@tinyrack/issuary-server 0.31.0 → 0.32.2

package/dist/services/password-reset.service.js

@@ -1,4 +1,5 @@
 import { e } from '../schemas/error.js';
+import { withUserSecurity } from './user-security.service.js';
 export class PasswordResetService {
     mikro;
     passwordAuthService;
@@ -11,11 +12,14 @@ export class PasswordResetService {
      * Invalidates all previous unused tokens
      */
     async generateToken(params) {
-        const token = await this.mikro.passwordReset.generateToken({
-            userSub: params.userSub,
-            expiresInHours: params.expiresInHours || 1,
+        return withUserSecurity(this.mikro, params.userSub, async (user) => {
+            const token = await this.mikro.passwordReset.generateToken({
+                userSub: params.userSub,
+                userEpoch: user.token_epoch,
+                expiresInHours: params.expiresInHours || 1,
+            });
+            return token;
         });
-        return token;
     }
     /**
      * Request password reset for an email
@@ -37,18 +41,33 @@ export class PasswordResetService {
      * Verifies token and updates user password
      */
     async resetPassword(params) {
-        const resetEntity = await this.mikro.passwordReset.verifyToken(params.token);
-        if (!resetEntity) {
-            throw new e.InvalidPasswordResetToken.Error();
-        }
-        const user = await resetEntity.user.loadOrFail({
-            failHandler: () => new e.UserNotFound.Error(),
+        const candidate = await this.mikro.passwordReset.findOne({
+            token: params.token,
+            used: false,
+            revoked_at: null,
+            expiresAt: { $gt: new Date() },
         });
-        if (user.managed_by === 'config') {
-            throw new e.UserNotEditable.Error();
-        }
-        await this.passwordAuthService.replacePassword(user, params.password);
-        return user;
+        if (!candidate)
+            throw new e.InvalidPasswordResetToken.Error();
+        return withUserSecurity(this.mikro, candidate.user.sub, async (freshUser) => {
+            if (freshUser.deleted_at ||
+                candidate.user_epoch !== freshUser.token_epoch)
+                throw new e.InvalidPasswordResetToken.Error();
+            const resetEntity = await this.mikro.passwordReset.verifyToken(params.token);
+            if (!resetEntity) {
+                throw new e.InvalidPasswordResetToken.Error();
+            }
+            const user = await resetEntity.user.loadOrFail({
+                failHandler: () => new e.UserNotFound.Error(),
+            });
+            if (user.deleted_at)
+                throw new e.InvalidPasswordResetToken.Error();
+            if (user.managed_by === 'config') {
+                throw new e.UserNotEditable.Error();
+            }
+            await this.passwordAuthService.replacePassword(user, params.password);
+            return user;
+        }, { includeDeleted: true });
     }
 }
 //# sourceMappingURL=password-reset.service.js.map

package/dist/services/password-reset.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.service.js","sourceRoot":"","sources":["../../src/services/password-reset.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAIxC,MAAM,OAAO,oBAAoB;IACd,KAAK,CAAe;IACpB,mBAAmB,CAAsB;IAC1D,YACE,KAAmB,EACnB,mBAAwC;QAExC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAGnB;QACC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC;YACzD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC;SAC3C,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAC9C,EAAE,KAAK,EAAE,EACT;YACE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAGnB;QACC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAC5D,MAAM,CAAC,KAAK,CACb,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7C,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtE,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"password-reset.service.js","sourceRoot":"","sources":["../../src/services/password-reset.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAGxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,MAAM,OAAO,oBAAoB;IACd,KAAK,CAAe;IACpB,mBAAmB,CAAsB;IAC1D,YACE,KAAmB,EACnB,mBAAwC;QAExC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAGnB;QACC,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC;gBACzD,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,IAAI,CAAC,WAAW;gBAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC;aAC3C,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAC9C,EAAE,KAAK,EAAE,EACT;YACE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAGnB;QACC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;QAC9D,OAAO,gBAAgB,CACrB,IAAI,CAAC,KAAK,EACV,SAAS,CAAC,IAAI,CAAC,GAAG,EAClB,KAAK,EAAE,SAAS,EAAE,EAAE;YAClB,IACE,SAAS,CAAC,UAAU;gBACpB,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,WAAW;gBAE9C,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAC5D,MAAM,CAAC,KAAK,CACb,CAAC;YAEF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YAChD,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC7C,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;aAC9C,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;YAEnE,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEtE,OAAO,IAAI,CAAC;QACd,CAAC,EACD,EAAE,cAAc,EAAE,IAAI,EAAE,CACzB,CAAC;IACJ,CAAC;CACF"}

