@tinyrack/tinyauth-server 0.5.1 → 0.6.0

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA0BvD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAmC,OAE5D,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAkB,CAAC,CAAC;YAC1C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE;YACpB,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClE,aAAa,CAAC,iBAAiB,EAAE,CAAC;YAClC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAkB,CAAC,CAAC;gBAC1C,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAElC,OAED,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAkB,CAAC,CAAC;YACpD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE;YAC9B,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClE,aAAa,CAAC,iBAAiB,EAAE,CAAC;YAClC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAkB,CAAC,CAAC;gBACpD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAEvC,OAED,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,SAAkB,CAAC,CAAC;YACzD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClE,aAAa,CAAC,iBAAiB,EAAE,CAAC;YAClC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,SAAkB,CAAC,CAAC;gBACzD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAQL,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,gBAAgB,CAGb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,WAAW,GAAG,CAAmC,OAE7D,EAAE,EAAE,CACH,gBAAgB,CAGb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,SAAkB,CAAC,CAAC;YAC3C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA0BvD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAmC,OAE5D,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAkB,CAAC,CAAC;YAC1C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE;YACpB,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClE,aAAa,CAAC,iBAAiB,EAAE,CAAC;YAClC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,SAAkB,CAAC,CAAC;gBAC1C,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,EAAE,CAC/B,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAChC,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE;YACpB,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClE,aAAa,CAAC,iBAAiB,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAElC,OAED,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAkB,CAAC,CAAC;YACpD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE;YAC9B,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClE,aAAa,CAAC,iBAAiB,EAAE,CAAC;YAClC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAkB,CAAC,CAAC;gBACpD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAEvC,OAED,EAAE,EAAE,CACH,gBAAgB,CAIb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,SAAkB,CAAC,CAAC;YACzD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAClE,aAAa,CAAC,iBAAiB,EAAE,CAAC;YAClC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,SAAkB,CAAC,CAAC;gBACzD,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAQL,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,gBAAgB,CAGb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAUL,MAAM,CAAC,MAAM,WAAW,GAAG,CAAmC,OAE7D,EAAE,EAAE,CACH,gBAAgB,CAGb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACnB,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,SAAkB,CAAC,CAAC;YAC3C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC"}

package/dist/middleware/session.d.ts

@@ -3,6 +3,24 @@ export type SessionEnv = {
         session: SessionHelper;
     };
 };
+export interface RememberedAccountsOptions {
+    enabled?: boolean | undefined;
+    maxAccounts?: number | undefined;
+    ttlMs?: number | undefined;
+}
+export interface SessionAccount {
+    sub: string;
+    authenticated_at: number;
+    last_used_at: number;
+}
+export interface AccountSelectionSession {
+    id: string;
+    client_id: string;
+    request_fingerprint: string;
+    allow_add_account: boolean;
+    allowed_subs: string[];
+    created_at: number;
+}
 export interface SessionData {
     /**
      * Fully authenticated user session.
@@ -13,6 +31,18 @@ export interface SessionData {
         sub: string;
         authenticated_at: number;
     };
+    /**
+     * Browser-local remembered authenticated accounts for OIDC account selection.
+     * This is stored only in the encrypted session cookie and must never be
+     * treated as an authoritative user directory.
+     */
+    accounts?: SessionAccount[];
+    /**
+     * Server-side continuation marker for account chooser completion.
+     * The public query flag is not trusted unless it matches this encrypted
+     * browser-session value.
+     */
+    accountSelection?: AccountSelectionSession;
     /**
      * Intermediate session for users who have passed primary authentication
      * (e.g., password) but still need to complete 2FA (TOTP) verification.
@@ -55,9 +85,11 @@ export interface SessionHelper {
     set<K extends keyof SessionData>(key: K, value: SessionData[K]): void;
     delete(): void;
     setUserSession(userSub: string, authenticatedAt?: number): void;
+    selectUserSession(userSub: string): boolean;
+    removeRememberedUserSession(userSub: string): boolean;
     setPending2FASession(userSub: string, authenticatedAt?: number): void;
     setPending2FASetupSession(userSub: string): void;
     clearAuthSessions(): void;
 }
-export declare function sessionMiddleware(cookieSecret: string, isSecure: boolean): import("hono").MiddlewareHandler<SessionEnv, string, {}, Response>;
+export declare function sessionMiddleware(cookieSecret: string, isSecure: boolean, rememberedAccountsOptions?: RememberedAccountsOptions): import("hono").MiddlewareHandler<SessionEnv, string, {}, Response>;
 //# sourceMappingURL=session.d.ts.map

