@warlock.js/auth 5.12.0 → 5.14.0

package/esm/middleware/require-verified-email.middleware.d.mts

@@ -0,0 +1,18 @@
+import { Middleware } from "@warlock.js/core";
+
+//#region ../auth/src/middleware/require-verified-email.middleware.d.ts
+/**
+ * Opt-in route gate that rejects a user who has not verified their email with
+ * {@link EmailNotVerifiedError} (`403`, `EC007`). Place it AFTER
+ * `authMiddleware` — it reads `request.locals.user`. A request with no user
+ * fails closed with the same error.
+ *
+ * @example
+ * router.post("/orders", createOrder, {
+ *   middleware: [authMiddleware("user"), requireVerifiedEmail()],
+ * });
+ */
+declare function requireVerifiedEmail(): Middleware;
+//#endregion
+export { requireVerifiedEmail };
+//# sourceMappingURL=require-verified-email.middleware.d.mts.map

package/esm/middleware/require-verified-email.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-verified-email.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/require-verified-email.middleware.ts"],"mappings":";;;;;AAeA;;;;AAAkD;;;;;iBAAlC,oBAAA,IAAwB,UAAU"}

package/esm/middleware/require-verified-email.middleware.mjs

@@ -0,0 +1,24 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { EmailNotVerifiedError } from "../errors/email-not-verified.error.mjs";
+
+//#region ../auth/src/middleware/require-verified-email.middleware.ts
+/**
+* Opt-in route gate that rejects a user who has not verified their email with
+* {@link EmailNotVerifiedError} (`403`, `EC007`). Place it AFTER
+* `authMiddleware` — it reads `request.locals.user`. A request with no user
+* fails closed with the same error.
+*
+* @example
+* router.post("/orders", createOrder, {
+*   middleware: [authMiddleware("user"), requireVerifiedEmail()],
+* });
+*/
+function requireVerifiedEmail() {
+	return async ({ request }) => {
+		if (!request.locals.user?.get?.(authConfig.verification.field())) throw new EmailNotVerifiedError();
+	};
+}
+
+//#endregion
+export { requireVerifiedEmail };
+//# sourceMappingURL=require-verified-email.middleware.mjs.map

package/esm/middleware/require-verified-email.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-verified-email.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/require-verified-email.middleware.ts"],"sourcesContent":["import type { Middleware } from \"@warlock.js/core\";\nimport { EmailNotVerifiedError } from \"../errors/email-not-verified.error\";\nimport { authConfig } from \"../services/auth-config\";\n\n/**\n * Opt-in route gate that rejects a user who has not verified their email with\n * {@link EmailNotVerifiedError} (`403`, `EC007`). Place it AFTER\n * `authMiddleware` — it reads `request.locals.user`. A request with no user\n * fails closed with the same error.\n *\n * @example\n * router.post(\"/orders\", createOrder, {\n *   middleware: [authMiddleware(\"user\"), requireVerifiedEmail()],\n * });\n */\nexport function requireVerifiedEmail(): Middleware {\n  return async ({ request }) => {\n    const user = request.locals.user as { get?: (key: string) => unknown } | undefined;\n\n    if (!user?.get?.(authConfig.verification.field())) {\n      throw new EmailNotVerifiedError();\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,SAAgB,uBAAmC;CACjD,OAAO,OAAO,EAAE,cAAc;EAG5B,IAAI,CAFS,QAAQ,OAAO,MAEjB,MAAM,WAAW,aAAa,MAAM,CAAC,GAC9C,MAAM,IAAI,sBAAsB;CAEpC;AACF"}

package/esm/models/access-token/access-token.model.d.mts

@@ -54,6 +54,14 @@ declare class AccessToken extends Model {
     user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
   }>>;
+  /**
+   * Permanent regardless of the data source default — Mongo's driver default
+   * is `"trash"`, which would copy live credential material (the JWT itself)
+   * into `access_tokensTrash` on every `destroy()` (logout, expiry purge,
+   * never-expiring purge). A revoked/expired access token must not survive
+   * anywhere.
+   */
+  static deleteStrategy: "permanent";
   /** The user this token was issued for. */
   get userId(): any;
   /** The user-type slug this token was issued for. */