package/dist/services/security.service.d.ts

@@ -1,10 +1,12 @@
 import type { IssuaryRuntimeConfig } from '../lib/config/index.ts';
-export type OpaquePurpose = 'oauth-code' | 'oauth-device-code' | 'oauth-device-user-code' | 'totp-recovery';
+export type OpaquePurpose = 'oauth-client-authentication' | 'oauth-code' | 'oauth-device-code' | 'oauth-device-user-code' | 'totp-recovery' | 'auth-budget' | 'mail-queue';
 export declare class SecurityService {
     private readonly hashMasterSecret;
     private readonly pbkdf2Iterations;
     private readonly purposeKeyCache;
     constructor(config: IssuaryRuntimeConfig);
+    sealMailPayload(payload: string): Promise<string>;
+    openMailPayload(payload: string): Promise<string | null>;
     private resolvePurposeKey;
     private hashPbkdf2Secret;
     private verifyPbkdf2Secret;

package/dist/services/security.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.service.d.ts","sourceRoot":"","sources":["../../src/services/security.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAmBnE,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,mBAAmB,GACnB,wBAAwB,GACxB,eAAe,CAAC;AAepB,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAE1E,YAAmB,MAAM,EAAE,oBAAoB,EAQ9C;YAEa,iBAAiB;YAiBjB,gBAAgB;YAyBhB,kBAAkB;IAyBnB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3D;IAEY,cAAc,CACzB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAElB;IAEY,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAEY,kBAAkB,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAElB;IAEY,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CASjB;CACF"}
+{"version":3,"file":"security.service.d.ts","sourceRoot":"","sources":["../../src/services/security.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAqBnE,MAAM,MAAM,aAAa,GACrB,6BAA6B,GAC7B,YAAY,GACZ,mBAAmB,GACnB,wBAAwB,GACxB,eAAe,GACf,aAAa,GACb,YAAY,CAAC;AAkBjB,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAE1E,YAAmB,MAAM,EAAE,oBAAoB,EAQ9C;IAEY,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK7D;IACY,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKpE;YAEa,iBAAiB;YAiBjB,gBAAgB;YAyBhB,kBAAkB;IAyBnB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3D;IAEY,cAAc,CACzB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAElB;IAEY,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAEY,kBAAkB,CAC7B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAElB;IAEY,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CASjB;CACF"}

package/dist/services/security.service.js

@@ -1,5 +1,5 @@
-import { fromBase64Url } from '../lib/base64url.js';
-import { derivePbkdf2Bytes, derivePurposeKeyBytes, formatOpaqueHash, formatPbkdf2Hash, getRandomBytes, parsePbkdf2Hash, signOpaqueValue, timingSafeEqualBytes, } from '../lib/crypto.js';
+import { bytesToHex, fromBase64Url } from '../lib/base64url.js';
+import { decrypt, derivePbkdf2Bytes, derivePurposeKeyBytes, encrypt, formatOpaqueHash, formatPbkdf2Hash, getRandomBytes, parsePbkdf2Hash, signOpaqueValue, timingSafeEqualBytes, } from '../lib/crypto.js';
 const PBKDF2_ALGORITHM = 'pbkdf2-sha256';
 const HMAC_ALGORITHM = 'hmac-sha256';
 const CURRENT_HASH_FORMAT_VERSION = 2;
@@ -11,9 +11,12 @@ const HASH_POLICY = {
         password: 'password-v2',
         'client-secret': 'client-secret-v2',
         'oauth-code': 'oauth-code-v2',
+        'oauth-client-authentication': 'oauth-client-authentication-v1',
         'oauth-device-code': 'oauth-device-code-v2',
         'oauth-device-user-code': 'oauth-device-user-code-v2',
         'totp-recovery': 'totp-recovery-v2',
+        'auth-budget': 'auth-budget-v1',
+        'mail-queue': 'mail-queue-v1',
     },
 };
 export class SecurityService {
@@ -28,6 +31,12 @@ export class SecurityService {
         this.hashMasterSecret = decodedSecret;
         this.pbkdf2Iterations = config.security.pbkdf2_iterations;
     }
+    async sealMailPayload(payload) {
+        return encrypt(payload, bytesToHex(await this.resolvePurposeKey('mail-queue')));
+    }
+    async openMailPayload(payload) {
+        return decrypt(payload, bytesToHex(await this.resolvePurposeKey('mail-queue')));
+    }
     async resolvePurposeKey(purpose) {
         const cached = this.purposeKeyCache.get(purpose);
         if (cached) {