package/dist/middleware/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG;IAAE,SAAS,EAAE;QAAE,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,MAAM,IAAI,IAAI,CAAC;IACf,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtE,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,sEA4FxE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG;IAAE,SAAS,EAAE;QAAE,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,CAAC;AAInE,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAqCD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;QACpC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,CAAC,SAAS,MAAM,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,MAAM,IAAI,IAAI,CAAC;IACf,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChE,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5C,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtE,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,OAAO,EACjB,yBAAyB,CAAC,EAAE,yBAAyB,sEAgLtD"}

package/dist/middleware/session.js

@@ -1,7 +1,26 @@
 import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
 import { createMiddleware } from 'hono/factory';
 import { decrypt, encrypt } from "../lib/crypto.js";
-export function sessionMiddleware(cookieSecret, isSecure) {
+const DEFAULT_MAX_REMEMBERED_ACCOUNTS = 5;
+function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+function resolveRememberedAccountsOptions(options) {
+    return {
+        enabled: options?.enabled ?? true,
+        maxAccounts: options?.maxAccounts ?? DEFAULT_MAX_REMEMBERED_ACCOUNTS,
+        ttlMs: options?.ttlMs,
+    };
+}
+function pruneRememberedAccounts(accounts, options) {
+    const ttlSeconds = options.ttlMs === undefined ? undefined : Math.floor(options.ttlMs / 1000);
+    const freshAccounts = ttlSeconds === undefined
+        ? accounts
+        : accounts.filter((account) => nowSeconds() - account.last_used_at <= ttlSeconds);
+    return freshAccounts.slice(-options.maxAccounts);
+}
+export function sessionMiddleware(cookieSecret, isSecure, rememberedAccountsOptions) {
+    const rememberedOptions = resolveRememberedAccountsOptions(rememberedAccountsOptions);
     return createMiddleware(async (c, next) => {
         const cookieValue = getCookie(c, 'session');
         let sessionData = {};
@@ -29,6 +48,17 @@ export function sessionMiddleware(cookieSecret, isSecure) {
                 return Reflect.deleteProperty(target, prop);
             },
         });
+        if (!rememberedOptions.enabled) {
+            if (data.accounts !== undefined) {
+                delete data.accounts;
+            }
+        }
+        else if (data.accounts) {
+            const prunedAccounts = pruneRememberedAccounts(data.accounts, rememberedOptions);
+            if (prunedAccounts.length !== data.accounts.length) {
+                data.accounts = prunedAccounts;
+            }
+        }
         c.set('session', {
             get(key) {
                 return data[key];
@@ -42,21 +72,72 @@ export function sessionMiddleware(cookieSecret, isSecure) {
                 }
             },
             setUserSession(userSub, authenticatedAt) {
+                const authTime = authenticatedAt ?? nowSeconds();
                 delete data.pending2FAUser;
                 delete data.pending2FASetup;
                 delete data.oauth;
                 delete data.passkey_challenge;
                 data.user = {
                     sub: userSub,
-                    authenticated_at: authenticatedAt ?? Math.floor(Date.now() / 1000),
+                    authenticated_at: authTime,
+                };
+                if (rememberedOptions.enabled) {
+                    const existingAccounts = pruneRememberedAccounts(data.accounts ?? [], rememberedOptions);
+                    data.accounts = [
+                        ...existingAccounts.filter((account) => account.sub !== userSub),
+                        {
+                            sub: userSub,
+                            authenticated_at: authTime,
+                            last_used_at: authTime,
+                        },
+                    ].slice(-rememberedOptions.maxAccounts);
+                }
+                else {
+                    delete data.accounts;
+                }
+            },
+            selectUserSession(userSub) {
+                if (!rememberedOptions.enabled) {
+                    return false;
+                }
+                const account = pruneRememberedAccounts(data.accounts ?? [], rememberedOptions).find((entry) => entry.sub === userSub);
+                if (!account) {
+                    return false;
+                }
+                delete data.pending2FAUser;
+                delete data.pending2FASetup;
+                delete data.oauth;
+                delete data.passkey_challenge;
+                data.user = {
+                    sub: account.sub,
+                    authenticated_at: account.authenticated_at,
                 };
+                data.accounts = pruneRememberedAccounts(data.accounts ?? [], rememberedOptions).map((entry) => entry.sub === userSub
+                    ? { ...entry, last_used_at: nowSeconds() }
+                    : entry);
+                return true;
+            },
+            removeRememberedUserSession(userSub) {
+                if (data.user?.sub === userSub) {
+                    return false;
+                }
+                if (!rememberedOptions.enabled) {
+                    return false;
+                }
+                const existingAccounts = pruneRememberedAccounts(data.accounts ?? [], rememberedOptions);
+                const nextAccounts = existingAccounts.filter((account) => account.sub !== userSub);
+                if (nextAccounts.length === existingAccounts.length) {
+                    return false;
+                }
+                data.accounts = nextAccounts;
+                return true;
             },
             setPending2FASession(userSub, authenticatedAt) {
                 delete data.user;
                 delete data.pending2FASetup;
                 data.pending2FAUser = {
                     sub: userSub,
-                    authenticated_at: authenticatedAt ?? Math.floor(Date.now() / 1000),
+                    authenticated_at: authenticatedAt ?? nowSeconds(),
                 };
             },
             setPending2FASetupSession(userSub) {

