@tstdl/base 0.93.186 → 0.93.188

package/ai/genkit/multi-region.plugin.js

@@ -14,16 +14,19 @@ export function vertexAiMultiLocation(options) {
     }
     const tokenLimitThreshold = options.tokenLimitThreshold ?? defaultTokenLimitThreshold;
     const locationConfigs = options.locations.map((location) => {
-        const circuitBreakerKey = `genkit:vertex-ai:location:${location}`;
-        const tokenLimitCircuitBreakerKey = `${circuitBreakerKey}:token-limit`;
+        const circuitBreakerNamespace = `genkit:vertex-ai:location`;
+        const resource = location;
+        const tokenLimitResource = `${location}:token-limit`;
         return {
             location,
-            circuitBreaker: options.circuitBreakerProvider.provide(circuitBreakerKey, {
+            resource,
+            tokenLimitResource,
+            circuitBreaker: options.circuitBreakerProvider.provide(circuitBreakerNamespace, {
                 threshold: 1,
                 resetTimeout: 30 * millisecondsPerSecond,
                 ...options.circuitBreakerConfig,
             }),
-            tokenLimitCircuitBreaker: options.circuitBreakerProvider.provide(tokenLimitCircuitBreakerKey, {
+            tokenLimitCircuitBreaker: options.circuitBreakerProvider.provide(circuitBreakerNamespace, {
                 threshold: 1,
                 resetTimeout: 15 * millisecondsPerMinute,
                 ...options.tokenLimitCircuitBreakerConfig,
@@ -48,15 +51,15 @@ export function vertexAiMultiLocation(options) {
             let lastError;
             let isLargeRequest = false;
             const skippedLocations = [];
-            for (const { location, circuitBreaker, tokenLimitCircuitBreaker } of shuffledConfigs) {
-                const check = await circuitBreaker.check();
+            for (const { location, resource, tokenLimitResource, circuitBreaker, tokenLimitCircuitBreaker } of shuffledConfigs) {
+                const check = await circuitBreaker.check(resource);
                 if (!check.allowed) {
                     options.logger.warn(`Location ${location} is currently unhealthy. Skipping...`);
                     skippedLocations.push({ location, reason: 'unhealthy' });
                     continue;
                 }
                 if (isLargeRequest) {
-                    const tokenCheck = await tokenLimitCircuitBreaker.check();
+                    const tokenCheck = await tokenLimitCircuitBreaker.check(tokenLimitResource);
                     if (!tokenCheck.allowed) {
                         options.logger.warn(`Location ${location} is known to have a low token limit. Skipping for this large request...`);
                         skippedLocations.push({ location, reason: 'known to have low token limits' });
@@ -73,10 +76,10 @@ export function vertexAiMultiLocation(options) {
                     }, {
                         onChunk: streamingCallback,
                     });
-                    await circuitBreaker.recordSuccess();
+                    await circuitBreaker.recordSuccess(resource);
                     const isLargeSuccess = isLargeRequest || ((result.usage?.inputTokens ?? 0) > tokenLimitThreshold);
                     if (isLargeSuccess) {
-                        await tokenLimitCircuitBreaker.recordSuccess();
+                        await tokenLimitCircuitBreaker.recordSuccess(tokenLimitResource);
                     }
                     return result;
                 }
@@ -93,11 +96,11 @@ export function vertexAiMultiLocation(options) {
                     if (isTokenLimitError) {
                         options.logger.warn(`Location ${location} responded with token limit error. Trying next location...`);
                         isLargeRequest = true;
-                        await tokenLimitCircuitBreaker.recordFailure();
+                        await tokenLimitCircuitBreaker.recordFailure(tokenLimitResource);
                     }
                     else {
                         options.logger.warn(`Location ${location} responded with ${error.status}. Tripping circuit breaker and trying next location...`);
-                        await circuitBreaker.recordFailure();
+                        await circuitBreaker.recordFailure(resource);
                     }
                 }
             }

package/ai/genkit/types.d.ts

@@ -430,7 +430,7 @@ export declare abstract class VertexAiMultiLocationOptions {
     /**
      * Threshold of input tokens after which a request is considered large.
      * A successful request with more tokens than this threshold will record a success for the token limit circuit breaker.
-     * Defaults to 131,072.
+     * Defaults to 131_072.
      */
     tokenLimitThreshold?: number;
 }

