@warlock.js/auth 4.1.14 → 4.2.0

package/esm/middleware/auth.middleware.mjs

@@ -5,7 +5,7 @@ import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { config, t } from "@warlock.js/core";
 import { log } from "@warlock.js/logger";
 
-//#region ../../@warlock.js/auth/src/middleware/auth.middleware.ts
+//#region ../@warlock.js/auth/src/middleware/auth.middleware.ts
 /**
 * Build a route gate that always requires an authenticated request.
 *
@@ -32,31 +32,31 @@ function authMiddleware(allowedUserType) {
 				error: t("auth.errors.missingAccessToken"),
 				errorCode: "EC001"
 			});
-			const user = await jwt.verify(authorizationValue);
-			request.decodedAccessToken = user;
-			const accessToken = await AccessToken.first({ token: authorizationValue });
+			const decoded = await jwt.verify(authorizationValue);
+			request.decodedAccessToken = decoded;
+			const accessToken = await config.key("auth.accessToken.model", AccessToken).findByToken(authorizationValue);
 			if (!accessToken) return response.unauthorized({
 				error: t("auth.errors.invalidAccessToken"),
 				errorCode: "EC002"
 			});
-			const userType = user.userType || accessToken.get("userType");
+			const userType = decoded.userType ?? accessToken.userType;
 			if (allowedTypes.length && !allowedTypes.includes(userType)) return response.unauthorized({
 				error: t("auth.errors.unauthorized"),
 				errorCode: "EC003"
 			});
 			const UserModel = config.key(`auth.userType.${userType}`);
 			if (!UserModel) throw new Error(`User type ${userType} is unknown type.`);
-			const currentUser = await UserModel.find(user.id);
+			const currentUser = await UserModel.find(decoded.id);
 			if (!currentUser) {
-				accessToken.destroy();
+				await accessToken.destroy();
 				return response.unauthorized({
 					error: t("auth.errors.invalidAccessToken"),
 					errorCode: "EC002"
 				});
 			}
 			request.user = currentUser;
-		} catch (err) {
-			log.error("http", "auth", err);
+		} catch (error) {
+			log.error("http", "auth", error);
 			request.clearCurrentUser();
 			return response.unauthorized({
 				error: t("auth.errors.invalidAccessToken"),

package/esm/middleware/auth.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../@warlock.js/auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { AccessToken } from \"../models/access-token\";\r\nimport { jwt } from \"../services/jwt\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\n\r\n/**\r\n * Build a route gate that always requires an authenticated request.\r\n *\r\n * The argument is mandatory and selects which user types may pass:\r\n * - `[]` — any authenticated user (token required, type not checked).\r\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\r\n *   `userType` must be one of the listed types.\r\n *\r\n * There is no anonymous/optional mode: a request without a valid access\r\n * token is always rejected with `401`. Routes that should be public\r\n * simply omit the middleware.\r\n *\r\n * @example\r\n * router.get(\"/account\", authMiddleware([]), accountController);\r\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\r\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\r\n */\r\nexport function authMiddleware(allowedUserType: string | string[]) {\r\n  const allowedTypes = Array.isArray(allowedUserType) ? allowedUserType : [allowedUserType];\r\n\r\n  const auth: Middleware = async (request: Request, response: Response) => {\r\n    try {\r\n      const authorizationValue = request.authorizationValue;\r\n\r\n      if (!authorizationValue) {\r\n        return response.unauthorized({\r\n          error: t(\"auth.errors.missingAccessToken\"),\r\n          errorCode: AuthErrorCodes.MissingAccessToken,\r\n        });\r\n      }\r\n\r\n      // get current user jwt\r\n      const user = await jwt.verify(authorizationValue);\r\n\r\n      // store decoded access token object in request object\r\n      request.decodedAccessToken = user;\r\n      // use our own jwt verify to verify the token\r\n      const accessToken = await AccessToken.first({\r\n        token: authorizationValue,\r\n      });\r\n\r\n      if (!accessToken) {\r\n        return response.unauthorized({\r\n          error: t(\"auth.errors.invalidAccessToken\"),\r\n          errorCode: AuthErrorCodes.InvalidAccessToken,\r\n        });\r\n      }\r\n\r\n      // now, we need to get an instance of user using its corresponding model\r\n      const userType = user.userType || accessToken.get(\"userType\");\r\n\r\n      // check if the user type is allowed\r\n      if (allowedTypes.length && !allowedTypes.includes(userType)) {\r\n        return response.unauthorized({\r\n          error: t(\"auth.errors.unauthorized\"),\r\n          errorCode: AuthErrorCodes.Unauthorized,\r\n        });\r\n      }\r\n\r\n      // get user model class\r\n      const UserModel = config.key(`auth.userType.${userType}`);\r\n\r\n      if (!UserModel) {\r\n        throw new Error(`User type ${userType} is unknown type.`);\r\n      }\r\n\r\n      // get user model instance\r\n      const currentUser = await UserModel.find(user.id);\r\n\r\n      if (!currentUser) {\r\n        accessToken.destroy();\r\n        return response.unauthorized({\r\n          error: t(\"auth.errors.invalidAccessToken\"),\r\n          errorCode: AuthErrorCodes.InvalidAccessToken,\r\n        });\r\n      }\r\n\r\n      // update last access\r\n      // accessToken.set(\"lastAccess\", new Date());\r\n      // await accessToken.save({ skipEvents: true });\r\n\r\n      // set current user\r\n      request.user = currentUser;\r\n    } catch (err: any) {\r\n      log.error(\"http\", \"auth\", err);\r\n\r\n      request.clearCurrentUser();\r\n\r\n      return response.unauthorized({\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n  };\r\n\r\n  return auth;\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,eAAe,iBAAoC;CACjE,MAAM,eAAe,MAAM,QAAQ,eAAe,IAAI,kBAAkB,CAAC,eAAe;CAExF,MAAM,OAAmB,OAAO,SAAkB,aAAuB;EACvE,IAAI;GACF,MAAM,qBAAqB,QAAQ;GAEnC,IAAI,CAAC,oBACH,OAAO,SAAS,aAAa;IAC3B,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;GAIH,MAAM,OAAO,MAAM,IAAI,OAAO,kBAAkB;GAGhD,QAAQ,qBAAqB;GAE7B,MAAM,cAAc,MAAM,YAAY,MAAM,EAC1C,OAAO,mBACT,CAAC;GAED,IAAI,CAAC,aACH,OAAO,SAAS,aAAa;IAC3B,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;GAIH,MAAM,WAAW,KAAK,YAAY,YAAY,IAAI,UAAU;GAG5D,IAAI,aAAa,UAAU,CAAC,aAAa,SAAS,QAAQ,GACxD,OAAO,SAAS,aAAa;IAC3B,OAAO,EAAE,0BAA0B;IACnC;GACF,CAAC;GAIH,MAAM,YAAY,OAAO,IAAI,iBAAiB,UAAU;GAExD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,SAAS,kBAAkB;GAI1D,MAAM,cAAc,MAAM,UAAU,KAAK,KAAK,EAAE;GAEhD,IAAI,CAAC,aAAa;IAChB,YAAY,QAAQ;IACpB,OAAO,SAAS,aAAa;KAC3B,OAAO,EAAE,gCAAgC;KACzC;IACF,CAAC;GACH;GAOA,QAAQ,OAAO;EACjB,SAAS,KAAU;GACjB,IAAI,MAAM,QAAQ,QAAQ,GAAG;GAE7B,QAAQ,iBAAiB;GAEzB,OAAO,SAAS,aAAa;IAC3B,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;CACF;CAEA,OAAO;AACT"}
+{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport { AccessToken } from \"../models/access-token\";\nimport { jwt } from \"../services/jwt\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * Decoded access-token claims the middleware reads. The full payload carries\n * more (`created_at`, `tokenType`, `iat`, `exp`) but only these drive routing.\n */\ntype DecodedAccessToken = {\n  id: string | number;\n  userType?: string;\n};\n\n/**\n * Build a route gate that always requires an authenticated request.\n *\n * The argument is mandatory and selects which user types may pass:\n * - `[]` — any authenticated user (token required, type not checked).\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\n *   `userType` must be one of the listed types.\n *\n * There is no anonymous/optional mode: a request without a valid access\n * token is always rejected with `401`. Routes that should be public\n * simply omit the middleware.\n *\n * @example\n * router.get(\"/account\", authMiddleware([]), accountController);\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\n */\nexport function authMiddleware(allowedUserType: string | string[]) {\n  const allowedTypes = Array.isArray(allowedUserType) ? allowedUserType : [allowedUserType];\n\n  const auth: Middleware = async (request: Request, response: Response) => {\n    try {\n      const authorizationValue = request.authorizationValue;\n\n      if (!authorizationValue) {\n        return response.unauthorized({\n          error: t(\"auth.errors.missingAccessToken\"),\n          errorCode: AuthErrorCodes.MissingAccessToken,\n        });\n      }\n\n      const decoded = await jwt.verify<DecodedAccessToken>(authorizationValue);\n\n      request.decodedAccessToken = decoded;\n\n      // A valid signature is not enough — the token must still exist in storage,\n      // so deleting the row (logout) invalidates it before its JWT expiry.\n      const AccessTokenModel = config.key(\"auth.accessToken.model\", AccessToken);\n      const accessToken = await AccessTokenModel.findByToken(authorizationValue);\n\n      if (!accessToken) {\n        return response.unauthorized({\n          error: t(\"auth.errors.invalidAccessToken\"),\n          errorCode: AuthErrorCodes.InvalidAccessToken,\n        });\n      }\n\n      const userType = decoded.userType ?? accessToken.userType;\n\n      if (allowedTypes.length && !allowedTypes.includes(userType)) {\n        return response.unauthorized({\n          error: t(\"auth.errors.unauthorized\"),\n          errorCode: AuthErrorCodes.Unauthorized,\n        });\n      }\n\n      const UserModel = config.key(`auth.userType.${userType}`);\n\n      if (!UserModel) {\n        throw new Error(`User type ${userType} is unknown type.`);\n      }\n\n      const currentUser = await UserModel.find(decoded.id);\n\n      if (!currentUser) {\n        await accessToken.destroy();\n\n        return response.unauthorized({\n          error: t(\"auth.errors.invalidAccessToken\"),\n          errorCode: AuthErrorCodes.InvalidAccessToken,\n        });\n      }\n\n      request.user = currentUser;\n    } catch (error: any) {\n      log.error(\"http\", \"auth\", error);\n\n      request.clearCurrentUser();\n\n      return response.unauthorized({\n        error: t(\"auth.errors.invalidAccessToken\"),\n        errorCode: AuthErrorCodes.InvalidAccessToken,\n      });\n    }\n  };\n\n  return auth;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAgB,eAAe,iBAAoC;CACjE,MAAM,eAAe,MAAM,QAAQ,eAAe,IAAI,kBAAkB,CAAC,eAAe;CAExF,MAAM,OAAmB,OAAO,SAAkB,aAAuB;EACvE,IAAI;GACF,MAAM,qBAAqB,QAAQ;GAEnC,IAAI,CAAC,oBACH,OAAO,SAAS,aAAa;IAC3B,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;GAGH,MAAM,UAAU,MAAM,IAAI,OAA2B,kBAAkB;GAEvE,QAAQ,qBAAqB;GAK7B,MAAM,cAAc,MADK,OAAO,IAAI,0BAA0B,WACrB,CAAC,CAAC,YAAY,kBAAkB;GAEzE,IAAI,CAAC,aACH,OAAO,SAAS,aAAa;IAC3B,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;GAGH,MAAM,WAAW,QAAQ,YAAY,YAAY;GAEjD,IAAI,aAAa,UAAU,CAAC,aAAa,SAAS,QAAQ,GACxD,OAAO,SAAS,aAAa;IAC3B,OAAO,EAAE,0BAA0B;IACnC;GACF,CAAC;GAGH,MAAM,YAAY,OAAO,IAAI,iBAAiB,UAAU;GAExD,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,SAAS,kBAAkB;GAG1D,MAAM,cAAc,MAAM,UAAU,KAAK,QAAQ,EAAE;GAEnD,IAAI,CAAC,aAAa;IAChB,MAAM,YAAY,QAAQ;IAE1B,OAAO,SAAS,aAAa;KAC3B,OAAO,EAAE,gCAAgC;KACzC;IACF,CAAC;GACH;GAEA,QAAQ,OAAO;EACjB,SAAS,OAAY;GACnB,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAE/B,QAAQ,iBAAiB;GAEzB,OAAO,SAAS,aAAa;IAC3B,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;CACF;CAEA,OAAO;AACT"}