package/dist/middleware/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AA8DpD,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,QAAiB;IACvE,OAAO,gBAAgB,CAAa,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,WAAW,GAAgB,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,iDAAiD;oBACjD,+CAA+C;oBAC/C,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAgB,IAAI,KAAK,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;gBACrB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,cAAc,CAAC,MAAM,EAAE,IAAI;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;SACF,CAAC,CAAC;QAEH,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,GAAG,CAA8B,GAAM;gBACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,GAAG,CAA8B,GAAM,EAAE,KAAqB;gBAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,MAAM;gBACJ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,cAAc,CAAC,OAAe,EAAE,eAAwB;gBACtD,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,eAAe,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;iBACnE,CAAC;YACJ,CAAC;YACD,oBAAoB,CAAC,OAAe,EAAE,eAAwB;gBAC5D,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,IAAI,CAAC,cAAc,GAAG;oBACpB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,eAAe,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;iBACnE,CAAC;YACJ,CAAC;YACD,yBAAyB,CAAC,OAAe;gBACvC,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,iBAAiB;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;YAC9B,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,YAAY,CACb,CAAC;gBACF,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;oBACjC,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAQ1C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAQD,SAAS,gCAAgC,CACvC,OAA8C;IAE9C,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;QACjC,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,+BAA+B;QACpE,KAAK,EAAE,OAAO,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAA0B,EAC1B,OAA4D;IAE5D,MAAM,UAAU,GACd,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC7E,MAAM,aAAa,GACjB,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC,MAAM,CACb,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,IAAI,UAAU,CAC/D,CAAC;IACR,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAyFD,MAAM,UAAU,iBAAiB,CAC/B,YAAoB,EACpB,QAAiB,EACjB,yBAAqD;IAErD,MAAM,iBAAiB,GAAG,gCAAgC,CACxD,yBAAyB,CAC1B,CAAC;IACF,OAAO,gBAAgB,CAAa,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,WAAW,GAAgB,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,iDAAiD;oBACjD,+CAA+C;oBAC/C,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAgB,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAgB,IAAI,KAAK,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;gBACrB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,cAAc,CAAC,MAAM,EAAE,IAAI;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,QAAQ,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,uBAAuB,CAC5C,IAAI,CAAC,QAAQ,EACb,iBAAiB,CAClB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;YACjC,CAAC;QACH,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,GAAG,CAA8B,GAAM;gBACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,GAAG,CAA8B,GAAM,EAAE,KAAqB;gBAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,MAAM;gBACJ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,cAAc,CAAC,OAAe,EAAE,eAAwB;gBACtD,MAAM,QAAQ,GAAG,eAAe,IAAI,UAAU,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC;gBACF,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;oBACF,IAAI,CAAC,QAAQ,GAAG;wBACd,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC;wBAChE;4BACE,GAAG,EAAE,OAAO;4BACZ,gBAAgB,EAAE,QAAQ;4BAC1B,YAAY,EAAE,QAAQ;yBACvB;qBACF,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,QAAQ,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,OAAe;gBAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,OAAO,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;gBACzC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,IAAI,CAAC,IAAI,GAAG;oBACV,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;iBAC3C,CAAC;gBACF,IAAI,CAAC,QAAQ,GAAG,uBAAuB,CACrC,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,KAAK,CAAC,GAAG,KAAK,OAAO;oBACnB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE;oBAC1C,CAAC,CAAC,KAAK,CACV,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,2BAA2B,CAAC,OAAe;gBACzC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,IAAI,CAAC,QAAQ,IAAI,EAAE,EACnB,iBAAiB,CAClB,CAAC;gBACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CACrC,CAAC;gBACF,IAAI,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,oBAAoB,CAAC,OAAe,EAAE,eAAwB;gBAC5D,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,eAAe,CAAC;gBAC5B,IAAI,CAAC,cAAc,GAAG;oBACpB,GAAG,EAAE,OAAO;oBACZ,gBAAgB,EAAE,eAAe,IAAI,UAAU,EAAE;iBAClD,CAAC;YACJ,CAAC;YACD,yBAAyB,CAAC,OAAe;gBACvC,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,iBAAiB;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;gBACjB,OAAO,IAAI,CAAC,cAAc,CAAC;gBAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;YAC9B,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;QAEb,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,YAAY,CACb,CAAC;gBACF,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;oBACjC,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/migrations/postgres/Migration20260624190500_add_oauth_device_denied_at.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260624190500_add_oauth_device_denied_at extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260624190500_add_oauth_device_denied_at.d.ts.map