package/dist/services/security.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.service.js","sourceRoot":"","sources":["../../src/services/security.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAUpC,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,qBAAqB;IAC9B,aAAa,EAAE;QACb,QAAQ,EAAE,aAAa;QACvB,eAAe,EAAE,kBAAkB;QACnC,YAAY,EAAE,eAAe;QAC7B,mBAAmB,EAAE,sBAAsB;QAC3C,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,kBAAkB;KACF;CACpC,CAAC;AAEF,MAAM,OAAO,eAAe;IACT,gBAAgB,CAAa;IAC7B,gBAAgB,CAAS;IACzB,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IAE1E,YAAmB,MAA4B;QAC7C,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC;QACtC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,OAAgB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CACtC,UAAU,CAAC,MAAM,EACjB,IAAI,CAAC,gBAAgB,EACrB,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,EAClC,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,OAAsB,EACtB,MAAc;QAEd,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,MAAM,EACN,UAAU,EACV,MAAM,EACN,IAAI,EACJ,IAAI,CAAC,gBAAgB,EACrB,wBAAwB,CACzB,CAAC;QAEF,OAAO,gBAAgB,CAAC;YACtB,SAAS,EAAE,gBAAgB;YAC3B,OAAO,EAAE,2BAA2B;YACpC,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,IAAI;YACJ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,OAAsB,EACtB,IAAY,EACZ,MAAc;QAEd,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAEvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,2BAA2B,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,MAAM,EACN,UAAU,EACV,MAAM,EACN,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,UAAU,EACjB,wBAAwB,CACzB,CAAC;QAEF,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,QAAgB;QACxC,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,IAAY,EACZ,QAAgB;QAEhB,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QAChD,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,IAAY,EACZ,YAAoB;QAEpB,OAAO,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,OAAsB,EACtB,KAAa;QAEb,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,gBAAgB,CAAC;YACtB,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,2BAA2B;YACpC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"security.service.js","sourceRoot":"","sources":["../../src/services/security.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,qBAAqB,EACrB,OAAO,EACP,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AACtC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAapC,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,qBAAqB;IAC9B,aAAa,EAAE;QACb,QAAQ,EAAE,aAAa;QACvB,eAAe,EAAE,kBAAkB;QACnC,YAAY,EAAE,eAAe;QAC7B,6BAA6B,EAAE,gCAAgC;QAC/D,mBAAmB,EAAE,sBAAsB;QAC3C,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,kBAAkB;QACnC,aAAa,EAAE,gBAAgB;QAC/B,YAAY,EAAE,eAAe;KACI;CACpC,CAAC;AAEF,MAAM,OAAO,eAAe;IACT,gBAAgB,CAAa;IAC7B,gBAAgB,CAAS;IACzB,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IAE1E,YAAmB,MAA4B;QAC7C,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC;QACtC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,OAAe;QAC1C,OAAO,OAAO,CACZ,OAAO,EACP,UAAU,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC;IACM,KAAK,CAAC,eAAe,CAAC,OAAe;QAC1C,OAAO,OAAO,CACZ,OAAO,EACP,UAAU,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,OAAgB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CACtC,UAAU,CAAC,MAAM,EACjB,IAAI,CAAC,gBAAgB,EACrB,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,EAClC,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,OAAsB,EACtB,MAAc;QAEd,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,MAAM,EACN,UAAU,EACV,MAAM,EACN,IAAI,EACJ,IAAI,CAAC,gBAAgB,EACrB,wBAAwB,CACzB,CAAC;QAEF,OAAO,gBAAgB,CAAC;YACtB,SAAS,EAAE,gBAAgB;YAC3B,OAAO,EAAE,2BAA2B;YACpC,UAAU,EAAE,IAAI,CAAC,gBAAgB;YACjC,IAAI;YACJ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,OAAsB,EACtB,IAAY,EACZ,MAAc;QAEd,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAEvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,2BAA2B,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,MAAM,EACN,UAAU,EACV,MAAM,EACN,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,UAAU,EACjB,wBAAwB,CACzB,CAAC;QAEF,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,QAAgB;QACxC,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,IAAY,EACZ,QAAgB;QAEhB,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QAChD,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,IAAY,EACZ,YAAoB;QAEpB,OAAO,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,OAAsB,EACtB,KAAa;QAEb,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,gBAAgB,CAAC;YACtB,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,2BAA2B;YACpC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/services/terms-policy.service.d.ts

@@ -0,0 +1,7 @@
+import { type EntityManager } from '@mikro-orm/core';
+export type TermsPolicyAccess = 'read' | 'write';
+/** Initialize before serving requests, even when config seeding is disabled. */
+export declare function initializeTermsPolicy(em: EntityManager): Promise<void>;
+/** Acquire before user/session/client locks; the transaction owns its lifetime. */
+export declare function lockTermsPolicy(em: EntityManager, access: TermsPolicyAccess): Promise<void>;
+//# sourceMappingURL=terms-policy.service.d.ts.map

package/dist/services/terms-policy.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms-policy.service.d.ts","sourceRoot":"","sources":["../../src/services/terms-policy.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,iBAAiB,CAAC;AAKpE,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,gFAAgF;AAChF,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAM5E;AAED,mFAAmF;AACnF,wBAAsB,eAAe,CACnC,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAuBf"}