package/esm/middleware/index.d.mts

@@ -0,0 +1,2 @@
+import { authMiddleware } from "./auth.middleware.mjs";
+import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./login-throttle.middleware.mjs";

package/esm/middleware/index.mjs

@@ -1,3 +1,4 @@
 import { authMiddleware } from "./auth.middleware.mjs";
+import { loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
 
 export {  };

package/esm/middleware/login-throttle.middleware.d.mts

@@ -0,0 +1,116 @@
+import { Middleware, Request, Response } from "@warlock.js/core";
+
+//#region ../@warlock.js/auth/src/middleware/login-throttle.middleware.d.ts
+/**
+ * Built-in identifier kinds the throttle knows how to extract from a request.
+ *
+ * - `"email"` tracks per-account, so an attacker can't spray one user from
+ *   many IPs.
+ * - `"ip"` tracks per-source, so an attacker can't stuff many accounts from
+ *   one IP.
+ *
+ * Lockout trips when ANY tracked identifier crosses `max` — defense-in-depth.
+ */
+type LoginThrottleIdentifier = "email" | "ip";
+/**
+ * Options for {@link loginThrottleMiddleware}.
+ *
+ * Failure-aware by design: only counts requests whose response is non-2xx
+ * (or whatever `isFailure` says) and resets on success, so a user who types
+ * a wrong password three times then the right one is not penalised.
+ *
+ * @example
+ * loginThrottleMiddleware({ max: 5, window: "15m", lockoutDuration: "15m" });
+ */
+type LoginThrottleOptions = {
+  /**
+   * Failures allowed within the window before the identifier is locked.
+   *
+   * @default 5
+   */
+  max?: number;
+  /**
+   * Counting window. `ms`-format string (`"15m"`, `"1h"`) or seconds as a number.
+   *
+   * @default "15m"
+   */
+  window?: string | number;
+  /**
+   * Lockout duration once the threshold is tripped. `ms`-format string or seconds.
+   *
+   * @default "15m"
+   */
+  lockoutDuration?: string | number;
+  /**
+   * Identifiers tracked. Each is counted and locked independently.
+   *
+   * @default ["email", "ip"]
+   */
+  by?: LoginThrottleIdentifier[];
+  /**
+   * Credential field consulted when `"email"` is tracked. Switch to
+   * `"username"` (or any other input field) for systems that don't
+   * authenticate by email.
+   *
+   * @default "email"
+   */
+  identifierKey?: string;
+  /**
+   * Override the default error message returned with the 429 response.
+   */
+  errorMessage?: string;
+  /**
+   * Decide whether the response represents a failed login. Defaults to
+   * "non-2xx is a failure"; override if your controller signals failure
+   * through a 200-style body.
+   *
+   * @default (response) => !response.isOk
+   */
+  isFailure?: (response: Response) => boolean;
+  /**
+   * Compute the identifiers tracked for this request. Override to derive the
+   * account key from a header, a JWT subject, or any other shape that does
+   * not match the built-in `email` / `ip` extraction.
+   */
+  identify?: (request: Request) => string[];
+};
+/**
+ * Failure-aware login throttle. Locks an identifier (account, IP, or both)
+ * after too many failed login attempts within a window — without penalising
+ * a user who eventually types the right password.
+ *
+ * Mechanism (per identifier):
+ *
+ * 1. **Before the controller** — reject with `429` if a lock key is set,
+ *    skipping the DB lookup AND the bcrypt verify (this also neutralises the
+ *    CPU-DoS angle of brute-forcing).
+ * 2. **After the controller** — observe the outcome via `response.onSent`.
+ *    On failure (non-2xx by default), bump a fixed-window counter; once it
+ *    reaches `max`, set a lock key with `lockoutDuration` TTL. On success,
+ *    clear both the counter and the lock for that identifier.
+ *
+ * Storage is `@warlock.js/cache` (a peer dependency of `@warlock.js/auth`,
+ * transitively guaranteed via `@warlock.js/core`). Lockout state is shared
+ * across replicas — correct security model, because an attacker can't bypass
+ * by round-robin to a different pod. Every cache call is guarded so a
+ * misconfigured driver fails open (a throttle outage must never escalate
+ * into a full auth outage).
+ *
+ * @example
+ * import { loginThrottleMiddleware } from "@warlock.js/auth";
+ * import { router } from "@warlock.js/core";
+ *
+ * router.post("/auth/login", loginController, {
+ *   middleware: [loginThrottleMiddleware({ max: 5, window: "15m" })],
+ * });
+ *
+ * @example
+ * // Per-IP only — avoid account-lockout-as-DoS on anonymous-attack vectors
+ * router.post("/auth/refresh-token", refreshController, {
+ *   middleware: [loginThrottleMiddleware({ by: ["ip"], max: 10, window: "1m" })],
+ * });
+ */
+declare function loginThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+//#endregion
+export { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware };
+//# sourceMappingURL=login-throttle.middleware.d.mts.map