package/dist/migrations/postgres/Migration20260624190500_add_oauth_device_denied_at.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260624190500_add_oauth_device_denied_at.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260624190500_add_oauth_device_denied_at.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,kDAAmD,SAAQ,SAAS;IACtE,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtC"}

package/dist/migrations/postgres/Migration20260624190500_add_oauth_device_denied_at.js

@@ -0,0 +1,11 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260624190500_add_oauth_device_denied_at extends Migration {
+    up() {
+        this.addSql(`alter table "oauth_device_code" add "denied_at" timestamptz null;`);
+        this.addSql(`comment on column "oauth_device_code"."denied_at" is 'Timestamp when the user denied the request';`);
+    }
+    down() {
+        this.addSql(`alter table "oauth_device_code" drop column "denied_at";`);
+    }
+}
+//# sourceMappingURL=Migration20260624190500_add_oauth_device_denied_at.js.map

package/dist/migrations/postgres/Migration20260624190500_add_oauth_device_denied_at.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260624190500_add_oauth_device_denied_at.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260624190500_add_oauth_device_denied_at.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,kDAAmD,SAAQ,SAAS;IACtE,EAAE;QACT,IAAI,CAAC,MAAM,CACT,mEAAmE,CACpE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAEQ,IAAI;QACX,IAAI,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;IAC1E,CAAC;CACF"}

package/dist/migrations/postgres/Migration20260624223000_add_oauth_device_poll_state.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260624223000_add_oauth_device_poll_state extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260624223000_add_oauth_device_poll_state.d.ts.map

package/dist/migrations/postgres/Migration20260624223000_add_oauth_device_poll_state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260624223000_add_oauth_device_poll_state.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260624223000_add_oauth_device_poll_state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,mDAAoD,SAAQ,SAAS;IACvE,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAe1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAQtC"}

package/dist/migrations/postgres/Migration20260624223000_add_oauth_device_poll_state.js

@@ -0,0 +1,14 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260624223000_add_oauth_device_poll_state extends Migration {
+    up() {
+        this.addSql(`alter table "oauth_device_code" add "last_polled_at" timestamptz null;`);
+        this.addSql(`alter table "oauth_device_code" add "poll_interval_seconds" int not null default 5;`);
+        this.addSql(`comment on column "oauth_device_code"."last_polled_at" is 'Timestamp of the most recent device token polling request';`);
+        this.addSql(`comment on column "oauth_device_code"."poll_interval_seconds" is 'Current required polling interval for this device code';`);
+    }
+    down() {
+        this.addSql(`alter table "oauth_device_code" drop column "poll_interval_seconds";`);
+        this.addSql(`alter table "oauth_device_code" drop column "last_polled_at";`);
+    }
+}
+//# sourceMappingURL=Migration20260624223000_add_oauth_device_poll_state.js.map

package/dist/migrations/postgres/Migration20260624223000_add_oauth_device_poll_state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260624223000_add_oauth_device_poll_state.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260624223000_add_oauth_device_poll_state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,mDAAoD,SAAQ,SAAS;IACvE,EAAE;QACT,IAAI,CAAC,MAAM,CACT,wEAAwE,CACzE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qFAAqF,CACtF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wHAAwH,CACzH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4HAA4H,CAC7H,CAAC;IACJ,CAAC;IAEQ,IAAI;QACX,IAAI,CAAC,MAAM,CACT,sEAAsE,CACvE,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+DAA+D,CAChE,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/postgres/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAMvF,eAAO,MAAM,mBAAmB,4CAM/B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAQvF,eAAO,MAAM,mBAAmB,4CAQ/B,CAAC"}

package/dist/migrations/postgres/index.js

@@ -3,11 +3,15 @@ import { Migration20260512120000_add_scheduler_jobs } from './Migration202605121
 import { Migration20260619075007 } from './Migration20260619075007.js';
 import { Migration20260619191600_unique_oauth_client_client_id } from './Migration20260619191600_unique_oauth_client_client_id.js';
 import { Migration20260620025358_add_oauth_client_skip_consent } from './Migration20260620025358_add_oauth_client_skip_consent.js';
+import { Migration20260624190500_add_oauth_device_denied_at } from './Migration20260624190500_add_oauth_device_denied_at.js';
+import { Migration20260624223000_add_oauth_device_poll_state } from './Migration20260624223000_add_oauth_device_poll_state.js';
 export const POSTGRES_MIGRATIONS = [
     Migration20260509171036_initial,
     Migration20260512120000_add_scheduler_jobs,
     Migration20260619075007,
     Migration20260619191600_unique_oauth_client_client_id,
     Migration20260620025358_add_oauth_client_skip_consent,
+    Migration20260624190500_add_oauth_device_denied_at,
+    Migration20260624223000_add_oauth_device_poll_state,
 ];
 //# sourceMappingURL=index.js.map