package/dist/services/terms-policy.service.js

@@ -0,0 +1,26 @@
+import { LockMode, raw } from '@mikro-orm/core';
+import { PostgreSqlPlatform } from '@mikro-orm/postgresql';
+import { BootstrapStateEntitySchema } from '../entities/bootstrap-state.entity.js';
+const TERMS_POLICY_LOCK = 'terms-policy-lock';
+/** Initialize before serving requests, even when config seeding is disabled. */
+export async function initializeTermsPolicy(em) {
+    await em.upsert(BootstrapStateEntitySchema, { id: TERMS_POLICY_LOCK, value: '1' }, { onConflictFields: ['id'], onConflictAction: 'ignore' });
+}
+/** Acquire before user/session/client locks; the transaction owns its lifetime. */
+export async function lockTermsPolicy(em, access) {
+    if (!em.isInTransaction())
+        throw new Error('Terms policy requires a transaction');
+    if (em.getPlatform() instanceof PostgreSqlPlatform) {
+        await em.findOneOrFail(BootstrapStateEntitySchema, { id: TERMS_POLICY_LOCK }, {
+            refresh: true,
+            lockMode: access === 'read'
+                ? LockMode.PESSIMISTIC_READ
+                : LockMode.PESSIMISTIC_WRITE,
+        });
+        return;
+    }
+    const changed = await em.nativeUpdate(BootstrapStateEntitySchema, { id: TERMS_POLICY_LOCK }, { value: raw('value') });
+    if (changed !== 1)
+        throw new Error('Terms policy lock is not initialized');
+}
+//# sourceMappingURL=terms-policy.service.js.map

package/dist/services/terms-policy.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms-policy.service.js","sourceRoot":"","sources":["../../src/services/terms-policy.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,QAAQ,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAEnF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAG9C,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAiB;IAC3D,MAAM,EAAE,CAAC,MAAM,CACb,0BAA0B,EAC1B,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EACrC,EAAE,gBAAgB,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAiB,EACjB,MAAyB;IAEzB,IAAI,CAAC,EAAE,CAAC,eAAe,EAAE;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,kBAAkB,EAAE,CAAC;QACnD,MAAM,EAAE,CAAC,aAAa,CACpB,0BAA0B,EAC1B,EAAE,EAAE,EAAE,iBAAiB,EAAE,EACzB;YACE,OAAO,EAAE,IAAI;YACb,QAAQ,EACN,MAAM,KAAK,MAAM;gBACf,CAAC,CAAC,QAAQ,CAAC,gBAAgB;gBAC3B,CAAC,CAAC,QAAQ,CAAC,iBAAiB;SACjC,CACF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CACnC,0BAA0B,EAC1B,EAAE,EAAE,EAAE,iBAAiB,EAAE,EACzB,EAAE,KAAK,EAAE,GAAG,CAAS,OAAO,CAAC,EAAE,CAChC,CAAC;IACF,IAAI,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/services/totp.service.d.ts

@@ -35,6 +35,7 @@ export declare class TotpService {
      * Verify a TOTP token against a secret
      */
     verifyToken(token: string, secret: string): boolean;
+    private consumeToken;
     /**
      * Generate a TOTP token for a secret (used for testing)
      */
@@ -43,7 +44,8 @@ export declare class TotpService {
      * Start TOTP setup for a user
      * Creates or updates unverified TOTP record
      */
-    startSetup(user: UserEntity): Promise<TotpSetupData>;
+    prepareSetup(user: UserEntity): Promise<TotpSetupData>;
+    startSetup(user: UserEntity, prepared?: TotpSetupData): Promise<TotpSetupData>;
     /**
      * Verify and complete TOTP setup.
      * Also generates recovery codes upon successful verification.
@@ -60,10 +62,7 @@ export declare class TotpService {
      * Disable TOTP for a user
      * Also deletes all recovery codes
      */
-    disable(userId: string, token: string, options: {
-        secondFactorRequired: boolean;
-        hasOtherSecondFactor: boolean;
-    }): Promise<void>;
+    disable(userId: string, token: string): Promise<void>;
     verifyForAuth(userId: string, token: string): Promise<void>;
     /**
      * Generate a single recovery code in the format XXXX-XXXX-XXXX-XXXX.

package/dist/services/totp.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"totp.service.d.ts","sourceRoot":"","sources":["../../src/services/totp.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;CACvB;AAQD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,YACE,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,oBAAoB,EAC5B,eAAe,EAAE,eAAe,EAKjC;IAED;;OAEG;IACI,cAAc,IAAI,MAAM,CAE9B;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ/D;IAED;;OAEG;IACU,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/D;IAED;;OAEG;IACI,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUzD;IAED;;OAEG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3C;IAED;;;OAGG;IACU,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAiChE;IAED;;;;;OAKG;IACU,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA6BzE;IAED;;;OAGG;IACU,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYvD;IAED;;;OAGG;IACU,OAAO,CAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;QACP,oBAAoB,EAAE,OAAO,CAAC;QAC9B,oBAAoB,EAAE,OAAO,CAAC;KAC/B,GACA,OAAO,CAAC,IAAI,CAAC,CAiBf;IAEY,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvE;IAED;;OAEG;IACI,0BAA0B,IAAI,MAAM,CAe1C;IAED;;;;;OAKG;IACU,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA8BtE;IAED;;;OAGG;IACU,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiC3E;IAEY,uBAAuB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBnB;CACF"}
+{"version":3,"file":"totp.service.d.ts","sourceRoot":"","sources":["../../src/services/totp.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;CACvB;AAQD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,YACE,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,oBAAoB,EAC5B,eAAe,EAAE,eAAe,EAKjC;IAED;;OAEG;IACI,cAAc,IAAI,MAAM,CAE9B;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ/D;IAED;;OAEG;IACU,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/D;IAED;;OAEG;IACI,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUzD;YAEa,YAAY;IAyB1B;;OAEG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3C;IAED;;;OAGG;IACU,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAMlE;IAEY,UAAU,CACrB,IAAI,EAAE,UAAU,EAChB,QAAQ,CAAC,EAAE,aAAa,GACvB,OAAO,CAAC,aAAa,CAAC,CAoCxB;IAED;;;;;OAKG;IACU,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA6BzE;IAED;;;OAGG;IACU,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcvD;IAED;;;OAGG;IACU,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBjE;IAEY,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvE;IAED;;OAEG;IACI,0BAA0B,IAAI,MAAM,CAe1C;IAED;;;;;OAKG;IACU,qBAAqB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA8BtE;IAED;;;OAGG;IACU,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB3E;IAEY,uBAAuB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;CACF"}

