@warlock.js/auth 4.1.15 → 4.2.0

package/esm/services/auth.service.d.mts

@@ -1,12 +1,23 @@
-import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import { Auth } from "../models/auth.model.mjs";
 import { AccessTokenOutput, DeviceInfo, LoginResult, TokenPair } from "../contracts/types.mjs";
+import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import { ChildModel } from "@warlock.js/cascade";
 
-//#region ../../@warlock.js/auth/src/services/auth.service.d.ts
+//#region ../@warlock.js/auth/src/services/auth.service.d.ts
 declare class AuthService {
   /**
-   * Build access token payload from user
+   * Resolve the active access-token model — the package default, or a subclass
+   * an app registered under `config.auth.accessToken.model` (e.g. to add a
+   * tenant column). The service never references the concrete class directly so
+   * an override is a pure config change.
+   */
+  private get accessTokenModel();
+  /**
+   * Resolve the active refresh-token model (default or registered override).
+   */
+  private get refreshTokenModel();
+  /**
+   * Build the default access-token JWT payload from a user.
    */
   buildAccessTokenPayload(user: Auth): {
     id: any;
@@ -14,78 +25,85 @@ declare class AuthService {
     created_at: number;
   };
   /**
-   * Generate access token for user
+   * Sign + persist an access token for the user and return the token with its
+   * expiry. The expiry is computed locally from `expiresIn` rather than by
+   * re-verifying the token we just signed.
    */
   generateAccessToken(user: Auth, payload?: any): Promise<AccessTokenOutput>;
   /**
-   * Create refresh token for user
+   * Sign + persist a refresh token for the user (enforcing the per-user cap
+   * first). Resolves to `undefined` when refresh tokens are disabled in config.
    */
   createRefreshToken(user: Auth, deviceInfo?: DeviceInfo): Promise<RefreshToken | undefined>;
   /**
-   * Create both access and refresh tokens
+   * Issue both an access and a refresh token, emitting the creation events.
    */
   createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair>;
   /**
-   * Refresh tokens using a refresh token
+   * Exchange a refresh token for a new token pair, with rotation + replay
+   * detection. A concurrent reuse of the same token loses the atomic revoke and
+   * is treated as a breach — the whole family is revoked and the request fails.
    */
   refreshTokens(refreshTokenString: string, deviceInfo?: DeviceInfo): Promise<TokenPair | null>;
   /**
-   * Verify password
+   * Verify a plaintext password against a stored hash.
    */
   verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean>;
   /**
-   * Hash password
+   * Hash a plaintext password.
    */
   hashPassword(password: string): Promise<string>;
   /**
-   * Attempt to login user with given credentials
+   * Resolve a user by credentials, verifying the password. Returns `null` on a
+   * missing user or a wrong password, emitting `login.failed` either way.
    */
   attemptLogin<T extends Auth>(Model: ChildModel<T>, data: any): Promise<T | null>;
   /**
-   * Full login flow: validate credentials, create tokens, emit events
-   * Returns token pair on success, null on failure
+   * Full login flow: validate credentials, issue tokens, emit events. Returns
+   * the user + token pair on success, `null` on failure.
    */
   login<T extends Auth>(Model: ChildModel<T>, credentials: any, deviceInfo?: DeviceInfo): Promise<LoginResult<T> | null>;
   /**
-   * Logout user
-   * @param user - The authenticated user
-   * @param accessToken - Optional access token string to revoke
-   * @param refreshToken - Optional refresh token string to revoke
-   * If refresh token is not provided, behavior is determined by config:
-   * - "revoke-all" (default): Revoke ALL refresh tokens for security
-   * - "error": Throw error requiring refresh token
+   * Log a user out.
+   *
+   * @param accessToken - access token string to revoke (optional)
+   * @param refreshToken - refresh token string to revoke (optional)
+   *
+   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`
+   * decides the behavior: `"revoke-all"` (default, fail-safe) revokes every
+   * refresh token; `"error"` requires the caller to pass one.
    */
   logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void>;
   /**
-   * Remove specific access token
+   * Remove a specific access token belonging to the user.
    */
   removeAccessToken(user: Auth, token: string): Promise<void>;
   /**
-   * Remove all access tokens for a user
+   * Remove every access token belonging to the user.
    */
   removeAllAccessTokens(user: Auth): Promise<void>;
   /**
-   * Remove specific refresh token
+   * Remove a specific refresh token belonging to the user.
    */
   removeRefreshToken(user: Auth, token: string): Promise<void>;
   /**
-   * Revoke all tokens for a user
+   * Revoke every active refresh token for the user and delete their access
+   * tokens — "log out of all devices". Revocation is a single bulk update; an
+   * event fires per revoked token.
    */
   revokeAllTokens(user: Auth): Promise<void>;
   /**
-   * Revoke entire token family (for rotation breach detection)
+   * Revoke an entire token family — rotation breach containment.
    */
   revokeTokenFamily(familyId: string): Promise<void>;
   /**
-   * Cleanup expired tokens
+   * Delete expired tokens (refresh + access). Emits `token.expired` per refresh
+   * token and `cleanup.completed` with the refresh count. Drives the
+   * `auth.cleanup` CLI command.
    */
   cleanupExpiredTokens(): Promise<number>;
   /**
-   * Enforce max refresh tokens per user
-   */
-  private enforceMaxRefreshTokens;
-  /**
-   * Get active sessions for user
+   * Active, unexpired sessions for the user, newest first.
    */
   getActiveSessions(user: Auth): Promise<RefreshToken[]>;
 }

package/esm/services/auth.service.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../@warlock.js/auth/src/services/auth.service.ts"],"mappings":";;;;;;cAWM,WAAA;;;AAJiD;EAQ9C,uBAAA,CAAwB,IAAA,EAAM,IAAA;;;;;EAWwB;;;EAAhD,mBAAA,CAAoB,IAAA,EAAM,IAAA,EAAM,OAAA,SAAgB,OAAA,CAAQ,iBAAA;EA0BlE;;;EAHU,kBAAA,CACX,IAAA,EAAM,IAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,YAAA;EA2CwD;;;EAAtD,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EAqFC;;;EA1D/D,aAAA,CACX,kBAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,SAAA;EAqEsC;;;EAdpC,cAAA,CAAe,aAAA,UAAuB,cAAA,WAAyB,OAAA;EAwCxD;;;EAjCP,YAAA,CAAa,QAAA,WAAmB,OAAA;EAoClC;;;EA7BE,YAAA,WAAuB,IAAA,CAAA,CAAM,KAAA,EAAO,UAAA,CAAW,CAAA,GAAI,IAAA,QAAY,OAAA,CAAQ,CAAA;EAkG/C;;;;EAzExB,KAAA,WAAgB,IAAA,CAAA,CAC3B,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,OACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EAyFqC;;;;;;;;;EA3D/C,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,WAAA,WAAsB,YAAA,YAAwB,OAAA;EA9OvE;;;EAqRM,iBAAA,CAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;;;;EAU9C,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAA;EApRf;;;EA8RpB,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EAvQ/C;;;EAiRA,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EA/QxC;;;EAsSW,iBAAA,CAAkB,QAAA,WAAmB,OAAA;EA1Pf;;;EA2QtB,oBAAA,CAAA,GAAwB,OAAA;EA3Q8B;;;EAAA,QA4RrD,uBAAA;EA/PC;;;EAuRF,iBAAA,CAAkB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;AAAA;AAAA,cAazC,WAAA,EAAW,WAAoB"}
+{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../../@warlock.js/auth/src/services/auth.service.ts"],"mappings":";;;;;;cAYM,WAAA;;;AALiD;;;;cAYzC,gBAAA;EA2ByD;;;EAAA,YApBzD,iBAAA;EA0CD;;;EAnCJ,uBAAA,CAAwB,IAAA,EAAM,IAAA;;;;;EA0FlC;;;;;EA7EU,mBAAA,CAAoB,IAAA,EAAM,IAAA,EAAM,OAAA,SAAgB,OAAA,CAAQ,iBAAA;EAwJe;;;;EArIvE,kBAAA,CACX,IAAA,EAAM,IAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,YAAA;EA+JI;;;EAvIF,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EAsKjD;;;;;EA1Ib,aAAA,CACX,kBAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,SAAA;EAkL2B;;;EAtHzB,cAAA,CAAe,aAAA,UAAuB,cAAA,WAAyB,OAAA;EA8I1B;;;EAvIrC,YAAA,CAAa,QAAA,WAAmB,OAAA;EAmKD;;;;EA3J/B,YAAA,WAAuB,IAAA,EAAM,KAAA,EAAO,UAAA,CAAW,CAAA,GAAI,IAAA,QAAY,OAAA,CAAQ,CAAA;EArK7E;;;;EA+LM,KAAA,WAAgB,IAAA,EAC3B,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,OACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;;;;;;;;;;;EA8BV,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,WAAA,WAAsB,YAAA,YAAwB,OAAA;EA/L5E;;;EA4NW,iBAAA,CAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EAnMxB;;;EA0MtB,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAA;EA1MmB;;;EAiNtD,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EAnL7C;;;;;EA4LF,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EA/HS;;;EA8ItC,iBAAA,CAAkB,QAAA,WAAmB,OAAA;EAvIL;;;;;EAkJhC,oBAAA,IAAwB,OAAA;EA1IK;;;EA2J7B,iBAAA,CAAkB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;AAAA;AAAA,cAKzC,WAAA,EAAW,WAAoB"}