package/dist/migrations/postgres/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AAEnI,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;CACtD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAE/H,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;CACpD,CAAC"}

package/dist/migrations/sqlite/Migration20260624190500_add_oauth_device_denied_at.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260624190500_add_oauth_device_denied_at extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260624190500_add_oauth_device_denied_at.d.ts.map

package/dist/migrations/sqlite/Migration20260624190500_add_oauth_device_denied_at.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260624190500_add_oauth_device_denied_at.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260624190500_add_oauth_device_denied_at.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,kDAAmD,SAAQ,SAAS;IACtE,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtC"}

package/dist/migrations/sqlite/Migration20260624190500_add_oauth_device_denied_at.js

@@ -0,0 +1,10 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260624190500_add_oauth_device_denied_at extends Migration {
+    up() {
+        this.addSql(`alter table \`oauth_device_code\` add column \`denied_at\` datetime null;`);
+    }
+    down() {
+        this.addSql(`alter table \`oauth_device_code\` drop column \`denied_at\`;`);
+    }
+}
+//# sourceMappingURL=Migration20260624190500_add_oauth_device_denied_at.js.map

package/dist/migrations/sqlite/Migration20260624190500_add_oauth_device_denied_at.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260624190500_add_oauth_device_denied_at.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260624190500_add_oauth_device_denied_at.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,kDAAmD,SAAQ,SAAS;IACtE,EAAE;QACT,IAAI,CAAC,MAAM,CACT,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAEQ,IAAI;QACX,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;IAC9E,CAAC;CACF"}

package/dist/migrations/sqlite/Migration20260624223000_add_oauth_device_poll_state.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260624223000_add_oauth_device_poll_state extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260624223000_add_oauth_device_poll_state.d.ts.map

package/dist/migrations/sqlite/Migration20260624223000_add_oauth_device_poll_state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260624223000_add_oauth_device_poll_state.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260624223000_add_oauth_device_poll_state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,mDAAoD,SAAQ,SAAS;IACvE,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAQtC"}

package/dist/migrations/sqlite/Migration20260624223000_add_oauth_device_poll_state.js

@@ -0,0 +1,12 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260624223000_add_oauth_device_poll_state extends Migration {
+    up() {
+        this.addSql(`alter table \`oauth_device_code\` add column \`last_polled_at\` datetime null;`);
+        this.addSql(`alter table \`oauth_device_code\` add column \`poll_interval_seconds\` integer not null default 5;`);
+    }
+    down() {
+        this.addSql(`alter table \`oauth_device_code\` drop column \`poll_interval_seconds\`;`);
+        this.addSql(`alter table \`oauth_device_code\` drop column \`last_polled_at\`;`);
+    }
+}
+//# sourceMappingURL=Migration20260624223000_add_oauth_device_poll_state.js.map

package/dist/migrations/sqlite/Migration20260624223000_add_oauth_device_poll_state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration20260624223000_add_oauth_device_poll_state.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260624223000_add_oauth_device_poll_state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,mDAAoD,SAAQ,SAAS;IACvE,EAAE;QACT,IAAI,CAAC,MAAM,CACT,gFAAgF,CACjF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAEQ,IAAI;QACX,IAAI,CAAC,MAAM,CACT,0EAA0E,CAC3E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mEAAmE,CACpE,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/sqlite/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAMvF,eAAO,MAAM,iBAAiB,4CAM7B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAQvF,eAAO,MAAM,iBAAiB,4CAQ7B,CAAC"}

package/dist/migrations/sqlite/index.js

@@ -3,11 +3,15 @@ import { Migration20260512120000_add_scheduler_jobs } from './Migration202605121
 import { Migration20260619075330 } from './Migration20260619075330.js';
 import { Migration20260619191600_unique_oauth_client_client_id } from './Migration20260619191600_unique_oauth_client_client_id.js';
 import { Migration20260620025358_add_oauth_client_skip_consent } from './Migration20260620025358_add_oauth_client_skip_consent.js';
+import { Migration20260624190500_add_oauth_device_denied_at } from './Migration20260624190500_add_oauth_device_denied_at.js';
+import { Migration20260624223000_add_oauth_device_poll_state } from './Migration20260624223000_add_oauth_device_poll_state.js';
 export const SQLITE_MIGRATIONS = [
     Migration20260509171226_initial,
     Migration20260512120000_add_scheduler_jobs,
     Migration20260619075330,
     Migration20260619191600_unique_oauth_client_client_id,
     Migration20260620025358_add_oauth_client_skip_consent,
+    Migration20260624190500_add_oauth_device_denied_at,
+    Migration20260624223000_add_oauth_device_poll_state,
 ];
 //# sourceMappingURL=index.js.map