package/esm/models/access-token/access-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"mappings":";;;;;;AAaA;;;;;;cAAa,iBAAA,6BAAiB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cAiBjB,WAAA,SAAoB,KAAA;EAAA,OACjB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;MAGT,MAAA;;MAKA,QAAA;;;;;;AAXb;;;;;;;;;;MA8Ba,SAAA;EAqBmD;;;;;;EAAA,IAPnD,YAAA;EAiC8B;;;EAAA,OA1B3B,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,WAAA;EAkEZ;;;EAAA,OAtDpC,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,WAAA;EA/Dd;;;EAAA,OAsEtB,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;EAnEjC;;;EAAA,OA0EN,gBAAA,CAAiB,IAAA,EAAM,IAAA,GAAI,OAAA;;;;;SAQrB,YAAA,IAAgB,OAAA;;;;;;;;;;;;SAqBhB,iBAAA,IAAqB,OAAA,CAAQ,WAAA;;;;;;SAW7B,kBAAA,IAAsB,OAAA,CAAQ,WAAA;AAAA"}
+{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"mappings":";;;;;;AAaA;;;;;;cAAa,iBAAA,6BAAiB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cAiBjB,WAAA,SAAoB,KAAA;EAAA,OACjB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;SASN,cAAA;;MAGH,MAAA;EAfY;EAAA,IAoBZ,QAAA;;;;;;;;;;;;;;;;MAmBA,SAAA;EAuDyB;;;;;;EAAA,IAzCzB,YAAA;EArDyB;;;EAAA,OA4DtB,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,WAAA;EAzD1C;;;EAAA,OAqEN,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,WAAA;;;;SAOpC,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;;;;SAOvC,gBAAA,CAAiB,IAAA,EAAM,IAAA,GAAI,OAAA;;;;;SAQrB,YAAA,IAAgB,OAAA;;;;;;;;;;;;SAqBhB,iBAAA,IAAqB,OAAA,CAAQ,WAAA;;;;;;SAW7B,kBAAA,IAAsB,OAAA,CAAQ,WAAA;AAAA"}

package/esm/models/access-token/access-token.model.mjs

@@ -34,6 +34,9 @@ var AccessToken = class extends Model {
 	static {
 		this.schema = accessTokenSchema;
 	}
+	static {
+		this.deleteStrategy = "permanent";
+	}
 	/** The user this token was issued for. */
 	get userId() {
 		return this.get("user_id");

