@warlock.js/auth 5.11.0 → 5.13.0

package/esm/middleware/auth.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware, type Request } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport type { TokenFrom } from \"../contracts/types\";\r\nimport { AccessToken } from \"../models/access-token\";\r\nimport { authConfig } from \"../services/auth-config\";\r\nimport { authService } from \"../services/auth.service\";\r\nimport { isInvalidCredentialError, jwt } from \"../services/jwt\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\n\r\n/** The 401 body shape every rejection in this middleware carries. */\r\ntype UnauthorizedPayload = { error: string; errorCode: string };\r\n\r\n/**\r\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\r\n *\r\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\r\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\r\n * browser to the configured login path with a `returnUrl`, so a human\r\n * navigating to a guarded page lands on the login screen rather than reading a\r\n * raw JSON error blob — the defect in finding b9ab9804.\r\n *\r\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\r\n * configured, even a page route falls back to the JSON 401, so an app that has\r\n * not asked for page-login UX keeps exactly its current behavior. The API 401\r\n * contract is never changed for API routes.\r\n *\r\n * `returnUrl` carries `request.url` — the relative path + query the browser was\r\n * on — never the absolute URL: a relative target cannot be turned into an\r\n * open-redirect off this app's origin.\r\n */\r\nfunction rejectUnauthorized({ request, response }: HttpContext, payload: UnauthorizedPayload) {\r\n  const loginPath = authConfig.pageAuth.loginPath();\r\n\r\n  if (loginPath && request.route?.isPage) {\r\n    const separator = loginPath.includes(\"?\") ? \"&\" : \"?\";\r\n    const returnUrl = encodeURIComponent(request.url);\r\n\r\n    return response.redirect(\r\n      `${loginPath}${separator}${authConfig.pageAuth.returnUrlParam()}=${returnUrl}`,\r\n    );\r\n  }\r\n\r\n  return response.unauthorized(payload);\r\n}\r\n\r\n/**\r\n * Decoded access-token claims the middleware reads. The full payload carries\r\n * more (`created_at`, `tokenType`, `iat`, `exp`) but only these drive routing.\r\n */\r\ntype DecodedAccessToken = {\r\n  id: string | number;\r\n  userType?: string;\r\n};\r\n\r\n/**\r\n * Whether the persisted row says the token is dead.\r\n *\r\n * The answer belongs to the model (`AccessToken.isExpired`), so a registered\r\n * override that renames or reshapes its expiry column stays authoritative and\r\n * the middleware never touches a column name. A row that cannot answer at all —\r\n * an override that dropped the getter — is treated as **expired**: the failure\r\n * mode of this whole defect class was a check that quietly answered \"fine\" when\r\n * it had nothing to check, and that is not repeated here.\r\n *\r\n * This is independent of the `exp` claim required by `jwt.verify`. That guard\r\n * catches a token whose *claims* carry no deadline; this one catches a token\r\n * whose *row* says the deadline has passed — a logged-out or expired session\r\n * whose JWT is still within its own lifetime. Neither subsumes the other.\r\n */\r\nfunction accessTokenRowIsExpired(accessToken: AccessToken): boolean {\r\n  return typeof accessToken.isExpired === \"boolean\" ? accessToken.isExpired : true;\r\n}\r\n\r\nfunction readCredential(request: Request, tokenFrom: TokenFrom): string {\r\n  if (tokenFrom === \"header\") {\r\n    return request.authorizationValue;\r\n  }\r\n\r\n  const value = request.cookie(tokenFrom.slice(\"cookie:\".length));\r\n\r\n  return value ? String(value) : \"\";\r\n}\r\n\r\n/**\r\n * Build a route gate that always requires an authenticated request.\r\n *\r\n * The argument is mandatory and selects which user types may pass:\r\n * - `[]` — any authenticated user (token required, type not checked).\r\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\r\n *   `userType` must be one of the listed types.\r\n *\r\n * There is no anonymous/optional mode: a request without a valid access\r\n * token is always rejected with `401`. Routes that should be public\r\n * simply omit the middleware.\r\n *\r\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\r\n * A single source avoids making credential precedence depend on array order.\r\n *\r\n * @example\r\n * router.get(\"/account\", authMiddleware([]), accountController);\r\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\r\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\r\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\r\n */\r\nexport function authMiddleware(\r\n  allowedUserType: string | string[],\r\n  tokenFrom: TokenFrom = \"header\",\r\n): Middleware {\r\n  const allowedTypes = Array.isArray(allowedUserType) ? allowedUserType : [allowedUserType];\r\n\r\n  const auth: Middleware = async ({ request, response }) => {\r\n    const authorizationValue = readCredential(request, tokenFrom);\r\n\r\n    if (!authorizationValue) {\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.missingAccessToken\"),\r\n        errorCode: AuthErrorCodes.MissingAccessToken,\r\n      });\r\n    }\r\n\r\n    let decoded: DecodedAccessToken;\r\n\r\n    // The ONLY try in this middleware, and it wraps a single call. Everything\r\n    // after it is storage and configuration, where an exception means the\r\n    // server is broken rather than the caller (D5).\r\n    try {\r\n      decoded = await jwt.verify<DecodedAccessToken>(authorizationValue);\r\n    } catch (error) {\r\n      if (!isInvalidCredentialError(error)) {\r\n        // A DB/cache outage, a missing `JWT_SECRET`, or any other server-side\r\n        // fault — not a verdict on this credential. Propagate to the request's\r\n        // normal error path (a 500 monitoring can see) instead of answering\r\n        // 401 and clearing the caller's session.\r\n        throw error;\r\n      }\r\n\r\n      // A forged, malformed, expired token — or (D6) a `tokenType` mismatch —\r\n      // is not an incident: it is a request carrying a credential the server\r\n      // will never accept.\r\n      log.error(\"http\", \"auth\", error);\r\n\r\n      request.clearCurrentUser();\r\n\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n\r\n    request.decodedAccessToken = decoded;\r\n\r\n    // A valid signature is not enough — the token must still exist in storage,\r\n    // so deleting the row (logout) invalidates it before its JWT expiry.\r\n    const AccessTokenModel = config.key(\"auth.accessToken.model\", AccessToken);\r\n    const accessToken = await AccessTokenModel.findByToken(authorizationValue);\r\n\r\n    if (!accessToken) {\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n\r\n    // ... and the row must still be live. Existence alone was the whole check\r\n    // before 4.12.0, so a row whose own `expires_at` had passed still opened\r\n    // the gate. The stored expiry is now enforced, and the dead row is\r\n    // removed on the way out rather than left for the cleanup command.\r\n    if (accessTokenRowIsExpired(accessToken)) {\r\n      await accessToken.destroy();\r\n\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n\r\n    const userType = decoded.userType ?? accessToken.userType;\r\n\r\n    if (allowedTypes.length && !allowedTypes.includes(userType)) {\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    const UserModel = config.key(`auth.userType.${userType}`);\r\n\r\n    if (!UserModel) {\r\n      // Configuration, not credentials. Throwing keeps a mis-registered app\r\n      // loudly broken instead of quietly rejecting every request of this type.\r\n      throw new Error(`User type ${userType} is unknown type.`);\r\n    }\r\n\r\n    const currentUser = await UserModel.find(decoded.id);\r\n\r\n    if (!currentUser) {\r\n      await accessToken.destroy();\r\n\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n\r\n    if (!(await authService.canAuthenticate(currentUser))) {\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    request.user = currentUser;\r\n  };\r\n\r\n  return auth;\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAS,mBAAmB,EAAE,SAAS,YAAyB,SAA8B;CAC5F,MAAM,YAAY,WAAW,SAAS,UAAU;CAEhD,IAAI,aAAa,QAAQ,OAAO,QAAQ;EACtC,MAAM,YAAY,UAAU,SAAS,GAAG,IAAI,MAAM;EAClD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SACd,GAAG,YAAY,YAAY,WAAW,SAAS,eAAe,EAAE,GAAG,WACrE;CACF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;;;;;;;;;;;;;;;;AA0BA,SAAS,wBAAwB,aAAmC;CAClE,OAAO,OAAO,YAAY,cAAc,YAAY,YAAY,YAAY;AAC9E;AAEA,SAAS,eAAe,SAAkB,WAA8B;CACtE,IAAI,cAAc,UAChB,OAAO,QAAQ;CAGjB,MAAM,QAAQ,QAAQ,OAAO,UAAU,MAAM,CAAgB,CAAC;CAE9D,OAAO,QAAQ,OAAO,KAAK,IAAI;AACjC;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,eACd,iBACA,YAAuB,UACX;CACZ,MAAM,eAAe,MAAM,QAAQ,eAAe,IAAI,kBAAkB,CAAC,eAAe;CAExF,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,qBAAqB,eAAe,SAAS,SAAS;EAE5D,IAAI,CAAC,oBACH,OAAO,mBAAmB;GAAE;GAAS;EAAS,GAAG;GAC/C,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAGH,IAAI;EAKJ,IAAI;GACF,UAAU,MAAM,IAAI,OAA2B,kBAAkB;EACnE,SAAS,OAAO;GACd,IAAI,CAAC,yBAAyB,KAAK,GAKjC,MAAM;GAMR,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAE/B,QAAQ,iBAAiB;GAEzB,OAAO,mBAAmB;IAAE;IAAS;GAAS,GAAG;IAC/C,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAEA,QAAQ,qBAAqB;EAK7B,MAAM,cAAc,MADK,OAAO,IAAI,0BAA0B,WACrB,CAAC,CAAC,YAAY,kBAAkB;EAEzE,IAAI,CAAC,aACH,OAAO,mBAAmB;GAAE;GAAS;EAAS,GAAG;GAC/C,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAOH,IAAI,wBAAwB,WAAW,GAAG;GACxC,MAAM,YAAY,QAAQ;GAE1B,OAAO,mBAAmB;IAAE;IAAS;GAAS,GAAG;IAC/C,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAEA,MAAM,WAAW,QAAQ,YAAY,YAAY;EAEjD,IAAI,aAAa,UAAU,CAAC,aAAa,SAAS,QAAQ,GACxD,OAAO,mBAAmB;GAAE;GAAS;EAAS,GAAG;GAC/C,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,MAAM,YAAY,OAAO,IAAI,iBAAiB,UAAU;EAExD,IAAI,CAAC,WAGH,MAAM,IAAI,MAAM,aAAa,SAAS,kBAAkB;EAG1D,MAAM,cAAc,MAAM,UAAU,KAAK,QAAQ,EAAE;EAEnD,IAAI,CAAC,aAAa;GAChB,MAAM,YAAY,QAAQ;GAE1B,OAAO,mBAAmB;IAAE;IAAS;GAAS,GAAG;IAC/C,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAEA,IAAI,CAAE,MAAM,YAAY,gBAAgB,WAAW,GACjD,OAAO,mBAAmB;GAAE;GAAS;EAAS,GAAG;GAC/C,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,QAAQ,OAAO;CACjB;CAEA,OAAO;AACT"}
