO,CAAC,mBAAmB;IA2B3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAyC7B,OAAO,CAAC,6BAA6B;IAgBrC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA+C/B,OAAO,CAAC,2BAA2B;IA2BnC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAwB7B,OAAO,CAAC,6BAA6B;YAqCvB,4BAA4B;IAiF1C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAwBxB;;OAEG;YACW,yBAAyB;CA2DxC"}

package/dist/services/oauth-authorize.service.js

@@ -179,122 +179,148 @@ export class OAuthAuthorizeService {
                 throw new e.InvalidAuthorizationRequest.Error();
             }
         }
-        // Complete required terms for the selected account before any grant.
-        const pendingTerms = await this.termsService.getPendingRequiredTerms(selectedSession.sub);
-        if (pendingTerms.length > 0) {
-            if (prompts.includes('none')) {
-                return this.buildErrorAuthorizationResult({
-                    redirectUri: query.redirect_uri,
-                    error: 'interaction_required',
-                    errorDescription: 'The End-User must accept the required terms.',
-                    state: query.state,
-                    responseType: query.response_type,
-                    responseMode: query.response_mode,
-                });
+        let grantedScopes = [];
+        const checkPolicy = async (current) => {
+            // Complete required terms for the selected account before any grant.
+            const pendingTerms = await this.termsService.getPendingRequiredTerms(selectedSession.sub);
+            if (pendingTerms.length > 0) {
+                if (prompts.includes('none')) {
+                    return this.buildErrorAuthorizationResult({
+                        redirectUri: query.redirect_uri,
+                        error: 'interaction_required',
+                        errorDescription: 'The End-User must accept the required terms.',
+                        state: query.state,
+                        responseType: query.response_type,
+                        responseMode: query.response_mode,
+                    });
+                }
+                const continuation = new URL('/oauth/authorize', this.config.server.public_origin);
+                this.copyAuthorizeParams(continuation, query);
+                const termsUrl = new URL('/terms', this.config.server.public_origin);
+                termsUrl.searchParams.set('redirect', `${continuation.pathname}${continuation.search}`);
+                return { type: 'redirect', url: termsUrl.toString() };
             }
-            const continuation = new URL('/oauth/authorize', this.config.server.public_origin);
-            this.copyAuthorizeParams(continuation, query);
-            const termsUrl = new URL('/terms', this.config.server.public_origin);
-            termsUrl.searchParams.set('redirect', continuation.toString());
-            return { type: 'redirect', url: termsUrl.toString() };
-        }
-        const grantedScopes = await this.userConsentService.resolveScopes({
+            grantedScopes = await this.userConsentService.resolveScopes({
+                userSub: selectedSession.sub,
+                clientId: current.id,
+                requestedScopes,
+                responseType: query.response_type,
+                prompt: query.prompt,
+                skipConsent: current.skipConsent,
+            });
+            // 9. Check if consent is required (using IDs, not entities)
+            const requiresConsent = await this.userConsentService.requiresConsent({
+                userSub: selectedSession.sub,
+                clientId: current.id,
+                requestedScopes: grantedScopes,
+                prompt: prompts.includes('consent') ? 'consent' : undefined,
+                skipConsent: current.skipConsent,
+            });
+            if (requiresConsent) {
+                // Handle prompt=none - must return error if consent is required
+                if (prompts.includes('none')) {
+                    return this.buildErrorAuthorizationResult({
+                        redirectUri: query.redirect_uri,
+                        error: 'consent_required',
+                        errorDescription: 'The Authorization Server requires End-User consent.',
+                        state: query.state,
+                        responseType: query.response_type,
+                        responseMode: query.response_mode,
+                    });
+                }
+                // Redirect to consent page
+                if (hasFreshReauthentication) {
+                    const consentReauthentication = this.createReauthenticationSession(this.buildConsentReauthenticationQuery(query));
+                    params.setReauthenticationSession?.({
+                        ...consentReauthentication,
+                        sub: userSession.sub,
+                        authenticated_at: userSession.authenticated_at,
+                    });
+                }
+                const consentUrl = this.buildConsentRedirectUrl(query);
+                return {
+                    type: 'redirect',
+                    url: consentUrl,
+                };
+            }
+            return undefined;
+        };
+        const preflight = await checkPolicy(client);
+        if (preflight)
+            return preflight;
+        if (!params.completeAuthorization)
+            throw new e.Unauthorized.Error();
+        return params.completeAuthorization({
             userSub: selectedSession.sub,
+            userEpoch: params.authenticationEpochs?.[selectedSession.sub] ?? '',
             clientId: client.id,
-            requestedScopes,
+            clientEpoch: client.tokenEpoch ?? '',
+            redirectUri: query.redirect_uri,
             responseType: query.response_type,
-            prompt: query.prompt,
-            skipConsent: client.skipConsent,
-        });
-        // 9. Check if consent is required (using IDs, not entities)
-        const requiresConsent = await this.userConsentService.requiresConsent({
-            userSub: selectedSession.sub,
-            clientId: client.id,
-            requestedScopes: grantedScopes,
-            prompt: prompts.includes('consent') ? 'consent' : undefined,
-            skipConsent: client.skipConsent,
-        });
-        if (requiresConsent) {
-            // Handle prompt=none - must return error if consent is required
-            if (prompts.includes('none')) {
-                return this.buildErrorAuthorizationResult({