package/esm/middleware/login-throttle.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../@warlock.js/auth/src/middleware/login-throttle.middleware.ts"],"mappings":";;;;;AAeA;;;;AAAmC;AAYnC;;;KAZY,uBAAA;;;;;;;;;;;KAYA,oBAAA;EAkDV;;;;;EA5CA,GAAA;EAmD4B;AAAA;AA6E9B;;;EAzHE,MAAA;EAyH+C;;;;AAAsC;EAlHrF,eAAA;;;;;;EAOA,EAAA,GAAK,uBAAA;;;;;;;;EASL,aAAA;;;;EAKA,YAAA;;;;;;;;EASA,SAAA,IAAa,QAAA,EAAU,QAAA;;;;;;EAOvB,QAAA,IAAY,OAAA,EAAS,OAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6EP,uBAAA,CAAwB,OAAA,GAAS,oBAAA,GAA4B,UAAU"}

package/esm/middleware/login-throttle.middleware.mjs

@@ -0,0 +1,105 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { t } from "@warlock.js/core";
+import { log } from "@warlock.js/logger";
+import { cache } from "@warlock.js/cache";
+
+//#region ../@warlock.js/auth/src/middleware/login-throttle.middleware.ts
+const COUNTER_PREFIX = "auth.throttle.count.";
+const LOCK_PREFIX = "auth.throttle.lock.";
+const counterKey = (identifier) => `${COUNTER_PREFIX}${identifier}`;
+const lockKey = (identifier) => `${LOCK_PREFIX}${identifier}`;
+/**
+* Built-in identifier extractor — reads the configured credential field from
+* the request body for the per-account key, and `request.detectIp()` for the
+* per-source key. Untruthy values are dropped; a request that yields zero
+* identifiers is left untracked so the middleware no-ops for it.
+*/
+function buildDefaultIdentifiers(request, tracked, credentialField) {
+	const identifiers = [];
+	if (tracked.includes("email")) {
+		const value = request.input(credentialField);
+		if (typeof value === "string" && value.length > 0) identifiers.push(`email.${value.toLowerCase()}`);
+	}
+	if (tracked.includes("ip")) {
+		const ip = request.detectIp();
+		if (ip) identifiers.push(`ip.${ip}`);
+	}
+	return identifiers;
+}
+/**
+* Failure-aware login throttle. Locks an identifier (account, IP, or both)
+* after too many failed login attempts within a window — without penalising
+* a user who eventually types the right password.
+*
+* Mechanism (per identifier):
+*
+* 1. **Before the controller** — reject with `429` if a lock key is set,
+*    skipping the DB lookup AND the bcrypt verify (this also neutralises the
+*    CPU-DoS angle of brute-forcing).
+* 2. **After the controller** — observe the outcome via `response.onSent`.
+*    On failure (non-2xx by default), bump a fixed-window counter; once it
+*    reaches `max`, set a lock key with `lockoutDuration` TTL. On success,
+*    clear both the counter and the lock for that identifier.
+*
+* Storage is `@warlock.js/cache` (a peer dependency of `@warlock.js/auth`,
+* transitively guaranteed via `@warlock.js/core`). Lockout state is shared
+* across replicas — correct security model, because an attacker can't bypass
+* by round-robin to a different pod. Every cache call is guarded so a
+* misconfigured driver fails open (a throttle outage must never escalate
+* into a full auth outage).
+*
+* @example
+* import { loginThrottleMiddleware } from "@warlock.js/auth";
+* import { router } from "@warlock.js/core";
+*
+* router.post("/auth/login", loginController, {
+*   middleware: [loginThrottleMiddleware({ max: 5, window: "15m" })],
+* });
+*
+* @example
+* // Per-IP only — avoid account-lockout-as-DoS on anonymous-attack vectors
+* router.post("/auth/refresh-token", refreshController, {
+*   middleware: [loginThrottleMiddleware({ by: ["ip"], max: 10, window: "1m" })],
+* });
+*/
+function loginThrottleMiddleware(options = {}) {
+	const max = options.max ?? 5;
+	const window = options.window ?? "15m";
+	const lockoutDuration = options.lockoutDuration ?? "15m";
+	const tracked = options.by ?? ["email", "ip"];
+	const credentialField = options.identifierKey ?? "email";
+	return async (request, response) => {
+		const identifiers = options.identify ? options.identify(request) : buildDefaultIdentifiers(request, tracked, credentialField);
+		if (identifiers.length === 0) return;
+		try {
+			for (const identifier of identifiers) if (await cache.get(lockKey(identifier))) return response.tooManyRequests({
+				error: options.errorMessage ?? t("auth.errors.tooManyAttempts"),
+				errorCode: "EC004"
+			});
+		} catch (error) {
+			log.error("auth", "login-throttle", error);
+			return;
+		}
+		response.onSent(async (resolvedResponse) => {
+			try {
+				if (!(options.isFailure ? options.isFailure(resolvedResponse) : !resolvedResponse.isOk)) {
+					for (const identifier of identifiers) {
+						await cache.remove(counterKey(identifier));
+						await cache.remove(lockKey(identifier));
+					}
+					return;
+				}
+				for (const identifier of identifiers) {
+					const ttlOption = await cache.get(counterKey(identifier)) === null ? { ttl: window } : void 0;
+					if ((await cache.update(counterKey(identifier), (current) => (current ?? 0) + 1, ttlOption) ?? 0) >= max) await cache.set(lockKey(identifier), true, { ttl: lockoutDuration });
+				}
+			} catch (error) {
+				log.error("auth", "login-throttle", error);
+			}
+		});
+	};
+}
+
+//#endregion
+export { loginThrottleMiddleware };
+//# sourceMappingURL=login-throttle.middleware.mjs.map