+{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware, type Request } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport type { TokenFrom } from \"../contracts/types\";\r\nimport { AccessToken } from \"../models/access-token\";\r\nimport { authConfig } from \"../services/auth-config\";\r\nimport { authService } from \"../services/auth.service\";\r\nimport { isInvalidCredentialError, jwt } from \"../services/jwt\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\nimport {\r\n  assertCsrfOriginAllowed,\r\n  CsrfOriginMismatchError,\r\n  requiresCsrfOriginCheck,\r\n} from \"./csrf-origin-check\";\r\n\r\n/** The 401 body shape every rejection in this middleware carries. */\r\ntype UnauthorizedPayload = { error: string; errorCode: string };\r\n\r\n/**\r\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\r\n *\r\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\r\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\r\n * browser to the configured login path with a `returnUrl`, so a human\r\n * navigating to a guarded page lands on the login screen rather than reading a\r\n * raw JSON error blob — the defect in finding b9ab9804.\r\n *\r\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\r\n * configured, even a page route falls back to the JSON 401, so an app that has\r\n * not asked for page-login UX keeps exactly its current behavior. The API 401\r\n * contract is never changed for API routes.\r\n *\r\n * `returnUrl` carries `request.url` — the relative path + query the browser was\r\n * on — never the absolute URL: a relative target cannot be turned into an\r\n * open-redirect off this app's origin.\r\n */\r\nfunction rejectUnauthorized({ request, response }: HttpContext, payload: UnauthorizedPayload) {\r\n  const loginPath = authConfig.pageAuth.loginPath();\r\n\r\n  if (loginPath && request.route?.isPage) {\r\n    const separator = loginPath.includes(\"?\") ? \"&\" : \"?\";\r\n    const returnUrl = encodeURIComponent(request.url);\r\n\r\n    return response.redirect(\r\n      `${loginPath}${separator}${authConfig.pageAuth.returnUrlParam()}=${returnUrl}`,\r\n    );\r\n  }\r\n\r\n  return response.unauthorized(payload);\r\n}\r\n\r\n/**\r\n * Decoded access-token claims the middleware reads. The full payload carries\r\n * more (`created_at`, `tokenType`, `iat`, `exp`) but only these drive routing.\r\n */\r\ntype DecodedAccessToken = {\r\n  id: string | number;\r\n  userType?: string;\r\n};\r\n\r\n/**\r\n * Whether the persisted row says the token is dead.\r\n *\r\n * The answer belongs to the model (`AccessToken.isExpired`), so a registered\r\n * override that renames or reshapes its expiry column stays authoritative and\r\n * the middleware never touches a column name. A row that cannot answer at all —\r\n * an override that dropped the getter — is treated as **expired**: the failure\r\n * mode of this whole defect class was a check that quietly answered \"fine\" when\r\n * it had nothing to check, and that is not repeated here.\r\n *\r\n * This is independent of the `exp` claim required by `jwt.verify`. That guard\r\n * catches a token whose *claims* carry no deadline; this one catches a token\r\n * whose *row* says the deadline has passed — a logged-out or expired session\r\n * whose JWT is still within its own lifetime. Neither subsumes the other.\r\n */\r\nfunction accessTokenRowIsExpired(accessToken: AccessToken): boolean {\r\n  return typeof accessToken.isExpired === \"boolean\" ? accessToken.isExpired : true;\r\n}\r\n\r\nfunction readCredential(request: Request, tokenFrom: TokenFrom): string {\r\n  if (tokenFrom === \"header\") {\r\n    return request.authorizationValue;\r\n  }\r\n\r\n  const value = request.cookie(tokenFrom.slice(\"cookie:\".length));\r\n\r\n  return value ? String(value) : \"\";\r\n}\r\n\r\n/**\r\n * Build a route gate that always requires an authenticated request.\r\n *\r\n * The argument is mandatory and selects which user types may pass:\r\n * - `[]` — any authenticated user (token required, type not checked).\r\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\r\n *   `userType` must be one of the listed types.\r\n *\r\n * There is no anonymous/optional mode: a request without a valid access\r\n * token is always rejected with `401`. Routes that should be public\r\n * simply omit the middleware.\r\n *\r\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\r\n * A single source avoids making credential precedence depend on array order.\r\n *\r\n * @example\r\n * router.get(\"/account\", authMiddleware([]), accountController);\r\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\r\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\r\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\r\n */\r\nexport function authMiddleware(\r\n  allowedUserType: string | string[],\r\n  tokenFrom: TokenFrom = \"header\",\r\n): Middleware {\r\n  const allowedTypes = Array.isArray(allowedUserType) ? allowedUserType : [allowedUserType];\r\n\r\n  const auth: Middleware = async ({ request, response }) => {\r\n    const authorizationValue = readCredential(request, tokenFrom);\r\n\r\n    if (!authorizationValue) {\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.missingAccessToken\"),\r\n        errorCode: AuthErrorCodes.MissingAccessToken,\r\n      });\r\n    }\r\n\r\n    // CSRF Origin check: only in scope for a cookie-sourced\r\n    // credential on an unsafe method. Header-token auth and safe methods\r\n    // (GET/HEAD/OPTIONS) never reach `assertCsrfOriginAllowed`.\r\n    if (requiresCsrfOriginCheck(tokenFrom, request.method)) {\r\n      try {\r\n        assertCsrfOriginAllowed(request);\r\n      } catch (error) {\r\n        if (!(error instanceof CsrfOriginMismatchError)) {\r\n          throw error;\r\n        }\r\n\r\n        log.error(\"http\", \"auth\", error);\r\n\r\n        return response.forbidden({\r\n          error: t(\"auth.errors.csrfOriginMismatch\"),\r\n          errorCode: AuthErrorCodes.CsrfOriginMismatch,\r\n        });\r\n      }\r\n    }\r\n\r\n    let decoded: DecodedAccessToken;\r\n\r\n    // The ONLY try in this middleware, and it wraps a single call. Everything\r\n    // after it is storage and configuration, where an exception means the\r\n    // server is broken rather than the caller (D5).\r\n    try {\r\n      decoded = await jwt.verify<DecodedAccessToken>(authorizationValue);\r\n    } catch (error) {\r\n      if (!isInvalidCredentialError(error)) {\r\n        // A DB/cache outage, a missing `JWT_SECRET`, or any other server-side\r\n        // fault — not a verdict on this credential. Propagate to the request's\r\n        // normal error path (a 500 monitoring can see) instead of answering\r\n        // 401 and clearing the caller's session.\r\n        throw error;\r\n      }\r\n\r\n      // A forged, malformed, expired token — or (D6) a `tokenType` mismatch —\r\n      // is not an incident: it is a request carrying a credential the server\r\n      // will never accept.\r\n      log.error(\"http\", \"auth\", error);\r\n\r\n      // Clearing rather than leaving a stale value matters: a request that\r\n      // failed authentication must not carry the identity of whoever\r\n      // `request.locals.user` last held (see the two-sided spec below that\r\n      // pins this — removing the clear must make the previous identity\r\n      // survive).\r\n      request.locals.user = undefined;\r\n\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n\r\n    request.decodedAccessToken = decoded;\r\n\r\n    // A valid signature is not enough — the token must still exist in storage,\r\n    // so deleting the row (logout) invalidates it before its JWT expiry.\r\n    const AccessTokenModel = config.key(\"auth.accessToken.model\", AccessToken);\r\n    const accessToken = await AccessTokenModel.findByToken(authorizationValue);\r\n\r\n    if (!accessToken) {\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n\r\n    // ... and the row must still be live. Existence alone was the whole check\r\n    // before 4.12.0, so a row whose own `expires_at` had passed still opened\r\n    // the gate. The stored expiry is now enforced, and the dead row is\r\n    // removed on the way out rather than left for the cleanup command.\r\n    if (accessTokenRowIsExpired(accessToken)) {\r\n      await accessToken.destroy();\r\n\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n\r\n    const userType = decoded.userType ?? accessToken.userType;\r\n\r\n    if (allowedTypes.length && !allowedTypes.includes(userType)) {\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    const UserModel = config.key(`auth.userType.${userType}`);\r\n\r\n    if (!UserModel) {\r\n      // Configuration, not credentials. Throwing keeps a mis-registered app\r\n      // loudly broken instead of quietly rejecting every request of this type.\r\n      throw new Error(`User type ${userType} is unknown type.`);\r\n    }\r\n\r\n    const currentUser = await UserModel.find(decoded.id);\r\n\r\n    if (!currentUser) {\r\n      await accessToken.destroy();\r\n\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.invalidAccessToken\"),\r\n        errorCode: AuthErrorCodes.InvalidAccessToken,\r\n      });\r\n    }\r\n\r\n    if (!(await authService.canAuthenticate(currentUser))) {\r\n      return rejectUnauthorized({ request, response }, {\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    request.locals.user = currentUser;\r\n  };\r\n\r\n  return auth;\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAS,mBAAmB,EAAE,SAAS,YAAyB,SAA8B;CAC5F,MAAM,YAAY,WAAW,SAAS,UAAU;CAEhD,IAAI,aAAa,QAAQ,OAAO,QAAQ;EACtC,MAAM,YAAY,UAAU,SAAS,GAAG,IAAI,MAAM;EAClD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SACd,GAAG,YAAY,YAAY,WAAW,SAAS,eAAe,EAAE,GAAG,WACrE;CACF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;;;;;;;;;;;;;;;;AA0BA,SAAS,wBAAwB,aAAmC;CAClE,OAAO,OAAO,YAAY,cAAc,YAAY,YAAY,YAAY;AAC9E;AAEA,SAAS,eAAe,SAAkB,WAA8B;CACtE,IAAI,cAAc,UAChB,OAAO,QAAQ;CAGjB,MAAM,QAAQ,QAAQ,OAAO,UAAU,MAAM,CAAgB,CAAC;CAE9D,OAAO,QAAQ,OAAO,KAAK,IAAI;AACjC;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,eACd,iBACA,YAAuB,UACX;CACZ,MAAM,eAAe,MAAM,QAAQ,eAAe,IAAI,kBAAkB,CAAC,eAAe;CAExF,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,qBAAqB,eAAe,SAAS,SAAS;EAE5D,IAAI,CAAC,oBACH,OAAO,mBAAmB;GAAE;GAAS;EAAS,GAAG;GAC/C,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAMH,IAAI,wBAAwB,WAAW,QAAQ,MAAM,GACnD,IAAI;GACF,wBAAwB,OAAO;EACjC,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,0BACrB,MAAM;GAGR,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAE/B,OAAO,SAAS,UAAU;IACxB,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAGF,IAAI;EAKJ,IAAI;GACF,UAAU,MAAM,IAAI,OAA2B,kBAAkB;EACnE,SAAS,OAAO;GACd,IAAI,CAAC,yBAAyB,KAAK,GAKjC,MAAM;GAMR,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAO/B,QAAQ,OAAO,OAAO;GAEtB,OAAO,mBAAmB;IAAE;IAAS;GAAS,GAAG;IAC/C,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAEA,QAAQ,qBAAqB;EAK7B,MAAM,cAAc,MADK,OAAO,IAAI,0BAA0B,WACrB,CAAC,CAAC,YAAY,kBAAkB;EAEzE,IAAI,CAAC,aACH,OAAO,mBAAmB;GAAE;GAAS;EAAS,GAAG;GAC/C,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAOH,IAAI,wBAAwB,WAAW,GAAG;GACxC,MAAM,YAAY,QAAQ;GAE1B,OAAO,mBAAmB;IAAE;IAAS;GAAS,GAAG;IAC/C,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAEA,MAAM,WAAW,QAAQ,YAAY,YAAY;EAEjD,IAAI,aAAa,UAAU,CAAC,aAAa,SAAS,QAAQ,GACxD,OAAO,mBAAmB;GAAE;GAAS;EAAS,GAAG;GAC/C,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,MAAM,YAAY,OAAO,IAAI,iBAAiB,UAAU;EAExD,IAAI,CAAC,WAGH,MAAM,IAAI,MAAM,aAAa,SAAS,kBAAkB;EAG1D,MAAM,cAAc,MAAM,UAAU,KAAK,QAAQ,EAAE;EAEnD,IAAI,CAAC,aAAa;GAChB,MAAM,YAAY,QAAQ;GAE1B,OAAO,mBAAmB;IAAE;IAAS;GAAS,GAAG;IAC/C,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAEA,IAAI,CAAE,MAAM,YAAY,gBAAgB,WAAW,GACjD,OAAO,mBAAmB;GAAE;GAAS;EAAS,GAAG;GAC/C,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,QAAQ,OAAO,OAAO;CACxB;CAEA,OAAO;AACT"}