package/ai/genkit/types.js

@@ -16,7 +16,7 @@ export class VertexAiMultiLocationOptions {
     /**
      * Threshold of input tokens after which a request is considered large.
      * A successful request with more tokens than this threshold will record a success for the token limit circuit breaker.
-     * Defaults to 131,072.
+     * Defaults to 131_072.
      */
     tokenLimitThreshold;
 }

package/authentication/client/authentication.service.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { Subject, filter, firstValueFrom, from, race, takeUntil, timer } from 'rxjs';
+import { Subject, filter, firstValueFrom, from, race, takeUntil, tap, timer } from 'rxjs';
 import { CancellationSignal } from '../../cancellation/token.js';
 import { BadRequestError } from '../../errors/bad-request.error.js';
 import { ForbiddenError } from '../../errors/forbidden.error.js';
@@ -204,7 +204,7 @@ let AuthenticationClientService = class AuthenticationClientService {
         this.loadToken();
         this.tokenUpdateBus.messages$
             .pipe(takeUntil(this.disposeSignal))
-            .subscribe((token) => this.token.set(token));
+            .subscribe(() => this.loadToken());
         this.refreshLoopPromise ??= this.refreshLoop();
     }
     /** @internal */
@@ -500,33 +500,46 @@ let AuthenticationClientService = class AuthenticationClientService {
         this.tokenUpdateBus.publishAndForget(token);
     }
     async refreshLoop() {
+        this.logger.trace('[refreshLoop] Starting refresh loop...');
         if (this.isLoggedIn()) {
+            this.logger.trace('[refreshLoop] User is logged in, syncing clock...');
             await this.syncClock();
         }
         // Helper to sleep until the delay passes OR a vital state change occurs
-        const waitForNextAction = async (delayMs, referenceExp) => await firstValueFrom(race([
-            timer(Math.max(10, delayMs)),
-            from(this.disposeSignal),
-            this.token$.pipe(filter((t) => t?.exp !== referenceExp)),
-            this.forceRefreshSubject,
-        ]), { defaultValue: undefined });
+        const waitForNextAction = async (delayMs) => {
+            this.logger.trace(`[waitForNextAction] Waiting ${delayMs}ms for next action...`);
+            return await firstValueFrom(race([
+                timer(Math.max(10, delayMs)).pipe(tap(() => this.logger.trace('[waitForNextAction] Timer expired'))),
+                from(this.disposeSignal).pipe(tap(() => this.logger.trace('[waitForNextAction] Dispose signal received'))),
+                this.tokenUpdateBus.allMessages$.pipe(tap(() => this.logger.trace('[waitForNextAction] Token update message received'))),
+                this.forceRefreshSubject.pipe(tap(() => this.logger.trace('[waitForNextAction] Force refresh requested'))),
+            ]), { defaultValue: undefined });
+        };
         while (this.disposeSignal.isUnset) {
             const token = this.token();
             // 1. Wait for login/token if none is present
             if (isUndefined(token)) {
-                await firstValueFrom(race([this.definedToken$, from(this.disposeSignal)]), { defaultValue: undefined });
+                this.logger.trace('[refreshLoop] No token found, waiting for login...');
+                await firstValueFrom(race([
+                    this.definedToken$.pipe(tap(() => this.logger.trace('[refreshLoop] Token became defined'))),
+                    from(this.disposeSignal).pipe(tap(() => this.logger.trace('[refreshLoop] Dispose signal received'))),
+                ]), { defaultValue: undefined });
                 continue;
             }
             try {
                 const now = this.estimatedServerTimestampSeconds();
                 const buffer = calculateRefreshBufferSeconds(token);
                 const needsRefresh = this.forceRefreshRequested() || (now >= token.exp - buffer);
+                this.logger.trace(`[refreshLoop] Checking token refresh status: now=${now}, exp=${token.exp}, buffer=${buffer}, needsRefresh=${needsRefresh}, force=${this.forceRefreshRequested()}`);
                 // 2. Handle token refresh
                 if (needsRefresh) {
+                    this.logger.trace('[refreshLoop] Attempting to acquire refresh lock...');
                     const lockResult = await this.lock.tryUse(undefined, async () => {
+                        this.logger.trace('[refreshLoop] Refresh lock acquired, evaluating if refresh is still needed...');
                         this.loadToken();
                         const currentToken = this.token();