package/esm/middleware/login-throttle.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-throttle.middleware.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/middleware/login-throttle.middleware.ts"],"sourcesContent":["import { cache } from \"@warlock.js/cache\";\nimport { t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * Built-in identifier kinds the throttle knows how to extract from a request.\n *\n * - `\"email\"` tracks per-account, so an attacker can't spray one user from\n *   many IPs.\n * - `\"ip\"` tracks per-source, so an attacker can't stuff many accounts from\n *   one IP.\n *\n * Lockout trips when ANY tracked identifier crosses `max` — defense-in-depth.\n */\nexport type LoginThrottleIdentifier = \"email\" | \"ip\";\n\n/**\n * Options for {@link loginThrottleMiddleware}.\n *\n * Failure-aware by design: only counts requests whose response is non-2xx\n * (or whatever `isFailure` says) and resets on success, so a user who types\n * a wrong password three times then the right one is not penalised.\n *\n * @example\n * loginThrottleMiddleware({ max: 5, window: \"15m\", lockoutDuration: \"15m\" });\n */\nexport type LoginThrottleOptions = {\n  /**\n   * Failures allowed within the window before the identifier is locked.\n   *\n   * @default 5\n   */\n  max?: number;\n\n  /**\n   * Counting window. `ms`-format string (`\"15m\"`, `\"1h\"`) or seconds as a number.\n   *\n   * @default \"15m\"\n   */\n  window?: string | number;\n\n  /**\n   * Lockout duration once the threshold is tripped. `ms`-format string or seconds.\n   *\n   * @default \"15m\"\n   */\n  lockoutDuration?: string | number;\n\n  /**\n   * Identifiers tracked. Each is counted and locked independently.\n   *\n   * @default [\"email\", \"ip\"]\n   */\n  by?: LoginThrottleIdentifier[];\n\n  /**\n   * Credential field consulted when `\"email\"` is tracked. Switch to\n   * `\"username\"` (or any other input field) for systems that don't\n   * authenticate by email.\n   *\n   * @default \"email\"\n   */\n  identifierKey?: string;\n\n  /**\n   * Override the default error message returned with the 429 response.\n   */\n  errorMessage?: string;\n\n  /**\n   * Decide whether the response represents a failed login. Defaults to\n   * \"non-2xx is a failure\"; override if your controller signals failure\n   * through a 200-style body.\n   *\n   * @default (response) => !response.isOk\n   */\n  isFailure?: (response: Response) => boolean;\n\n  /**\n   * Compute the identifiers tracked for this request. Override to derive the\n   * account key from a header, a JWT subject, or any other shape that does\n   * not match the built-in `email` / `ip` extraction.\n   */\n  identify?: (request: Request) => string[];\n};\n\nconst COUNTER_PREFIX = \"auth.throttle.count.\";\nconst LOCK_PREFIX = \"auth.throttle.lock.\";\n\nconst counterKey = (identifier: string): string => `${COUNTER_PREFIX}${identifier}`;\nconst lockKey = (identifier: string): string => `${LOCK_PREFIX}${identifier}`;\n\n/**\n * Built-in identifier extractor — reads the configured credential field from\n * the request body for the per-account key, and `request.detectIp()` for the\n * per-source key. Untruthy values are dropped; a request that yields zero\n * identifiers is left untracked so the middleware no-ops for it.\n */\nfunction buildDefaultIdentifiers(\n  request: Request,\n  tracked: LoginThrottleIdentifier[],\n  credentialField: string,\n): string[] {\n  const identifiers: string[] = [];\n\n  if (tracked.includes(\"email\")) {\n    const value = request.input(credentialField);\n\n    if (typeof value === \"string\" && value.length > 0) {\n      identifiers.push(`email.${value.toLowerCase()}`);\n    }\n  }\n\n  if (tracked.includes(\"ip\")) {\n    const ip = request.detectIp();\n\n    if (ip) {\n      identifiers.push(`ip.${ip}`);\n    }\n  }\n\n  return identifiers;\n}\n\n/**\n * Failure-aware login throttle. Locks an identifier (account, IP, or both)\n * after too many failed login attempts within a window — without penalising\n * a user who eventually types the right password.\n *\n * Mechanism (per identifier):\n *\n * 1. **Before the controller** — reject with `429` if a lock key is set,\n *    skipping the DB lookup AND the bcrypt verify (this also neutralises the\n *    CPU-DoS angle of brute-forcing).\n * 2. **After the controller** — observe the outcome via `response.onSent`.\n *    On failure (non-2xx by default), bump a fixed-window counter; once it\n *    reaches `max`, set a lock key with `lockoutDuration` TTL. On success,\n *    clear both the counter and the lock for that identifier.\n *\n * Storage is `@warlock.js/cache` (a peer dependency of `@warlock.js/auth`,\n * transitively guaranteed via `@warlock.js/core`). Lockout state is shared\n * across replicas — correct security model, because an attacker can't bypass\n * by round-robin to a different pod. Every cache call is guarded so a\n * misconfigured driver fails open (a throttle outage must never escalate\n * into a full auth outage).\n *\n * @example\n * import { loginThrottleMiddleware } from \"@warlock.js/auth\";\n * import { router } from \"@warlock.js/core\";\n *\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [loginThrottleMiddleware({ max: 5, window: \"15m\" })],\n * });\n *\n * @example\n * // Per-IP only — avoid account-lockout-as-DoS on anonymous-attack vectors\n * router.post(\"/auth/refresh-token\", refreshController, {\n *   middleware: [loginThrottleMiddleware({ by: [\"ip\"], max: 10, window: \"1m\" })],\n * });\n */\nexport function loginThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  const max = options.max ?? 5;\n  const window = options.window ?? \"15m\";\n  const lockoutDuration = options.lockoutDuration ?? \"15m\";\n  const tracked = options.by ?? [\"email\", \"ip\"];\n  const credentialField = options.identifierKey ?? \"email\";\n\n  return async (request: Request, response: Response) => {\n    const identifiers = options.identify\n      ? options.identify(request)\n      : buildDefaultIdentifiers(request, tracked, credentialField);\n\n    if (identifiers.length === 0) return;\n\n    try {\n      for (const identifier of identifiers) {\n        const locked = await cache.get(lockKey(identifier));\n\n        if (locked) {\n          return response.tooManyRequests({\n            error: options.errorMessage ?? t(\"auth.errors.tooManyAttempts\"),\n            errorCode: AuthErrorCodes.TooManyAttempts,\n          });\n        }\n      }\n    } catch (error) {\n      // Fail open — a cache outage (driver not initialised, network blip)\n      // must never escalate into a full auth outage. Log and let the request\n      // through; the onSent recorder below is independently guarded so an\n      // outage there is also harmless.\n      log.error(\"auth\", \"login-throttle\", error);\n\n      return;\n    }\n\n    response.onSent(async (resolvedResponse: Response) => {\n      try {\n        const failed = options.isFailure\n          ? options.isFailure(resolvedResponse)\n          : !resolvedResponse.isOk;\n\n        if (!failed) {\n          for (const identifier of identifiers) {\n            await cache.remove(counterKey(identifier));\n            await cache.remove(lockKey(identifier));\n          }\n\n          return;\n        }\n\n        for (const identifier of identifiers) {\n          const existing = await cache.get(counterKey(identifier));\n          const ttlOption = existing === null ? { ttl: window } : undefined;\n          const count = await cache.update<number>(\n            counterKey(identifier),\n            (current) => (current ?? 0) + 1,\n            ttlOption,\n          );\n\n          if ((count ?? 0) >= max) {\n            await cache.set(lockKey(identifier), true, { ttl: lockoutDuration });\n          }\n        }\n      } catch (error) {\n        log.error(\"auth\", \"login-throttle\", error);\n      }\n    });\n  };\n}\n"],"mappings":";;;;;;AAuFA,MAAM,iBAAiB;AACvB,MAAM,cAAc;AAEpB,MAAM,cAAc,eAA+B,GAAG,iBAAiB;AACvE,MAAM,WAAW,eAA+B,GAAG,cAAc;;;;;;;AAQjE,SAAS,wBACP,SACA,SACA,iBACU;CACV,MAAM,cAAwB,CAAC;CAE/B,IAAI,QAAQ,SAAS,OAAO,GAAG;EAC7B,MAAM,QAAQ,QAAQ,MAAM,eAAe;EAE3C,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAC9C,YAAY,KAAK,SAAS,MAAM,YAAY,GAAG;CAEnD;CAEA,IAAI,QAAQ,SAAS,IAAI,GAAG;EAC1B,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,IACF,YAAY,KAAK,MAAM,IAAI;CAE/B;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,wBAAwB,UAAgC,CAAC,GAAe;CACtF,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,kBAAkB,QAAQ,mBAAmB;CACnD,MAAM,UAAU,QAAQ,MAAM,CAAC,SAAS,IAAI;CAC5C,MAAM,kBAAkB,QAAQ,iBAAiB;CAEjD,OAAO,OAAO,SAAkB,aAAuB;EACrD,MAAM,cAAc,QAAQ,WACxB,QAAQ,SAAS,OAAO,IACxB,wBAAwB,SAAS,SAAS,eAAe;EAE7D,IAAI,YAAY,WAAW,GAAG;EAE9B,IAAI;GACF,KAAK,MAAM,cAAc,aAGvB,IAAI,MAFiB,MAAM,IAAI,QAAQ,UAAU,CAAC,GAGhD,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,6BAA6B;IAC9D;GACF,CAAC;EAGP,SAAS,OAAO;GAKd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAEzC;EACF;EAEA,SAAS,OAAO,OAAO,qBAA+B;GACpD,IAAI;IAKF,IAAI,EAJW,QAAQ,YACnB,QAAQ,UAAU,gBAAgB,IAClC,CAAC,iBAAiB,OAET;KACX,KAAK,MAAM,cAAc,aAAa;MACpC,MAAM,MAAM,OAAO,WAAW,UAAU,CAAC;MACzC,MAAM,MAAM,OAAO,QAAQ,UAAU,CAAC;KACxC;KAEA;IACF;IAEA,KAAK,MAAM,cAAc,aAAa;KAEpC,MAAM,YAAY,MADK,MAAM,IAAI,WAAW,UAAU,CAAC,MACxB,OAAO,EAAE,KAAK,OAAO,IAAI;KAOxD,KAAK,MANe,MAAM,OACxB,WAAW,UAAU,IACpB,aAAa,WAAW,KAAK,GAC9B,SACF,KAEc,MAAM,KAClB,MAAM,MAAM,IAAI,QAAQ,UAAU,GAAG,MAAM,EAAE,KAAK,gBAAgB,CAAC;IAEvE;GACF,SAAS,OAAO;IACd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAC3C;EACF,CAAC;CACH;AACF"}

