@tinyrack/tinyauth-server 0.0.7

package/dist/schemas/terms.d.ts

@@ -0,0 +1,93 @@
+import { z } from 'zod';
+export declare const termsSchema: {
+    TermsResponse: z.ZodObject<{
+        terms: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            required: z.ZodBoolean;
+            consentMode: z.ZodEnum<{
+                explicit: "explicit";
+                implicit: "implicit";
+            }>;
+            version: z.ZodString;
+            effectiveDate: z.ZodOptional<z.ZodString>;
+            title: z.ZodString;
+            type: z.ZodEnum<{
+                link: "link";
+                text: "text";
+            }>;
+            content: z.ZodString;
+            userConsent: z.ZodNullable<z.ZodObject<{
+                agreed: z.ZodBoolean;
+                agreedVersion: z.ZodNullable<z.ZodString>;
+                agreedAt: z.ZodNullable<z.ZodString>;
+                consentType: z.ZodNullable<z.ZodEnum<{
+                    explicit: "explicit";
+                    implicit: "implicit";
+                }>>;
+                requiresUpdate: z.ZodBoolean;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        pendingTerms: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    TermsConsentRequest: z.ZodObject<{
+        consents: z.ZodArray<z.ZodObject<{
+            termsId: z.ZodString;
+            agreed: z.ZodBoolean;
+            consentType: z.ZodOptional<z.ZodEnum<{
+                explicit: "explicit";
+                implicit: "implicit";
+            }>>;
+        }, z.core.$strip>>;
+        registrationToken: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    TermsConsentResponse: z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        recorded: z.ZodNumber;
+        registered: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+    TermsUserConsent: z.ZodObject<{
+        agreed: z.ZodBoolean;
+        agreedVersion: z.ZodNullable<z.ZodString>;
+        agreedAt: z.ZodNullable<z.ZodString>;
+        consentType: z.ZodNullable<z.ZodEnum<{
+            explicit: "explicit";
+            implicit: "implicit";
+        }>>;
+        requiresUpdate: z.ZodBoolean;
+    }, z.core.$strip>;
+    TermItem: z.ZodObject<{
+        id: z.ZodString;
+        required: z.ZodBoolean;
+        consentMode: z.ZodEnum<{
+            explicit: "explicit";
+            implicit: "implicit";
+        }>;
+        version: z.ZodString;
+        effectiveDate: z.ZodOptional<z.ZodString>;
+        title: z.ZodString;
+        type: z.ZodEnum<{
+            link: "link";
+            text: "text";
+        }>;
+        content: z.ZodString;
+        userConsent: z.ZodNullable<z.ZodObject<{
+            agreed: z.ZodBoolean;
+            agreedVersion: z.ZodNullable<z.ZodString>;
+            agreedAt: z.ZodNullable<z.ZodString>;
+            consentType: z.ZodNullable<z.ZodEnum<{
+                explicit: "explicit";
+                implicit: "implicit";
+            }>>;
+            requiresUpdate: z.ZodBoolean;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    ConsentItem: z.ZodObject<{
+        termsId: z.ZodString;
+        agreed: z.ZodBoolean;
+        consentType: z.ZodOptional<z.ZodEnum<{
+            explicit: "explicit";
+            implicit: "implicit";
+        }>>;
+    }, z.core.$strip>;
+};
+//# sourceMappingURL=terms.d.ts.map

package/dist/schemas/terms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.d.ts","sourceRoot":"","sources":["../../src/schemas/terms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsHxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOvB,CAAC"}

