@voltro/plugin-auth 0.85.0 → 0.87.0

package/dist/handlers.js

@@ -0,0 +1,337 @@
+import { hashPassword as e, verifyPassword as t, verifyPasswordWithRehash as n } from "./password.js";
+import { SESSION_COOKIE_NAME as r, clearSessionCookie as i, issueSession as a, resolveSessionSecret as o, resolveSessionSecrets as s, sessionSecretsOf as c } from "./session.js";
+import { newAuthId as l, subjectFromUser as u } from "./userStore.js";
+import { CSRF_COOKIE_NAME as d, issueCsrfToken as f } from "./csrf.js";
+import { decideAdmission as p } from "./admission.js";
+import { generateRecoveryCodes as m, generateTotpSecret as h, otpauthUrl as g, verifyTotpCode as _ } from "./totp.js";
+import { MFA_PENDING_TTL_S as v, hashToken as y, mintToken as b } from "./tokens.js";
+import { runSubjectGuards as x } from "./subjectGuard.js";
+import { EMAIL_VERIFIED_METADATA_KEY as S, emailVerificationActive as C, sendEmailVerification as w, userEmailVerified as T } from "./emailVerification.js";
+import { Effect as E } from "effect";
+import { buildSetCookie as D } from "@voltro/protocol/session";
+import { writeTenantSelection as O } from "@voltro/database";
+import { selectSubjectTenant as k } from "@voltro/protocol";
+//#region src/handlers.ts
+var A = 5, j = 900, M = 900, N = (e) => e.email ?? `user:${e.id}`, P = (e) => ({
+	maxAttempts: e.lockout?.maxAttempts ?? A,
+	windowMs: (e.lockout?.windowSeconds ?? j) * 1e3,
+	lockMs: (e.lockout?.lockSeconds ?? M) * 1e3
+}), F = (e) => e.secrets ?? (e.secret === void 0 ? s() : c(e.secret)), I = (e) => e.secret ?? o(), L = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), R = (e, t = {}) => ({
+	status: 302,
+	body: "",
+	contentType: "text/plain",
+	location: e,
+	...t
+}), z = 604800, B = (e, t) => e.type === "user" ? {
+	...e,
+	metadata: {
+		...e.metadata ?? {},
+		sessionId: t
+	}
+} : e, V = (e, t, n, r = {}) => E.gen(function* () {
+	r.clearLoginFailures !== !1 && (yield* t.clearLoginFailures(N(e))), n.ensureActor && (yield* n.ensureActor(e));
+	let i = yield* t.listMemberships(e.id), o = r.sessionId ?? l("sess"), s = r.ttlSeconds ?? z;
+	r.sessionRow !== "existing" && (yield* t.insertSession({
+		id: o,
+		userId: e.id,
+		tenantId: e.tenantId,
+		expiresAt: new Date(Date.now() + s * 1e3),
+		ipAddress: r.ipAddress ?? null,
+		userAgent: r.userAgent ?? null
+	}).pipe(E.ignore));
+	let c = { ...r.metadata };
+	C(n.emailVerification) && (c[S] = T(e, n.emailVerification));
+	let d = B(u(e, {
+		memberships: i,
+		...Object.keys(c).length > 0 ? { metadata: c } : {}
+	}), o), f = a(d, F(n), {
+		ttlSeconds: s,
+		...n.cookieDomain ? { domain: n.cookieDomain } : {},
+		secure: n.cookieSecure ?? !0
+	});
+	return {
+		setCookie: f.setCookie,
+		value: f.value,
+		expiresAt: Math.floor(Date.now() / 1e3) + s,
+		subject: d
+	};
+}), H = (e, t) => E.gen(function* () {
+	let n = t.subjectGuards ?? [];
+	if (n.length === 0) return null;
+	let r = yield* x(n, e);
+	return r.ok ? null : L(403, {
+		error: r.code,
+		message: r.message
+	});
+}), U = (r, i, a) => E.gen(function* () {
+	if (!r.email || !r.password) return L(400, { error: "email and password required" });
+	let o = yield* i.findByEmail(r.email), s = (a.now ?? Date.now)(), c = yield* i.isLockedOut(r.email, s);
+	if (c.locked) return L(429, {
+		error: "account_locked",
+		retryAfterSeconds: c.retryAfterSeconds
+	});
+	let u = o?.passwordHash, d = typeof u == "string" && u.length > 0 ? yield* n(r.password, u) : yield* E.gen(function* () {
+		let n = yield* e("decoy-not-a-real-password").pipe(E.orElseSucceed(() => ""));