package/esm/models/access-token/access-token.model.d.mts

@@ -1,13 +1,55 @@
+import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
 
-//#region ../../@warlock.js/auth/src/models/access-token/access-token.model.d.ts
+//#region ../@warlock.js/auth/src/models/access-token/access-token.model.d.ts
+/**
+ * Seal schema for the persisted access-token record. Exported so an override
+ * can spread it and add columns (e.g. a tenant key) without re-declaring the
+ * base shape.
+ *
+ * `last_access` and the `is_active` soft-revoke flag were removed — neither was
+ * ever read; access tokens are revoked by deleting the row.
+ */
+declare const accessTokenSchema: any;
+/**
+ * Persisted access-token record + the data layer for access tokens.
+ *
+ * **Role.** Owns access-token persistence and lookup. The middleware checks a
+ * presented JWT against this table so deleting a row (logout) invalidates the
+ * token immediately, before its JWT expiry. The auth service goes through the
+ * named statics exclusively, so it never hard-codes a column name and an
+ * override can rename/add columns by registering under
+ * `config.auth.accessToken.model`.
+ */
 declare class AccessToken extends Model {
-  /**
-   * {@inheritDoc}
-   */
   static table: string;
   static schema: any;
+  /** The user this token was issued for. */
+  get userId(): any;
+  /** The user-type slug this token was issued for. */
+  get userType(): string;
+  /**
+   * Persist a freshly-signed access token for the user.
+   */
+  static issue(user: Auth, token: string, expiresAt: Date): any;
+  /**
+   * Find an access-token row by its raw token string.
+   */
+  static findByToken(token: string): Promise<AccessToken | null>;
+  /**
+   * Delete a specific token that belongs to the given user.
+   */
+  static deleteForUser(user: Auth, token: string): any;
+  /**
+   * Delete every access token belonging to the user.
+   */
+  static deleteAllForUser(user: Auth): any;
+  /**
+   * Hard-delete every expired access-token row. Returns the number removed.
+   * Runs from the `auth.cleanup` CLI command (a cold batch path).
+   */
+  static purgeExpired(): Promise<number>;
 }
 //#endregion
-export { AccessToken };
+export { AccessToken, accessTokenSchema };
 //# sourceMappingURL=access-token.model.d.mts.map

package/esm/models/access-token/access-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/access-token/access-token.model.ts"],"mappings":";;;cAWa,WAAA,SAAoB,KAAK;;AAAtC;;SAIgB,KAAA;EAAA,OAEA,MAAA;AAAA"}
+{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../../@warlock.js/auth/src/models/access-token/access-token.model.ts"],"mappings":";;;;;;AAYA;;;;AAKE;AAYF;cAjBa,iBAAA;;;;;;;;;;;cAiBA,WAAA,SAAoB,KAAA;EAAA,OACjB,KAAA;EAAA,OAEA,MAAA;EAAA;EAAA,IAGH,MAAA;EAKA;EAAA,IAAA,QAAA;EAOe;;;EAAA,OAAZ,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,SAAA,EAAW,IAAA;EAAX;;;EAAA,OAYjC,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,WAAA;EAAA;;;EAAA,OAOpC,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA;EAAA;;;EAAA,OAO1B,gBAAA,CAAiB,IAAA,EAAM,IAAA;EAQjB;;;AAAuB;EAAvB,OAAA,YAAA,IAAgB,OAAA;AAAA"}

package/esm/models/access-token/access-token.model.mjs

@@ -1,14 +1,31 @@
 import { Model } from "@warlock.js/cascade";
 import { v } from "@warlock.js/seal";
 