package/dist/schemas/terms.js

@@ -0,0 +1,109 @@
+import { z } from 'zod';
+/**
+ * User consent status for a term
+ */
+const TermsUserConsent = z
+    .object({
+    agreed: z.boolean().describe('Whether the user agreed to this term'),
+    agreedVersion: z
+        .string()
+        .nullable()
+        .describe('Version of the term the user agreed to'),
+    agreedAt: z
+        .string()
+        .datetime()
+        .nullable()
+        .describe('When the user agreed to the term'),
+    consentType: z
+        .enum(['explicit', 'implicit'])
+        .nullable()
+        .describe('How consent was obtained'),
+    requiresUpdate: z
+        .boolean()
+        .describe('Whether the user needs to re-consent due to version change'),
+})
+    .describe('User consent status');
+/**
+ * Content type for terms content
+ */
+const TermsContentType = z
+    .enum(['link', 'text'])
+    .describe('Content type: link (URL) or text (inline content)');
+/**
+ * Term item with localized content and user consent status
+ */
+const TermItem = z
+    .object({
+    id: z.string().describe('Unique identifier for the term'),
+    required: z.boolean().describe('Whether this term is mandatory'),
+    consentMode: z
+        .enum(['explicit', 'implicit'])
+        .describe('Consent mode: explicit (checkbox required) or implicit (auto-agree)'),
+    version: z.string().describe('Version of the term'),
+    effectiveDate: z
+        .string()
+        .optional()
+        .describe('When this version became effective'),
+    title: z.string().describe('Localized title'),
+    type: TermsContentType.describe('How to interpret the content'),
+    content: z
+        .string()
+        .describe('Content value (URL if type=link, text if type=text)'),
+    userConsent: TermsUserConsent.nullable().describe('User consent status (null if not logged in)'),
+})
+    .describe('Term item with user consent');
+/**
+ * GET /api/terms response
+ */
+const TermsResponse = z
+    .object({
+    terms: z.array(TermItem).describe('List of terms'),
+    pendingTerms: z.array(z.string()).describe('Term IDs that require consent'),
+})
+    .describe('Terms response');
+/**
+ * Single consent item in request
+ */
+const ConsentItem = z.object({
+    termsId: z.string().describe('Term ID to consent to'),
+    agreed: z.boolean().describe('Whether user agrees to this term'),
+    consentType: z
+        .enum(['explicit', 'implicit'])
+        .optional()
+        .describe('How consent was obtained. Defaults to term consentMode if omitted'),
+});
+/**
+ * POST /api/terms/consent request body
+ */
+const TermsConsentRequest = z
+    .object({
+    consents: z.array(ConsentItem).min(1).describe('List of consent decisions'),
+    registrationToken: z
+        .string()
+        .uuid()
+        .optional()
+        .describe('Pending OAuth registration token. Required when completing registration after terms consent.'),
+})
+    .describe('Terms consent request');
+/**
+ * POST /api/terms/consent response
+ */
+const TermsConsentResponse = z
+    .object({
+    ok: z.literal(true),
+    recorded: z.number().int().describe('Number of consents recorded'),
+    registered: z
+        .boolean()
+        .optional()
+        .describe('True if OAuth registration was completed with this consent submission'),
+})
+    .describe('Terms consent response');
+export const termsSchema = {
+    TermsResponse,
+    TermsConsentRequest,
+    TermsConsentResponse,
+    TermsUserConsent,
+    TermItem,
+    ConsentItem,
+};
+//# sourceMappingURL=terms.js.map

package/dist/schemas/terms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.js","sourceRoot":"","sources":["../../src/schemas/terms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,wCAAwC,CAAC;IACrD,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CAAC,kCAAkC,CAAC;IAC/C,WAAW,EAAE,CAAC;SACX,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CAAC,0BAA0B,CAAC;IACvC,cAAc,EAAE,CAAC;SACd,OAAO,EAAE;SACT,QAAQ,CAAC,4DAA4D,CAAC;CAC1E,CAAC;KACD,QAAQ,CAAC,qBAAqB,CAAC,CAAC;AAEnC;;GAEG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtB,QAAQ,CAAC,mDAAmD,CAAC,CAAC;AAEjE;;GAEG;AACH,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IACzD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAChE,WAAW,EAAE,CAAC;SACX,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC9B,QAAQ,CACP,qEAAqE,CACtE;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IACnD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,oCAAoC,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC7C,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IAC/D,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,CAAC,qDAAqD,CAAC;IAClE,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC/C,6CAA6C,CAC9C;CACF,CAAC;KACD,QAAQ,CAAC,6BAA6B,CAAC,CAAC;AAE3C;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;CAC5E,CAAC;KACD,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAE9B;;GAEG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAChE,WAAW,EAAE,CAAC;SACX,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CACP,mEAAmE,CACpE;CACJ,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC3E,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F,CAC/F;CACJ,CAAC;KACD,QAAQ,CAAC,uBAAuB,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAClE,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,uEAAuE,CACxE;CACJ,CAAC;KACD,QAAQ,CAAC,wBAAwB,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,aAAa;IACb,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,QAAQ;IACR,WAAW;CACZ,CAAC"}