+		return yield* t(r.password, n), { valid: !1 };
+	});
+	if (!o || !d.valid) return yield* i.recordLoginFailure(r.email, s, P(a)), L(401, { error: "invalid credentials" });
+	let f = yield* H(o, a);
+	if (f) return f;
+	if (d.rehash && (yield* i.updatePassword(o.id, d.rehash).pipe(E.ignore)), o.mfaEnrolledAt) {
+		let e = b("mfa-pending", 300);
+		return yield* i.insertToken({
+			id: l("tok"),
+			tokenHash: e.tokenHash,
+			userId: o.id,
+			purpose: "mfa-pending",
+			expiresAt: e.expiresAt
+		}).pipe(E.ignore), L(200, {
+			ok: !0,
+			mfaRequired: !0,
+			pendingToken: e.token,
+			expiresInSeconds: 300
+		});
+	}
+	let { setCookie: p, subject: m } = yield* V(o, i, a, {
+		ipAddress: r.ipAddress ?? null,
+		userAgent: r.userAgent ?? null
+	});
+	return r.redirectAfter ? R(a.successRedirect ?? "/", { setCookie: p }) : L(200, {
+		ok: !0,
+		subject: m
+	}, { setCookie: p });
+}), W = (e, t, n) => E.gen(function* () {
+	if (!e.pendingToken) return L(400, { error: "pending token required" });
+	if (!e.code && !e.recoveryCode) return L(400, { error: "code or recoveryCode required" });
+	let r = yield* t.consumeToken(y(e.pendingToken), "mfa-pending");
+	if (!r) return L(401, { error: "invalid or expired challenge" });
+	let i = yield* t.findById(r.userId);
+	if (!i || !i.mfaEnrolledAt || !i.mfaSecret) return L(401, { error: "mfa not enrolled" });
+	let a = (n.now ?? Date.now)(), o = yield* t.isLockedOut(N(i), a);
+	if (o.locked) return L(429, {
+		error: "account_locked",
+		retryAfterSeconds: o.retryAfterSeconds
+	});
+	let s = yield* H(i, n);
+	if (s) return s;
+	if (!(e.recoveryCode ? yield* t.consumeRecoveryCode(i.id, y(e.recoveryCode.trim())) : yield* _(i.mfaSecret, e.code ?? "").pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return yield* t.recordLoginFailure(N(i), a, P(n)), L(401, { error: "invalid_code" });
+	let { setCookie: c, subject: l } = yield* V(i, t, n, {
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	});
+	return e.redirectAfter ? R(n.successRedirect ?? "/", { setCookie: c }) : L(200, {
+		ok: !0,
+		subject: l
+	}, { setCookie: c });
+}), G = (t, n, r) => E.gen(function* () {
+	if (!t.email || !t.password) return L(400, { error: "email and password required" });
+	if (t.password.length < 8) return L(400, { error: "password must be at least 8 characters" });
+	if (yield* n.findByEmail(t.email)) return L(409, { error: "email already registered" });
+	let i = t.tenantId ?? r.defaultTenantId, a = yield* p(r.admit, {
+		email: t.email,
+		tenantId: i,
+		via: "sign-up"
+	});
+	if (a) return L(403, {
+		error: "not_admitted",
+		reason: a.reason,
+		message: a.message
+	});
+	let o = yield* e(t.password), s = yield* n.insert({
+		id: l("user"),
+		email: t.email,
+		passwordHash: o,
+		tenantId: i
+	});
+	yield* n.addMembership({
+		userId: s.id,
+		tenantId: i,
+		role: "owner"
+	}).pipe(E.ignore), C(r.emailVerification) && (r.emailVerification?.sendOnSignUp ?? !0) && (yield* w(s, n, r).pipe(E.ignore));
+	let { setCookie: c, subject: u } = yield* V(s, n, r);
+	return t.redirectAfter ? R(r.successRedirect ?? "/", { setCookie: c }) : L(200, {
+		ok: !0,
+		subject: u
+	}, { setCookie: c });
+}).pipe(E.catch((e) => E.succeed(L(500, {
+	error: "signup_failed",
+	cause: String(e)
+})))), K = (e) => ({
+	status: 302,
+	body: "",
+	location: e.successRedirect ?? "/",
+	setCookie: i({
+		...e.cookieDomain ? { domain: e.cookieDomain } : {},
+		secure: e.cookieSecure ?? !0
+	})
+}), q = (e, t) => E.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return L(404, { error: "user_not_found" });