+            scopes: grantedScopes,
+        }, async () => {
+            const current = await this.oauthClientService.findByClientId(client.clientId);
+            const pendingPolicy = await checkPolicy(current);
+            if (pendingPolicy)
+                return pendingPolicy;
+            if (isImplicitIdToken) {
+                if (!query.nonce) {
+                    throw new e.InvalidAuthorizationRequest.Error();
+                }
+                params.clearAccountSelectionSession?.();
+                return this.buildImplicitIdTokenRedirect({
+                    clientId: client.clientId,
+                    userSub: selectedSession.sub,
+                    userEpoch: params.authenticationEpochs?.[selectedSession.sub] ?? '',
                     redirectUri: query.redirect_uri,
-                    error: 'consent_required',
-                    errorDescription: 'The Authorization Server requires End-User consent.',
+                    scope: grantedScopes,
+                    nonce: query.nonce,
                     state: query.state,
-                    responseType: query.response_type,
+                    authTime: selectedSession.authenticated_at,
                     responseMode: query.response_mode,
                 });
             }
-            // Redirect to consent page
-            if (hasFreshReauthentication) {
-                const consentReauthentication = this.createReauthenticationSession(this.buildConsentReauthenticationQuery(query));
-                params.setReauthenticationSession?.({
-                    ...consentReauthentication,
-                    sub: userSession.sub,
-                    authenticated_at: userSession.authenticated_at,
-                });
-            }
-            const consentUrl = this.buildConsentRedirectUrl(query);
-            return {
-                type: 'redirect',
-                url: consentUrl,
-            };
-        }
-        if (isImplicitIdToken) {
-            if (!query.nonce) {
-                throw new e.InvalidAuthorizationRequest.Error();
-            }
-            params.clearAccountSelectionSession?.();
-            return this.buildImplicitIdTokenRedirect({
-                clientId: client.clientId,
+            const codeParams = {
+                clientId: client.id,
+                clientEpoch: client.tokenEpoch ?? '',
                 userSub: selectedSession.sub,
+                userEpoch: params.authenticationEpochs?.[selectedSession.sub] ?? '',
                 redirectUri: query.redirect_uri,
                 scope: grantedScopes,
-                nonce: query.nonce,
-                state: query.state,
-                authTime: selectedSession.authenticated_at,
-                responseMode: query.response_mode,
-            });
-        }
-        const codeParams = {
-            clientId: client.id,
-            userSub: selectedSession.sub,
-            redirectUri: query.redirect_uri,
-            scope: grantedScopes,
-        };
-        if (query.nonce) {
-            codeParams.nonce = query.nonce;
-        }
-        if (query.code_challenge) {
-            codeParams.codeChallenge = query.code_challenge;
-        }
-        if (query.code_challenge_method) {
-            codeParams.codeChallengeMethod = query.code_challenge_method;
-        }
-        // Include OIDC authentication metadata from session
-        if (userSession) {
-            codeParams.authTime = selectedSession.authenticated_at;
-        }
-        const code = await this.generateAuthorizationCode(codeParams);
-        params.clearAccountSelectionSession?.();
-        // 10. Redirect back to client with authorization code
-        const callbackUrl = this.buildCallbackUrl(code, query.state, query.redirect_uri, query.response_mode);
-        if (query.response_mode === 'form_post') {
-            const params = { code };
-            if (query.state) {
-                params['state'] = query.state;
+            };
+            if (query.nonce) {
+                codeParams.nonce = query.nonce;
+            }
+            if (query.code_challenge) {
+                codeParams.codeChallenge = query.code_challenge;
+            }
+            if (query.code_challenge_method) {
+                codeParams.codeChallengeMethod = query.code_challenge_method;
+            }
+            // Include OIDC authentication metadata from session
+            if (userSession) {
+                codeParams.authTime = selectedSession.authenticated_at;
+            }
+            const code = await this.generateAuthorizationCode(codeParams);
+            params.clearAccountSelectionSession?.();
+            // 10. Redirect back to client with authorization code
+            const callbackUrl = this.buildCallbackUrl(code, query.state, query.redirect_uri, query.response_mode);
+            if (query.response_mode === 'form_post') {
+                const params = { code };
+                if (query.state) {
+                    params['state'] = query.state;
+                }
+                return {
+                    type: 'form_post',
+                    url: query.redirect_uri,
+                    params,
+                };
             }
             return {
-                type: 'form_post',
-                url: query.redirect_uri,
-                params,
+                type: 'redirect',
+                url: callbackUrl,
             };
-        }
-        return {
-            type: 'redirect',
-            url: callbackUrl,
-        };
+        });
     }
     parseResponseMode(responseMode) {
         if (responseMode === undefined) {
@@ -736,6 +762,8 @@ export class OAuthAuthorizeService {
         const user = await this.mikro.user.findOneOrFail({ sub: params.userSub }, {
             failHandler: () => new e.UserNotFound.Error(),
         });
+        if (user.deleted_at || user.token_epoch !== params.userEpoch)
+            throw new e.Unauthorized.Error();
         const idTokenPayload = {
             sub: user.sub,
             aud: params.clientId,
@@ -808,7 +836,9 @@ export class OAuthAuthorizeService {
     async generateAuthorizationCode(params) {
         const codeParams = {
             clientId: params.clientId,
+            clientEpoch: params.clientEpoch,
             userSub: params.userSub,
+            userEpoch: params.userEpoch,
             redirectUri: params.redirectUri,
             scope: params.scope,
         };