package/dist/seeders/config.seeder.d.ts

@@ -0,0 +1,21 @@
+import type { EntityManager } from '@mikro-orm/core';
+import type { TinyAuthRuntimeConfig } from '../lib/config/index.ts';
+import type { SecurityService } from '../services/security.service.ts';
+/**
+ * ConfigSeeder
+ *
+ * Synchronizes users, OAuth clients, and terms from config.yaml to the database.
+ * This seeder is run on every server startup to ensure config data is in DB.
+ *
+ * Key behaviors:
+ * - Uses em.upsert() for atomic INSERT ON CONFLICT operations
+ *   (cluster-safe: multiple instances can run concurrently without race conditions)
+ * - Bypasses entity lifecycle hooks to prevent double-hashing of passwords
+ * - Sets managed_by='config' to distinguish from runtime-created records
+ * - Cleans up records that were removed from config
+ */
+/**
+ * Run config seeder with the given config
+ */
+export declare function seedConfig(em: EntityManager, config: TinyAuthRuntimeConfig, securityService: SecurityService): Promise<void>;
+//# sourceMappingURL=config.seeder.d.ts.map

package/dist/seeders/config.seeder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.seeder.d.ts","sourceRoot":"","sources":["../../src/seeders/config.seeder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAKrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE,qBAAqB,EAC7B,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/seeders/config.seeder.js

@@ -0,0 +1,168 @@
+import { OAuthClientEntitySchema } from "../entities/oauth-client.entity.js";
+import { TermsEntitySchema } from "../entities/terms.entity.js";
+import { TermsContentEntitySchema } from "../entities/terms-content.entity.js";
+import { UserEntity } from "../entities/user.entity.js";
+/**
+ * ConfigSeeder
+ *
+ * Synchronizes users, OAuth clients, and terms from config.yaml to the database.
+ * This seeder is run on every server startup to ensure config data is in DB.
+ *
+ * Key behaviors:
+ * - Uses em.upsert() for atomic INSERT ON CONFLICT operations
+ *   (cluster-safe: multiple instances can run concurrently without race conditions)
+ * - Bypasses entity lifecycle hooks to prevent double-hashing of passwords
+ * - Sets managed_by='config' to distinguish from runtime-created records
+ * - Cleans up records that were removed from config
+ */
+/**
+ * Run config seeder with the given config
+ */
+export async function seedConfig(em, config, securityService) {
+    await syncTerms(em, config);
+    await syncUsers(em, config, securityService);
+    await syncOAuthClients(em, config, securityService);
+}
+/**
+ * Sync terms from config.yaml to database
+ * Uses em.upsert() for atomic upsert operations that are cluster-safe
+ */
+async function syncTerms(em, config) {
+    const now = new Date();
+    const configTerms = config.terms;
+    for (const term of configTerms) {
+        // Upsert term entity
+        await em.upsert(TermsEntitySchema, {
+            id: term.id,
+            required: term.required,
+            consentMode: term.consent_mode,
+            version: term.version,
+            managed_by: 'config',
+            created_at: now,
+            updated_at: now,
+        }, {
+            onConflictFields: ['id'],
+            onConflictAction: 'merge',
+            onConflictExcludeFields: ['id', 'created_at'],
+        });
+        // Delete existing content for this term (to handle language changes)
+        await em.nativeDelete(TermsContentEntitySchema, {
+            terms: term.id,
+        });
+        // Insert new content for each language
+        for (const lang of Object.keys(term.content)) {
+            const content = term.content[lang];
+            if (!content) {
+                continue;
+            }
+            const contentEntity = em.create(TermsContentEntitySchema, {
+                terms: term.id,
+                lang,
+                title: content.title,
+                type: content.type,
+                content: content.content,
+            });
+            em.persist(contentEntity);
+        }
+    }
+    await em.flush();