package/dist/services/totp.service.js

@@ -2,6 +2,7 @@ import { generateSecret, generateSync, generateURI, verifySync } from 'otplib';
 import qrcode from 'qrcode';
 import { getRandomBytes } from '../lib/crypto.js';
 import { e } from '../schemas/error.js';
+import { withUserSecurity } from './user-security.service.js';
 /** Number of recovery codes to generate */
 const RECOVERY_CODE_COUNT = 8;
 const RECOVERY_CODE_ALPHABET = 'ABCDEFGHJKMNPQRSTVWXYZ23456789';
@@ -54,6 +55,25 @@ export class TotpService {
             throw new e.InvalidTotpCode.Error();
         }
     }
+    async consumeToken(token, totp) {
+        const result = verifySync({
+            token,
+            secret: totp.secret,
+            epochTolerance: 1,
+        });
+        if (!result.valid || !('timeStep' in result))
+            throw new e.InvalidTotpCode.Error();
+        const changed = await this.mikro.userTotp.nativeUpdate({
+            id: totp.id,
+            secret: totp.secret,
+            $or: [
+                { last_used_step: null },
+                { last_used_step: { $lt: result.timeStep } },
+            ],
+        }, { last_used_step: result.timeStep });
+        if (changed !== 1)
+            throw new e.InvalidTotpCode.Error();
+    }
     /**
      * Generate a TOTP token for a secret (used for testing)
      */
@@ -64,34 +84,42 @@ export class TotpService {
      * Start TOTP setup for a user
      * Creates or updates unverified TOTP record
      */
-    async startSetup(user) {
-        const existingTotp = await this.mikro.userTotp.findByUserSub(user.sub);
-        // Only throw if TOTP is fully registered (verified AND recovery confirmed)
-        // If user verified but didn't confirm recovery codes, allow re-setup
-        if (existingTotp?.verified && existingTotp?.recovery_confirmed) {
-            throw new e.TotpAlreadyEnabled.Error();
-        }
+    async prepareSetup(user) {
         const secret = this.generateSecret();
         const otpauthUrl = this.generateOtpAuthUrl(user.email, secret);
         const qrCodeDataUrl = await this.generateQrCode(otpauthUrl);
-        // If there's an existing unverified TOTP, delete it first to avoid
-        // unique constraint violation (handles race conditions and retries)
-        if (existingTotp) {
-            await this.mikro.userTotp.nativeDelete({ user: { sub: user.sub } });
-            this.mikro.em.clear();
-        }
-        // Create new TOTP record
-        const totp = this.mikro.userTotp.create({
-            user: user.sub,
-            secret: secret,
+        return { secret, otpauthUrl, qrCodeDataUrl };
+    }
+    async startSetup(user, prepared) {
+        const { secret, otpauthUrl, qrCodeDataUrl } = prepared ?? (await this.prepareSetup(user));
+        return withUserSecurity(this.mikro, user.sub, async (freshUser) => {
+            user = freshUser;
+            const existingTotp = await this.mikro.userTotp.findByUserSub(user.sub);
+            // Only throw if TOTP is fully registered (verified AND recovery confirmed)
+            // If user verified but didn't confirm recovery codes, allow re-setup
+            if (existingTotp?.verified && existingTotp?.recovery_confirmed) {
+                throw new e.TotpAlreadyEnabled.Error();
+            }
+            // If there's an existing unverified TOTP, delete it first to avoid
+            // unique constraint violation (handles race conditions and retries)
+            if (existingTotp) {
+                await this.mikro.userTotp.nativeDelete({ user: { sub: user.sub } });
+                this.mikro.em.clear();
+            }
+            await this.mikro.userTotpRecoveryCode.deleteByUserSub(user.sub);
+            // Create new TOTP record
+            const totp = this.mikro.userTotp.create({
+                user: user.sub,
+                secret: secret,
+            });
+            this.mikro.em.persist(totp);
+            await this.mikro.em.flush();
+            return {
+                secret,
+                otpauthUrl,
+                qrCodeDataUrl,
+            };
         });
-        this.mikro.em.persist(totp);
-        await this.mikro.em.flush();
-        return {
-            secret,
-            otpauthUrl,
-            qrCodeDataUrl,
-        };
     }
     /**
      * Verify and complete TOTP setup.
@@ -100,70 +128,74 @@ export class TotpService {
      * @returns Array of plain-text recovery codes (shown only once)
      */
     async verifySetup(userId, token) {
-        const totp = await this.mikro.userTotp.findByUserSub(userId);
-        if (!totp) {
-            throw new e.TotpNotSetup.Error();
-        }
-        // Only throw if TOTP is fully registered (verified AND recovery confirmed)
-        // If user verified but didn't confirm recovery codes, allow re-verification
-        if (totp.verified && totp.recovery_confirmed) {
-            throw new e.TotpAlreadyEnabled.Error();
-        }
-        if (!this.verifyToken(token, totp.secret)) {
-            throw new e.InvalidTotpCode.Error();
-        }
-        // Flush verified status before generating recovery codes,
-        // because generateRecoveryCodes calls em.clear() which
-        // would discard the pending verified change.
-        totp.verified = true;
-        await this.mikro.em.flush();
-        // Generate recovery codes on TOTP setup completion
-        const user = await this.mikro.user.findOneOrFail({
-            sub: userId,
+        return withUserSecurity(this.mikro, userId, async () => {
+            const totp = await this.mikro.userTotp.findByUserSub(userId);
+            if (!totp) {
+                throw new e.TotpNotSetup.Error();
+            }
+            // Only throw if TOTP is fully registered (verified AND recovery confirmed)