-//#region ../../@warlock.js/auth/src/models/access-token/access-token.model.ts
+//#region ../@warlock.js/auth/src/models/access-token/access-token.model.ts
+/**
+* Seal schema for the persisted access-token record. Exported so an override
+* can spread it and add columns (e.g. a tenant key) without re-declaring the
+* base shape.
+*
+* `last_access` and the `is_active` soft-revoke flag were removed — neither was
+* ever read; access tokens are revoked by deleting the row.
+*/
 const accessTokenSchema = v.object({
 	token: v.string().required(),
-	last_access: v.date().defaultNow().optional(),
 	user_id: v.scalar().required(),
 	user_type: v.string().required(),
-	is_active: v.boolean().default(true)
+	expires_at: v.date().required()
 });
+/**
+* Persisted access-token record + the data layer for access tokens.
+*
+* **Role.** Owns access-token persistence and lookup. The middleware checks a
+* presented JWT against this table so deleting a row (logout) invalidates the
+* token immediately, before its JWT expiry. The auth service goes through the
+* named statics exclusively, so it never hard-codes a column name and an
+* override can rename/add columns by registering under
+* `config.auth.accessToken.model`.
+*/
 var AccessToken = class extends Model {
 	static {
 		this.table = "access_tokens";
@@ -16,8 +33,57 @@ var AccessToken = class extends Model {
 	static {
 		this.schema = accessTokenSchema;
 	}
+	/** The user this token was issued for. */
+	get userId() {
+		return this.get("user_id");
+	}
+	/** The user-type slug this token was issued for. */
+	get userType() {
+		return this.get("user_type");
+	}
+	/**
+	* Persist a freshly-signed access token for the user.
+	*/
+	static issue(user, token, expiresAt) {
+		return this.create({
+			token,
+			user_id: user.id,
+			user_type: user.userType,
+			expires_at: expiresAt
+		});
+	}
+	/**
+	* Find an access-token row by its raw token string.
+	*/
+	static findByToken(token) {
+		return this.first({ token });
+	}
+	/**
+	* Delete a specific token that belongs to the given user.
+	*/
+	static deleteForUser(user, token) {
+		return this.delete({
+			token,
+			user_id: user.id
+		});
+	}
+	/**
+	* Delete every access token belonging to the user.
+	*/
+	static deleteAllForUser(user) {
+		return this.delete({ user_id: user.id });
+	}
+	/**
+	* Hard-delete every expired access-token row. Returns the number removed.
+	* Runs from the `auth.cleanup` CLI command (a cold batch path).
+	*/
+	static async purgeExpired() {
+		const expiredTokens = await this.query().where("expires_at", "<", /* @__PURE__ */ new Date()).get();
+		for (const token of expiredTokens) await token.destroy();
+		return expiredTokens.length;
+	}
 };
 
 //#endregion
-export { AccessToken };
+export { AccessToken, accessTokenSchema };
 //# sourceMappingURL=access-token.model.mjs.map

package/esm/models/access-token/access-token.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\n\r\nconst accessTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  last_access: v.date().defaultNow().optional(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  is_active: v.boolean().default(true),\r\n});\r\n\r\nexport class AccessToken extends Model {\r\n  /**\r\n   * {@inheritDoc}\r\n   */\r\n  public static table = \"access_tokens\";\r\n\r\n  public static schema = accessTokenSchema;\r\n}\r\n"],"mappings":";;;;AAGA,MAAM,oBAAoB,EAAE,OAAO;CACjC,OAAO,EAAE,OAAO,EAAE,SAAS;CAC3B,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS;CAC5C,SAAS,EAAE,OAAO,EAAE,SAAS;CAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;CAC/B,WAAW,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACrC,CAAC;AAED,IAAa,cAAb,cAAiC,MAAM;;eAIf;;;gBAEC;;AACzB"}
+{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../../@warlock.js/auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/**\n * Seal schema for the persisted access-token record. Exported so an override\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\n * base shape.\n *\n * `last_access` and the `is_active` soft-revoke flag were removed — neither was\n * ever read; access tokens are revoked by deleting the row.\n */\nexport const accessTokenSchema = v.object({\n  token: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  expires_at: v.date().required(),\n});\n\n/**\n * Persisted access-token record + the data layer for access tokens.\n *\n * **Role.** Owns access-token persistence and lookup. The middleware checks a\n * presented JWT against this table so deleting a row (logout) invalidates the\n * token immediately, before its JWT expiry. The auth service goes through the\n * named statics exclusively, so it never hard-codes a column name and an\n * override can rename/add columns by registering under\n * `config.auth.accessToken.model`.\n */\nexport class AccessToken extends Model {\n  public static table = \"access_tokens\";\n\n  public static schema = accessTokenSchema;\n\n  /** The user this token was issued for. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The user-type slug this token was issued for. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /**\n   * Persist a freshly-signed access token for the user.\n   */\n  public static issue(user: Auth, token: string, expiresAt: Date) {\n    return this.create({\n      token,\n      user_id: user.id,\n      user_type: user.userType,\n      expires_at: expiresAt,\n    });\n  }\n\n  /**\n   * Find an access-token row by its raw token string.\n   */\n  public static findByToken(token: string): Promise<AccessToken | null> {\n    return this.first({ token });\n  }\n\n  /**\n   * Delete a specific token that belongs to the given user.\n   */\n  public static deleteForUser(user: Auth, token: string) {\n    return this.delete({ token, user_id: user.id });\n  }\n\n  /**\n   * Delete every access token belonging to the user.\n   */\n  public static deleteAllForUser(user: Auth) {\n    return this.delete({ user_id: user.id });\n  }\n\n  /**\n   * Hard-delete every expired access-token row. Returns the number removed.\n   * Runs from the `auth.cleanup` CLI command (a cold batch path).\n   */\n  public static async purgeExpired(): Promise<number> {\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\n\n    for (const token of expiredTokens) {\n      await token.destroy();\n    }\n\n    return expiredTokens.length;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAa,oBAAoB,EAAE,OAAO;CACxC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;AAYD,IAAa,cAAb,cAAiC,MAAM;;eACf;;;gBAEC;;;CAGvB,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;CAKA,OAAc,MAAM,MAAY,OAAe,WAAiB;EAC9D,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;EACd,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA4C;EACpE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,iBAAiB,MAAY;EACzC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC;CACzC;;;;;CAMA,aAAoB,eAAgC;EAClD,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO,cAAc;CACvB;AACF"}

package/esm/models/access-token/index.d.mts

@@ -1 +1 @@
-import { AccessToken } from "./access-token.model.mjs";
+import { AccessToken, accessTokenSchema } from "./access-token.model.mjs";

package/esm/models/access-token/index.mjs

@@ -1,3 +1,3 @@
-import { AccessToken } from "./access-token.model.mjs";
+import { AccessToken, accessTokenSchema } from "./access-token.model.mjs";
 
 export {  };

package/esm/models/access-token/migration.mjs

@@ -1,17 +1,16 @@
 import { AccessToken } from "./access-token.model.mjs";
 import { migrate } from "@warlock.js/cascade";
 
-//#region ../../@warlock.js/auth/src/models/access-token/migration.ts
+//#region ../@warlock.js/auth/src/models/access-token/migration.ts
 const AccessTokenMigration = migrate(AccessToken, {
 	name: "accessToken",
 	up() {
 		this.createTableIfNotExists();
 		this.primaryUuid();
 		this.text("token").unique();
-		this.timestamp("last_access").nullable();
 		this.uuid("user_id").index();
 		this.string("user_type", 50).nullable();
-		this.boolean("is_active").nullable();
+		this.timestamp("expires_at").index().nullable();
 		this.timestamps();
 	},
 	down() {

package/esm/models/access-token/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/access-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\r\nimport { AccessToken } from \"./access-token.model\";\r\n\r\nexport const AccessTokenMigration = migrate(AccessToken, {\r\n  name: \"accessToken\",\r\n  up() {\r\n    // Create table\r\n    this.createTableIfNotExists();\r\n\r\n    // Primary key\r\n    this.primaryUuid();\r\n\r\n    // Token field\r\n    this.text(\"token\").unique();\r\n    this.timestamp(\"last_access\").nullable();\r\n\r\n    // User reference (flat columns for cross-driver compatibility)\r\n    this.uuid(\"user_id\").index();\r\n    this.string(\"user_type\", 50).nullable();\r\n\r\n    // Status (for token revocation)\r\n    this.boolean(\"is_active\").nullable();\r\n\r\n    // Timestamps\r\n    this.timestamps();\r\n  },\r\n  down() {\r\n    this.dropTableIfExists();\r\n  },\r\n});\r\n"],"mappings":";;;;AAGA,MAAa,uBAAuB,QAAQ,aAAa;CACvD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,EAAE,OAAO;EAC1B,KAAK,UAAU,aAAa,EAAE,SAAS;EAGvC,KAAK,KAAK,SAAS,EAAE,MAAM;EAC3B,KAAK,OAAO,aAAa,EAAE,EAAE,SAAS;EAGtC,KAAK,QAAQ,WAAW,EAAE,SAAS;EAGnC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../@warlock.js/auth/src/models/access-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { AccessToken } from \"./access-token.model\";\n\nexport const AccessTokenMigration = migrate(AccessToken, {\n  name: \"accessToken\",\n  up() {\n    // Create table\n    this.createTableIfNotExists();\n\n    // Primary key\n    this.primaryUuid();\n\n    // Token field\n    this.text(\"token\").unique();\n\n    // User reference (flat columns for cross-driver compatibility)\n    this.uuid(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n\n    // Expiry — enables server-side cleanup of stale access-token rows\n    this.timestamp(\"expires_at\").index().nullable();\n\n    // Timestamps\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,uBAAuB,QAAQ,aAAa;CACvD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,CAAC,CAAC,OAAO;EAG1B,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM;EAC3B,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAGtC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAG9C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/auth.model.d.mts