package/esm/services/auth.service.mjs

@@ -2,16 +2,32 @@ import { AccessToken } from "../models/access-token/access-token.model.mjs";
 import "../models/access-token/index.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import "../models/refresh-token/index.mjs";
+import { authConfig } from "./auth-config.mjs";
 import { authEvents } from "./auth-events.mjs";
 import { jwt } from "./jwt.mjs";
 import { config, hashPassword, verifyPassword } from "@warlock.js/core";
 import { Random } from "@mongez/reinforcements";
 import ms from "ms";
 
-//#region ../../@warlock.js/auth/src/services/auth.service.ts
+//#region ../@warlock.js/auth/src/services/auth.service.ts
 var AuthService = class {
 	/**
-	* Build access token payload from user
+	* Resolve the active access-token model — the package default, or a subclass
+	* an app registered under `config.auth.accessToken.model` (e.g. to add a
+	* tenant column). The service never references the concrete class directly so
+	* an override is a pure config change.
+	*/
+	get accessTokenModel() {
+		return config.key("auth.accessToken.model", AccessToken);
+	}
+	/**
+	* Resolve the active refresh-token model (default or registered override).
+	*/
+	get refreshTokenModel() {
+		return config.key("auth.refreshToken.model", RefreshToken);
+	}
+	/**
+	* Build the default access-token JWT payload from a user.
 	*/
 	buildAccessTokenPayload(user) {
 		return {
@@ -21,54 +37,46 @@ var AuthService = class {
 		};
 	}
 	/**
-	* Generate access token for user
+	* Sign + persist an access token for the user and return the token with its
+	* expiry. The expiry is computed locally from `expiresIn` rather than by
+	* re-verifying the token we just signed.
 	*/
 	async generateAccessToken(user, payload) {
 		const data = payload || this.buildAccessTokenPayload(user);
-		const expiresInConfig = config.key("auth.jwt.expiresIn");
-		const expiresIn = expiresInConfig ? ms(expiresInConfig) : 3600;
+		const expiresInConfig = authConfig.accessToken.expiresIn();
+		const expiresIn = expiresInConfig ? ms(expiresInConfig) : ms("1h");
 		const token = await jwt.generate(data, { expiresIn });
-		const decoed = await jwt.verify(token);
-		await AccessToken.create({
-			token,
-			user_id: user.id,
-			user_type: user.userType
-		});
+		const expiresAt = new Date(Date.now() + expiresIn);
+		await this.accessTokenModel.issue(user, token, expiresAt);
 		return {
 			token,
-			expiresAt: (/* @__PURE__ */ new Date(decoed.exp * 1e3)).toISOString()
+			expiresAt: expiresAt.toISOString()
 		};
 	}
 	/**
-	* Create refresh token for user
+	* Sign + persist a refresh token for the user (enforcing the per-user cap
+	* first). Resolves to `undefined` when refresh tokens are disabled in config.
 	*/
 	async createRefreshToken(user, deviceInfo) {
-		if (config.get("auth.jwt.refresh.enabled") === false) return;
+		if (!authConfig.refreshToken.enabled()) return;
 		const familyId = deviceInfo?.familyId || Random.string(32);
 		const payload = {
 			userId: user.id,
 			userType: user.userType,
 			familyId
 		};
-		const expiresIn = ms(config.get("auth.jwt.refresh.expiresIn", "7d"));
-		const token = await jwt.generateRefreshToken(payload, { expiresIn });
+		const expiresIn = ms(authConfig.refreshToken.expiresIn());
 		const expiresAt = new Date(Date.now() + expiresIn).toISOString();
-		await this.enforceMaxRefreshTokens(user);
-		return RefreshToken.create({
-			token,
-			user_id: user.id,
-			user_type: user.userType,
-			family_id: familyId,
-			expires_at: expiresAt,
-			device_info: deviceInfo ? {
-				userAgent: deviceInfo.userAgent,
-				ip: deviceInfo.ip,
-				deviceId: deviceInfo.deviceId
-			} : void 0
+		await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());
+		const token = await jwt.generateRefreshToken(payload, { expiresIn });
+		return this.refreshTokenModel.issue(user, token, {
+			familyId,
+			expiresAt,
+			deviceInfo
 		});
 	}
 	/**
-	* Create both access and refresh tokens
+	* Issue both an access and a refresh token, emitting the creation events.
 	*/
 	async createTokenPair(user, deviceInfo) {
 		const accessToken = await this.generateAccessToken(user, deviceInfo?.payload);
@@ -85,26 +93,32 @@ var AuthService = class {
 		return tokenPair;
 	}
 	/**
-	* Refresh tokens using a refresh token
+	* Exchange a refresh token for a new token pair, with rotation + replay
+	* detection. A concurrent reuse of the same token loses the atomic revoke and
+	* is treated as a breach — the whole family is revoked and the request fails.
 	*/
 	async refreshTokens(refreshTokenString, deviceInfo) {
 		try {
 			const decoded = await jwt.verifyRefreshToken(refreshTokenString);
 			if (!decoded) return null;
-			const refreshToken = await RefreshToken.first({ token: refreshTokenString });
+			const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);
 			if (!refreshToken?.isValid) {
-				if (refreshToken) await this.revokeTokenFamily(refreshToken.get("family_id"));
+				if (refreshToken) await this.revokeTokenFamily(refreshToken.familyId);
 				return null;
 			}
 			const UserModel = config.key(`auth.userType.${decoded.userType}`);
 			if (!UserModel) return null;
 			const user = await UserModel.find(decoded.userId);
 			if (!user) return null;
-			if (config.key("auth.jwt.refresh.rotation", true)) await refreshToken.revoke();
-			else await refreshToken.markAsUsed();
+			if (authConfig.refreshToken.rotation()) {
+				if (!await refreshToken.revokeIfActive()) {
+					await this.revokeTokenFamily(refreshToken.familyId);
+					return null;
+				}
+			} else await refreshToken.markAsUsed();
 			const newTokenPair = await this.createTokenPair(user, {
 				...deviceInfo,
-				familyId: refreshToken.get("family_id")
+				familyId: refreshToken.familyId
 			});
 			authEvents.emit("token.refreshed", user, newTokenPair, refreshToken);
 			return newTokenPair;
@@ -113,19 +127,20 @@ var AuthService = class {
 		}
 	}
 	/**
-	* Verify password
+	* Verify a plaintext password against a stored hash.
 	*/
 	async verifyPassword(plainPassword, hashedPassword) {
 		return verifyPassword(plainPassword, hashedPassword);
 	}
 	/**
-	* Hash password
+	* Hash a plaintext password.
 	*/
 	async hashPassword(password) {
 		return hashPassword(password);
 	}
 	/**
-	* Attempt to login user with given credentials
+	* Resolve a user by credentials, verifying the password. Returns `null` on a
+	* missing user or a wrong password, emitting `login.failed` either way.
 	*/
 	async attemptLogin(Model, data) {
 		const { password, ...otherData } = data;
@@ -142,13 +157,13 @@ var AuthService = class {
 		return user;
 	}
 	/**
-	* Full login flow: validate credentials, create tokens, emit events
-	* Returns token pair on success, null on failure
+	* Full login flow: validate credentials, issue tokens, emit events. Returns
+	* the user + token pair on success, `null` on failure.
 	*/
 	async login(Model, credentials, deviceInfo) {
 		const user = await this.attemptLogin(Model, credentials);
 		if (!user) return null;
-		if (!config.key("auth.jwt.refresh.enabled", true)) return {
+		if (!authConfig.refreshToken.enabled()) return {
 			user,
 			tokens: { accessToken: await this.generateAccessToken(user, deviceInfo?.payload) }
 		};
@@ -160,112 +175,83 @@ var AuthService = class {
 		};
 	}
 	/**
-	* Logout user
-	* @param user - The authenticated user
-	* @param accessToken - Optional access token string to revoke
-	* @param refreshToken - Optional refresh token string to revoke
-	* If refresh token is not provided, behavior is determined by config:
-	* - "revoke-all" (default): Revoke ALL refresh tokens for security
-	* - "error": Throw error requiring refresh token
+	* Log a user out.
+	*
+	* @param accessToken - access token string to revoke (optional)
+	* @param refreshToken - refresh token string to revoke (optional)
+	*
+	* When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`
+	* decides the behavior: `"revoke-all"` (default, fail-safe) revokes every
+	* refresh token; `"error"` requires the caller to pass one.
 	*/
 	async logout(user, accessToken, refreshToken) {
 		if (accessToken) await this.removeAccessToken(user, accessToken);
 		if (refreshToken) {
-			const token = await RefreshToken.first({
-				token: refreshToken,
-				userId: user.id
-			});
+			const token = await this.refreshTokenModel.findForUser(user, refreshToken);
 			if (token) {
 				await token.revoke();
 				authEvents.emit("session.destroyed", user, token);
 			}
 		} else {
-			if (config.key("auth.jwt.refresh.logoutWithoutToken", "revoke-all") === "error") throw new Error("Refresh token required for logout");
+			if (authConfig.refreshToken.logoutWithoutToken() === "error") throw new Error("Refresh token required for logout");
 			await this.revokeAllTokens(user);
 			authEvents.emit("logout.failsafe", user);
 		}
 		authEvents.emit("logout", user);
 	}
 	/**
-	* Remove specific access token
+	* Remove a specific access token belonging to the user.
 	*/
 	async removeAccessToken(user, token) {
-		AccessToken.delete({
-			token,
-			userId: user.id
-		});
+		await this.accessTokenModel.deleteForUser(user, token);
 	}
 	/**
-	* Remove all access tokens for a user
+	* Remove every access token belonging to the user.
 	*/
 	async removeAllAccessTokens(user) {
-		AccessToken.delete({ user_id: user.id });
+		await this.accessTokenModel.deleteAllForUser(user);
 	}
 	/**
-	* Remove specific refresh token
+	* Remove a specific refresh token belonging to the user.
 	*/
 	async removeRefreshToken(user, token) {
-		RefreshToken.delete({
-			token,
-			userId: user.id
-		});
+		await this.refreshTokenModel.deleteForUser(user, token);
 	}
 	/**
-	* Revoke all tokens for a user
+	* Revoke every active refresh token for the user and delete their access
+	* tokens — "log out of all devices". Revocation is a single bulk update; an
+	* event fires per revoked token.
 	*/
 	async revokeAllTokens(user) {
-		const refreshTokens = await RefreshToken.query().where("user_id", user.id).where("user_type", user.userType).where("revoked_at", null).get();
-		for (const token of refreshTokens) {
-			await token.revoke();
-			authEvents.emit("token.revoked", user, token);
-		}
+		const revokedTokens = await this.refreshTokenModel.revokeAllFor(user);
+		for (const token of revokedTokens) authEvents.emit("token.revoked", user, token);
 		await this.removeAllAccessTokens(user);
 		authEvents.emit("logout.all", user);
 	}
 	/**
-	* Revoke entire token family (for rotation breach detection)
+	* Revoke an entire token family — rotation breach containment.
 	*/
 	async revokeTokenFamily(familyId) {
-		const tokens = await RefreshToken.query().where("family_id", familyId).where("revoked_at", null).get();
-		for (const token of tokens) await token.revoke();
-		authEvents.emit("token.familyRevoked", familyId, tokens);
+		const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);
+		authEvents.emit("token.familyRevoked", familyId, revokedTokens);
 	}
 	/**
-	* Cleanup expired tokens
+	* Delete expired tokens (refresh + access). Emits `token.expired` per refresh
+	* token and `cleanup.completed` with the refresh count. Drives the
+	* `auth.cleanup` CLI command.
 	*/
 	async cleanupExpiredTokens() {
-		const expiredTokens = await RefreshToken.query().where("expires_at", "<", /* @__PURE__ */ new Date()).get();
-		for (const token of expiredTokens) {
-			authEvents.emit("token.expired", token);
-			await token.destroy();
-		}
+		const expiredTokens = await this.refreshTokenModel.purgeExpired();
+		for (const token of expiredTokens) authEvents.emit("token.expired", token);
+		await this.accessTokenModel.purgeExpired();
 		authEvents.emit("cleanup.completed", expiredTokens.length);
 		return expiredTokens.length;
 	}
 	/**
-	* Enforce max refresh tokens per user
-	*/
-	async enforceMaxRefreshTokens(user) {
-		const maxPerUser = config.key("auth.jwt.refresh.maxPerUser", 5);
-		const activeTokens = await RefreshToken.query().where({
-			user_id: user.id,
-			user_type: user.userType,
-			revoked_at: null
-		}).orderBy("created_at", "asc").get();
-		if (activeTokens.length >= maxPerUser) {
-			const tokensToRevoke = activeTokens.slice(0, activeTokens.length - maxPerUser + 1);
-			for (const token of tokensToRevoke) await token.revoke();
-		}
-	}
-	/**
-	* Get active sessions for user
+	* Active, unexpired sessions for the user, newest first.
 	*/
 	async getActiveSessions(user) {
-		return RefreshToken.query().where({
-			user_id: user.id,
-			user_type: user.userType,
-			revoked_at: null
-		}).where("expires_at", ">", /* @__PURE__ */ new Date()).orderBy("created_at", "desc").get();
+		return this.refreshTokenModel.activeFor(user);
 	}
 };
 const authService = new AuthService();