                         if (isUndefined(currentToken)) {
+                            this.logger.trace('[refreshLoop] Token became undefined while waiting for lock, skipping refresh.');
                             return;
                         }
                         // Passive Sync: Verify if refresh is still needed once lock is acquired
@@ -534,15 +547,22 @@ let AuthenticationClientService = class AuthenticationClientService {
                         const currentBuffer = calculateRefreshBufferSeconds(currentToken);
                         const stillNeedsRefresh = this.forceRefreshRequested() || (currentNow >= currentToken.exp - currentBuffer);
                         if (stillNeedsRefresh) {
+                            this.logger.trace('[refreshLoop] Refresh is still needed, performing refresh...');
                             await this.refresh();
                             this.forceRefreshRequested.set(false);
+                            this.logger.trace('[refreshLoop] Refresh completed successfully.');
+                        }
+                        else {
+                            this.logger.trace('[refreshLoop] Token already refreshed by another instance, skipping.');
                         }
                     });
                     // If lock is held by another instance/tab, wait briefly for it to finish (passive sync)
                     if (!lockResult.success) {
-                        await waitForNextAction(5000, token.exp);
+                        this.logger.trace('[refreshLoop] Refresh lock held by another instance, waiting 5000ms for passive sync...');
+                        await waitForNextAction(5000);
                         // If another tab successfully refreshed, the expiration will have changed
                         if (this.token()?.exp !== token.exp) {
+                            this.logger.trace('[refreshLoop] Token refreshed by another instance (expiration changed), clearing force refresh flag.');
                             this.forceRefreshRequested.set(false);
                         }
                     }
@@ -553,26 +573,31 @@ let AuthenticationClientService = class AuthenticationClientService {
                         const newBuffer = calculateRefreshBufferSeconds(newToken);
                         const stillNeedsRefresh = this.forceRefreshRequested() || (newNow >= newToken.exp - newBuffer);
                         if (stillNeedsRefresh) {
-                            this.logger.warn('Token still needs refresh after attempt. Waiting briefly to avoid tight loop.');
-                            await waitForNextAction(refreshLoopTightLoopDelay, newToken.exp);
+                            this.logger.warn('[refreshLoop] Token still needs refresh after attempt. Waiting briefly to avoid tight loop.');
+                            await waitForNextAction(refreshLoopTightLoopDelay);
                         }
                     }
-                    await waitForNextAction(100, newToken?.exp);
+                    this.logger.trace('[refreshLoop] Completing refresh evaluation cycle, waiting 100ms...');
+                    await waitForNextAction(100);
                     continue; // Re-evaluate the loop with the newly refreshed (or synced) token
                 }
                 // 3. Calculate delay and sleep until the next scheduled refresh window
                 const timeUntilRefreshMs = (token.exp - this.estimatedServerTimestampSeconds() - buffer) * millisecondsPerSecond;
                 let delay = clamp(timeUntilRefreshMs, minRefreshDelay, maxRefreshDelay);
                 if (Number.isNaN(delay)) {
+                    this.logger.trace(`[refreshLoop] Calculated delay is NaN, using minRefreshDelay (${minRefreshDelay}ms)`);
                     delay = minRefreshDelay;
                 }
-                await waitForNextAction(delay, token.exp);
+                this.logger.trace(`[refreshLoop] Scheduling next refresh in ${delay}ms...`);
+                await waitForNextAction(delay);
             }
             catch (error) {
                 this.logger.error(error);
-                await waitForNextAction(refreshLoopTightLoopDelay, token.exp);
+                this.logger.trace(`[refreshLoop] Refresh loop encountered error, waiting ${refreshLoopTightLoopDelay}ms before retry...`);
+                await waitForNextAction(refreshLoopTightLoopDelay);
             }
         }
+        this.logger.trace('[refreshLoop] Refresh loop exited (dispose signal set).');
     }
     async handleRefreshError(error) {
         this.logger.error(error);