+	let r = h();
+	return yield* t.setMfaSecret(n.id, r).pipe(E.catch(() => E.succeed(n))), L(200, {
+		ok: !0,
+		secret: r,
+		otpauthUrl: g({
+			issuer: e.issuer,
+			accountName: e.accountName,
+			secret: r
+		})
+	});
+}), J = (e, t) => E.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return L(404, { error: "user_not_found" });
+	if (!n.mfaSecret) return L(400, { error: "no_enrollment_in_progress" });
+	if (n.mfaEnrolledAt) return L(409, { error: "already_enrolled" });
+	if (!(yield* _(n.mfaSecret, e.code).pipe(E.map(() => !0), E.catchTag("TotpVerifyError", () => E.succeed(!1))))) return L(401, { error: "invalid_code" });
+	yield* t.markMfaEnrolled(n.id).pipe(E.catch(() => E.succeed(n)));
+	let r = m();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => y(e))).pipe(E.ignore), L(200, {
+		ok: !0,
+		enrolled: !0,
+		recoveryCodes: r
+	});
+}), Y = (e, t) => E.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	if (!n) return L(404, { error: "user_not_found" });
+	if (!n.mfaEnrolledAt) return L(400, { error: "mfa_not_enrolled" });
+	let r = m();
+	return yield* t.replaceRecoveryCodes(n.id, r.map((e) => y(e))).pipe(E.ignore), L(200, {
+		ok: !0,
+		recoveryCodes: r
+	});
+}), X = (e, t) => E.gen(function* () {
+	let n = yield* t.findById(e.userId);
+	return n ? (yield* t.clearMfa(n.id).pipe(E.catch(() => E.succeed(n))), yield* t.replaceRecoveryCodes(n.id, []).pipe(E.ignore), L(200, {
+		ok: !0,
+		enrolled: !1
+	})) : L(404, { error: "user_not_found" });
+}), Z = (e) => {
+	let t = f(I(e)), n = D(d, t, {
+		httpOnly: !1,
+		sameSite: "lax",
+		secure: e.cookieSecure ?? !0,
+		...e.cookieDomain ? { domain: e.cookieDomain } : {},
+		path: "/"
+	});
+	return L(200, { csrfToken: t }, { setCookie: n });
+}, Q = (e, t, n) => `${e}${t}${t.includes("?") ? "&" : "?"}token=${encodeURIComponent(n)}`, $ = (e, t, n) => E.gen(function* () {
+	if (!e.email) return L(400, { error: "email required" });
+	let r = yield* t.findByEmail(e.email);
+	if (r) {
+		let i = b("magic-link");
+		yield* t.insertToken({
+			id: l("tok"),
+			tokenHash: i.tokenHash,
+			userId: r.id,
+			purpose: "magic-link",
+			expiresAt: i.expiresAt
+		}).pipe(E.ignore);
+		let a = Q(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/magic-link/callback", i.token);
+		n.sendEmail && (yield* E.tryPromise(() => n.sendEmail({
+			to: r.email ?? e.email,
+			kind: "magic-link",
+			actionUrl: a,
+			subject: "Your sign-in link",
+			text: `Sign in: ${a}`,
+			html: `<p><a href="${a}">Sign in</a> — this link expires shortly.</p>`
+		})).pipe(E.ignore));
+	}
+	return L(202, { ok: !0 });
+}), ee = (e, t, n) => E.gen(function* () {
+	if (!e.token) return L(400, { error: "token required" });
+	let r = yield* t.consumeToken(y(e.token), "magic-link");
+	if (!r) return L(401, { error: "invalid or expired token" });
+	let i = yield* t.findById(r.userId);
+	if (!i) return L(401, { error: "invalid or expired token" });
+	let a = yield* t.markEmailVerified(i.id).pipe(E.orElseSucceed(() => i)), o = yield* H(a, n);
+	if (o) return o;
+	let { setCookie: s, subject: c } = yield* V(a, t, n);
+	return e.redirectAfter ? R(n.successRedirect ?? "/", { setCookie: s }) : L(200, {
+		ok: !0,
+		subject: c
+	}, { setCookie: s });
+}), te = (e, t, n) => E.gen(function* () {
+	if (!e.email) return L(400, { error: "email required" });
+	let r = yield* t.findByEmail(e.email);
+	if (r) {
+		let i = b("password-reset");
+		yield* t.insertToken({
+			id: l("tok"),
+			tokenHash: i.tokenHash,
+			userId: r.id,
+			purpose: "password-reset",