package/esm/services/auth.service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../@warlock.js/auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\nimport type { ChildModel } from \"@warlock.js/cascade\";\nimport { config, hashPassword, verifyPassword } from \"@warlock.js/core\";\nimport ms from \"ms\";\nimport type { AccessTokenOutput, DeviceInfo, LoginResult, TokenPair } from \"../contracts/types\";\nimport { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport { RefreshToken } from \"../models/refresh-token\";\nimport { authEvents } from \"./auth-events\";\nimport { jwt } from \"./jwt\";\n\nclass AuthService {\n  /**\n   * Build access token payload from user\n   */\n  public buildAccessTokenPayload(user: Auth) {\n    return {\n      id: user.id,\n      userType: user.userType,\n      created_at: Date.now(),\n    };\n  }\n\n  /**\n   * Generate access token for user\n   */\n  public async generateAccessToken(user: Auth, payload?: any): Promise<AccessTokenOutput> {\n    const data = payload || this.buildAccessTokenPayload(user);\n    const expiresInConfig = config.key(\"auth.jwt.expiresIn\");\n    const expiresIn = expiresInConfig ? ms(expiresInConfig) : 3_600; // default 1 hour\n\n    // If expiresIn is undefined, token never expires\n    const token = await jwt.generate(data, { expiresIn });\n\n    const decoed = await jwt.verify(token);\n\n    // Store in database\n    await AccessToken.create({\n      token,\n      user_id: user.id,\n      user_type: user.userType,\n    });\n\n    return { token, expiresAt: new Date(decoed.exp * 1_000).toISOString() };\n  }\n\n  /**\n   * Create refresh token for user\n   */\n  public async createRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (config.get(\"auth.jwt.refresh.enabled\") === false) return;\n\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const payload = {\n      userId: user.id,\n      userType: user.userType,\n      familyId,\n    };\n\n    const epireTime = config.get(\"auth.jwt.refresh.expiresIn\", \"7d\");\n\n    const expiresIn = ms(epireTime);\n\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\n\n    // Calculate expiration date (undefined means never expires, but we still set a far future date)\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\n\n    // Enforce max tokens per user\n    await this.enforceMaxRefreshTokens(user);\n\n    // Store in database\n    return RefreshToken.create({\n      token,\n      user_id: user.id,\n      user_type: user.userType,\n      family_id: familyId,\n      expires_at: expiresAt,\n      device_info: deviceInfo\n        ? {\n            userAgent: deviceInfo.userAgent,\n            ip: deviceInfo.ip,\n            deviceId: deviceInfo.deviceId,\n          }\n        : undefined,\n    });\n  }\n\n  /**\n   * Create both access and refresh tokens\n   */\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    const accessToken = await this.generateAccessToken(user, deviceInfo?.payload);\n    const refreshToken = await this.createRefreshToken(user, deviceInfo);\n\n    const tokenPair: TokenPair = {\n      accessToken,\n      refreshToken: refreshToken\n        ? {\n            token: refreshToken.get(\"token\"),\n            expiresAt: refreshToken.get(\"expires_at\"),\n          }\n        : undefined,\n    };\n\n    // Emit events\n    authEvents.emit(\"token.created\", user, tokenPair);\n\n    if (refreshToken) {\n      authEvents.emit(\"session.created\", user, refreshToken, deviceInfo);\n    }\n\n    return tokenPair;\n  }\n\n  /**\n   * Refresh tokens using a refresh token\n   */\n  public async refreshTokens(\n    refreshTokenString: string,\n    deviceInfo?: DeviceInfo,\n  ): Promise<TokenPair | null> {\n    try {\n      // 1. Verify JWT signature\n      const decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n\n      if (!decoded) return null;\n\n      // 2. Find token in database\n      const refreshToken = await RefreshToken.first({ token: refreshTokenString });\n\n      if (!refreshToken?.isValid) {\n        // If token was already used (rotation detection), revoke entire family\n        if (refreshToken) {\n          await this.revokeTokenFamily(refreshToken.get(\"family_id\"));\n        }\n        return null;\n      }\n\n      // 3. Get user model and find user\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n      if (!UserModel) return null;\n\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n      if (!user) return null;\n\n      // 4. Rotate token if enabled (revoke old token)\n      const rotationEnabled = config.key(\"auth.jwt.refresh.rotation\", true);\n      if (rotationEnabled) {\n        await refreshToken.revoke();\n      } else {\n        await refreshToken.markAsUsed();\n      }\n\n      // 5. Generate new token pair (keep same family)\n      const newTokenPair = await this.createTokenPair(user, {\n        ...deviceInfo,\n        familyId: refreshToken.get(\"family_id\"),\n      });\n\n      // Emit token refreshed event\n      authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken);\n\n      return newTokenPair;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Verify password\n   */\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\n    return verifyPassword(plainPassword, hashedPassword);\n  }\n\n  /**\n   * Hash password\n   */\n  public async hashPassword(password: string): Promise<string> {\n    return hashPassword(password);\n  }\n\n  /**\n   * Attempt to login user with given credentials\n   */\n  public async attemptLogin<T extends Auth>(Model: ChildModel<T>, data: any): Promise<T | null> {\n    const { password, ...otherData } = data;\n\n    // Emit login attempt event\n    authEvents.emit(\"login.attempt\", otherData);\n\n    const user = (await Model.first(otherData)) as T | null;\n\n    if (!user) {\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\n      return null;\n    }\n\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\n      return null;\n    }\n\n    return user;\n  }\n\n  /**\n   * Full login flow: validate credentials, create tokens, emit events\n   * Returns token pair on success, null on failure\n   */\n  public async login<T extends Auth>(\n    Model: ChildModel<T>,\n    credentials: any,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    const user = await this.attemptLogin(Model, credentials);\n\n    if (!user) {\n      return null;\n    }\n\n    // if no refresh token in config, then return user and access token only\n    if (!config.key(\"auth.jwt.refresh.enabled\", true)) {\n      const accessToken = await this.generateAccessToken(user, deviceInfo?.payload);\n      return { user, tokens: { accessToken } };\n    }\n\n    const tokens = await this.createTokenPair(user, deviceInfo);\n\n    // Emit login success event\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\n\n    return { user, tokens } as LoginResult<T>;\n  }\n\n  /**\n   * Logout user\n   * @param user - The authenticated user\n   * @param accessToken - Optional access token string to revoke\n   * @param refreshToken - Optional refresh token string to revoke\n   * If refresh token is not provided, behavior is determined by config:\n   * - \"revoke-all\" (default): Revoke ALL refresh tokens for security\n   * - \"error\": Throw error requiring refresh token\n   */\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\n    // Remove access token if provided\n    if (accessToken) {\n      await this.removeAccessToken(user, accessToken);\n    }\n\n    if (refreshToken) {\n      // Revoke specific refresh token\n      const token = await RefreshToken.first({\n        token: refreshToken,\n        userId: user.id, // Security: ensure token belongs to