package/esm/middleware/csrf-origin-check.d.mts

@@ -0,0 +1,40 @@
+import { TokenFrom } from "../contracts/types.mjs";
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { Request } from "@warlock.js/core";
+
+//#region ../auth/src/middleware/csrf-origin-check.d.ts
+/** Why {@link assertCsrfOriginAllowed} refused a request. */
+type CsrfOriginMismatchReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
+/**
+ * A cookie-authenticated, unsafe-method request whose `Origin`/`Referer`
+ * failed the check. `reason` names exactly why,
+ * so an error transformer or an incident log never has to string-match the
+ * message.
+ */
+declare class CsrfOriginMismatchError extends Error {
+  readonly reason: CsrfOriginMismatchReason;
+  readonly code = AuthErrorCodes.CsrfOriginMismatch;
+  constructor(reason: CsrfOriginMismatchReason);
+}
+/**
+ * Whether a request is in scope for the CSRF Origin check at all — only a
+ * `cookie:`-sourced credential on an unsafe method (POST/PUT/PATCH/DELETE) is.
+ * Header-token auth and safe methods (GET/HEAD/OPTIONS) are always exempt:
+ * only a cookie-sourced credential can be silently replayed cross-site by a
+ * browser, so only it needs the check.
+ */
+declare function requiresCsrfOriginCheck(tokenFrom: TokenFrom, method: string): boolean;
+/**
+ * CSRF Origin check for a cookie-authenticated unsafe-method request (lead
+ * decision 3). Allowed when `Origin` — or, when `Origin` is absent, `Referer`
+ * — names the request's own origin or an entry in `auth.csrf.allowedOrigins`.
+ * Throws {@link CsrfOriginMismatchError} otherwise, including when BOTH
+ * headers are absent.
+ *
+ * Callers gate this behind {@link requiresCsrfOriginCheck} — this function
+ * itself does not re-check the token source or the method.
+ */
+declare function assertCsrfOriginAllowed(request: Request): void;
+//#endregion
+export { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck };
+//# sourceMappingURL=csrf-origin-check.d.mts.map