package/dist/migrations/sqlite/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AAEnI,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;CACtD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/sqlite/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AACnI,OAAO,EAAE,kDAAkD,EAAE,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,mDAAmD,EAAE,MAAM,0DAA0D,CAAC;AAE/H,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;IACrD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;CACpD,CAAC"}

package/dist/repositories/oauth-device-code.repository.d.ts

@@ -14,6 +14,10 @@ export declare class OAuthDeviceCodeRepository extends EntityRepository<IOAuthDe
         userSub: string;
         approvedAt: Date;
     }): Promise<IOAuthDeviceCodeEntity | null>;
+    denyPendingByUserCodeHash(params: {
+        userCodeHash: string;
+        deniedAt: Date;
+    }): Promise<IOAuthDeviceCodeEntity | null>;
     findByClientAndDeviceCodeHash(clientId: string, deviceCodeHash: string): Promise<IOAuthDeviceCodeEntity | null>;
     consumeAuthorizedDeviceCode(id: string, consumedAt: Date): Promise<boolean>;
 }

package/dist/repositories/oauth-device-code.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-device-code.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/oauth-device-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEtF,qBAAa,yBAA0B,SAAQ,gBAAgB,CAAC,sBAAsB,CAAC;IAC/E,yBAAyB,CAAC,MAAM,EAAE;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAe7B,yBAAyB,CAC7B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQnC,4BAA4B,CAAC,MAAM,EAAE;QACzC,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAwBpC,6BAA6B,CACjC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQnC,2BAA2B,CAC/B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,IAAI,GACf,OAAO,CAAC,OAAO,CAAC;CAapB"}
+{"version":3,"file":"oauth-device-code.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/oauth-device-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEtF,qBAAa,yBAA0B,SAAQ,gBAAgB,CAAC,sBAAsB,CAAC;IAC/E,yBAAyB,CAAC,MAAM,EAAE;QACtC,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAe7B,yBAAyB,CAC7B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAUnC,4BAA4B,CAAC,MAAM,EAAE;QACzC,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI,CAAC;KAClB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAyBpC,yBAAyB,CAAC,MAAM,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,IAAI,CAAC;KAChB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAwBpC,6BAA6B,CACjC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQnC,2BAA2B,CAC/B,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,IAAI,GACf,OAAO,CAAC,OAAO,CAAC;CAcpB"}

package/dist/repositories/oauth-device-code.repository.js

@@ -18,6 +18,8 @@ export class OAuthDeviceCodeRepository extends EntityRepository {
             userCodeHash,
             consumedAt: null,
             authorizedAt: null,
+            deniedAt: null,
+            expiresAt: { $gt: new Date() },
         });
     }
     async approvePendingByUserCodeHash(params) {
@@ -25,6 +27,7 @@ export class OAuthDeviceCodeRepository extends EntityRepository {
             userCodeHash: params.userCodeHash,
             consumedAt: null,
             authorizedAt: null,
+            deniedAt: null,
             expiresAt: { $gt: params.approvedAt },
         }, {
             authorizedUser: params.userSub,
@@ -35,6 +38,21 @@ export class OAuthDeviceCodeRepository extends EntityRepository {
         }
         return this.findOne({ userCodeHash: params.userCodeHash }, { populate: ['client'] });
     }
+    async denyPendingByUserCodeHash(params) {
+        const updated = await this.nativeUpdate({
+            userCodeHash: params.userCodeHash,
+            consumedAt: null,
+            authorizedAt: null,
+            deniedAt: null,
+            expiresAt: { $gt: params.deniedAt },
+        }, {
+            deniedAt: params.deniedAt,
+        });
+        if (updated !== 1) {
+            return null;
+        }
+        return this.findOne({ userCodeHash: params.userCodeHash }, { populate: ['client'] });
+    }
     async findByClientAndDeviceCodeHash(clientId, deviceCodeHash) {
         return this.findOne({
             client: clientId,
@@ -47,6 +65,7 @@ export class OAuthDeviceCodeRepository extends EntityRepository {
             id,
             consumedAt: null,
             authorizedAt: { $ne: null },
+            deniedAt: null,
             expiresAt: { $gt: consumedAt },
         }, { consumedAt });
         return updated === 1;