this user\n      });\n\n      if (token) {\n        await token.revoke();\n        authEvents.emit(\"session.destroyed\", user, token);\n      }\n    } else {\n      // No refresh token provided - check configured behavior\n      const behavior = config.key(\"auth.jwt.refresh.logoutWithoutToken\", \"revoke-all\") as\n        | \"revoke-all\"\n        | \"error\";\n\n      if (behavior === \"error\") {\n        throw new Error(\"Refresh token required for logout\");\n      }\n\n      // Default: revoke-all (fail-safe)\n      await this.revokeAllTokens(user);\n      authEvents.emit(\"logout.failsafe\", user);\n    }\n\n    // Emit logout event\n    authEvents.emit(\"logout\", user);\n  }\n\n  /**\n   * Remove specific access token\n   */\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\n    AccessToken.delete({\n      token,\n      userId: user.id,\n    });\n  }\n\n  /**\n   * Remove all access tokens for a user\n   */\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\n    // Delete access token\n    AccessToken.delete({\n      user_id: user.id,\n    });\n  }\n\n  /**\n   * Remove specific refresh token\n   */\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\n    RefreshToken.delete({\n      token,\n      userId: user.id,\n    });\n  }\n\n  /**\n   * Revoke all tokens for a user\n   */\n  public async revokeAllTokens(user: Auth): Promise<void> {\n    // Revoke all refresh tokens\n    const refreshTokens = await RefreshToken.query()\n      .where(\"user_id\", user.id)\n      .where(\"user_type\", user.userType)\n      .where(\"revoked_at\", null)\n      .get();\n\n    for (const token of refreshTokens) {\n      await token.revoke();\n      authEvents.emit(\"token.revoked\", user, token);\n    }\n\n    // Delete all access tokens\n    await this.removeAllAccessTokens(user);\n\n    // Emit logout all event\n    authEvents.emit(\"logout.all\", user);\n  }\n\n  /**\n   * Revoke entire token family (for rotation breach detection)\n   */\n  public async revokeTokenFamily(familyId: string): Promise<void> {\n    const tokens = await RefreshToken.query()\n      .where(\"family_id\", familyId)\n      .where(\"revoked_at\", null)\n      .get();\n\n    for (const token of tokens) {\n      await token.revoke();\n    }\n\n    // Emit family revoked event\n    authEvents.emit(\"token.familyRevoked\", familyId, tokens);\n  }\n\n  /**\n   * Cleanup expired tokens\n   */\n  public async cleanupExpiredTokens(): Promise<number> {\n    const expiredTokens = await RefreshToken.query().where(\"expires_at\", \"<\", new Date()).get();\n\n    for (const token of expiredTokens) {\n      authEvents.emit(\"token.expired\", token);\n      await token.destroy();\n    }\n\n    // Emit cleanup completed event\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\n\n    return expiredTokens.length;\n  }\n\n  /**\n   * Enforce max refresh tokens per user\n   */\n  private async enforceMaxRefreshTokens(user: Auth): Promise<void> {\n    const maxPerUser = config.key(\"auth.jwt.refresh.maxPerUser\", 5);\n\n    const activeTokens = await RefreshToken.query()\n      .where({\n        user_id: user.id,\n        user_type: user.userType,\n        revoked_at: null,\n      })\n      .orderBy(\"created_at\", \"asc\")\n      .get();\n\n    // Revoke oldest tokens if exceeding limit\n    if (activeTokens.length >= maxPerUser) {\n      const tokensToRevoke = activeTokens.slice(0, activeTokens.length - maxPerUser + 1);\n      for (const token of tokensToRevoke) {\n        await token.revoke();\n      }\n    }\n  }\n\n  /**\n   * Get active sessions for user\n   */\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\n    return RefreshToken.query()\n      .where({\n        user_id: user.id,\n        user_type: user.userType,\n        revoked_at: null,\n      })\n      .where(\"expires_at\", \">\", new Date())\n      .orderBy(\"created_at\", \"desc\")\n      .get();\n  }\n}\n\nexport const authService = new AuthService();\n"],"mappings":";;;;;;;;;;;AAWA,IAAM,cAAN,MAAkB;;;;CAIhB,AAAO,wBAAwB,MAAY;EACzC,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;;;CAKA,MAAa,oBAAoB,MAAY,SAA2C;EACtF,MAAM,OAAO,WAAW,KAAK,wBAAwB,IAAI;EACzD,MAAM,kBAAkB,OAAO,IAAI,oBAAoB;EACvD,MAAM,YAAY,kBAAkB,GAAG,eAAe,IAAI;EAG1D,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EAEpD,MAAM,SAAS,MAAM,IAAI,OAAO,KAAK;EAGrC,MAAM,YAAY,OAAO;GACvB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;EAClB,CAAC;EAED,OAAO;GAAE;GAAO,4BAAW,IAAI,KAAK,OAAO,MAAM,GAAK,GAAE,YAAY;EAAE;CACxE;;;;CAKA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,OAAO,IAAI,0BAA0B,MAAM,OAAO;EAEtD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;EACF;EAIA,MAAM,YAAY,GAFA,OAAO,IAAI,8BAA8B,IAE9B,CAAC;EAE9B,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAGnE,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,EAAE,YAAY;EAG/D,MAAM,KAAK,wBAAwB,IAAI;EAGvC,OAAO,aAAa,OAAO;GACzB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,WAAW;GACX,YAAY;GACZ,aAAa,aACT;IACE,WAAW,WAAW;IACtB,IAAI,WAAW;IACf,UAAU,WAAW;GACvB,IACA;EACN,CAAC;CACH;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,cAAc,MAAM,KAAK,oBAAoB,MAAM,YAAY,OAAO;EAC5E,MAAM,eAAe,MAAM,KAAK,mBAAmB,MAAM,UAAU;EAEnE,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAGA,WAAW,KAAK,iBAAiB,MAAM,SAAS;EAEhD,IAAI,cACF,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU;EAGnE,OAAO;CACT;;;;CAKA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;GAEF,MAAM,UAAU,MAAM,IAAI,mBAIvB,kBAAkB;GAErB,IAAI,CAAC,SAAS,OAAO;GAGrB,MAAM,eAAe,MAAM,aAAa,MAAM,EAAE,OAAO,mBAAmB,CAAC;GAE3E,IAAI,CAAC,cAAc,SAAS;IAE1B,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,IAAI,WAAW,CAAC;IAE5D,OAAO;GACT;GAGA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAChE,IAAI,CAAC,WAAW,OAAO;GAEvB,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GACjD,IAAI,CAAC,MAAM,OAAO;GAIlB,IADwB,OAAO,IAAI,6BAA6B,IAC9C,GAChB,MAAM,aAAa,OAAO;QAE1B,MAAM,aAAa,WAAW;GAIhC,MAAM,eAAe,MAAM,KAAK,gBAAgB,MAAM;IACpD,GAAG;IACH,UAAU,aAAa,IAAI,WAAW;GACxC,CAAC;GAGD,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY;GAEnE,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;CAKA,MAAa,aAA6B,OAAsB,MAA8B;EAC5F,MAAM,EAAE,UAAU,GAAG,cAAc;EAGnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAC3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAC7D,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAIT,IAAI,CAAC,OAAO,IAAI,4BAA4B,IAAI,GAE9C,OAAO;GAAE;GAAM,QAAQ,EAAE,mBADC,KAAK,oBAAoB,MAAM,YAAY,OAAO,EACvC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,gBAAgB,MAAM,UAAU;EAG1D,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;CAWA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAE1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAEhB,MAAM,QAAQ,MAAM,aAAa,MAAM;IACrC,OAAO;IACP,QAAQ,KAAK;GACf,CAAC;GAED,IAAI,OAAO;IACT,MAAM,MAAM,OAAO;IACnB,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAML,IAJiB,OAAO,IAAI,uCAAuC,YAIxD,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAIrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAGA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,YAAY,OAAO;GACjB;GACA,QAAQ,KAAK;EACf,CAAC;CACH;;;;CAKA,MAAa,sBAAsB,MAA2B;EAE5D,YAAY,OAAO,EACjB,SAAS,KAAK,GAChB,CAAC;CACH;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,aAAa,OAAO;GAClB;GACA,QAAQ,KAAK;EACf,CAAC;CACH;;;;CAKA,MAAa,gBAAgB,MAA2B;EAEtD,MAAM,gBAAgB,MAAM,aAAa,MAAM,EAC5C,MAAM,WAAW,KAAK,EAAE,EACxB,MAAM,aAAa,KAAK,QAAQ,EAChC,MAAM,cAAc,IAAI,EACxB,IAAI;EAEP,KAAK,MAAM,SAAS,eAAe;GACjC,MAAM,MAAM,OAAO;GACnB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAC9C;EAGA,MAAM,KAAK,sBAAsB,IAAI;EAGrC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,MAAM,SAAS,MAAM,aAAa,MAAM,EACrC,MAAM,aAAa,QAAQ,EAC3B,MAAM,cAAc,IAAI,EACxB,IAAI;EAEP,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAIrB,WAAW,KAAK,uBAAuB,UAAU,MAAM;CACzD;;;;CAKA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,aAAa,MAAM,EAAE,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,EAAE,IAAI;EAE1F,KAAK,MAAM,SAAS,eAAe;GACjC,WAAW,KAAK,iBAAiB,KAAK;GACtC,MAAM,MAAM,QAAQ;EACtB;EAGA,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;CAKA,MAAc,wBAAwB,MAA2B;EAC/D,MAAM,aAAa,OAAO,IAAI,+BAA+B,CAAC;EAE9D,MAAM,eAAe,MAAM,aAAa,MAAM,EAC3C,MAAM;GACL,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;EACd,CAAC,EACA,QAAQ,cAAc,KAAK,EAC3B,IAAI;EAGP,IAAI,aAAa,UAAU,YAAY;GACrC,MAAM,iBAAiB,aAAa,MAAM,GAAG,aAAa,SAAS,aAAa,CAAC;GACjF,KAAK,MAAM,SAAS,gBAClB,MAAM,MAAM,OAAO;EAEvB;CACF;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,aAAa,MAAM,EACvB,MAAM;GACL,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;EACd,CAAC,EACA,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,EACnC,QAAQ,cAAc,MAAM,EAC5B,IAAI;CACT;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}