+    // Remove config-managed terms that are no longer in config
+    const configTermIds = configTerms.map((term) => term.id);
+    if (configTermIds.length > 0) {
+        await em.nativeDelete(TermsEntitySchema, {
+            managed_by: 'config',
+            id: { $nin: configTermIds },
+        });
+    }
+    else {
+        // If no config terms, remove all config-managed terms
+        await em.nativeDelete(TermsEntitySchema, { managed_by: 'config' });
+    }
+}
+/**
+ * Sync users from config.yaml to database
+ * Uses em.upsert() for atomic upsert operations that are cluster-safe
+ */
+async function syncUsers(em, config, securityService) {
+    const now = new Date();
+    for (const configUser of config.users) {
+        const hashedPassword = await securityService.hashPassword(configUser.password);
+        // Use upsert for atomic INSERT ON CONFLICT DO UPDATE
+        // This is cluster-safe: concurrent instances won't cause race conditions
+        await em.upsert(UserEntity, {
+            sub: configUser.sub,
+            email: configUser.email,
+            password_hash: hashedPassword,
+            email_verified: true,
+            managed_by: 'config',
+            role: configUser.role ?? 'user',
+            created_at: now,
+            updated_at: now,
+        }, {
+            onConflictFields: ['sub'],
+            onConflictAction: 'merge',
+            // Exclude sub and created_at from merge (don't update primary key or creation time)
+            onConflictExcludeFields: ['sub', 'created_at'],
+        });
+    }
+    // Remove config-managed users that are no longer in config
+    const configUserSubs = config.users.map((user) => user.sub);
+    if (configUserSubs.length > 0) {
+        await em.nativeDelete(UserEntity, {
+            managed_by: 'config',
+            sub: { $nin: configUserSubs },
+        });
+    }
+    else {
+        // If no config users, remove all config-managed users
+        await em.nativeDelete(UserEntity, { managed_by: 'config' });
+    }
+}
+/**
+ * Sync OAuth clients from config.yaml to database
+ * Uses em.upsert() for atomic upsert operations that are cluster-safe
+ */
+async function syncOAuthClients(em, config, securityService) {
+    const now = new Date();
+    for (const client of config.clients) {
+        // Public clients (PKCE-only) don't have client_secret
+        const hashedSecret = client.client_secret
+            ? await securityService.hashClientSecret(client.client_secret)
+            : null;
+        // Use upsert for atomic INSERT ON CONFLICT DO UPDATE
+        // This is cluster-safe: concurrent instances won't cause race conditions
+        await em.upsert(OAuthClientEntitySchema, {
+            id: client.id,
+            clientId: client.client_id,
+            clientSecretHash: hashedSecret,
+            name: client.name,
+            logoUri: client.logo_uri ?? null,
+            redirectUris: client.redirect_uris,
+            responseTypes: client.response_types,
+            grantTypes: client.grant_types,
+            scopes: client.scope.split(' '),
+            enabled: true,
+            managed_by: 'config',
+            created_at: now,
+            updated_at: now,
+        }, {
+            onConflictFields: ['id'],
+            onConflictAction: 'merge',
+            // Exclude id and created_at from merge (don't update primary key or creation time)
+            onConflictExcludeFields: ['id', 'created_at'],
+        });
+    }
+    // Remove config-managed clients that are no longer in config
+    const configClientIds = config.clients.map((client) => client.id);
+    if (configClientIds.length > 0) {
+        await em.nativeDelete(OAuthClientEntitySchema, {
+            managed_by: 'config',
+            id: { $nin: configClientIds },
+        });
+    }
+    else {
+        // If no config providers, remove all config-managed clients
+        await em.nativeDelete(OAuthClientEntitySchema, { managed_by: 'config' });
+    }
+}
+//# sourceMappingURL=config.seeder.js.map