package/authentication/models/authentication-totp-recovery-code.model.js

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { Table, TenantEntity, TenantReference, TimestampProperty, UuidProperty } from '../../orm/index.js';
+import { Index, Table, TenantEntity, TenantReference, TimestampProperty, UuidProperty } from '../../orm/index.js';
 import { Uint8ArrayProperty } from '../../schema/index.js';
 import { AuthenticationTotp } from './authentication-totp.model.js';
 let AuthenticationTotpRecoveryCode = class AuthenticationTotpRecoveryCode extends TenantEntity {
@@ -29,6 +29,7 @@ __decorate([
     __metadata("design:type", Object)
 ], AuthenticationTotpRecoveryCode.prototype, "usedTimestamp", void 0);
 AuthenticationTotpRecoveryCode = __decorate([
-    Table('totp_recovery_code', { schema: 'authentication' })
+    Table('totp_recovery_code', { schema: 'authentication' }),
+    Index(['tenantId', 'totpId'])
 ], AuthenticationTotpRecoveryCode);
 export { AuthenticationTotpRecoveryCode };

package/authentication/server/authentication.api-controller.d.ts

@@ -99,6 +99,7 @@ export declare class AuthenticationApiController<AdditionalTokenPayload extends
      */
     invalidateAllOtherSessions({ getToken, getAuditor }: ApiRequestContext<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'invalidateAllOtherSessions'>): Promise<ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'invalidateAllOtherSessions'>>;
     protected enforceRateLimit(ip: string, subjectResource: string, auditor: Auditor, targetId: string, action: string): Promise<void>;
+    protected refundRateLimit(ip: string, subjectResource: string): Promise<void>;
     protected getTokenResponse<T>(result: TokenResult<AdditionalTokenPayload>, body: NoInfer<T>): HttpServerResponse;
     protected getLoginResponse(result: LoginResult<AdditionalTokenPayload>): ApiServerResult<AuthenticationApiDefinition<AdditionalTokenPayload, AuthenticationData, AdditionalInitPasswordResetData>, 'login'>;
 }

package/authentication/server/authentication.api-controller.js

@@ -35,12 +35,12 @@ let AuthenticationApiController = AuthenticationApiController_1 = class Authenti
     authenticationService = inject((AuthenticationService));
     options = inject(AuthenticationServiceOptions, undefined, { optional: true }) ?? {};
     subjectRateLimiter = inject(RateLimiter, {
-        resource: 'authentication:subject',
+        namespace: 'authentication:subject',
         burstCapacity: this.options.bruteForceProtection?.subjectBurstCapacity ?? 10,
         refillInterval: this.options.bruteForceProtection?.subjectRefillInterval ?? (30 * millisecondsPerMinute),
     });
     ipRateLimiter = inject(RateLimiter, {
-        resource: 'authentication:ip',
+        namespace: 'authentication:ip',
         burstCapacity: this.options.bruteForceProtection?.ipBurstCapacity ?? 20,
         refillInterval: this.options.bruteForceProtection?.ipRefillInterval ?? (5 * millisecondsPerMinute),
     });
@@ -154,6 +154,7 @@ let AuthenticationApiController = AuthenticationApiController_1 = class Authenti
         const subjectResource = `${validatedToken.payload.tenant}:${validatedToken.payload.subject}`;
         await this.enforceRateLimit(request.ip, subjectResource, auditor, validatedToken.payload.subject, 'refresh');
         const result = await this.authenticationService.refreshAlreadyValidatedToken(validatedToken, parameters.data, undefined, auditor);
+        await this.refundRateLimit(request.ip, subjectResource);
         return this.getTokenResponse(result, result.jsonToken.payload);
     }
     /**
@@ -332,6 +333,12 @@ let AuthenticationApiController = AuthenticationApiController_1 = class Authenti
             throw new TooManyRequestsError();
         }
     }
+    async refundRateLimit(ip, subjectResource) {
+        await Promise.all([
+            this.ipRateLimiter.refund(ip),
+            this.subjectRateLimiter.refund(subjectResource),
+        ]);
+    }
     getTokenResponse(result, body) {
         const { token, jsonToken, refreshToken, remember, omitImpersonatorRefreshToken, impersonatorRefreshToken, impersonatorRefreshTokenExpiration } = result;
         const options = {