+            // If user verified but didn't confirm recovery codes, allow re-verification
+            if (totp.verified && totp.recovery_confirmed) {
+                throw new e.TotpAlreadyEnabled.Error();
+            }
+            await this.consumeToken(token, totp);
+            // Flush verified status before generating recovery codes,
+            // because generateRecoveryCodes calls em.clear() which
+            // would discard the pending verified change.
+            totp.verified = true;
+            await this.mikro.em.flush();
+            // Generate recovery codes on TOTP setup completion
+            const user = await this.mikro.user.findOneOrFail({
+                sub: userId,
+            });
+            const recoveryCodes = await this.generateRecoveryCodes(user);
+            return recoveryCodes;
         });
-        const recoveryCodes = await this.generateRecoveryCodes(user);
-        return recoveryCodes;
     }
     /**
      * Confirm TOTP setup by acknowledging recovery codes.
      * This marks the TOTP setup as fully complete.
      */
     async confirmSetup(userId) {
-        const totp = await this.mikro.userTotp.findVerifiedByUserSub(userId);
-        if (!totp) {
-            throw new e.TotpNotSetup.Error();
-        }
-        if (totp.recovery_confirmed) {
-            throw new e.TotpAlreadyEnabled.Error();
-        }
-        totp.recovery_confirmed = true;
-        await this.mikro.em.flush();
+        return withUserSecurity(this.mikro, userId, async () => {
+            const totp = await this.mikro.userTotp.findVerifiedByUserSub(userId);
+            if (!totp) {
+                throw new e.TotpNotSetup.Error();
+            }
+            if (totp.recovery_confirmed) {
+                throw new e.TotpAlreadyEnabled.Error();
+            }
+            totp.recovery_confirmed = true;
+            await this.mikro.em.flush();
+        });
     }
     /**
      * Disable TOTP for a user
      * Also deletes all recovery codes
      */
-    async disable(userId, token, options) {
-        const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
-        if (!totp) {
-            throw new e.TotpNotEnabled.Error();
-        }
-        if (!this.verifyToken(token, totp.secret)) {
-            throw new e.InvalidTotpCode.Error();
-        }
-        // Prevent disabling TOTP when 2FA is required and no other 2FA method exists
-        if (options.secondFactorRequired && !options.hasOtherSecondFactor) {
-            throw new e.CannotRemoveLastSecondFactor.Error();
-        }
-        await this.mikro.userTotp.deleteByUserSub(userId);
-        await this.mikro.userTotpRecoveryCode.deleteByUserSub(userId);
+    async disable(userId, token) {
+        return withUserSecurity(this.mikro, userId, async () => {
+            const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
+            if (!totp) {
+                throw new e.TotpNotEnabled.Error();
+            }
+            await this.consumeToken(token, totp);
+            // Prevent disabling TOTP when 2FA is required and no other 2FA method exists
+            if (this.config.auth.password.two_factor.enrollment_required &&
+                !(this.config.auth.passkey.enabled &&
+                    (await this.mikro.userPasskey.countByUserSub(userId)) > 0)) {
+                throw new e.CannotRemoveLastSecondFactor.Error();
+            }
+            await this.mikro.userTotp.deleteByUserSub(userId);
+            await this.mikro.userTotpRecoveryCode.deleteByUserSub(userId);
+        });
     }
     async verifyForAuth(userId, token) {
         const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
         if (!totp) {
             throw new e.TotpNotEnabled.Error();
         }
-        this.verifyToken(token, totp.secret);
+        await this.consumeToken(token, totp);
     }
     /**
      * Generate a single recovery code in the format XXXX-XXXX-XXXX-XXXX.
@@ -219,26 +251,24 @@ export class TotpService {
             throw new e.NoRecoveryCodesAvailable.Error();
         }
         const codeHash = await this.securityService.hashOpaqueToken('totp-recovery', normalizedCode);
-        const recoveryCode = await this.mikro.userTotpRecoveryCode.findUnusedByUserSubAndCodeHash(userId, codeHash);
-        if (!recoveryCode) {
+        const consumed = await this.mikro.userTotpRecoveryCode.nativeUpdate({ user: userId, code_hash: codeHash, used: false }, { used: true, used_at: new Date() });
+        if (consumed !== 1)
             throw new e.InvalidRecoveryCode.Error();
-        }
-        recoveryCode.used = true;
-        recoveryCode.used_at = new Date();
-        await this.mikro.em.flush();
     }
     async regenerateRecoveryCodes(userId, token) {
-        const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
-        if (!totp) {
-            throw new e.TotpNotEnabled.Error();
-        }
-        this.verifyToken(token, totp.secret);
-        const user = await this.mikro.user.findOneOrFail({
-            sub: userId,
-        }, {
-            failHandler: () => new e.UserNotFound.Error(),
+        return withUserSecurity(this.mikro, userId, async () => {
+            const totp = await this.mikro.userTotp.findFullyRegisteredByUserSub(userId);
+            if (!totp) {
+                throw new e.TotpNotEnabled.Error();
+            }
+            await this.consumeToken(token, totp);
+            const user = await this.mikro.user.findOneOrFail({
+                sub: userId,
+            }, {
+                failHandler: () => new e.UserNotFound.Error(),
+            });
+            return this.generateRecoveryCodes(user);
         });
-        return this.generateRecoveryCodes(user);
     }
 }
 //# sourceMappingURL=totp.service.js.map