package/esm/middleware/csrf-origin-check.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-origin-check.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/csrf-origin-check.ts"],"mappings":";;;;;;KASY,wBAAA;AAAZ;;;;AAAoC;AAWpC;AAXA,cAWa,uBAAA,SAAgC,KAAA;EAAA,SAGf,MAAA,EAAQ,wBAAA;EAAA,SAF3B,IAAA,GAAI,cAAA,CAAA,kBAAA;cAEe,MAAA,EAAQ,wBAAA;AAAA;;;;;;;;iBAatB,uBAAA,CAAwB,SAAA,EAAW,SAAS,EAAE,MAAA;;;;;;AAbA;AAa9D;;;;iBAmEgB,uBAAA,CAAwB,OAAgB,EAAP,OAAO"}

package/esm/middleware/csrf-origin-check.mjs

@@ -0,0 +1,105 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+
+//#region ../auth/src/middleware/csrf-origin-check.ts
+/** HTTP methods the CSRF Origin check exempts — reads, never state changes. */
+const SAFE_METHODS = new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/**
+* A cookie-authenticated, unsafe-method request whose `Origin`/`Referer`
+* failed the check. `reason` names exactly why,
+* so an error transformer or an incident log never has to string-match the
+* message.
+*/
+var CsrfOriginMismatchError = class extends Error {
+	constructor(reason) {
+		super(`CSRF Origin check failed: ${reason}`);
+		this.reason = reason;
+		this.code = "EC006";
+		this.name = "CsrfOriginMismatchError";
+	}
+};
+/**
+* Whether a request is in scope for the CSRF Origin check at all — only a
+* `cookie:`-sourced credential on an unsafe method (POST/PUT/PATCH/DELETE) is.
+* Header-token auth and safe methods (GET/HEAD/OPTIONS) are always exempt:
+* only a cookie-sourced credential can be silently replayed cross-site by a
+* browser, so only it needs the check.
+*/
+function requiresCsrfOriginCheck(tokenFrom, method) {
+	return tokenFrom.startsWith("cookie:") && !SAFE_METHODS.has(method.toUpperCase());
+}
+/**
+* The request's own origin — what an `Origin`/`Referer` header must match.
+*
+* `request.hostname` (core's `Request`, backed by Express/Fastify's
+* `hostname`) never carries a port. A browser's `Origin` header on a
+* non-default port (e.g. any `warlock dev` session) does, so the port must
+* come from the raw `Host` header instead — core exposes no getter for that,
+* so it is read directly here.
+*/
+function ownOrigin(request) {
+	const hostHeader = request.header("host");
+	const host = typeof hostHeader === "string" && hostHeader ? hostHeader : request.hostname;
+	return `${request.protocol}://${host}`;
+}
+/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */
+function originOf(rawUrl) {
+	try {
+		const url = new URL(rawUrl);
+		return `${url.protocol}//${url.host}`;
+	} catch {
+		return;
+	}
+}
+/**
+* Normalize an origin string (`scheme://host[:port]`) so that a default port
+* (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin
+* written without a port. Falls back to the raw value if it does not parse
+* as a URL (in which case it will simply fail the exact-match comparison).
+*/
+function normalizeOrigin(origin) {
+	try {
+		const url = new URL(origin);
+		const isDefaultPort = url.protocol === "http:" && (url.port === "" || url.port === "80") || url.protocol === "https:" && (url.port === "" || url.port === "443");
+		return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;
+	} catch {
+		return origin;
+	}
+}
+/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */
+function isAllowedOrigin(origin, request) {
+	if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;
+	return authConfig.csrf.allowedOrigins().includes(origin);
+}
+/**
+* CSRF Origin check for a cookie-authenticated unsafe-method request (lead
+* decision 3). Allowed when `Origin` — or, when `Origin` is absent, `Referer`
+* — names the request's own origin or an entry in `auth.csrf.allowedOrigins`.
+* Throws {@link CsrfOriginMismatchError} otherwise, including when BOTH
+* headers are absent.
+*
+* Callers gate this behind {@link requiresCsrfOriginCheck} — this function
+* itself does not re-check the token source or the method.
+*/
+function assertCsrfOriginAllowed(request) {
+	const origin = request.origin;
+	if (origin) {
+		if (isAllowedOrigin(origin, request)) return;
+		throw new CsrfOriginMismatchError("origin-mismatch");
+	}
+	const referer = request.header("referer");
+	const refererOrigin = typeof referer === "string" ? originOf(referer) : void 0;
+	if (refererOrigin) {
+		if (isAllowedOrigin(refererOrigin, request)) return;
+		throw new CsrfOriginMismatchError("referer-mismatch");
+	}
+	throw new CsrfOriginMismatchError("missing-origin-and-referer");
+}
+
+//#endregion
+export { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck };
+//# sourceMappingURL=csrf-origin-check.mjs.map

package/esm/middleware/csrf-origin-check.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-origin-check.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/csrf-origin-check.ts"],"sourcesContent":["import type { Request } from \"@warlock.js/core\";\nimport type { TokenFrom } from \"../contracts/types\";\nimport { authConfig } from \"../services/auth-config\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/** HTTP methods the CSRF Origin check exempts — reads, never state changes. */\nconst SAFE_METHODS = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/** Why {@link assertCsrfOriginAllowed} refused a request. */\nexport type CsrfOriginMismatchReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/**\n * A cookie-authenticated, unsafe-method request whose `Origin`/`Referer`\n * failed the check. `reason` names exactly why,\n * so an error transformer or an incident log never has to string-match the\n * message.\n */\nexport class CsrfOriginMismatchError extends Error {\n  readonly code = AuthErrorCodes.CsrfOriginMismatch;\n\n  constructor(public readonly reason: CsrfOriginMismatchReason) {\n    super(`CSRF Origin check failed: ${reason}`);\n    this.name = \"CsrfOriginMismatchError\";\n  }\n}\n\n/**\n * Whether a request is in scope for the CSRF Origin check at all — only a\n * `cookie:`-sourced credential on an unsafe method (POST/PUT/PATCH/DELETE) is.\n * Header-token auth and safe methods (GET/HEAD/OPTIONS) are always exempt:\n * only a cookie-sourced credential can be silently replayed cross-site by a\n * browser, so only it needs the check.\n */\nexport function requiresCsrfOriginCheck(tokenFrom: TokenFrom, method: string): boolean {\n  return tokenFrom.startsWith(\"cookie:\") && !SAFE_METHODS.has(method.toUpperCase());\n}\n\n/**\n * The request's own origin — what an `Origin`/`Referer` header must match.\n *\n * `request.hostname` (core's `Request`, backed by Express/Fastify's\n * `hostname`) never carries a port. A browser's `Origin` header on a\n * non-default port (e.g. any `warlock dev` session) does, so the port must\n * come from the raw `Host` header instead — core exposes no getter for that,\n * so it is read directly here.\n */\nfunction ownOrigin(request: Request): string {\n  const hostHeader = request.header(\"host\");\n  const host = typeof hostHeader === \"string\" && hostHeader ? hostHeader : request.hostname;\n\n  return `${request.protocol}://${host}`;\n}\n\n/** Extract `scheme://host` from a full URL (e.g. a `Referer` header value). */\nfunction originOf(rawUrl: string): string | undefined {\n  try {\n    const url = new URL(rawUrl);\n\n    return `${url.protocol}//${url.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Normalize an origin string (`scheme://host[:port]`) so that a default port\n * (`:80` on `http:`, `:443` on `https:`) compares equal to the same origin\n * written without a port. Falls back to the raw value if it does not parse\n * as a URL (in which case it will simply fail the exact-match comparison).\n */\nfunction normalizeOrigin(origin: string): string {\n  try {\n    const url = new URL(origin);\n    const isDefaultPort =\n      (url.protocol === \"http:\" && (url.port === \"\" || url.port === \"80\")) ||\n      (url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\"));\n\n    return `${url.protocol}//${isDefaultPort ? url.hostname : url.host}`;\n  } catch {\n    return origin;\n  }\n}\n\n/** Same-origin, or an explicit entry in `auth.csrf.allowedOrigins` (default `[]`). */\nfunction isAllowedOrigin(origin: string, request: Request): boolean {\n  if (normalizeOrigin(origin) === normalizeOrigin(ownOrigin(request))) return true;\n\n  return authConfig.csrf.allowedOrigins().includes(origin);\n}\n\n/**\n * CSRF Origin check for a cookie-authenticated unsafe-method request (lead\n * decision 3). Allowed when `Origin` — or, when `Origin` is absent, `Referer`\n * — names the request's own origin or an entry in `auth.csrf.allowedOrigins`.\n * Throws {@link CsrfOriginMismatchError} otherwise, including when BOTH\n * headers are absent.\n *\n * Callers gate this behind {@link requiresCsrfOriginCheck} — this function\n * itself does not re-check the token source or the method.\n */\nexport function assertCsrfOriginAllowed(request: Request): void {\n  const origin = request.origin;\n\n  if (origin) {\n    if (isAllowedOrigin(origin, request)) return;\n\n    throw new CsrfOriginMismatchError(\"origin-mismatch\");\n  }\n\n  const referer = request.header(\"referer\");\n  const refererOrigin = typeof referer === \"string\" ? originOf(referer) : undefined;\n\n  if (refererOrigin) {\n    if (isAllowedOrigin(refererOrigin, request)) return;\n\n    throw new CsrfOriginMismatchError(\"referer-mismatch\");\n  }\n\n  throw new CsrfOriginMismatchError(\"missing-origin-and-referer\");\n}\n"],"mappings":";;;;;AAMA,MAAM,eAAe,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;;;;;;;AAcvD,IAAa,0BAAb,cAA6C,MAAM;CAGjD,YAAY,AAAgB,QAAkC;EAC5D,MAAM,6BAA6B,QAAQ;EADjB;;EAE1B,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,wBAAwB,WAAsB,QAAyB;CACrF,OAAO,UAAU,WAAW,SAAS,KAAK,CAAC,aAAa,IAAI,OAAO,YAAY,CAAC;AAClF;;;;;;;;;;AAWA,SAAS,UAAU,SAA0B;CAC3C,MAAM,aAAa,QAAQ,OAAO,MAAM;CACxC,MAAM,OAAO,OAAO,eAAe,YAAY,aAAa,aAAa,QAAQ;CAEjF,OAAO,GAAG,QAAQ,SAAS,KAAK;AAClC;;AAGA,SAAS,SAAS,QAAoC;CACpD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAE1B,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAS,gBAAgB,QAAwB;CAC/C,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,MAAM,gBACH,IAAI,aAAa,YAAY,IAAI,SAAS,MAAM,IAAI,SAAS,SAC7D,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;EAEjE,OAAO,GAAG,IAAI,SAAS,IAAI,gBAAgB,IAAI,WAAW,IAAI;CAChE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAS,gBAAgB,QAAgB,SAA2B;CAClE,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,OAAO;CAE5E,OAAO,WAAW,KAAK,eAAe,CAAC,CAAC,SAAS,MAAM;AACzD;;;;;;;;;;;AAYA,SAAgB,wBAAwB,SAAwB;CAC9D,MAAM,SAAS,QAAQ;CAEvB,IAAI,QAAQ;EACV,IAAI,gBAAgB,QAAQ,OAAO,GAAG;EAEtC,MAAM,IAAI,wBAAwB,iBAAiB;CACrD;CAEA,MAAM,UAAU,QAAQ,OAAO,SAAS;CACxC,MAAM,gBAAgB,OAAO,YAAY,WAAW,SAAS,OAAO,IAAI;CAExE,IAAI,eAAe;EACjB,IAAI,gBAAgB,eAAe,OAAO,GAAG;EAE7C,MAAM,IAAI,wBAAwB,kBAAkB;CACtD;CAEA,MAAM,IAAI,wBAAwB,4BAA4B;AAChE"}