package/authentication/server/authentication.service.js

@@ -294,14 +294,15 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         const authAuditor = auditor.fork(AuthenticationService_1.name);
         await this.#endSession(sessionId, authAuditor);
     }
-    async #endSession(sessionId, authAuditor) {
-        const session = await this.#sessionRepository.tryLoad(sessionId);
+    async #endSession(sessionId, authAuditor, tx) {
+        const sessionRepository = this.#sessionRepository.withOptionalTransaction(tx);
+        const session = await sessionRepository.tryLoad(sessionId);
         if (isUndefined(session)) {
             this.#logger.warn(`Session "${sessionId}" not found for logout.`);
             return;
         }
         const now = currentTimestamp();
-        await this.#sessionRepository.update(sessionId, { end: now });
+        await sessionRepository.update(sessionId, { end: now });
         await authAuditor.info('logout', {
             tenantId: session.tenantId,
             actor: session.subjectId,
@@ -411,53 +412,55 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         let session;
         try {
             const sessionId = validatedRefreshToken.payload.session;
-            session = await this.#sessionRepository.load(sessionId);
-            const hash = await this.getHash(validatedRefreshToken.payload.secret, session.refreshTokenSalt);
-            if (session.end <= currentTimestamp()) {
-                throw new InvalidTokenError('Session is expired.');
-            }
-            if (!timingSafeBinaryEquals(hash, session.refreshTokenHash)) {
-                await this.#endSession(sessionId, authAuditor);
-                await authAuditor.warn('refresh-failure', {
-                    actorType: ActorType.Anonymous,
+            return await this.#sessionRepository.transaction(async (tx) => {
+                session = await this.#sessionRepository.withTransaction(tx).load(sessionId);
+                const hash = await this.getHash(validatedRefreshToken.payload.secret, session.refreshTokenSalt);
+                if (session.end <= currentTimestamp()) {
+                    throw new InvalidTokenError('Session is expired.');
+                }
+                if (!timingSafeBinaryEquals(hash, session.refreshTokenHash)) {
+                    await this.#endSession(sessionId, authAuditor, tx);
+                    await authAuditor.warn('refresh-failure', {
+                        actorType: ActorType.Anonymous,
+                        tenantId: session.tenantId,
+                        targetId: session.subjectId,
+                        targetType: 'Subject',
+                        details: { sessionId, reason: 'Token reuse detected. Session revoked.' },
+                    });
+                    throw new InvalidTokenError('Invalid refresh token.');
+                }
+                const now = currentTimestamp();
+                const impersonator = (options.omitImpersonator == true) ? undefined : validatedRefreshToken.payload.impersonator;
+                const remember = validatedRefreshToken.payload.remember;
+                const ttl = remember ? this.rememberRefreshTokenTimeToLive : this.refreshTokenTimeToLive;
+                const newEnd = now + ttl;
+                const subject = await this.#subjectRepository.loadByQuery({ tenantId: session.tenantId, id: session.subjectId });
+                this.ensureNotSuspended(subject);
+                const tokenPayload = await this.#authenticationAncillaryService?.getTokenPayload(subject, authenticationData, { action: GetTokenPayloadContextAction.Refresh });
+                const { token, jsonToken } = await this.createToken({ additionalTokenPayload: tokenPayload, subject, sessionId, refreshTokenExpiration: newEnd, impersonator, timestamp: now });
+                const newRefreshToken = await this.createRefreshToken(subject, sessionId, newEnd, { impersonator, remember });
+                await this.#sessionRepository.withTransaction(tx).update(sessionId, {
+                    end: newEnd,
+                    refreshTokenSalt: newRefreshToken.salt,
+                    refreshTokenHash: newRefreshToken.hash,
+                });
+                await authAuditor.info('refresh-success', {
                     tenantId: session.tenantId,
+                    actor: session.subjectId,
+                    actorType: ActorType.Subject,
                     targetId: session.subjectId,
                     targetType: 'Subject',
-                    details: { sessionId, reason: 'Token reuse detected. Session revoked.' },
+                    details: { sessionId, remember },
                 });
-                throw new InvalidTokenError('Invalid refresh token.');
-            }
-            const now = currentTimestamp();
-            const impersonator = (options.omitImpersonator == true) ? undefined : validatedRefreshToken.payload.impersonator;
-            const remember = validatedRefreshToken.payload.remember;
-            const ttl = remember ? this.rememberRefreshTokenTimeToLive : this.refreshTokenTimeToLive;
-            const newEnd = now + ttl;
-            const subject = await this.#subjectRepository.loadByQuery({ tenantId: session.tenantId, id: session.subjectId });
-            this.ensureNotSuspended(subject);
-            const tokenPayload = await this.#authenticationAncillaryService?.getTokenPayload(subject, authenticationData, { action: GetTokenPayloadContextAction.Refresh });
-            const { token, jsonToken } = await this.createToken({ additionalTokenPayload: tokenPayload, subject, sessionId, refreshTokenExpiration: newEnd, impersonator, timestamp: now });
-            const newRefreshToken = await this.createRefreshToken(subject, sessionId, newEnd, { impersonator, remember });
-            await this.#sessionRepository.update(sessionId, {