+{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\nimport type { ChildModel } from \"@warlock.js/cascade\";\nimport { config, hashPassword, verifyPassword } from \"@warlock.js/core\";\nimport ms from \"ms\";\nimport type { AccessTokenOutput, DeviceInfo, LoginResult, TokenPair } from \"../contracts/types\";\nimport { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport { RefreshToken } from \"../models/refresh-token\";\nimport { authConfig } from \"./auth-config\";\nimport { authEvents } from \"./auth-events\";\nimport { jwt } from \"./jwt\";\n\nclass AuthService {\n  /**\n   * Resolve the active access-token model — the package default, or a subclass\n   * an app registered under `config.auth.accessToken.model` (e.g. to add a\n   * tenant column). The service never references the concrete class directly so\n   * an override is a pure config change.\n   */\n  private get accessTokenModel(): typeof AccessToken {\n    return config.key(\"auth.accessToken.model\", AccessToken);\n  }\n\n  /**\n   * Resolve the active refresh-token model (default or registered override).\n   */\n  private get refreshTokenModel(): typeof RefreshToken {\n    return config.key(\"auth.refreshToken.model\", RefreshToken);\n  }\n\n  /**\n   * Build the default access-token JWT payload from a user.\n   */\n  public buildAccessTokenPayload(user: Auth) {\n    return {\n      id: user.id,\n      userType: user.userType,\n      created_at: Date.now(),\n    };\n  }\n\n  /**\n   * Sign + persist an access token for the user and return the token with its\n   * expiry. The expiry is computed locally from `expiresIn` rather than by\n   * re-verifying the token we just signed.\n   */\n  public async generateAccessToken(user: Auth, payload?: any): Promise<AccessTokenOutput> {\n    const data = payload || this.buildAccessTokenPayload(user);\n    const expiresInConfig = authConfig.accessToken.expiresIn();\n    const expiresIn = expiresInConfig\n      ? ms(expiresInConfig as ms.StringValue)\n      : ms(\"1h\"); // default 1 hour\n\n    const token = await jwt.generate(data, { expiresIn });\n    const expiresAt = new Date(Date.now() + expiresIn);\n\n    await this.accessTokenModel.issue(user, token, expiresAt);\n\n    return { token, expiresAt: expiresAt.toISOString() };\n  }\n\n  /**\n   * Sign + persist a refresh token for the user (enforcing the per-user cap\n   * first). Resolves to `undefined` when refresh tokens are disabled in config.\n   */\n  public async createRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const payload = {\n      userId: user.id,\n      userType: user.userType,\n      familyId,\n    };\n\n    const expiresIn = ms(authConfig.refreshToken.expiresIn() as ms.StringValue);\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\n\n    await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());\n\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\n\n    return this.refreshTokenModel.issue(user, token, { familyId, expiresAt, deviceInfo });\n  }\n\n  /**\n   * Issue both an access and a refresh token, emitting the creation events.\n   */\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    const accessToken = await this.generateAccessToken(user, deviceInfo?.payload);\n    const refreshToken = await this.createRefreshToken(user, deviceInfo);\n\n    const tokenPair: TokenPair = {\n      accessToken,\n      refreshToken: refreshToken\n        ? {\n            token: refreshToken.get(\"token\"),\n            expiresAt: refreshToken.get(\"expires_at\"),\n          }\n        : undefined,\n    };\n\n    authEvents.emit(\"token.created\", user, tokenPair);\n\n    if (refreshToken) {\n      authEvents.emit(\"session.created\", user, refreshToken, deviceInfo);\n    }\n\n    return tokenPair;\n  }\n\n  /**\n   * Exchange a refresh token for a new token pair, with rotation + replay\n   * detection. A concurrent reuse of the same token loses the atomic revoke and\n   * is treated as a breach — the whole family is revoked and the request fails.\n   */\n  public async refreshTokens(\n    refreshTokenString: string,\n    deviceInfo?: DeviceInfo,\n  ): Promise<TokenPair | null> {\n    try {\n      const decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n\n      if (!decoded) return null;\n\n      const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n\n      if (!refreshToken?.isValid) {\n        // Already-invalid token presented → likely a replayed (rotated) token.\n        if (refreshToken) {\n          await this.revokeTokenFamily(refreshToken.familyId);\n        }\n\n        return null;\n      }\n\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n\n      if (!UserModel) return null;\n\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n\n      if (!user) return null;\n\n      const rotationEnabled = authConfig.refreshToken.rotation();\n\n      if (rotationEnabled) {\n        const won = await refreshToken.revokeIfActive();\n\n        if (!won) {\n          // A concurrent request already rotated this token (reuse / replay).\n          await this.revokeTokenFamily(refreshToken.familyId);\n\n          return null;\n        }\n      } else {\n        await refreshToken.markAsUsed();\n      }\n\n      const newTokenPair = await this.createTokenPair(user, {\n        ...deviceInfo,\n        familyId: refreshToken.familyId,\n      });\n\n      authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken);\n\n      return newTokenPair;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Verify a plaintext password against a stored hash.\n   */\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\n    return verifyPassword(plainPassword, hashedPassword);\n  }\n\n  /**\n   * Hash a plaintext password.\n   */\n  public async hashPassword(password: string): Promise<string> {\n    return hashPassword(password);\n  }\n\n  /**\n   * Resolve a user by credentials, verifying the password. Returns `null` on a\n   * missing user or a wrong password, emitting `login.failed` either way.\n   */\n  public async attemptLogin<T extends Auth>(Model: ChildModel<T>, data: any): Promise<T | null> {\n    const { password, ...otherData } = data;\n\n    authEvents.emit(\"login.attempt\", otherData);\n\n    const user = (await Model.first(otherData)) as T | null;\n\n    if (!user) {\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\n\n      return null;\n    }\n\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\n\n      return null;\n    }\n\n    return user;\n  }\n\n  /**\n   * Full login flow: validate credentials, issue tokens, emit events. Returns\n   * the user + token pair on success, `null` on failure.