package/dist/seeders/config.seeder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.seeder.js","sourceRoot":"","sources":["../../src/seeders/config.seeder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAIxD;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAiB,EACjB,MAA6B,EAC7B,eAAgC;IAEhC,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,MAAM,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CACtB,EAAiB,EACjB,MAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,qBAAqB;QACrB,MAAM,EAAE,CAAC,MAAM,CACb,iBAAiB,EACjB;YACE,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAChB,EACD;YACE,gBAAgB,EAAE,CAAC,IAAI,CAAC;YACxB,gBAAgB,EAAE,OAAO;YACzB,uBAAuB,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC;SAC9C,CACF,CAAC;QAEF,qEAAqE;QACrE,MAAM,EAAE,CAAC,YAAY,CAAC,wBAAwB,EAAE;YAC9C,KAAK,EAAE,IAAI,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,uCAAuC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,wBAAwB,EAAE;gBACxD,KAAK,EAAE,IAAI,CAAC,EAAE;gBACd,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,2DAA2D;IAC3D,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,EAAE,CAAC,YAAY,CAAC,iBAAiB,EAAE;YACvC,UAAU,EAAE,QAAQ;YACpB,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,MAAM,EAAE,CAAC,YAAY,CAAC,iBAAiB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CACtB,EAAiB,EACjB,MAA6B,EAC7B,eAAgC;IAEhC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,YAAY,CACvD,UAAU,CAAC,QAAQ,CACpB,CAAC;QAEF,qDAAqD;QACrD,yEAAyE;QACzE,MAAM,EAAE,CAAC,MAAM,CACb,UAAU,EACV;YACE,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,aAAa,EAAE,cAAc;YAC7B,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,MAAM;YAC/B,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAChB,EACD;YACE,gBAAgB,EAAE,CAAC,KAAK,CAAC;YACzB,gBAAgB,EAAE,OAAO;YACzB,oFAAoF;YACpF,uBAAuB,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;SAC/C,CACF,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE;YAChC,UAAU,EAAE,QAAQ;YACpB,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,EAAiB,EACjB,MAA6B,EAC7B,eAAgC;IAEhC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,sDAAsD;QACtD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa;YACvC,CAAC,CAAC,MAAM,eAAe,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC;QAET,qDAAqD;QACrD,yEAAyE;QACzE,MAAM,EAAE,CAAC,MAAM,CACb,uBAAuB,EACvB;YACE,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,gBAAgB,EAAE,YAAY;YAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;YAChC,YAAY,EAAE,MAAM,CAAC,aAAa;YAClC,aAAa,EAAE,MAAM,CAAC,cAAc;YACpC,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;YAC/B,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAChB,EACD;YACE,gBAAgB,EAAE,CAAC,IAAI,CAAC;YACxB,gBAAgB,EAAE,OAAO;YACzB,mFAAmF;YACnF,uBAAuB,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC;SAC9C,CACF,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,EAAE,CAAC,YAAY,CAAC,uBAAuB,EAAE;YAC7C,UAAU,EAAE,QAAQ;YACpB,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,4DAA4D;QAC5D,MAAM,EAAE,CAAC,YAAY,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/dist/services/cleanup.service.d.ts