-                end: newEnd,
-                refreshTokenSalt: newRefreshToken.salt,
-                refreshTokenHash: newRefreshToken.hash,
-            });
-            await authAuditor.info('refresh-success', {
-                tenantId: session.tenantId,
-                actor: session.subjectId,
-                actorType: ActorType.Subject,
-                targetId: session.subjectId,
-                targetType: 'Subject',
-                details: { sessionId, remember },
+                return { token, jsonToken, refreshToken: newRefreshToken.token, remember, omitImpersonatorRefreshToken: options.omitImpersonator };
             });
-            return { token, jsonToken, refreshToken: newRefreshToken.token, remember, omitImpersonatorRefreshToken: options.omitImpersonator };
         }
         catch (error) {
             await authAuditor.warn('refresh-failure', {
                 actorType: ActorType.Anonymous,
                 targetId: session?.subjectId ?? NIL_UUID,
                 targetType: 'Subject',
-                details: { sessionId: null, reason: error.message },
+                details: { sessionId: session?.id ?? null, reason: error.message },
             });
             throw error;
         }
@@ -995,7 +998,7 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         }));
         await this.#totpRepository.transaction(async (transaction) => {
             const totpRecoveryCodeRepository = this.#totpRecoveryCodeRepository.withTransaction(transaction);
-            await totpRecoveryCodeRepository.deleteByQuery({ tenantId, totpId: totp.id });
+            await totpRecoveryCodeRepository.hardDeleteManyByQuery({ tenantId, totpId: totp.id });
             await totpRecoveryCodeRepository.insertMany(hashedRecoveryCodes);
             if (options?.invalidateOtherSessions == true) {
                 await this.#invalidateAllOtherSessions(tenantId, subjectId, NIL_UUID, authAuditor);
@@ -1028,7 +1031,10 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
             });
             throw new ForbiddenError('Invalid TOTP token');
         }
-        await this.#totpRepository.deleteByQuery({ tenantId, id: totp.id });
+        await this.#totpRepository.transaction(async (tx) => {
+            await this.#totpRecoveryCodeRepository.withTransaction(tx).hardDeleteManyByQuery({ tenantId, totpId: totp.id });
+            await this.#totpRepository.withTransaction(tx).hardDeleteByQuery({ tenantId, id: totp.id });
+        });
         await authAuditor.info('totp-disable-success', {
             tenantId,
             actor: subjectId,
@@ -1054,7 +1060,10 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
             });
             throw new ForbiddenError('Invalid recovery code');
         }
-        await this.#totpRepository.deleteByQuery({ tenantId, id: totp.id });
+        await this.#totpRepository.transaction(async (tx) => {
+            await this.#totpRecoveryCodeRepository.withTransaction(tx).hardDeleteManyByQuery({ tenantId, totpId: totp.id });
+            await this.#totpRepository.withTransaction(tx).hardDeleteByQuery({ tenantId, id: totp.id });
+        });
         await authAuditor.info('totp-disable-success', {
             tenantId,
             actor: subjectId,
@@ -1075,58 +1084,63 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         const challengeToken = await this.validateTotpChallengeToken(challengeTokenString);
         const { tenant, subject: subjectId, remember, data } = challengeToken.payload;
         const totp = await this.#totpRepository.loadByQuery({ tenantId: tenant, subjectId });
-        const isRecoveryCodeValid = await this.verifyAndUseRecoveryCode(totp, recoveryCode);
-        if (!isRecoveryCodeValid) {
-            await authAuditor.warn('recovery-login-failure', {
-                actorType: ActorType.Anonymous,
-                tenantId: tenant,
-                targetId: subjectId,
-                targetType: 'Subject',
-                details: {
-                    subjectInput: { tenantId: tenant, subject: subjectId },
-                    resolvedSubjectId: subjectId,
-                },
-            });
-            throw new ForbiddenError('Invalid recovery code');
-        }
-        const subject = await this.#subjectRepository.loadByQuery({ tenantId: tenant, id: subjectId });
-        const loginResult = await this.#loginAlreadyValidatedSubject(subject, data, authAuditor, remember);
-        const unusedRecoveryCodesCount = await this.#totpRecoveryCodeRepository.countByQuery({ tenantId: tenant, totpId: totp.id, usedTimestamp: null });
+        const result = await this.#totpRepository.transaction(async (tx) => {
+            const isRecoveryCodeValid = await this.verifyAndUseRecoveryCode(totp, recoveryCode, tx);
+            if (!isRecoveryCodeValid) {
+                await authAuditor.warn('recovery-login-failure', {
+                    actorType: ActorType.Anonymous,
+                    tenantId: tenant,
+                    targetId: subjectId,
+                    targetType: 'Subject',
+                    details: {
+                        subjectInput: { tenantId: tenant, subject: subjectId },
+                        resolvedSubjectId: subjectId,
+                    },
+                });
+                throw new ForbiddenError('Invalid recovery code');
+            }
+            const subject = await this.#subjectRepository.loadByQuery({ tenantId: tenant, id: subjectId });
+            const loginResult = await this.#loginAlreadyValidatedSubject(subject, data, authAuditor, remember);
+            const unusedRecoveryCodesCount = await this.#totpRecoveryCodeRepository.withTransaction(tx).countByQuery({ tenantId: tenant, totpId: totp.id, usedTimestamp: null });
+            return { loginResult, unusedRecoveryCodesCount };
+        });