\n   */\n  public async login<T extends Auth>(\n    Model: ChildModel<T>,\n    credentials: any,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    const user = await this.attemptLogin(Model, credentials);\n\n    if (!user) {\n      return null;\n    }\n\n    if (!authConfig.refreshToken.enabled()) {\n      const accessToken = await this.generateAccessToken(user, deviceInfo?.payload);\n\n      return { user, tokens: { accessToken } };\n    }\n\n    const tokens = await this.createTokenPair(user, deviceInfo);\n\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\n\n    return { user, tokens } as LoginResult<T>;\n  }\n\n  /**\n   * Log a user out.\n   *\n   * @param accessToken - access token string to revoke (optional)\n   * @param refreshToken - refresh token string to revoke (optional)\n   *\n   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`\n   * decides the behavior: `\"revoke-all\"` (default, fail-safe) revokes every\n   * refresh token; `\"error\"` requires the caller to pass one.\n   */\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\n    if (accessToken) {\n      await this.removeAccessToken(user, accessToken);\n    }\n\n    if (refreshToken) {\n      const token = await this.refreshTokenModel.findForUser(user, refreshToken);\n\n      if (token) {\n        await token.revoke();\n        authEvents.emit(\"session.destroyed\", user, token);\n      }\n    } else {\n      const behavior = authConfig.refreshToken.logoutWithoutToken();\n\n      if (behavior === \"error\") {\n        throw new Error(\"Refresh token required for logout\");\n      }\n\n      await this.revokeAllTokens(user);\n      authEvents.emit(\"logout.failsafe\", user);\n    }\n\n    authEvents.emit(\"logout\", user);\n  }\n\n  /**\n   * Remove a specific access token belonging to the user.\n   */\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\n    await this.accessTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Remove every access token belonging to the user.\n   */\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\n    await this.accessTokenModel.deleteAllForUser(user);\n  }\n\n  /**\n   * Remove a specific refresh token belonging to the user.\n   */\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\n    await this.refreshTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Revoke every active refresh token for the user and delete their access\n   * tokens — \"log out of all devices\". Revocation is a single bulk update; an\n   * event fires per revoked token.\n   */\n  public async revokeAllTokens(user: Auth): Promise<void> {\n    const revokedTokens = await this.refreshTokenModel.revokeAllFor(user);\n\n    for (const token of revokedTokens) {\n      authEvents.emit(\"token.revoked\", user, token);\n    }\n\n    await this.removeAllAccessTokens(user);\n\n    authEvents.emit(\"logout.all\", user);\n  }\n\n  /**\n   * Revoke an entire token family — rotation breach containment.\n   */\n  public async revokeTokenFamily(familyId: string): Promise<void> {\n    const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n\n    authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens);\n  }\n\n  /**\n   * Delete expired tokens (refresh + access). Emits `token.expired` per refresh\n   * token and `cleanup.completed` with the refresh count. Drives the\n   * `auth.cleanup` CLI command.\n   */\n  public async cleanupExpiredTokens(): Promise<number> {\n    const expiredTokens = await this.refreshTokenModel.purgeExpired();\n\n    for (const token of expiredTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    await this.accessTokenModel.purgeExpired();\n\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\n\n    return expiredTokens.length;\n  }\n\n  /**\n   * Active, unexpired sessions for the user, newest first.\n   */\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\n    return this.refreshTokenModel.activeFor(user);\n  }\n}\n\nexport const authService = new AuthService();\n"],"mappings":";;;;;;;;;;;;AAYA,IAAM,cAAN,MAAkB;;;;;;;CAOhB,IAAY,mBAAuC;EACjD,OAAO,OAAO,IAAI,0BAA0B,WAAW;CACzD;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,AAAO,wBAAwB,MAAY;EACzC,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;;;;;CAOA,MAAa,oBAAoB,MAAY,SAA2C;EACtF,MAAM,OAAO,WAAW,KAAK,wBAAwB,IAAI;EACzD,MAAM,kBAAkB,WAAW,YAAY,UAAU;EACzD,MAAM,YAAY,kBACd,GAAG,eAAiC,IACpC,GAAG,IAAI;EAEX,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EACpD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;EAEjD,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,SAAS;EAExD,OAAO;GAAE;GAAO,WAAW,UAAU,YAAY;EAAE;CACrD;;;;;CAMA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAExC,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;EACF;EAEA,MAAM,YAAY,GAAG,WAAW,aAAa,UAAU,CAAmB;EAC1E,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,YAAY;EAE/D,MAAM,KAAK,kBAAkB,WAAW,MAAM,WAAW,aAAa,WAAW,CAAC;EAElF,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAEnE,OAAO,KAAK,kBAAkB,MAAM,MAAM,OAAO;GAAE;GAAU;GAAW;EAAW,CAAC;CACtF;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,cAAc,MAAM,KAAK,oBAAoB,MAAM,YAAY,OAAO;EAC5E,MAAM,eAAe,MAAM,KAAK,mBAAmB,MAAM,UAAU;EAEnE,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAEA,WAAW,KAAK,iBAAiB,MAAM,SAAS;EAEhD,IAAI,cACF,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU;EAGnE,OAAO;CACT;;;;;;CAOA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;GACF,MAAM,UAAU,MAAM,IAAI,mBAIvB,kBAAkB;GAErB,IAAI,CAAC,SAAS,OAAO;GAErB,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAEhF,IAAI,CAAC,cAAc,SAAS;IAE1B,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IAGpD,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAEhE,IAAI,CAAC,WAAW,OAAO;GAEvB,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GAEjD,IAAI,CAAC,MAAM,OAAO;GAIlB,IAFwB,WAAW,aAAa,SAE9B,GAGhB;QAAI,CAAC,MAFa,aAAa,eAAe,GAEpC;KAER,MAAM,KAAK,kBAAkB,aAAa,QAAQ;KAElD,OAAO;IACT;UAEA,MAAM,aAAa,WAAW;GAGhC,MAAM,eAAe,MAAM,KAAK,gBAAgB,MAAM;IACpD,GAAG;IACH,UAAU,aAAa;GACzB,CAAC;GAED,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY;GAEnE,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;;CAMA,MAAa,aAA6B,OAAsB,MAA8B;EAC5F,MAAM,EAAE,UAAU,GAAG,cAAc;EAEnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAE3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAE7D,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAGT,IAAI,CAAC,WAAW,aAAa,QAAQ,GAGnC,OAAO;GAAE;GAAM,QAAQ,EAAE,mBAFC,KAAK,oBAAoB,MAAM,YAAY,OAAO,EAEvC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,gBAAgB,MAAM,UAAU;EAE1D,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;;CAYA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAC1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAChB,MAAM,QAAQ,MAAM,KAAK,kBAAkB,YAAY,MAAM,YAAY;GAEzE,IAAI,OAAO;IACT,MAAM,MAAM,OAAO;IACnB,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAGL,IAFiB,WAAW,aAAa,mBAE9B,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAGrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAEA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,MAAM,KAAK,iBAAiB,cAAc,MAAM,KAAK;CACvD;;;;CAKA,MAAa,sBAAsB,MAA2B;EAC5D,MAAM,KAAK,iBAAiB,iBAAiB,IAAI;CACnD;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,MAAM,KAAK,kBAAkB,cAAc,MAAM,KAAK;CACxD;;;;;;CAOA,MAAa,gBAAgB,MAA2B;EACtD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,IAAI;EAEpE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAG9C,MAAM,KAAK,sBAAsB,IAAI;EAErC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;EAExE,WAAW,KAAK,uBAAuB,UAAU,aAAa;CAChE;;;;;;CAOA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa;EAEhE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,MAAM,KAAK,iBAAiB,aAAa;EAEzC,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,KAAK,kBAAkB,UAAU,IAAI;CAC9C;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}