package/dist/repositories/oauth-device-code.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-device-code.repository.js","sourceRoot":"","sources":["../../src/repositories/oauth-device-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,MAAM,OAAO,yBAA0B,SAAQ,gBAAwC;IACrF,KAAK,CAAC,yBAAyB,CAAC,MAM/B;QACC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,YAAoB;QAEpB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,YAAY;YACZ,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,MAIlC;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC;YACE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;SACtC,EACD;YACE,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,YAAY,EAAE,MAAM,CAAC,UAAU;SAChC,CACF,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CACjB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACrC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,QAAgB,EAChB,cAAsB;QAEtB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,QAAQ;YAChB,cAAc;YACd,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,EAAU,EACV,UAAgB;QAEhB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC;YACE,EAAE;YACF,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;YAC3B,SAAS,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;SAC/B,EACD,EAAE,UAAU,EAAE,CACf,CAAC;QAEF,OAAO,OAAO,KAAK,CAAC,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"oauth-device-code.repository.js","sourceRoot":"","sources":["../../src/repositories/oauth-device-code.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,MAAM,OAAO,yBAA0B,SAAQ,gBAAwC;IACrF,KAAK,CAAC,yBAAyB,CAAC,MAM/B;QACC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,YAAoB;QAEpB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,YAAY;YACZ,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,MAIlC;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC;YACE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;SACtC,EACD;YACE,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,YAAY,EAAE,MAAM,CAAC,UAAU;SAChC,CACF,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CACjB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACrC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,MAG/B;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC;YACE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE;SACpC,EACD;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CACF,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CACjB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACrC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,QAAgB,EAChB,cAAsB;QAEtB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,QAAQ;YAChB,cAAc;YACd,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,EAAU,EACV,UAAgB;QAEhB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC;YACE,EAAE;YACF,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;SAC/B,EACD,EAAE,UAAU,EAAE,CACf,CAAC;QAEF,OAAO,OAAO,KAAK,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/repositories/user.repository.d.ts

@@ -9,12 +9,14 @@ export declare class UserRepository extends EntityRepository<UserEntity> {
      */
     findBySub(sub: string): Promise<UserEntity>;
     verifyBySub(sub: string): Promise<Loaded<UserEntity, 'password_hash' | 'passkeys' | 'totps', '*', never>>;
+    verifyBySubIncludingDeleted(sub: string): Promise<Loaded<UserEntity, 'password_hash' | 'passkeys' | 'totps', '*', never>>;
+    private verifyBySubWhere;
     findActiveByEmailForPasswordAuth(email: string): Promise<Loaded<UserEntity, 'password_hash' | 'passkeys' | 'totps', '*', never>>;
     /**
-     * Check if email is already registered (excluding deleted users)
+     * Check if email is already registered, including soft-deleted users.
      *
      * @param email - Email address to check
-     * @returns True if email exists and is not deleted, false otherwise
+     * @returns True if email exists, false otherwise
      */
     exists(email: string): Promise<boolean>;
     /**

package/dist/repositories/user.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/user.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAG7D,qBAAa,cAAe,SAAQ,gBAAgB,CAAC,UAAU,CAAC;IAC9D;;;;;OAKG;IACU,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQ3C,WAAW,CACtB,GAAG,EAAE,MAAM,GACV,OAAO,CACR,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,UAAU,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CACvE;IAiBY,gCAAgC,CAC3C,KAAK,EAAE,MAAM,GACZ,OAAO,CACR,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,UAAU,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CACvE;IAiBD;;;;;OAKG;IACU,MAAM,CAAC,KAAK,EAAE,MAAM;IAKjC;;;;;;OAMG;IACU,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE;CAYtE"}
+{"version":3,"file":"user.repository.d.ts","sourceRoot":"","sources":["../../src/repositories/user.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAG7D,qBAAa,cAAe,SAAQ,gBAAgB,CAAC,UAAU,CAAC;IAC9D;;;;;OAKG;IACU,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQ3C,WAAW,CACtB,GAAG,EAAE,MAAM,GACV,OAAO,CACR,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,UAAU,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CACvE;IAIY,2BAA2B,CACtC,GAAG,EAAE,MAAM,GACV,OAAO,CACR,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,UAAU,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CACvE;YAIa,gBAAgB;IAiBjB,gCAAgC,CAC3C,KAAK,EAAE,MAAM,GACZ,OAAO,CACR,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,UAAU,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CACvE;IAiBD;;;;;OAKG;IACU,MAAM,CAAC,KAAK,EAAE,MAAM;IAKjC;;;;;;OAMG;IACU,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE;CAYtE"}