package/esm/middleware/index.d.mts

@@ -1,2 +1,6 @@
 import { authMiddleware } from "./auth.middleware.mjs";
-import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
+import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
+import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./otp-throttle.middleware.mjs";
+import { requireVerifiedEmail } from "./require-verified-email.middleware.mjs";

package/esm/middleware/index.mjs

@@ -1,4 +1,8 @@
+import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
 import { authMiddleware } from "./auth.middleware.mjs";
 import { loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
+import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./otp-throttle.middleware.mjs";
+import { requireVerifiedEmail } from "./require-verified-email.middleware.mjs";
 
 export {  };

package/esm/middleware/one-time-token-throttle.middleware.d.mts

@@ -0,0 +1,36 @@
+import { LoginThrottleOptions } from "./login-throttle.middleware.mjs";
+import { Middleware } from "@warlock.js/core";
+
+//#region ../auth/src/middleware/one-time-token-throttle.middleware.d.ts
+/**
+ * Throttle for routes that ISSUE a verification or reset token ("send
+ * verification email", "forgot password"). Built on
+ * {@link loginThrottleMiddleware}, tracked per email and per IP, with one
+ * difference: EVERY request counts. A reset request answers the same success
+ * for known and unknown emails, so a failure-aware counter would never trip.
+ *
+ * Defaults: 3 requests per 1h window, then a 1h lockout (`429`, `EC004`).
+ *
+ * @example
+ * router.post("/auth/forgot-password", forgotPassword, {
+ *   middleware: [tokenIssueThrottleMiddleware()],
+ * });
+ */
+declare function tokenIssueThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+/**
+ * Throttle for routes that CONSUME a token ("verify email", "reset
+ * password"). Built on {@link loginThrottleMiddleware}: per IP (the body
+ * carries a token, not an account), failure-aware — a rejected token counts,
+ * a successful use clears the counter.
+ *
+ * Defaults: 10 failures per 15m window, then a 15m lockout (`429`, `EC004`).
+ *
+ * @example
+ * router.post("/auth/reset-password", resetPasswordController, {
+ *   middleware: [tokenConsumeThrottleMiddleware()],
+ * });
+ */
+declare function tokenConsumeThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+//#endregion
+export { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware };
+//# sourceMappingURL=one-time-token-throttle.middleware.d.mts.map

package/esm/middleware/one-time-token-throttle.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-token-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/one-time-token-throttle.middleware.ts"],"mappings":";;;;;;AAiBA;;;;;;;;AAA4F;AAwB5F;;;iBAxBgB,4BAAA,CAA6B,OAAA,GAAS,oBAAA,GAA4B,UAAU;;;;;AAwBE;;;;;;;;;iBAA9E,8BAAA,CAA+B,OAAA,GAAS,oBAAA,GAA4B,UAAU"}

package/esm/middleware/one-time-token-throttle.middleware.mjs

@@ -0,0 +1,53 @@
+import { loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+
+//#region ../auth/src/middleware/one-time-token-throttle.middleware.ts
+/**
+* Throttle for routes that ISSUE a verification or reset token ("send
+* verification email", "forgot password"). Built on
+* {@link loginThrottleMiddleware}, tracked per email and per IP, with one
+* difference: EVERY request counts. A reset request answers the same success
+* for known and unknown emails, so a failure-aware counter would never trip.
+*
+* Defaults: 3 requests per 1h window, then a 1h lockout (`429`, `EC004`).
+*
+* @example
+* router.post("/auth/forgot-password", forgotPassword, {
+*   middleware: [tokenIssueThrottleMiddleware()],
+* });
+*/
+function tokenIssueThrottleMiddleware(options = {}) {
+	return loginThrottleMiddleware({
+		max: 3,
+		window: "1h",
+		lockoutDuration: "1h",
+		by: ["email", "ip"],
+		isFailure: () => true,
+		...options
+	});
+}
+/**
+* Throttle for routes that CONSUME a token ("verify email", "reset
+* password"). Built on {@link loginThrottleMiddleware}: per IP (the body
+* carries a token, not an account), failure-aware — a rejected token counts,
+* a successful use clears the counter.
+*
+* Defaults: 10 failures per 15m window, then a 15m lockout (`429`, `EC004`).
+*
+* @example
+* router.post("/auth/reset-password", resetPasswordController, {
+*   middleware: [tokenConsumeThrottleMiddleware()],
+* });
+*/
+function tokenConsumeThrottleMiddleware(options = {}) {
+	return loginThrottleMiddleware({
+		max: 10,
+		window: "15m",
+		lockoutDuration: "15m",
+		by: ["ip"],
+		...options
+	});
+}
+
+//#endregion
+export { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware };
+//# sourceMappingURL=one-time-token-throttle.middleware.mjs.map