package/esm/services/generate-jwt-secret.d.mts

@@ -1,4 +1,4 @@
-//#region ../../@warlock.js/auth/src/services/generate-jwt-secret.d.ts
+//#region ../@warlock.js/auth/src/services/generate-jwt-secret.d.ts
 declare function generateJWTSecret(): Promise<void>;
 //#endregion
 export { generateJWTSecret };

package/esm/services/generate-jwt-secret.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-jwt-secret.d.mts","names":[],"sources":["../../../../../../@warlock.js/auth/src/services/generate-jwt-secret.ts"],"mappings":";iBAKsB,iBAAA,CAAA,GAAiB,OAAA"}
+{"version":3,"file":"generate-jwt-secret.d.mts","names":[],"sources":["../../../../../../../@warlock.js/auth/src/services/generate-jwt-secret.ts"],"mappings":";iBAKsB,iBAAA,IAAiB,OAAA"}

package/esm/services/generate-jwt-secret.mjs

@@ -1,9 +1,9 @@
 import { environment, rootPath } from "@warlock.js/core";
 import { Random } from "@mongez/reinforcements";
-import { fileExistsAsync, getFileAsync, putFileAsync } from "@warlock.js/fs";
 import { log } from "@warlock.js/logger";
+import { fileExistsAsync, getFileAsync, putFileAsync } from "@warlock.js/fs";
 
-//#region ../../@warlock.js/auth/src/services/generate-jwt-secret.ts
+//#region ../@warlock.js/auth/src/services/generate-jwt-secret.ts
 async function generateJWTSecret() {
 	let envFile = rootPath(".env");
 	log.info("jwt", "generating", "Generating JWT secrets");
@@ -22,7 +22,7 @@ async function generateJWTSecret() {
 	}
 	let secretsToAdd = "";
 	if (!hasJwtSecret) {
-		const jwtSecret = Random.string(32);
+		const jwtSecret = Random.token(32);
 		secretsToAdd += `
 # JWT Secret
 JWT_SECRET=${jwtSecret}
@@ -30,7 +30,7 @@ JWT_SECRET=${jwtSecret}
 		log.success("jwt", "generated", "JWT_SECRET generated and added to the .env file.");
 	} else log.info("jwt", "exists", "JWT_SECRET already exists in the .env file.");
 	if (!hasJwtRefreshSecret) {
-		const jwtRefreshSecret = Random.string(32);
+		const jwtRefreshSecret = Random.token(32);
 		secretsToAdd += `
 # JWT Refresh Secret
 JWT_REFRESH_SECRET=${jwtRefreshSecret}