package/dist/repositories/user.repository.js

@@ -8,13 +8,17 @@ export class UserRepository extends EntityRepository {
      * use verifyBySub() or populate the entity yourself.
      */
     async findBySub(sub) {
-        const user = await this.findOneOrFail({ sub }, { failHandler: () => new e.UserNotFound.Error() });
+        const user = await this.findOneOrFail({ sub, deleted_at: null }, { failHandler: () => new e.UserNotFound.Error() });
         return user;
     }
     async verifyBySub(sub) {
-        const user = await this.findOneOrFail({
-            sub: sub,
-        }, {
+        return this.verifyBySubWhere({ sub, deleted_at: null });
+    }
+    async verifyBySubIncludingDeleted(sub) {
+        return this.verifyBySubWhere({ sub });
+    }
+    async verifyBySubWhere(where) {
+        const user = await this.findOneOrFail(where, {
             populate: ['password_hash', 'totps', 'passkeys'],
             populateWhere: {
                 totps: { verified: true },
@@ -38,13 +42,13 @@ export class UserRepository extends EntityRepository {
         });
     }
     /**
-     * Check if email is already registered (excluding deleted users)
+     * Check if email is already registered, including soft-deleted users.
      *
      * @param email - Email address to check
-     * @returns True if email exists and is not deleted, false otherwise
+     * @returns True if email exists, false otherwise
      */
     async exists(email) {
-        const count = await this.count({ email: email, deleted_at: null });
+        const count = await this.count({ email });
         return count > 0;
     }
     /**

package/dist/repositories/user.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.repository.js","sourceRoot":"","sources":["../../src/repositories/user.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,MAAM,OAAO,cAAe,SAAQ,gBAA4B;IAC9D;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAAC,GAAW;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC,EAAE,GAAG,EAAE,EACP,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAClD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,GAAW;QAIX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC;YACE,GAAG,EAAE,GAAG;SACT,EACD;YACE,QAAQ,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC;YAChD,aAAa,EAAE;gBACb,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzB,QAAQ,EAAE,EAAE;aACb;YACD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,gCAAgC,CAC3C,KAAa;QAIb,OAAO,IAAI,CAAC,aAAa,CACvB;YACE,KAAK;YACL,UAAU,EAAE,IAAI;SACjB,EACD;YACE,QAAQ,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC;YAChD,aAAa,EAAE;gBACb,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzB,QAAQ,EAAE,EAAE;aACb;YACD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE;SACxD,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,QAAQ,CAAC,MAA+C;QACnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa,EAAE,MAAM,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"user.repository.js","sourceRoot":"","sources":["../../src/repositories/user.repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AAExC,MAAM,OAAO,cAAe,SAAQ,gBAA4B;IAC9D;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAAC,GAAW;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,EACzB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAClD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,GAAW;QAIX,OAAO,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,2BAA2B,CACtC,GAAW;QAIX,OAAO,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAG9B;QAGC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE;YAC3C,QAAQ,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC;YAChD,aAAa,EAAE;gBACb,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzB,QAAQ,EAAE,EAAE;aACb;YACD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;SAC9C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,gCAAgC,CAC3C,KAAa;QAIb,OAAO,IAAI,CAAC,aAAa,CACvB;YACE,KAAK;YACL,UAAU,EAAE,IAAI;SACjB,EACD;YACE,QAAQ,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC;YAChD,aAAa,EAAE;gBACb,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzB,QAAQ,EAAE,EAAE;aACb;YACD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE;SACxD,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,QAAQ,CAAC,MAA+C;QACnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa,EAAE,MAAM,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/routes/.well-known/openid-configuration/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/.well-known/openid-configuration/get.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAGrD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAO3B,CAAC"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/routes/.well-known/openid-configuration/get.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAGrD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAW3B,CAAC"}

package/dist/routes/.well-known/openid-configuration/get.js

@@ -10,6 +10,10 @@ import { buildOpenidConfiguration } from '#server/routes/oauth/.well-known/openi
 export const openidConfigGet = new Hono().get('/openid-configuration', async (c) => {
     const { config } = c.var.services;
     c.header('Cache-Control', 'public, max-age=3600');
+    if (c.req.header('origin')) {
+        c.res.headers.delete('Access-Control-Allow-Credentials');
+        c.header('Access-Control-Allow-Origin', '*');
+    }
     return c.json(buildOpenidConfiguration(config), 200);
 });
 //# sourceMappingURL=get.js.map

package/dist/routes/.well-known/openid-configuration/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/.well-known/openid-configuration/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AAExG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CACnD,uBAAuB,EACvB,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC,CACF,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/routes/.well-known/openid-configuration/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,8DAA8D,CAAC;AAExG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAU,CAAC,GAAG,CACnD,uBAAuB,EACvB,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC,CACF,CAAC"}