@@ -1,9 +1,9 @@
-import { RefreshToken } from "./refresh-token/refresh-token.model.mjs";
 import { AccessTokenOutput, DeviceInfo, TokenPair } from "../contracts/types.mjs";
+import { RefreshToken } from "./refresh-token/refresh-token.model.mjs";
 import { Authenticable } from "../contracts/auth-contract.mjs";
 import { ChildModel, Model, ModelSchema } from "@warlock.js/cascade";
 
-//#region ../../@warlock.js/auth/src/models/auth.model.d.ts
+//#region ../@warlock.js/auth/src/models/auth.model.d.ts
 declare abstract class Auth<Schema extends ModelSchema = ModelSchema> extends Model<Schema> implements Authenticable {
   /**
    * Get user type

package/esm/models/auth.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.model.d.mts","names":[],"sources":["../../../../../../@warlock.js/auth/src/models/auth.model.ts"],"mappings":";;;;;;uBAMsB,IAAA,gBAAoB,WAAA,GAAc,WAAA,UAC9C,KAAA,CAAM,MAAA,aACH,aAAA;;AAFb;;eAOsB,QAAA,CAAA;EAPoB;;;EAYjC,kBAAA,CAAA;;;;;EAqBwC;;;EAdlC,eAAA,CAAgB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EA4Bf;;;EArBnC,mBAAA,CAAoB,IAAA,SAAa,OAAA,CAAQ,iBAAA;EA0CvB;;;EAnClB,oBAAA,CAAqB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,YAAA;EA0CJ;;;EAnCnD,iBAAA,CAAkB,KAAA,WAAgB,OAAA;EAtCvB;;;EA6CX,kBAAA,CAAmB,KAAA,WAAgB,OAAA;EA/CM;;;EAsDzC,qBAAA,CAAA,GAAyB,OAAA;EA/ClB;;;EAsDP,eAAA,CAAA,GAAmB,OAAA;;;;EAOnB,cAAA,CAAA,GAAkB,OAAA,CAAQ,YAAA;EAjDgB;;;EAAA,OAwDnC,OAAA,CAAQ,IAAA,EAAM,UAAA,CAAW,IAAA,GAAO,IAAA,QAAY,OAAA,CAAQ,IAAA;EAjD1B;;;EAwDjC,eAAA,CAAgB,QAAA,WAAmB,OAAA;AAAA"}
+{"version":3,"file":"auth.model.d.mts","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/auth.model.ts"],"mappings":";;;;;;uBAMsB,IAAA,gBAAoB,WAAA,GAAc,WAAA,UAC9C,KAAA,CAAM,MAAA,aACH,aAAA;;AAFb;;eAOsB,QAAA;EAPoB;;;EAYjC,kBAAA;;;;;EAqBwC;;;EAdlC,eAAA,CAAgB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EA4Bf;;;EArBnC,mBAAA,CAAoB,IAAA,SAAa,OAAA,CAAQ,iBAAA;EA0CvB;;;EAnClB,oBAAA,CAAqB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,YAAA;EA0CJ;;;EAnCnD,iBAAA,CAAkB,KAAA,WAAgB,OAAA;EAtCvB;;;EA6CX,kBAAA,CAAmB,KAAA,WAAgB,OAAA;EA/CM;;;EAsDzC,qBAAA,IAAyB,OAAA;EA/ClB;;;EAsDP,eAAA,IAAmB,OAAA;;;;EAOnB,cAAA,IAAkB,OAAA,CAAQ,YAAA;EAjDgB;;;EAAA,OAwDnC,OAAA,CAAQ,IAAA,EAAM,UAAA,CAAW,IAAA,GAAO,IAAA,QAAY,OAAA,CAAQ,IAAA;EAjD1B;;;EAwDjC,eAAA,CAAgB,QAAA,WAAmB,OAAA;AAAA"}

package/esm/models/auth.model.mjs

@@ -2,7 +2,7 @@ import { authService } from "../services/auth.service.mjs";
 import "../services/index.mjs";
 import { Model } from "@warlock.js/cascade";
 
-//#region ../../@warlock.js/auth/src/models/auth.model.ts
+//#region ../@warlock.js/auth/src/models/auth.model.ts
 var Auth = class extends Model {
 	/**
 	* Get access token payload