package/esm/services/generate-jwt-secret.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"generate-jwt-secret.mjs","names":[],"sources":["../../../../../../@warlock.js/auth/src/services/generate-jwt-secret.ts"],"sourcesContent":["import { fileExistsAsync, getFileAsync, putFileAsync } from \"@warlock.js/fs\";\r\nimport { Random } from \"@mongez/reinforcements\";\r\nimport { environment, rootPath } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\n\r\nexport async function generateJWTSecret() {\r\n  let envFile = rootPath(\".env\");\r\n\r\n  log.info(\"jwt\", \"generating\", \"Generating JWT secrets\");\r\n\r\n  const environmentMode = environment();\r\n\r\n  if (!(await fileExistsAsync(envFile))) {\r\n    const envFileType = environmentMode === \"production\" ? \".env.production\" : \".env.development\";\r\n    envFile = rootPath(envFileType);\r\n  }\r\n\r\n  if (!(await fileExistsAsync(envFile))) {\r\n    log.error(\"jwt\", \"error\", \".env file not found\");\r\n    return;\r\n  }\r\n\r\n  let contents = await getFileAsync(envFile);\r\n\r\n  const hasJwtSecret = contents.includes(\"JWT_SECRET\");\r\n  const hasJwtRefreshSecret = contents.includes(\"JWT_REFRESH_SECRET\");\r\n\r\n  if (hasJwtSecret && hasJwtRefreshSecret) {\r\n    log.warn(\"jwt\", \"exists\", \"JWT secrets already exist in the .env file.\");\r\n    return;\r\n  }\r\n\r\n  let secretsToAdd = \"\";\r\n\r\n  if (!hasJwtSecret) {\r\n    const jwtSecret = Random.string(32);\r\n    secretsToAdd += `\r\n# JWT Secret\r\nJWT_SECRET=${jwtSecret}\r\n`;\r\n    log.success(\"jwt\", \"generated\", \"JWT_SECRET generated and added to the .env file.\");\r\n  } else {\r\n    log.info(\"jwt\", \"exists\", \"JWT_SECRET already exists in the .env file.\");\r\n  }\r\n\r\n  if (!hasJwtRefreshSecret) {\r\n    const jwtRefreshSecret = Random.string(32);\r\n    secretsToAdd += `\r\n# JWT Refresh Secret\r\nJWT_REFRESH_SECRET=${jwtRefreshSecret}\r\n`;\r\n    log.success(\"jwt\", \"generated\", \"JWT_REFRESH_SECRET generated and added to the .env file.\");\r\n  } else {\r\n    log.info(\"jwt\", \"exists\", \"JWT_REFRESH_SECRET already exists in the .env file.\");\r\n  }\r\n\r\n  if (secretsToAdd) {\r\n    contents += secretsToAdd;\r\n    await putFileAsync(envFile, contents);\r\n  }\r\n}\r\n"],"mappings":";;;;;;AAKA,eAAsB,oBAAoB;CACxC,IAAI,UAAU,SAAS,MAAM;CAE7B,IAAI,KAAK,OAAO,cAAc,wBAAwB;CAEtD,MAAM,kBAAkB,YAAY;CAEpC,IAAI,CAAE,MAAM,gBAAgB,OAAO,GAEjC,UAAU,SADU,oBAAoB,eAAe,oBAAoB,kBAC7C;CAGhC,IAAI,CAAE,MAAM,gBAAgB,OAAO,GAAI;EACrC,IAAI,MAAM,OAAO,SAAS,qBAAqB;EAC/C;CACF;CAEA,IAAI,WAAW,MAAM,aAAa,OAAO;CAEzC,MAAM,eAAe,SAAS,SAAS,YAAY;CACnD,MAAM,sBAAsB,SAAS,SAAS,oBAAoB;CAElE,IAAI,gBAAgB,qBAAqB;EACvC,IAAI,KAAK,OAAO,UAAU,6CAA6C;EACvE;CACF;CAEA,IAAI,eAAe;CAEnB,IAAI,CAAC,cAAc;EACjB,MAAM,YAAY,OAAO,OAAO,EAAE;EAClC,gBAAgB;;aAEP,UAAU;;EAEnB,IAAI,QAAQ,OAAO,aAAa,kDAAkD;CACpF,OACE,IAAI,KAAK,OAAO,UAAU,6CAA6C;CAGzE,IAAI,CAAC,qBAAqB;EACxB,MAAM,mBAAmB,OAAO,OAAO,EAAE;EACzC,gBAAgB;;qBAEC,iBAAiB;;EAElC,IAAI,QAAQ,OAAO,aAAa,0DAA0D;CAC5F,OACE,IAAI,KAAK,OAAO,UAAU,qDAAqD;CAGjF,IAAI,cAAc;EAChB,YAAY;EACZ,MAAM,aAAa,SAAS,QAAQ;CACtC;AACF"}
+{"version":3,"file":"generate-jwt-secret.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/services/generate-jwt-secret.ts"],"sourcesContent":["import { fileExistsAsync, getFileAsync, putFileAsync } from \"@warlock.js/fs\";\r\nimport { Random } from \"@mongez/reinforcements\";\r\nimport { environment, rootPath } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\n\r\nexport async function generateJWTSecret() {\r\n  let envFile = rootPath(\".env\");\r\n\r\n  log.info(\"jwt\", \"generating\", \"Generating JWT secrets\");\r\n\r\n  const environmentMode = environment();\r\n\r\n  if (!(await fileExistsAsync(envFile))) {\r\n    const envFileType = environmentMode === \"production\" ? \".env.production\" : \".env.development\";\r\n    envFile = rootPath(envFileType);\r\n  }\r\n\r\n  if (!(await fileExistsAsync(envFile))) {\r\n    log.error(\"jwt\", \"error\", \".env file not found\");\r\n    return;\r\n  }\r\n\r\n  let contents = await getFileAsync(envFile);\r\n\r\n  const hasJwtSecret = contents.includes(\"JWT_SECRET\");\r\n  const hasJwtRefreshSecret = contents.includes(\"JWT_REFRESH_SECRET\");\r\n\r\n  if (hasJwtSecret && hasJwtRefreshSecret) {\r\n    log.warn(\"jwt\", \"exists\", \"JWT secrets already exist in the .env file.\");\r\n    return;\r\n  }\r\n\r\n  let secretsToAdd = \"\";\r\n\r\n  if (!hasJwtSecret) {\r\n    const jwtSecret = Random.token(32);\r\n    secretsToAdd += `\r\n# JWT Secret\r\nJWT_SECRET=${jwtSecret}\r\n`;\r\n    log.success(\"jwt\", \"generated\", \"JWT_SECRET generated and added to the .env file.\");\r\n  } else {\r\n    log.info(\"jwt\", \"exists\", \"JWT_SECRET already exists in the .env file.\");\r\n  }\r\n\r\n  if (!hasJwtRefreshSecret) {\r\n    const jwtRefreshSecret = Random.token(32);\r\n    secretsToAdd += `\r\n# JWT Refresh Secret\r\nJWT_REFRESH_SECRET=${jwtRefreshSecret}\r\n`;\r\n    log.success(\"jwt\", \"generated\", \"JWT_REFRESH_SECRET generated and added to the .env file.\");\r\n  } else {\r\n    log.info(\"jwt\", \"exists\", \"JWT_REFRESH_SECRET already exists in the .env file.\");\r\n  }\r\n\r\n  if (secretsToAdd) {\r\n    contents += secretsToAdd;\r\n    await putFileAsync(envFile, contents);\r\n  }\r\n}\r\n"],"mappings":";;;;;;AAKA,eAAsB,oBAAoB;CACxC,IAAI,UAAU,SAAS,MAAM;CAE7B,IAAI,KAAK,OAAO,cAAc,wBAAwB;CAEtD,MAAM,kBAAkB,YAAY;CAEpC,IAAI,CAAE,MAAM,gBAAgB,OAAO,GAEjC,UAAU,SADU,oBAAoB,eAAe,oBAAoB,kBAC7C;CAGhC,IAAI,CAAE,MAAM,gBAAgB,OAAO,GAAI;EACrC,IAAI,MAAM,OAAO,SAAS,qBAAqB;EAC/C;CACF;CAEA,IAAI,WAAW,MAAM,aAAa,OAAO;CAEzC,MAAM,eAAe,SAAS,SAAS,YAAY;CACnD,MAAM,sBAAsB,SAAS,SAAS,oBAAoB;CAElE,IAAI,gBAAgB,qBAAqB;EACvC,IAAI,KAAK,OAAO,UAAU,6CAA6C;EACvE;CACF;CAEA,IAAI,eAAe;CAEnB,IAAI,CAAC,cAAc;EACjB,MAAM,YAAY,OAAO,MAAM,EAAE;EACjC,gBAAgB;;aAEP,UAAU;;EAEnB,IAAI,QAAQ,OAAO,aAAa,kDAAkD;CACpF,OACE,IAAI,KAAK,OAAO,UAAU,6CAA6C;CAGzE,IAAI,CAAC,qBAAqB;EACxB,MAAM,mBAAmB,OAAO,MAAM,EAAE;EACxC,gBAAgB;;qBAEC,iBAAiB;;EAElC,IAAI,QAAQ,OAAO,aAAa,0DAA0D;CAC5F,OACE,IAAI,KAAK,OAAO,UAAU,qDAAqD;CAGjF,IAAI,cAAc;EAChB,YAAY;EACZ,MAAM,aAAa,SAAS,QAAQ;CACtC;AACF"}

package/esm/services/index.d.mts

@@ -1,4 +1,4 @@
 import { AuthEventCallback, AuthEventName, AuthEventPayloads, authEvents } from "./auth-events.mjs";
 import { authService } from "./auth.service.mjs";
 import { generateJWTSecret } from "./generate-jwt-secret.mjs";
-import { jwt } from "./jwt.mjs";
+import { TokenType, jwt } from "./jwt.mjs";