         await authAuditor.info('recovery-login-success', {
             tenantId: tenant,
             actor: subjectId,
             actorType: ActorType.Subject,
             targetId: subjectId,
             targetType: 'Subject',
-            network: { sessionId: loginResult.result.jsonToken.payload.session },
+            network: { sessionId: result.loginResult.result.jsonToken.payload.session },
             details: {
-                sessionId: loginResult.result.jsonToken.payload.session,
+                sessionId: result.loginResult.result.jsonToken.payload.session,
                 remember,
             },
         });
         return {
-            ...loginResult,
-            lowRecoveryCodesWarning: unusedRecoveryCodesCount <= 3,
+            ...result.loginResult,
+            lowRecoveryCodesWarning: result.unusedRecoveryCodesCount <= 3,
         };
     }
     async #loginVerifyTotp(challengeTokenString, token, authAuditor) {
         const challengeToken = await this.validateTotpChallengeToken(challengeTokenString);
         const { tenant, subject: subjectId, remember, data } = challengeToken.payload;
-        const totp = await this.#totpRepository.loadByQuery({ tenantId: tenant, subjectId });
-        const isValid = await this.verifyAndRecordTotpToken(totp, token, authAuditor);
-        if (!isValid) {
-            await authAuditor.warn('totp-verify-failure', {
-                tenantId: tenant,
-                actor: subjectId,
-                actorType: ActorType.Subject,
-                targetId: subjectId,
-                targetType: 'Subject',
-                details: { reason: 'Invalid token' },
-            });
-            throw new ForbiddenError('Invalid TOTP token');
-        }
-        const subject = await this.#subjectRepository.loadByQuery({ tenantId: tenant, id: subjectId });
-        return await this.#loginAlreadyValidatedSubject(subject, data, authAuditor, remember);
+        return await this.#totpRepository.transaction(async (tx) => {
+            const totp = await this.#totpRepository.withTransaction(tx).loadByQuery({ tenantId: tenant, subjectId });
+            const isValid = await this.verifyAndRecordTotpToken(totp, token, authAuditor, tx);
+            if (!isValid) {
+                await authAuditor.warn('totp-verify-failure', {
+                    tenantId: tenant,
+                    actor: subjectId,
+                    actorType: ActorType.Subject,
+                    targetId: subjectId,
+                    targetType: 'Subject',
+                    details: { reason: 'Invalid token' },
+                });
+                throw new ForbiddenError('Invalid TOTP token');
+            }
+            const subject = await this.#subjectRepository.loadByQuery({ tenantId: tenant, id: subjectId });
+            return await this.#loginAlreadyValidatedSubject(subject, data, authAuditor, remember);
+        });
     }
     async validateTotpChallengeToken(tokenString) {
         const validatedToken = await parseAndValidateJwtTokenString(tokenString, 'KMAC256', await this.#totpChallengeSigningKey.getKey());
@@ -1155,26 +1169,29 @@ let AuthenticationService = AuthenticationService_1 = class AuthenticationServic
         };
         return await createJwtTokenString(jsonToken, await this.#totpChallengeSigningKey.getKey());
     }
-    async verifyAndUseRecoveryCode(totp, code) {
-        const recoveryCodes = await this.#totpRecoveryCodeRepository.loadManyByQuery({ tenantId: totp.tenantId, totpId: totp.id, usedTimestamp: null });
-        const hashingOptions = this.#getTotpRecoveryCodeHashingOptions(totp.recoveryCodeSalt);
-        const hash = await hashTotpRecoveryCode(code, hashingOptions);
-        for (const recoveryCode of recoveryCodes) {
-            const isValid = await verifyTotpRecoveryCode(hash, recoveryCode.code, hashingOptions);
-            if (isValid) {
-                await this.#totpRecoveryCodeRepository.updateByQuery({ tenantId: recoveryCode.tenantId, id: recoveryCode.id }, { usedTimestamp: TRANSACTION_TIMESTAMP });
-                return true;
+    async verifyAndUseRecoveryCode(totp, code, tx) {
+        return await this.#totpRecoveryCodeRepository.useTransaction(tx, async (tx) => {
+            const totpRecoveryCodeRepository = this.#totpRecoveryCodeRepository.withTransaction(tx);
+            const recoveryCodes = await totpRecoveryCodeRepository.loadManyByQuery({ tenantId: totp.tenantId, totpId: totp.id, usedTimestamp: null });
+            const hashingOptions = this.#getTotpRecoveryCodeHashingOptions(totp.recoveryCodeSalt);
+            const hash = await hashTotpRecoveryCode(code, hashingOptions);
+            for (const recoveryCode of recoveryCodes) {
+                const isValid = await verifyTotpRecoveryCode(hash, recoveryCode.code, hashingOptions);
+                if (isValid) {
+                    await totpRecoveryCodeRepository.updateByQuery({ tenantId: recoveryCode.tenantId, id: recoveryCode.id, usedTimestamp: null }, { usedTimestamp: TRANSACTION_TIMESTAMP });
+                    return true;
+                }
             }
-        }
-        return false;
+            return false;
+        });
     }
-    async verifyAndRecordTotpToken(totp, token, authAuditor) {
+    async verifyAndRecordTotpToken(totp, token, authAuditor, tx) {
         const secret = await importHmacKey('raw-secret', this.totpOptions.codeHashAlgorithm, totp.secret, false);
         const isValid = await verifyTotpToken(secret, token, this.#getTotpOptions(totp.recoveryCodeSalt));
         if (!isValid) {
             return false;
         }
-        const inserted = await this.#usedTotpTokenRepository.tryInsert({
+        const inserted = await this.#usedTotpTokenRepository.withOptionalTransaction(tx).tryInsert({
             tenantId: totp.tenantId,
             subjectId: totp.subjectId,
             token,