+			expiresAt: i.expiresAt
+		}).pipe(E.ignore);
+		let a = Q(n.appBaseUrl ?? "", e.callbackPath ?? "/auth/password-reset/callback", i.token);
+		n.sendEmail && (yield* E.tryPromise(() => n.sendEmail({
+			to: r.email ?? e.email,
+			kind: "password-reset",
+			actionUrl: a,
+			subject: "Reset your password",
+			text: `Reset your password: ${a}`,
+			html: `<p><a href="${a}">Reset your password</a> — this link expires shortly.</p>`
+		})).pipe(E.ignore));
+	}
+	return L(202, { ok: !0 });
+}), ne = (t, n) => E.gen(function* () {
+	if (!t.token || !t.newPassword) return L(400, { error: "token and newPassword required" });
+	if (t.newPassword.length < 8) return L(400, { error: "password must be at least 8 characters" });
+	let r = yield* n.consumeToken(y(t.token), "password-reset");
+	if (!r) return L(401, { error: "invalid or expired token" });
+	let i = yield* e(t.newPassword).pipe(E.orElseSucceed(() => ""));
+	return i ? (yield* n.updatePassword(r.userId, i).pipe(E.ignore), yield* n.markEmailVerified(r.userId).pipe(E.ignore), yield* n.revokeAllSessions(r.userId).pipe(E.ignore), L(200, { ok: !0 })) : L(500, { error: "hash_failed" });
+}), re = (e, t) => E.gen(function* () {
+	return L(200, { sessions: (yield* t.listSessions(e.userId)).map((e) => ({
+		id: e.id,
+		tenantId: e.tenantId,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null,
+		createdAt: e.createdAt.toISOString(),
+		lastSeenAt: e.lastSeenAt.toISOString(),
+		expiresAt: e.expiresAt.toISOString()
+	})) });
+}), ie = (e, t) => E.gen(function* () {
+	return (yield* t.revokeSession(e.userId, e.sessionId)) ? L(200, {
+		ok: !0,
+		revoked: 1
+	}) : L(404, { error: "session_not_found" });
+}), ae = (e, t) => E.gen(function* () {
+	return L(200, {
+		ok: !0,
+		revoked: yield* t.revokeAllOtherSessions(e.userId, e.keepSessionId)
+	});
+}), oe = (e, t, n, i, o) => E.gen(function* () {
+	let s = yield* t.findById(e.userId);
+	if (!s) return L(404, { error: "user_not_found" });
+	let c = yield* t.listMemberships(s.id), l = c.find((t) => t.tenantId === e.targetTenantId)?.role ?? null;
+	if (l === null) return L(403, { error: "not a member of the target tenant" });
+	let d = e.metadata === void 0 ? void 0 : Object.fromEntries(Object.entries(e.metadata).filter(([e]) => e !== "memberships")), f = k(u(s, { ...d === void 0 ? {} : { metadata: d } }), e.targetTenantId, c);
+	o !== void 0 && f.type === "user" && (yield* E.promise(() => O(o, {
+		type: f.type,
+		id: f.id
+	}, e.targetTenantId)));
+	let p = e.sessionId ? B(f, e.sessionId) : f, m = a(p, F(n), {
+		ttlSeconds: z,
+		...n.cookieDomain ? { domain: n.cookieDomain } : {},
+		secure: n.cookieSecure ?? !0
+	});
+	return e.clientId !== void 0 && i && i(e.clientId, { cookies: { [r]: m.value } }), L(200, {
+		ok: !0,
+		tenantId: e.targetTenantId,
+		role: l,
+		subject: p
+	}, { setCookie: m.setCookie });
+}), se = (e, t) => E.gen(function* () {
+	return L(200, { memberships: (yield* t.listMemberships(e.userId)).map((e) => ({
+		tenantId: e.tenantId,
+		role: e.role,
+		joinedAt: e.joinedAt.toISOString()
+	})) });
+});
+//#endregion
+export { v as MFA_PENDING_TTL_S, F as configSessionSecrets, I as configSigningKey, H as guardSubject, Z as handleCsrf, se as handleListMemberships, re as handleListSessions, ee as handleMagicLinkConsume, $ as handleMagicLinkRequest, q as handleMfaEnrollStart, J as handleMfaEnrollVerify, Y as handleMfaRegenerateRecoveryCodes, X as handleMfaUnenroll, W as handleMfaVerify, ne as handlePasswordResetConfirm, te as handlePasswordResetRequest, ae as handleRevokeAllOtherSessions, ie as handleRevokeSession, U as handleSignIn, K as handleSignOut, G as handleSignUp, oe as handleSwitchTenant, V as issueUserSession };