package/esm/models/auth.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.model.mjs","names":[],"sources":["../../../../../../@warlock.js/auth/src/models/auth.model.ts"],"sourcesContent":["import { type ChildModel, Model, type ModelSchema } from \"@warlock.js/cascade\";\r\nimport type { Authenticable } from \"../contracts/auth-contract\";\r\nimport type { AccessTokenOutput, DeviceInfo, TokenPair } from \"../contracts/types\";\r\nimport { authService } from \"../services\";\r\nimport type { RefreshToken } from \"./refresh-token/refresh-token.model\";\r\n\r\nexport abstract class Auth<Schema extends ModelSchema = ModelSchema>\r\n  extends Model<Schema>\r\n  implements Authenticable\r\n{\r\n  /**\r\n   * Get user type\r\n   */\r\n  public abstract get userType(): string;\r\n\r\n  /**\r\n   * Get access token payload\r\n   */\r\n  public accessTokenPayload() {\r\n    return authService.buildAccessTokenPayload(this);\r\n  }\r\n\r\n  /**\r\n   * Create both access and refresh tokens\r\n   */\r\n  public async createTokenPair(deviceInfo?: DeviceInfo): Promise<TokenPair> {\r\n    return authService.createTokenPair(this, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Generate access token\r\n   */\r\n  public async generateAccessToken(data?: any): Promise<AccessTokenOutput> {\r\n    return authService.generateAccessToken(this, data);\r\n  }\r\n\r\n  /**\r\n   * Generate refresh token\r\n   */\r\n  public async generateRefreshToken(deviceInfo?: DeviceInfo): Promise<RefreshToken | undefined> {\r\n    return authService.createRefreshToken(this, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Remove current access token\r\n   */\r\n  public async removeAccessToken(token: string): Promise<void> {\r\n    return authService.removeAccessToken(this, token);\r\n  }\r\n\r\n  /**\r\n   * Remove refresh token\r\n   */\r\n  public async removeRefreshToken(token: string): Promise<void> {\r\n    return authService.removeRefreshToken(this, token);\r\n  }\r\n\r\n  /**\r\n   * Remove all access tokens\r\n   */\r\n  public async removeAllAccessTokens(): Promise<void> {\r\n    return authService.removeAllAccessTokens(this);\r\n  }\r\n\r\n  /**\r\n   * Revoke all tokens (logout from all devices)\r\n   */\r\n  public async revokeAllTokens(): Promise<void> {\r\n    return authService.revokeAllTokens(this);\r\n  }\r\n\r\n  /**\r\n   * Get active sessions\r\n   */\r\n  public async activeSessions(): Promise<RefreshToken[]> {\r\n    return authService.getActiveSessions(this);\r\n  }\r\n\r\n  /**\r\n   * Attempt to login the user\r\n   */\r\n  public static async attempt(this: ChildModel<Auth>, data: any): Promise<Auth | null> {\r\n    return authService.attemptLogin(this, data);\r\n  }\r\n\r\n  /**\r\n   * Confirm password\r\n   */\r\n  public async confirmPassword(password: string): Promise<boolean> {\r\n    return authService.verifyPassword(password, this.string(\"password\")!);\r\n  }\r\n}\r\n"],"mappings":";;;;;AAMA,IAAsB,OAAtB,cACU,MAEV;;;;CASE,AAAO,qBAAqB;EAC1B,OAAO,YAAY,wBAAwB,IAAI;CACjD;;;;CAKA,MAAa,gBAAgB,YAA6C;EACxE,OAAO,YAAY,gBAAgB,MAAM,UAAU;CACrD;;;;CAKA,MAAa,oBAAoB,MAAwC;EACvE,OAAO,YAAY,oBAAoB,MAAM,IAAI;CACnD;;;;CAKA,MAAa,qBAAqB,YAA4D;EAC5F,OAAO,YAAY,mBAAmB,MAAM,UAAU;CACxD;;;;CAKA,MAAa,kBAAkB,OAA8B;EAC3D,OAAO,YAAY,kBAAkB,MAAM,KAAK;CAClD;;;;CAKA,MAAa,mBAAmB,OAA8B;EAC5D,OAAO,YAAY,mBAAmB,MAAM,KAAK;CACnD;;;;CAKA,MAAa,wBAAuC;EAClD,OAAO,YAAY,sBAAsB,IAAI;CAC/C;;;;CAKA,MAAa,kBAAiC;EAC5C,OAAO,YAAY,gBAAgB,IAAI;CACzC;;;;CAKA,MAAa,iBAA0C;EACrD,OAAO,YAAY,kBAAkB,IAAI;CAC3C;;;;CAKA,aAAoB,QAAgC,MAAiC;EACnF,OAAO,YAAY,aAAa,MAAM,IAAI;CAC5C;;;;CAKA,MAAa,gBAAgB,UAAoC;EAC/D,OAAO,YAAY,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE;CACtE;AACF"}
+{"version":3,"file":"auth.model.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/auth.model.ts"],"sourcesContent":["import { type ChildModel, Model, type ModelSchema } from \"@warlock.js/cascade\";\r\nimport type { Authenticable } from \"../contracts/auth-contract\";\r\nimport type { AccessTokenOutput, DeviceInfo, TokenPair } from \"../contracts/types\";\r\nimport { authService } from \"../services\";\r\nimport type { RefreshToken } from \"./refresh-token/refresh-token.model\";\r\n\r\nexport abstract class Auth<Schema extends ModelSchema = ModelSchema>\r\n  extends Model<Schema>\r\n  implements Authenticable\r\n{\r\n  /**\r\n   * Get user type\r\n   */\r\n  public abstract get userType(): string;\r\n\r\n  /**\r\n   * Get access token payload\r\n   */\r\n  public accessTokenPayload() {\r\n    return authService.buildAccessTokenPayload(this);\r\n  }\r\n\r\n  /**\r\n   * Create both access and refresh tokens\r\n   */\r\n  public async createTokenPair(deviceInfo?: DeviceInfo): Promise<TokenPair> {\r\n    return authService.createTokenPair(this, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Generate access token\r\n   */\r\n  public async generateAccessToken(data?: any): Promise<AccessTokenOutput> {\r\n    return authService.generateAccessToken(this, data);\r\n  }\r\n\r\n  /**\r\n   * Generate refresh token\r\n   */\r\n  public async generateRefreshToken(deviceInfo?: DeviceInfo): Promise<RefreshToken | undefined> {\r\n    return authService.createRefreshToken(this, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Remove current access token\r\n   */\r\n  public async removeAccessToken(token: string): Promise<void> {\r\n    return authService.removeAccessToken(this, token);\r\n  }\r\n\r\n  /**\r\n   * Remove refresh token\r\n   */\r\n  public async removeRefreshToken(token: string): Promise<void> {\r\n    return authService.removeRefreshToken(this, token);\r\n  }\r\n\r\n  /**\r\n   * Remove all access tokens\r\n   */\r\n  public async removeAllAccessTokens(): Promise<void> {\r\n    return authService.removeAllAccessTokens(this);\r\n  }\r\n\r\n  /**\r\n   * Revoke all tokens (logout from all devices)\r\n   */\r\n  public async revokeAllTokens(): Promise<void> {\r\n    return authService.revokeAllTokens(this);\r\n  }\r\n\r\n  /**\r\n   * Get active sessions\r\n   */\r\n  public async activeSessions(): Promise<RefreshToken[]> {\r\n    return authService.getActiveSessions(this);\r\n  }\r\n\r\n  /**\r\n   * Attempt to login the user\r\n   */\r\n  public static async attempt(this: ChildModel<Auth>, data: any): Promise<Auth | null> {\r\n    return authService.attemptLogin(this, data);\r\n  }\r\n\r\n  /**\r\n   * Confirm password\r\n   */\r\n  public async confirmPassword(password: string): Promise<boolean> {\r\n    return authService.verifyPassword(password, this.string(\"password\")!);\r\n  }\r\n}\r\n"],"mappings":";;;;;AAMA,IAAsB,OAAtB,cACU,MAEV;;;;CASE,AAAO,qBAAqB;EAC1B,OAAO,YAAY,wBAAwB,IAAI;CACjD;;;;CAKA,MAAa,gBAAgB,YAA6C;EACxE,OAAO,YAAY,gBAAgB,MAAM,UAAU;CACrD;;;;CAKA,MAAa,oBAAoB,MAAwC;EACvE,OAAO,YAAY,oBAAoB,MAAM,IAAI;CACnD;;;;CAKA,MAAa,qBAAqB,YAA4D;EAC5F,OAAO,YAAY,mBAAmB,MAAM,UAAU;CACxD;;;;CAKA,MAAa,kBAAkB,OAA8B;EAC3D,OAAO,YAAY,kBAAkB,MAAM,KAAK;CAClD;;;;CAKA,MAAa,mBAAmB,OAA8B;EAC5D,OAAO,YAAY,mBAAmB,MAAM,KAAK;CACnD;;;;CAKA,MAAa,wBAAuC;EAClD,OAAO,YAAY,sBAAsB,IAAI;CAC/C;;;;CAKA,MAAa,kBAAiC;EAC5C,OAAO,YAAY,gBAAgB,IAAI;CACzC;;;;CAKA,MAAa,iBAA0C;EACrD,OAAO,YAAY,kBAAkB,IAAI;CAC3C;;;;CAKA,aAAoB,QAAgC,MAAiC;EACnF,OAAO,YAAY,aAAa,MAAM,IAAI;CAC5C;;;;CAKA,MAAa,gBAAgB,UAAoC;EAC/D,OAAO,YAAY,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE;CACtE;AACF"}

package/esm/models/index.d.mts

@@ -1,7 +1,8 @@
-import { RefreshToken } from "./refresh-token/refresh-token.model.mjs";
 import { Auth } from "./auth.model.mjs";
-import { AccessToken } from "./access-token/access-token.model.mjs";
-//#region ../../@warlock.js/auth/src/models/index.d.ts
+import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
+import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
+
+//#region ../@warlock.js/auth/src/models/index.d.ts
 declare const authMigrations: any[];
 //#endregion
 export { authMigrations };

package/esm/models/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../@warlock.js/auth/src/models/index.ts"],"mappings":";;;;cAOa,cAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/index.ts"],"mappings":";;;;;cAOa,cAAA"}