@@ -0,0 +1,166 @@
+import type { TinyAuthRuntimeConfig } from '../lib/config/index.ts';
+import type { JwtService } from './jwt.service.ts';
+import type { MikroService } from './mikro.service.ts';
+/**
+ * Result of a cleanup operation.
+ */
+export interface CleanupResult {
+    /** Number of items deleted (or would be deleted in dry-run mode) */
+    deletedCount: number;
+    /** If true, the cleanup was skipped (e.g., disabled in config) */
+    skipped: boolean;
+    /** Optional message with additional details */
+    message?: string;
+}
+/**
+ * Options for cleanup operations.
+ */
+export interface CleanupOptions {
+    /** If true, don't actually delete anything, just report what would be deleted */
+    dryRun: boolean;
+}
+/**
+ * Result of a single task execution
+ */
+export interface TaskExecutionResult {
+    name: string;
+    description: string;
+    result: CleanupResult;
+    durationMs: number;
+    error?: Error;
+}
+/**
+ * Summary of all cleanup tasks execution
+ */
+export interface CleanupSummary {
+    tasks: TaskExecutionResult[];
+    totalDeleted: number;
+    totalSkipped: number;
+    totalFailed: number;
+    totalDurationMs: number;
+}
+/**
+ * Cleanup Service
+ *
+ * Centralizes all cleanup/maintenance tasks for the application.
+ * Handles cleanup of:
+ * - Revoked tokens (expired JWT revocations)
+ * - OAuth authorization codes (expired/consumed)
+ * - Email verification tokens (expired)
+ * - Password reset tokens (expired)
+ * - Deleted users (past retention period)
+ * - JWT signing keys (rotation)
+ *
+ * Can be invoked via:
+ * - CLI command: `tinyauth cleanup`
+ * - In-process scheduler adapter
+ */
+export declare class CleanupService {
+    private readonly config;
+    private readonly mikro;
+    private readonly jwtService;
+    constructor(config: TinyAuthRuntimeConfig, mikro: MikroService, jwtService: JwtService);
+    /**
+     * Remove expired revoked tokens from the database.
+     *
+     * Revoked tokens can be safely deleted after their original expiration time
+     * since they would be invalid anyway due to JWT expiration.
+     * The retention period allows keeping expired tokens for a while longer
+     * for debugging purposes. Default is "0" (immediate cleanup after expiry).
+     *
+     * @param options - Cleanup options (dryRun)
+     * @returns Cleanup result with deleted count and details
+     */
+    cleanupRevokedTokens(options: CleanupOptions): Promise<CleanupResult>;
+    /**
+     * Remove expired and consumed OAuth authorization codes.
+     *
+     * Authorization codes have a short lifetime (typically 10 minutes)
+     * and should be cleaned up regularly to prevent database bloat.
+     * Also cleans up consumed codes after the configured retention period.
+     *
+     * @param options - Cleanup options (dryRun)
+     * @returns Cleanup result with deleted count and details
+     */
+    cleanupOAuthCodes(options: CleanupOptions): Promise<CleanupResult>;
+    /**
+     * Remove expired email verification tokens.
+     *
+     * Expired tokens are no longer valid and can be safely deleted.
+     * The retention period allows keeping expired tokens for a while longer
+     * for debugging purposes. Default is "0" (immediate cleanup after expiry).
+     *
+     * @param options - Cleanup options (dryRun)
+     * @returns Cleanup result with deleted count and details
+     */
+    cleanupEmailVerifications(options: CleanupOptions): Promise<CleanupResult>;
+    /**
+     * Remove expired password reset tokens.
+     *
+     * Expired tokens are no longer valid and can be safely deleted.
+     * The retention period allows keeping expired tokens for a while longer
+     * for debugging purposes. Default is "0" (immediate cleanup after expiry).
+     *
+     * @param options - Cleanup options (dryRun)
+     * @returns Cleanup result with deleted count and details
+     */
+    cleanupPasswordResets(options: CleanupOptions): Promise<CleanupResult>;
+    /**
+     * Permanently delete users marked for deletion whose retention period
+     * has expired.
+     *
+     * This is a destructive operation that:
+     * 1. Deletes all user-related data (OAuth accounts, TOTP, passkeys, consents)
+     * 2. Removes the user record permanently
+     *
+     * The retention period is configured in account_deletion.retention
+     * (e.g., "30d", "90d").
+     *
+     * @param options - Cleanup options (dryRun)
+     * @returns Cleanup result with deleted count and details
+     */
+    cleanupDeletedUsers(options: CleanupOptions): Promise<CleanupResult>;
+    /**
+     * Remove expired pending OAuth registration records.
+     *
+     * When a new OAuth user needs to accept terms before completing
+     * registration, the OAuth tokens and user info are stored in the
+     * database. These records expire after 1 hour and can be safely
+     * cleaned up afterwards.
+     *
+     * @param options - Cleanup options (dryRun)
+     * @returns Cleanup result with deleted count and details
+     */
+    cleanupPendingOAuthRegistrations(options: CleanupOptions): Promise<CleanupResult>;
+    /**
+     * Rotate expired JWT signing keys and retire old keys.
+     *
+     * This method checks for expired active keys and performs rotation if needed.
+     * Also retires old keys that have passed the overlap period.
+     *
+     * Key lifecycle:
+     * 1. next: Generated, waiting to be activated
+     * 2. active: Currently used for signing tokens
+     * 3. previous: Recently rotated, still valid for verification
+     * 4. retired: No longer valid for any operation
+     *
+     * @param options - Cleanup options (dryRun)
+     * @returns Cleanup result with rotation details
+     */
+    rotateExpiredJwtKeys(options: CleanupOptions): Promise<CleanupResult>;
+    /**
+     * Build cleanup tasks
+     */
+    private buildCleanupTasks;
+    /**
+     * Run all cleanup tasks.
+     *
+     * @param options - Cleanup options (dryRun, verbose)
+     * @returns Summary of all task executions
+     */
+    runAll(options: {
+        dryRun: boolean;
+        verbose?: boolean;
+    }): Promise<CleanupSummary>;
+}
+//# sourceMappingURL=cleanup.service.d.ts.map

package/dist/services/cleanup.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.service.d.ts","sourceRoot":"","sources":["../../src/services/cleanup.service.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAOpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,MAAM,EAAE,OAAO,CAAC;CACjB;AAcD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;gBAEtC,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,YAAY,EACnB,UAAU,EAAE,UAAU;IAWxB;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAsD3E;;;;;;;;;OASG;IACG,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA+DxE;;;;;;;;;OASG;IACG,yBAAyB,CAC7B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC;IAyDzB;;;;;;;;;OASG;IACG,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAuD5E;;;;;;;;;;;;;OAaG;IACG,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAiF1E;;;;;;;;;;OAUG;IACG,gCAAgC,CACpC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC;IAuDzB;;;;;;;;;;;;;;OAcG;IACG,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAiH3E;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwCzB;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE;QACpB,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,CAAC;CAmD5B"}