package/esm/middleware/one-time-token-throttle.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-token-throttle.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/one-time-token-throttle.middleware.ts"],"sourcesContent":["import type { Middleware } from \"@warlock.js/core\";\nimport { loginThrottleMiddleware, type LoginThrottleOptions } from \"./login-throttle.middleware\";\n\n/**\n * Throttle for routes that ISSUE a verification or reset token (\"send\n * verification email\", \"forgot password\"). Built on\n * {@link loginThrottleMiddleware}, tracked per email and per IP, with one\n * difference: EVERY request counts. A reset request answers the same success\n * for known and unknown emails, so a failure-aware counter would never trip.\n *\n * Defaults: 3 requests per 1h window, then a 1h lockout (`429`, `EC004`).\n *\n * @example\n * router.post(\"/auth/forgot-password\", forgotPassword, {\n *   middleware: [tokenIssueThrottleMiddleware()],\n * });\n */\nexport function tokenIssueThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  return loginThrottleMiddleware({\n    max: 3,\n    window: \"1h\",\n    lockoutDuration: \"1h\",\n    by: [\"email\", \"ip\"],\n    isFailure: () => true,\n    ...options,\n  });\n}\n\n/**\n * Throttle for routes that CONSUME a token (\"verify email\", \"reset\n * password\"). Built on {@link loginThrottleMiddleware}: per IP (the body\n * carries a token, not an account), failure-aware — a rejected token counts,\n * a successful use clears the counter.\n *\n * Defaults: 10 failures per 15m window, then a 15m lockout (`429`, `EC004`).\n *\n * @example\n * router.post(\"/auth/reset-password\", resetPasswordController, {\n *   middleware: [tokenConsumeThrottleMiddleware()],\n * });\n */\nexport function tokenConsumeThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  return loginThrottleMiddleware({\n    max: 10,\n    window: \"15m\",\n    lockoutDuration: \"15m\",\n    by: [\"ip\"],\n    ...options,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,SAAgB,6BAA6B,UAAgC,CAAC,GAAe;CAC3F,OAAO,wBAAwB;EAC7B,KAAK;EACL,QAAQ;EACR,iBAAiB;EACjB,IAAI,CAAC,SAAS,IAAI;EAClB,iBAAiB;EACjB,GAAG;CACL,CAAC;AACH;;;;;;;;;;;;;;AAeA,SAAgB,+BAA+B,UAAgC,CAAC,GAAe;CAC7F,OAAO,wBAAwB;EAC7B,KAAK;EACL,QAAQ;EACR,iBAAiB;EACjB,IAAI,CAAC,IAAI;EACT,GAAG;CACL,CAAC;AACH"}

package/esm/middleware/otp-throttle.middleware.d.mts

@@ -0,0 +1,30 @@
+import { LoginThrottleOptions } from "./login-throttle.middleware.mjs";
+import { Middleware } from "@warlock.js/core";
+
+//#region ../auth/src/middleware/otp-throttle.middleware.d.ts
+/**
+ * Throttle for the route that SENDS a login code. {@link tokenIssueThrottleMiddleware}
+ * keyed on the `phone` input and IP: every request counts (the answer is the
+ * same for unknown phones), 3 per 1h, then a 1h lockout (`429`, `EC004`).
+ *
+ * @example
+ * router.post("/auth/otp/request", requestOtpController, {
+ *   middleware: [otpRequestThrottleMiddleware()],
+ * });
+ */
+declare function otpRequestThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+/**
+ * Throttle for the route that VERIFIES a login code. {@link loginThrottleMiddleware}
+ * keyed on `phone` and IP, failure-aware: 5 failures per 15m, then a 15m lockout
+ * (`429`, `EC004`). Complements the per-code attempt cap, which a fresh code
+ * would otherwise reset.
+ *
+ * @example
+ * router.post("/auth/otp/verify", verifyOtpController, {
+ *   middleware: [otpVerifyThrottleMiddleware()],
+ * });
+ */
+declare function otpVerifyThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+//#endregion
+export { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware };
+//# sourceMappingURL=otp-throttle.middleware.d.mts.map

package/esm/middleware/otp-throttle.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/otp-throttle.middleware.ts"],"mappings":";;;;;;AAcA;;;;;;;;iBAAgB,4BAAA,CAA6B,OAAA,GAAS,oBAAA,GAA4B,UAAU;AAe5F;;;;;;;;AAA2F;;;AAA3F,iBAAgB,2BAAA,CAA4B,OAAA,GAAS,oBAAA,GAA4B,UAAU"}

package/esm/middleware/otp-throttle.middleware.mjs

@@ -0,0 +1,45 @@
+import { loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
+
+//#region ../auth/src/middleware/otp-throttle.middleware.ts
+/**
+* Throttle for the route that SENDS a login code. {@link tokenIssueThrottleMiddleware}
+* keyed on the `phone` input and IP: every request counts (the answer is the
+* same for unknown phones), 3 per 1h, then a 1h lockout (`429`, `EC004`).
+*
+* @example
+* router.post("/auth/otp/request", requestOtpController, {
+*   middleware: [otpRequestThrottleMiddleware()],
+* });
+*/
+function otpRequestThrottleMiddleware(options = {}) {
+	return tokenIssueThrottleMiddleware({
+		identifierKey: "phone",
+		...options
+	});
+}
+/**
+* Throttle for the route that VERIFIES a login code. {@link loginThrottleMiddleware}
+* keyed on `phone` and IP, failure-aware: 5 failures per 15m, then a 15m lockout
+* (`429`, `EC004`). Complements the per-code attempt cap, which a fresh code
+* would otherwise reset.
+*
+* @example
+* router.post("/auth/otp/verify", verifyOtpController, {
+*   middleware: [otpVerifyThrottleMiddleware()],
+* });
+*/
+function otpVerifyThrottleMiddleware(options = {}) {
+	return loginThrottleMiddleware({
+		max: 5,
+		window: "15m",
+		lockoutDuration: "15m",
+		by: ["email", "ip"],
+		identifierKey: "phone",
+		...options
+	});
+}
+
+//#endregion
+export { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware };
+//# sourceMappingURL=otp-throttle.middleware.mjs.map

package/esm/middleware/otp-throttle.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp-throttle.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/otp-throttle.middleware.ts"],"sourcesContent":["import type { Middleware } from \"@warlock.js/core\";\nimport { loginThrottleMiddleware, type LoginThrottleOptions } from \"./login-throttle.middleware\";\nimport { tokenIssueThrottleMiddleware } from \"./one-time-token-throttle.middleware\";\n\n/**\n * Throttle for the route that SENDS a login code. {@link tokenIssueThrottleMiddleware}\n * keyed on the `phone` input and IP: every request counts (the answer is the\n * same for unknown phones), 3 per 1h, then a 1h lockout (`429`, `EC004`).\n *\n * @example\n * router.post(\"/auth/otp/request\", requestOtpController, {\n *   middleware: [otpRequestThrottleMiddleware()],\n * });\n */\nexport function otpRequestThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  return tokenIssueThrottleMiddleware({ identifierKey: \"phone\", ...options });\n}\n\n/**\n * Throttle for the route that VERIFIES a login code. {@link loginThrottleMiddleware}\n * keyed on `phone` and IP, failure-aware: 5 failures per 15m, then a 15m lockout\n * (`429`, `EC004`). Complements the per-code attempt cap, which a fresh code\n * would otherwise reset.\n *\n * @example\n * router.post(\"/auth/otp/verify\", verifyOtpController, {\n *   middleware: [otpVerifyThrottleMiddleware()],\n * });\n */\nexport function otpVerifyThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  return loginThrottleMiddleware({\n    max: 5,\n    window: \"15m\",\n    lockoutDuration: \"15m\",\n    by: [\"email\", \"ip\"],\n    identifierKey: \"phone\",\n    ...options,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,SAAgB,6BAA6B,UAAgC,CAAC,GAAe;CAC3F,OAAO,6BAA6B;EAAE,eAAe;EAAS,GAAG;CAAQ,CAAC;AAC5E;;;;;;;;;;;;AAaA,SAAgB,4BAA4B,UAAgC,CAAC,GAAe;CAC1F,OAAO,wBAAwB;EAC7B,KAAK;EACL,QAAQ;EACR,iBAAiB;EACjB,IAAI,CAAC,SAAS,IAAI;EAClB,eAAe;EACf,GAAG;CACL,CAAC;AACH"}

package/esm/middleware/require-verified-email.middleware.d.mts

@@ -0,0 +1,18 @@
+import { Middleware } from "@warlock.js/core";
+
+//#region ../auth/src/middleware/require-verified-email.middleware.d.ts
+/**
+ * Opt-in route gate that rejects a user who has not verified their email with
+ * {@link EmailNotVerifiedError} (`403`, `EC007`). Place it AFTER
+ * `authMiddleware` — it reads `request.locals.user`. A request with no user
+ * fails closed with the same error.
+ *
+ * @example
+ * router.post("/orders", createOrder, {
+ *   middleware: [authMiddleware("user"), requireVerifiedEmail()],
+ * });
+ */
+declare function requireVerifiedEmail(): Middleware;
+//#endregion
+export { requireVerifiedEmail };
+//# sourceMappingURL=require-verified-email.middleware.d.mts.map

package/esm/middleware/require-verified-email.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-verified-email.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/require-verified-email.middleware.ts"],"mappings":";;;;;AAeA;;;;AAAkD;;;;;iBAAlC,oBAAA,IAAwB,UAAU"}