package/dist/services/totp.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"totp.service.js","sourceRoot":"","sources":["../../src/services/totp.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,MAAM,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAiBxC,2CAA2C;AAC3C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAChE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,MAAM,OAAO,WAAW;IACL,KAAK,CAAe;IACpB,MAAM,CAAuB;IAC7B,eAAe,CAAkB;IAClD,YACE,KAAmB,EACnB,MAA4B,EAC5B,eAAgC;QAEhC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;OAEG;IACI,cAAc;QACnB,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAa,EAAE,MAAc;QACrD,OAAO,WAAW,CAAC;YACjB,MAAM,EACJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;YAClC,KAAK,EAAE,KAAK;YACZ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,WAAW,CAAC,KAAa,EAAE,MAAc;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YACtC,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,MAAc;QACjC,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,UAAU,CAAC,IAAgB;QACtC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEvE,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,YAAY,EAAE,QAAQ,IAAI,YAAY,EAAE,kBAAkB,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAE5D,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,yBAAyB;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtC,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO;YACL,MAAM;YACN,UAAU;YACV,aAAa;SACd,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAa;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,0DAA0D;QAC1D,uDAAuD;QACvD,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,mDAAmD;QACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;YAC/C,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE7D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,OAAO,CAClB,MAAc,EACd,KAAa,EACb,OAGC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAED,6EAA6E;QAC7E,IAAI,OAAO,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAClE,MAAM,IAAI,CAAC,CAAC,4BAA4B,CAAC,KAAK,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAa;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACI,0BAA0B;QAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC3B,GAAG,CACF,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CACvE;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,KAAK,CAAC,IAAI,CACf,EAAE,MAAM,EAAE,oBAAoB,GAAG,0BAA0B,EAAE,EAC7D,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CACX,IAAI,CAAC,KAAK,CACR,KAAK,GAAG,0BAA0B,EAClC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,0BAA0B,CACzC,CACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAAgB;QACjD,qCAAqC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAEtB,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;YACpD,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QAEH,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CACzD,eAAe,EACf,IAAI,CACL,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC;gBACpD,IAAI,EAAE,SAAS,CAAC,GAAG;gBACnB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE1C,sDAAsD;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,eAAe,GACnB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAErE,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CACzD,eAAe,EACf,cAAc,CACf,CAAC;QACF,MAAM,YAAY,GAChB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,8BAA8B,CAClE,MAAM,EACN,QAAQ,CACT,CAAC;QAEJ,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC;QACzB,YAAY,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAClC,MAAc,EACd,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAC9C;YACE,GAAG,EAAE,MAAM;SACZ,EACD;YACE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CACF,CAAC;QAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"totp.service.js","sourceRoot":"","sources":["../../src/services/totp.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,MAAM,MAAM,QAAQ,CAAC;AAI5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAGxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAe9D,2CAA2C;AAC3C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAChE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,MAAM,OAAO,WAAW;IACL,KAAK,CAAe;IACpB,MAAM,CAAuB;IAC7B,eAAe,CAAkB;IAClD,YACE,KAAmB,EACnB,MAA4B,EAC5B,eAAgC;QAEhC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;OAEG;IACI,cAAc;QACnB,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACI,kBAAkB,CAAC,KAAa,EAAE,MAAc;QACrD,OAAO,WAAW,CAAC;YACjB,MAAM,EACJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;YAClC,KAAK,EAAE,KAAK;YACZ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,WAAW,CAAC,KAAa,EAAE,MAAc;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YACtC,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,KAAa,EACb,IAAqB;QAErB,MAAM,MAAM,GAAG,UAAU,CAAC;YACxB,KAAK;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC;YAC1C,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CACpD;YACE,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE;gBACH,EAAE,cAAc,EAAE,IAAI,EAAE;gBACxB,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;aAC7C;SACF,EACD,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CACpC,CAAC;QACF,IAAI,