package/dist/impersonation.js

@@ -0,0 +1,176 @@
+import { isSessionCredentialLiveFor as e } from "./sessionFamily.js";
+import { newAuthId as t, subjectFromUser as n } from "./userStore.js";
+import { Effect as r } from "effect";
+import { IMPERSONATION_METADATA_KEY as i, rawImpersonationMark as a } from "@voltro/protocol";
+//#region src/impersonation.ts
+var o = 900, s = [
+	"/mfa/enroll/start",
+	"/mfa/enroll/verify",
+	"/mfa/unenroll",
+	"/mfa/recovery-codes/regenerate",
+	"/passkey/register/options",
+	"/passkey/register/verify",
+	"/sessions/revoke-others",
+	"/switch-tenant",
+	"/impersonate/start"
+], c = (e) => {
+	if (typeof e != "object" || !e) return null;
+	let t = e;
+	return typeof t.actorUserId != "string" || t.actorUserId.length === 0 || typeof t.grantId != "string" || typeof t.expiresAt != "string" || typeof t.actorSessionId != "string" || typeof t.startedAt != "string" ? null : {
+		actorUserId: t.actorUserId,
+		actorSessionId: t.actorSessionId,
+		grantId: t.grantId,
+		startedAt: t.startedAt,
+		expiresAt: t.expiresAt,
+		...typeof t.reason == "string" ? { reason: t.reason } : {}
+	};
+}, l = (e) => e.type === "user" ? c(a(e)) : null, u = (e) => l(e) !== null, d = () => (e) => {
+	if (e.type !== "user" || e.metadata === void 0) return e;
+	let t = c(e.metadata[i]), { metadata: n, ...r } = e;
+	return {
+		...r,
+		metadata: t === null ? { __redacted: "all" } : {
+			__redacted: "all-except-impersonation",
+			[i]: t
+		}
+	};
+}, f = (e, t, n = {}) => ({
+	status: e,
+	body: JSON.stringify(t),
+	contentType: "application/json; charset=utf-8",
+	...n
+}), p = (e, t) => r.suspend(() => {
+	let n = e.audit(t);
+	return n === void 0 ? r.void : r.isEffect(n) ? n : r.tryPromise({
+		try: () => Promise.resolve(n),
+		catch: (e) => e
+	});
+}).pipe(r.catchCause(() => r.void)), m = (e, a, o) => r.gen(function* () {
+	let s = o.impersonation, c = (o.now ?? Date.now)(), l = new Date(c), d = e.actorSubject, m = (t, n, i = {}) => p(s, {
+		kind: "refused",
+		at: l,
+		actorUserId: i.actorUser?.id ?? (d.type === "user" ? d.id : null),
+		actorEmail: i.actorUser?.email ?? null,
+		targetUserId: i.target?.id ?? null,
+		targetEmail: i.target?.email ?? null,
+		tenantId: d.tenantId ?? null,
+		reason: e.reason ?? null,
+		refusal: n,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	}).pipe(r.as(f(t, {
+		error: n,
+		...i.message === void 0 ? {} : { message: i.message }
+	})));
+	if (d.type !== "user") return yield* m(401, "unauthenticated");
+	if (u(d)) return yield* m(403, "nested_impersonation", { message: "An impersonated session may not start another impersonation. Stop the current one first." });
+	if (!e.actorSessionId) return yield* m(400, "no_actor_session");
+	let h = yield* a.findById(d.id);
+	if (!h) return yield* m(401, "unauthenticated");
+	if (!e.targetUserId && !e.targetEmail) return yield* m(400, "target_required", { actorUser: h });
+	let g = e.targetUserId ? yield* a.findById(e.targetUserId) : yield* a.findByEmail(e.targetEmail);
+	if (!g) return yield* m(404, "target_not_found", { actorUser: h });
+	if (g.id === h.id) return yield* m(400, "self_impersonation", {
+		actorUser: h,
+		target: g
+	});
+	let _ = e.reason?.trim() ?? "";
+	if ((s.requireReason ?? !0) && _.length === 0) return yield* m(400, "reason_required", {
+		actorUser: h,
+		target: g,
+		message: "A reason is required to impersonate a user."