package/esm/middleware/require-verified-email.middleware.mjs

@@ -0,0 +1,24 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { EmailNotVerifiedError } from "../errors/email-not-verified.error.mjs";
+
+//#region ../auth/src/middleware/require-verified-email.middleware.ts
+/**
+* Opt-in route gate that rejects a user who has not verified their email with
+* {@link EmailNotVerifiedError} (`403`, `EC007`). Place it AFTER
+* `authMiddleware` — it reads `request.locals.user`. A request with no user
+* fails closed with the same error.
+*
+* @example
+* router.post("/orders", createOrder, {
+*   middleware: [authMiddleware("user"), requireVerifiedEmail()],
+* });
+*/
+function requireVerifiedEmail() {
+	return async ({ request }) => {
+		if (!request.locals.user?.get?.(authConfig.verification.field())) throw new EmailNotVerifiedError();
+	};
+}
+
+//#endregion
+export { requireVerifiedEmail };
+//# sourceMappingURL=require-verified-email.middleware.mjs.map

package/esm/middleware/require-verified-email.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-verified-email.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/require-verified-email.middleware.ts"],"sourcesContent":["import type { Middleware } from \"@warlock.js/core\";\nimport { EmailNotVerifiedError } from \"../errors/email-not-verified.error\";\nimport { authConfig } from \"../services/auth-config\";\n\n/**\n * Opt-in route gate that rejects a user who has not verified their email with\n * {@link EmailNotVerifiedError} (`403`, `EC007`). Place it AFTER\n * `authMiddleware` — it reads `request.locals.user`. A request with no user\n * fails closed with the same error.\n *\n * @example\n * router.post(\"/orders\", createOrder, {\n *   middleware: [authMiddleware(\"user\"), requireVerifiedEmail()],\n * });\n */\nexport function requireVerifiedEmail(): Middleware {\n  return async ({ request }) => {\n    const user = request.locals.user as { get?: (key: string) => unknown } | undefined;\n\n    if (!user?.get?.(authConfig.verification.field())) {\n      throw new EmailNotVerifiedError();\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,SAAgB,uBAAmC;CACjD,OAAO,OAAO,EAAE,cAAc;EAG5B,IAAI,CAFS,QAAQ,OAAO,MAEjB,MAAM,WAAW,aAAa,MAAM,CAAC,GAC9C,MAAM,IAAI,sBAAsB;CAEpC;AACF"}

package/esm/models/access-token/access-token.model.d.mts

@@ -54,6 +54,14 @@ declare class AccessToken extends Model {
     user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
   }>>;
+  /**
+   * Permanent regardless of the data source default — Mongo's driver default
+   * is `"trash"`, which would copy live credential material (the JWT itself)
+   * into `access_tokensTrash` on every `destroy()` (logout, expiry purge,
+   * never-expiring purge). A revoked/expired access token must not survive
+   * anywhere.
+   */
+  static deleteStrategy: "permanent";
   /** The user this token was issued for. */
   get userId(): any;
   /** The user-type slug this token was issued for. */

package/esm/models/access-token/access-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"mappings":";;;;;;AAaA;;;;;;cAAa,iBAAA,6BAAiB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cAiBjB,WAAA,SAAoB,KAAA;EAAA,OACjB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;MAGT,MAAA;;MAKA,QAAA;;;;;;AAXb;;;;;;;;;;MA8Ba,SAAA;EAqBmD;;;;;;EAAA,IAPnD,YAAA;EAiC8B;;;EAAA,OA1B3B,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,WAAA;EAkEZ;;;EAAA,OAtDpC,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,WAAA;EA/Dd;;;EAAA,OAsEtB,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;EAnEjC;;;EAAA,OA0EN,gBAAA,CAAiB,IAAA,EAAM,IAAA,GAAI,OAAA;;;;;SAQrB,YAAA,IAAgB,OAAA;;;;;;;;;;;;SAqBhB,iBAAA,IAAqB,OAAA,CAAQ,WAAA;;;;;;SAW7B,kBAAA,IAAsB,OAAA,CAAQ,WAAA;AAAA"}
+{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"mappings":";;;;;;AAaA;;;;;;cAAa,iBAAA,6BAAiB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cAiBjB,WAAA,SAAoB,KAAA;EAAA,OACjB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;SASN,cAAA;;MAGH,MAAA;EAfY;EAAA,IAoBZ,QAAA;;;;;;;;;;;;;;;;MAmBA,SAAA;EAuDyB;;;;;;EAAA,IAzCzB,YAAA;EArDyB;;;EAAA,OA4DtB,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,WAAA;EAzD1C;;;EAAA,OAqEN,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,WAAA;;;;SAOpC,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;;;;SAOvC,gBAAA,CAAiB,IAAA,EAAM,IAAA,GAAI,OAAA;;;;;SAQrB,YAAA,IAAgB,OAAA;;;;;;;;;;;;SAqBhB,iBAAA,IAAqB,OAAA,CAAQ,WAAA;;;;;;SAW7B,kBAAA,IAAsB,OAAA,CAAQ,WAAA;AAAA"}

package/esm/models/access-token/access-token.model.mjs

@@ -34,6 +34,9 @@ var AccessToken = class extends Model {
 	static {
 		this.schema = accessTokenSchema;
 	}
+	static {
+		this.deleteStrategy = "permanent";
+	}
 	/** The user this token was issued for. */
 	get userId() {
 		return this.get("user_id");