package/authentication/server/drizzle/{0000_odd_echo.sql → 0000_dry_stepford_cuckoos.sql}

@@ -140,4 +140,5 @@ ALTER TABLE "authentication"."used_totp_tokens" ADD CONSTRAINT "used_totp_tokens
 ALTER TABLE "authentication"."service_account" ADD CONSTRAINT "service_account_tenantId_type_id_subject_fkey" FOREIGN KEY ("tenant_id","type","id") REFERENCES "authentication"."subject"("tenant_id","type","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "authentication"."service_account" ADD CONSTRAINT "service_account_id_subject_fkey" FOREIGN KEY ("tenant_id","parent") REFERENCES "authentication"."subject"("tenant_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "authentication"."system_account" ADD CONSTRAINT "system_account_tenantId_type_id_subject_fkey" FOREIGN KEY ("tenant_id","type","id") REFERENCES "authentication"."subject"("tenant_id","type","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "authentication"."user" ADD CONSTRAINT "user_tenantId_type_id_subject_fkey" FOREIGN KEY ("tenant_id","type","id") REFERENCES "authentication"."subject"("tenant_id","type","id") ON DELETE cascade ON UPDATE no action;
+ALTER TABLE "authentication"."user" ADD CONSTRAINT "user_tenantId_type_id_subject_fkey" FOREIGN KEY ("tenant_id","type","id") REFERENCES "authentication"."subject"("tenant_id","type","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "totp_recovery_code_tenant_id_totp_id_idx" ON "authentication"."totp_recovery_code" USING btree ("tenant_id","totp_id");

package/authentication/server/drizzle/meta/0000_snapshot.json

@@ -1,5 +1,5 @@
 {
-  "id": "98e3b751-2fd9-4c4a-a432-c397baa359c0",
+  "id": "06619eff-dfa3-4a91-b5f4-c3cfe7a78951",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "version": "7",
   "dialect": "postgresql",
@@ -408,7 +408,29 @@
           "default": "'{}'::jsonb"
         }
       },
-      "indexes": {},
+      "indexes": {
+        "totp_recovery_code_tenant_id_totp_id_idx": {
+          "name": "totp_recovery_code_tenant_id_totp_id_idx",
+          "columns": [
+            {
+              "expression": "tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "totp_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
       "foreignKeys": {
         "totp_recovery_code_id_totp_fkey": {
           "name": "totp_recovery_code_id_totp_fkey",