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,MAAc;QACjC,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY,CAAC,IAAgB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAE5D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,UAAU,CACrB,IAAgB,EAChB,QAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GACzC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAChE,IAAI,GAAG,SAAS,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEvE,2EAA2E;YAC3E,qEAAqE;YACrE,IAAI,YAAY,EAAE,QAAQ,IAAI,YAAY,EAAE,kBAAkB,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACzC,CAAC;YAED,mEAAmE;YACnE,oEAAoE;YACpE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEhE,yBAAyB;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACtC,IAAI,EAAE,IAAI,CAAC,GAAG;gBACd,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAE5B,OAAO;gBACL,MAAM;gBACN,UAAU;gBACV,aAAa;aACd,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAa;QACpD,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACnC,CAAC;YAED,2EAA2E;YAC3E,4EAA4E;YAC5E,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACzC,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAErC,0DAA0D;YAC1D,uDAAuD;YACvD,6CAA6C;YAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAE5B,mDAAmD;YACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC/C,GAAG,EAAE,MAAM;aACZ,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAE7D,OAAO,aAAa,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACnC,CAAC;YAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACzC,CAAC;YAED,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,KAAa;QAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YACrC,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAErC,6EAA6E;YAC7E,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,mBAAmB;gBACxD,CAAC,CACC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;oBAChC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAC1D,EACD,CAAC;gBACD,MAAM,IAAI,CAAC,CAAC,4BAA4B,CAAC,KAAK,EAAE,CAAC;YACnD,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAa;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACI,0BAA0B;QAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC3B,GAAG,CACF,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CACvE;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,KAAK,CAAC,IAAI,CACf,EAAE,MAAM,EAAE,oBAAoB,GAAG,0BAA0B,EAAE,EAC7D,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CACX,IAAI,CAAC,KAAK,CACR,KAAK,GAAG,0BAA0B,EAClC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,0BAA0B,CACzC,CACJ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAAgB;QACjD,qCAAqC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAEtB,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;YACpD,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QAEH,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CACzD,eAAe,EACf,IAAI,CACL,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC;gBACpD,IAAI,EAAE,SAAS,CAAC,GAAG;gBACnB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAE5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE1C,sDAAsD;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,eAAe,GACnB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAErE,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CACzD,eAAe,EACf,cAAc,CACf,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,CACjE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAClD,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CACpC,CAAC;QACF,IAAI,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAClC,MAAc,EACd,KAAa;QAEb,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GACR,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YACrC,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAErC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAC9C;gBACE,GAAG,EAAE,MAAM;aACZ,EACD;gBACE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;aAC9C,CACF,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/services/user-security.service.d.ts

@@ -0,0 +1,15 @@
+import { UserEntity } from '../entities/user.entity.js';
+import type { IssuaryRuntimeConfig } from '../lib/config/index.js';
+import type { MikroService } from './mikro.service.js';
+export declare function isSecurityConflict(error: unknown): boolean;
+/** The write precedes every policy read, including on SQLite's deferred transactions. */
+export declare function withUserSecurity<T>(mikro: MikroService, sub: string, operation: (user: UserEntity) => Promise<T>, options?: {
+    includeDeleted?: boolean;
+}): Promise<T>;
+export declare function authenticationMethods(mikro: MikroService, config: IssuaryRuntimeConfig, user: UserEntity): Promise<{
+    oauth: number;
+    passkeys: number;
+    totp: boolean;
+    password: boolean;
+}>;
+//# sourceMappingURL=user-security.service.d.ts.map

package/dist/services/user-security.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-security.service.d.ts","sourceRoot":"","sources":["../../src/services/user-security.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAgB1D;AAED,yFAAyF;AACzF,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EAC3C,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,UAAU;;;;;GAuBjB"}