package/esm/models/access-token/access-token.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted access-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape.\r\n *\r\n * `last_access` and the `is_active` soft-revoke flag were removed — neither was\r\n * ever read; access tokens are revoked by deleting the row.\r\n */\r\nexport const accessTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  expires_at: v.date().required(),\r\n});\r\n\r\n/**\r\n * Persisted access-token record + the data layer for access tokens.\r\n *\r\n * **Role.** Owns access-token persistence and lookup. The middleware checks a\r\n * presented JWT against this table so deleting a row (logout) invalidates the\r\n * token immediately, before its JWT expiry. The auth service goes through the\r\n * named statics exclusively, so it never hard-codes a column name and an\r\n * override can rename/add columns by registering under\r\n * `config.auth.accessToken.model`.\r\n */\r\nexport class AccessToken extends Model {\r\n  public static table = \"access_tokens\";\r\n\r\n  public static schema = accessTokenSchema;\r\n\r\n  /** The user this token was issued for. */\r\n  public get userId() {\r\n    return this.get(\"user_id\");\r\n  }\r\n\r\n  /** The user-type slug this token was issued for. */\r\n  public get userType(): string {\r\n    return this.get(\"user_type\");\r\n  }\r\n\r\n  /**\r\n   * Whether the persisted expiry has passed.\r\n   *\r\n   * The middleware asks this on every request, which is what makes the row the\r\n   * authority it always looked like it was: before 4.12.0 the gate only checked\r\n   * that the row *existed*, so a row the database knew was dead still let its\r\n   * token through — the database was never asked.\r\n   *\r\n   * **Fails closed.** A missing or unparseable `expires_at` counts as expired.\r\n   * `expires_at` is `required` in the schema, so a row that cannot answer \"when\r\n   * does this die\" is malformed, and the safe reading of a malformed credential\r\n   * is that it is not one. This is deliberately stricter than a naive\r\n   * `now > expires_at`, which answers `false` for an `Invalid Date` and thereby\r\n   * grants exactly the poisoned rows an unlimited life.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date(expiresAt).getTime() <= Date.now();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing about this row can ever retire it — an unusable\r\n   * `expires_at`, or a token carrying no `exp` claim. See\r\n   * {@link isNeverExpiring}; this is the predicate `purgeNeverExpiring` selects\r\n   * on.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed access token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, expiresAt: Date) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      expires_at: expiresAt,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find an access-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<AccessToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Delete a specific token that belongs to the given user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete every access token belonging to the user.\r\n   */\r\n  public static deleteAllForUser(user: Auth) {\r\n    return this.delete({ user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired access-token row. Returns the number removed.\r\n   * Runs from the `auth.cleanup` CLI command (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<number> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens.length;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}.\r\n   *\r\n   * **A full scan, filtered in memory, on purpose.** The defining case is a row\r\n   * whose `expires_at` is an `Invalid Date`, which no date predicate can select\r\n   * (`< now` and `> now` are both `false` for it), and the definitive case is a\r\n   * token with no `exp` claim, which lives inside the token string rather than\r\n   * in a column. Neither is expressible as a `where`, so the rows have to be\r\n   * read to be judged. This runs from a one-off remediation command, not a\r\n   * request path.\r\n   */\r\n  public static async findNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: AccessToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed so the\r\n   * caller can report what it revoked. Deletion *is* revocation for access\r\n   * tokens — the middleware rejects a token with no row.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,oBAAoB,EAAE,OAAO;CACxC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;AAYD,IAAa,cAAb,cAAiC,MAAM;;eACf;;;gBAEC;;;CAGvB,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;;;;;;CAiBA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;;CAQA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;;;CAKA,OAAc,MAAM,MAAY,OAAe,WAAiB;EAC9D,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;EACd,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA4C;EACpE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,iBAAiB,MAAY;EACzC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC;CACzC;;;;;CAMA,aAAoB,eAAgC;EAClD,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO,cAAc;CACvB;;;;;;;;;;;;CAaA,aAAoB,oBAA4C;EAG9D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAuB,MAAM,YAAY;CACjE;;;;;;CAOA,aAAoB,qBAA6C;EAC/D,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}
+{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted access-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape.\r\n *\r\n * `last_access` and the `is_active` soft-revoke flag were removed — neither was\r\n * ever read; access tokens are revoked by deleting the row.\r\n */\r\nexport const accessTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  expires_at: v.date().required(),\r\n});\r\n\r\n/**\r\n * Persisted access-token record + the data layer for access tokens.\r\n *\r\n * **Role.** Owns access-token persistence and lookup. The middleware checks a\r\n * presented JWT against this table so deleting a row (logout) invalidates the\r\n * token immediately, before its JWT expiry. The auth service goes through the\r\n * named statics exclusively, so it never hard-codes a column name and an\r\n * override can rename/add columns by registering under\r\n * `config.auth.accessToken.model`.\r\n */\r\nexport class AccessToken extends Model {\r\n  public static table = \"access_tokens\";\r\n\r\n  public static schema = accessTokenSchema;\r\n\r\n  /**\r\n   * Permanent regardless of the data source default — Mongo's driver default\r\n   * is `\"trash\"`, which would copy live credential material (the JWT itself)\r\n   * into `access_tokensTrash` on every `destroy()` (logout, expiry purge,\r\n   * never-expiring purge). A revoked/expired access token must not survive\r\n   * anywhere.\r\n   */\r\n  public static deleteStrategy = \"permanent\" as const;\r\n\r\n  /** The user this token was issued for. */\r\n  public get userId() {\r\n    return this.get(\"user_id\");\r\n  }\r\n\r\n  /** The user-type slug this token was issued for. */\r\n  public get userType(): string {\r\n    return this.get(\"user_type\");\r\n  }\r\n\r\n  /**\r\n   * Whether the persisted expiry has passed.\r\n   *\r\n   * The middleware asks this on every request, which is what makes the row the\r\n   * authority it always looked like it was: before 4.12.0 the gate only checked\r\n   * that the row *existed*, so a row the database knew was dead still let its\r\n   * token through — the database was never asked.\r\n   *\r\n   * **Fails closed.** A missing or unparseable `expires_at` counts as expired.\r\n   * `expires_at` is `required` in the schema, so a row that cannot answer \"when\r\n   * does this die\" is malformed, and the safe reading of a malformed credential\r\n   * is that it is not one. This is deliberately stricter than a naive\r\n   * `now > expires_at`, which answers `false` for an `Invalid Date` and thereby\r\n   * grants exactly the poisoned rows an unlimited life.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date(expiresAt).getTime() <= Date.now();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing about this row can ever retire it — an unusable\r\n   * `expires_at`, or a token carrying no `exp` claim. See\r\n   * {@link isNeverExpiring}; this is the predicate `purgeNeverExpiring` selects\r\n   * on.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed access token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, expiresAt: Date) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      expires_at: expiresAt,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find an access-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<AccessToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Delete a specific token that belongs to the given user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete every access token belonging to the user.\r\n   */\r\n  public static deleteAllForUser(user: Auth) {\r\n    return this.delete({ user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired access-token row. Returns the number removed.\r\n   * Runs from the `auth.cleanup` CLI command (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<number> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens.length;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}.\r\n   *\r\n   * **A full scan, filtered in memory, on purpose.** The defining case is a row\r\n   * whose `expires_at` is an `Invalid Date`, which no date predicate can select\r\n   * (`< now` and `> now` are both `false` for it), and the definitive case is a\r\n   * token with no `exp` claim, which lives inside the token string rather than\r\n   * in a column. Neither is expressible as a `where`, so the rows have to be\r\n   * read to be judged. This runs from a one-off remediation command, not a\r\n   * request path.\r\n   */\r\n  public static async findNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: AccessToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed so the\r\n   * caller can report what it revoked. Deletion *is* revocation for access\r\n   * tokens — the middleware rejects a token with no row.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,oBAAoB,EAAE,OAAO;CACxC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;AAYD,IAAa,cAAb,cAAiC,MAAM;;eACf;;;gBAEC;;;wBASQ;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;;;;;;CAiBA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;;CAQA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;;;CAKA,OAAc,MAAM,MAAY,OAAe,WAAiB;EAC9D,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;EACd,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA4C;EACpE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,iBAAiB,MAAY;EACzC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC;CACzC;;;;;CAMA,aAAoB,eAAgC;EAClD,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO,cAAc;CACvB;;;;;;;;;;;;CAaA,aAAoB,oBAA4C;EAG9D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAuB,MAAM,YAAY;CACjE;;;;;;CAOA,aAAoB,qBAA6C;EAC/D,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}

package/esm/models/index.d.mts

@@ -1,7 +1,9 @@
 import { Auth } from "./auth.model.mjs";
 import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
+import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token/one-time-token.model.mjs";
 import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
-
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential/passkey-credential.model.mjs";
+import { ProviderAccount, providerAccountSchema } from "./provider-account/provider-account.model.mjs";
 //#region ../auth/src/models/index.d.ts
 declare const authMigrations: import("@warlock.js/cascade").MigrationConstructor[];
 //#endregion

package/esm/models/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"mappings":";;;;;cAOa,cAAA,gCAAc,oBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"mappings":";;;;;;;cAaa,cAAA,gCAAc,oBAAA"}

package/esm/models/index.mjs

@@ -1,13 +1,28 @@
 import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
 import "./access-token/index.mjs";
+import { OneTimeToken, oneTimeTokenSchema } from "./one-time-token/one-time-token.model.mjs";
+import "./one-time-token/index.mjs";
 import { RefreshToken, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
 import "./refresh-token/index.mjs";
 import { AccessTokenMigration } from "./access-token/migration.mjs";
+import { OneTimeTokenMigration } from "./one-time-token/migration.mjs";
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential/passkey-credential.model.mjs";
+import { PasskeyCredentialMigration } from "./passkey-credential/migration.mjs";
+import { ProviderAccount, providerAccountSchema } from "./provider-account/provider-account.model.mjs";
+import { ProviderAccountMigration } from "./provider-account/migration.mjs";
 import { RefreshTokenMigration } from "./refresh-token/migration.mjs";
 import { Auth } from "./auth.model.mjs";
+import "./passkey-credential/index.mjs";
+import "./provider-account/index.mjs";
 
 //#region ../auth/src/models/index.ts
-const authMigrations = [AccessTokenMigration, RefreshTokenMigration];
+const authMigrations = [
+	AccessTokenMigration,
+	RefreshTokenMigration,
+	OneTimeTokenMigration,
+	ProviderAccountMigration,
+	PasskeyCredentialMigration
+];
 
 //#endregion
 export { authMigrations };

package/esm/models/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenMigration } from \"./access-token/migration\";\r\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\r\n\r\nexport * from \"./access-token\";\r\nexport * from \"./auth.model\";\r\nexport * from \"./refresh-token\";\r\n\r\nexport const authMigrations = [AccessTokenMigration, RefreshTokenMigration];\r\n"],"mappings":";;;;;;;;;AAOA,MAAa,iBAAiB,CAAC,sBAAsB,qBAAqB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenMigration } from \"./access-token/migration\";\nimport { OneTimeTokenMigration } from \"./one-time-token/migration\";\nimport { PasskeyCredentialMigration } from \"./passkey-credential/migration\";\nimport { ProviderAccountMigration } from \"./provider-account/migration\";\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\n\nexport * from \"./access-token\";\nexport * from \"./auth.model\";\nexport * from \"./one-time-token\";\nexport * from \"./passkey-credential\";\nexport * from \"./provider-account\";\nexport * from \"./refresh-token\";\n\nexport const authMigrations = [\n  AccessTokenMigration,\n  RefreshTokenMigration,\n  OneTimeTokenMigration,\n  ProviderAccountMigration,\n  PasskeyCredentialMigration,\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;AAaA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;AACF"}