+	});
+	if (!(yield* s.authority({
+		actor: d,
+		actorUser: h,
+		target: g
+	}).pipe(r.catchCause(() => r.succeed(!1))))) return yield* m(403, "not_permitted", {
+		actorUser: h,
+		target: g
+	});
+	if (yield* s.authority({
+		actor: n(g),
+		actorUser: g,
+		target: h
+	}).pipe(r.catchCause(() => r.succeed(!0)))) return yield* m(403, "target_may_impersonate", {
+		actorUser: h,
+		target: g,
+		message: "This user may themselves impersonate others and cannot be impersonated."
+	});
+	let v = s.maxDurationSeconds ?? 900, y = Math.max(1, Math.min(e.durationSeconds ?? v, v)), b = new Date(c + y * 1e3), x = t("sess"), S = yield* a.insertImpersonationGrant({
+		id: t("imp"),
+		sessionId: x,
+		actorUserId: h.id,
+		actorSessionId: e.actorSessionId,
+		targetUserId: g.id,
+		tenantId: g.tenantId,
+		reason: _.length > 0 ? _ : null,
+		expiresAt: b,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	}), C = {
+		actorUserId: h.id,
+		actorSessionId: e.actorSessionId,
+		grantId: S.id,
+		startedAt: S.startedAt.toISOString(),
+		expiresAt: b.toISOString(),
+		..._.length > 0 ? { reason: _ } : {}
+	}, w = yield* o.issuer.issue(g, {
+		sessionId: x,
+		ttlSeconds: y,
+		metadata: { [i]: C },
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	});
+	return yield* p(s, {
+		kind: "started",
+		at: l,
+		actorUserId: h.id,
+		actorEmail: h.email,
+		targetUserId: g.id,
+		targetEmail: g.email,
+		tenantId: g.tenantId,
+		sessionId: x,
+		grantId: S.id,
+		reason: _.length > 0 ? _ : null,
+		expiresAt: b,
+		ipAddress: e.ipAddress ?? null,
+		userAgent: e.userAgent ?? null
+	}), f(200, {
+		ok: !0,
+		impersonation: C,
+		subject: w.subject
+	}, { setCookie: w.setCookie });
+}), h = (t, n, i) => r.gen(function* () {
+	let a = i.impersonation, o = (i.now ?? Date.now)(), s = new Date(o), c = l(t.subject);
+	if (!c || !t.sessionId) return f(400, { error: "not_impersonating" });
+	let u = yield* n.findImpersonationGrantBySession(t.sessionId);
+	yield* n.endImpersonationGrant(t.sessionId, "stopped", s).pipe(r.ignore), t.subject.type === "user" && (yield* n.revokeSession(t.subject.id, t.sessionId).pipe(r.ignore)), i.invalidateSession?.(t.sessionId);
+	let d = yield* n.findById(c.actorUserId), m = yield* n.findSession(c.actorSessionId), h = m ? Math.floor((m.expiresAt.getTime() - o) / 1e3) : 0;
+	if (yield* p(a, {
+		kind: "stopped",
+		at: s,
+		actorUserId: c.actorUserId,
+		actorEmail: d?.email ?? null,
+		targetUserId: t.subject.type === "user" ? t.subject.id : null,
+		targetEmail: null,
+		tenantId: u?.tenantId ?? t.subject.tenantId ?? null,
+		sessionId: t.sessionId,
+		...u ? { grantId: u.id } : {},
+		reason: u?.reason ?? null
+	}), !d || !e(m, c.actorSessionId, d.id, o) || !Number.isSafeInteger(h) || h <= 0) return f(200, {
+		ok: !0,
+		restored: !1
+	}, { setCookie: i.issuer.clear() });
+	let g = yield* i.issuer.reissue(d, {
+		sessionId: c.actorSessionId,
+		ttlSeconds: h
+	});
+	return f(200, {
+		ok: !0,
+		restored: !0,
+		subject: g.subject
+	}, { setCookie: g.setCookie });
+});
+//#endregion
+export { o as IMPERSONATION_DEFAULT_DURATION_S, s as IMPERSONATION_FORBIDDEN_SUBPATHS, m as handleImpersonationStart, h as handleImpersonationStop, d as impersonationAuditRedactor, l as impersonationOf, u as isImpersonated };