package/esm/models/access-token/access-token.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted access-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape.\r\n *\r\n * `last_access` and the `is_active` soft-revoke flag were removed — neither was\r\n * ever read; access tokens are revoked by deleting the row.\r\n */\r\nexport const accessTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  expires_at: v.date().required(),\r\n});\r\n\r\n/**\r\n * Persisted access-token record + the data layer for access tokens.\r\n *\r\n * **Role.** Owns access-token persistence and lookup. The middleware checks a\r\n * presented JWT against this table so deleting a row (logout) invalidates the\r\n * token immediately, before its JWT expiry. The auth service goes through the\r\n * named statics exclusively, so it never hard-codes a column name and an\r\n * override can rename/add columns by registering under\r\n * `config.auth.accessToken.model`.\r\n */\r\nexport class AccessToken extends Model {\r\n  public static table = \"access_tokens\";\r\n\r\n  public static schema = accessTokenSchema;\r\n\r\n  /** The user this token was issued for. */\r\n  public get userId() {\r\n    return this.get(\"user_id\");\r\n  }\r\n\r\n  /** The user-type slug this token was issued for. */\r\n  public get userType(): string {\r\n    return this.get(\"user_type\");\r\n  }\r\n\r\n  /**\r\n   * Whether the persisted expiry has passed.\r\n   *\r\n   * The middleware asks this on every request, which is what makes the row the\r\n   * authority it always looked like it was: before 4.12.0 the gate only checked\r\n   * that the row *existed*, so a row the database knew was dead still let its\r\n   * token through — the database was never asked.\r\n   *\r\n   * **Fails closed.** A missing or unparseable `expires_at` counts as expired.\r\n   * `expires_at` is `required` in the schema, so a row that cannot answer \"when\r\n   * does this die\" is malformed, and the safe reading of a malformed credential\r\n   * is that it is not one. This is deliberately stricter than a naive\r\n   * `now > expires_at`, which answers `false` for an `Invalid Date` and thereby\r\n   * grants exactly the poisoned rows an unlimited life.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date(expiresAt).getTime() <= Date.now();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing about this row can ever retire it — an unusable\r\n   * `expires_at`, or a token carrying no `exp` claim. See\r\n   * {@link isNeverExpiring}; this is the predicate `purgeNeverExpiring` selects\r\n   * on.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed access token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, expiresAt: Date) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      expires_at: expiresAt,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find an access-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<AccessToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Delete a specific token that belongs to the given user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete every access token belonging to the user.\r\n   */\r\n  public static deleteAllForUser(user: Auth) {\r\n    return this.delete({ user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired access-token row. Returns the number removed.\r\n   * Runs from the `auth.cleanup` CLI command (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<number> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens.length;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}.\r\n   *\r\n   * **A full scan, filtered in memory, on purpose.** The defining case is a row\r\n   * whose `expires_at` is an `Invalid Date`, which no date predicate can select\r\n   * (`< now` and `> now` are both `false` for it), and the definitive case is a\r\n   * token with no `exp` claim, which lives inside the token string rather than\r\n   * in a column. Neither is expressible as a `where`, so the rows have to be\r\n   * read to be judged. This runs from a one-off remediation command, not a\r\n   * request path.\r\n   */\r\n  public static async findNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: AccessToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed so the\r\n   * caller can report what it revoked. Deletion *is* revocation for access\r\n   * tokens — the middleware rejects a token with no row.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,oBAAoB,EAAE,OAAO;CACxC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;AAYD,IAAa,cAAb,cAAiC,MAAM;;eACf;;;gBAEC;;;CAGvB,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;;;;;;CAiBA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;;CAQA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;;;CAKA,OAAc,MAAM,MAAY,OAAe,WAAiB;EAC9D,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;EACd,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA4C;EACpE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,iBAAiB,MAAY;EACzC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC;CACzC;;;;;CAMA,aAAoB,eAAgC;EAClD,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO,cAAc;CACvB;;;;;;;;;;;;CAaA,aAAoB,oBAA4C;EAG9D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAuB,MAAM,YAAY;CACjE;;;;;;CAOA,aAAoB,qBAA6C;EAC/D,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}
+{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted access-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape.\r\n *\r\n * `last_access` and the `is_active` soft-revoke flag were removed — neither was\r\n * ever read; access tokens are revoked by deleting the row.\r\n */\r\nexport const accessTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  expires_at: v.date().required(),\r\n});\r\n\r\n/**\r\n * Persisted access-token record + the data layer for access tokens.\r\n *\r\n * **Role.** Owns access-token persistence and lookup. The middleware checks a\r\n * presented JWT against this table so deleting a row (logout) invalidates the\r\n * token immediately, before its JWT expiry. The auth service goes through the\r\n * named statics exclusively, so it never hard-codes a column name and an\r\n * override can rename/add columns by registering under\r\n * `config.auth.accessToken.model`.\r\n */\r\nexport class AccessToken extends Model {\r\n  public static table = \"access_tokens\";\r\n\r\n  public static schema = accessTokenSchema;\r\n\r\n  /**\r\n   * Permanent regardless of the data source default — Mongo's driver default\r\n   * is `\"trash\"`, which would copy live credential material (the JWT itself)\r\n   * into `access_tokensTrash` on every `destroy()` (logout, expiry purge,\r\n   * never-expiring purge). A revoked/expired access token must not survive\r\n   * anywhere.\r\n   */\r\n  public static deleteStrategy = \"permanent\" as const;\r\n\r\n  /** The user this token was issued for. */\r\n  public get userId() {\r\n    return this.get(\"user_id\");\r\n  }\r\n\r\n  /** The user-type slug this token was issued for. */\r\n  public get userType(): string {\r\n    return this.get(\"user_type\");\r\n  }\r\n\r\n  /**\r\n   * Whether the persisted expiry has passed.\r\n   *\r\n   * The middleware asks this on every request, which is what makes the row the\r\n   * authority it always looked like it was: before 4.12.0 the gate only checked\r\n   * that the row *existed*, so a row the database knew was dead still let its\r\n   * token through — the database was never asked.\r\n   *\r\n   * **Fails closed.** A missing or unparseable `expires_at` counts as expired.\r\n   * `expires_at` is `required` in the schema, so a row that cannot answer \"when\r\n   * does this die\" is malformed, and the safe reading of a malformed credential\r\n   * is that it is not one. This is deliberately stricter than a naive\r\n   * `now > expires_at`, which answers `false` for an `Invalid Date` and thereby\r\n   * grants exactly the poisoned rows an unlimited life.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date(expiresAt).getTime() <= Date.now();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing about this row can ever retire it — an unusable\r\n   * `expires_at`, or a token carrying no `exp` claim. See\r\n   * {@link isNeverExpiring}; this is the predicate `purgeNeverExpiring` selects\r\n   * on.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed access token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, expiresAt: Date) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      expires_at: expiresAt,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find an access-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<AccessToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Delete a specific token that belongs to the given user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete every access token belonging to the user.\r\n   */\r\n  public static deleteAllForUser(user: Auth) {\r\n    return this.delete({ user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired access-token row. Returns the number removed.\r\n   * Runs from the `auth.cleanup` CLI command (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<number> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens.length;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}.\r\n   *\r\n   * **A full scan, filtered in memory, on purpose.** The defining case is a row\r\n   * whose `expires_at` is an `Invalid Date`, which no date predicate can select\r\n   * (`< now` and `> now` are both `false` for it), and the definitive case is a\r\n   * token with no `exp` claim, which lives inside the token string rather than\r\n   * in a column. Neither is expressible as a `where`, so the rows have to be\r\n   * read to be judged. This runs from a one-off remediation command, not a\r\n   * request path.\r\n   */\r\n  public static async findNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: AccessToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed so the\r\n   * caller can report what it revoked. Deletion *is* revocation for access\r\n   * tokens — the middleware rejects a token with no row.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,oBAAoB,EAAE,OAAO;CACxC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;AAYD,IAAa,cAAb,cAAiC,MAAM;;eACf;;;gBAEC;;;wBASQ;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;;;;;;CAiBA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;;CAQA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;;;CAKA,OAAc,MAAM,MAAY,OAAe,WAAiB;EAC9D,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;EACd,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA4C;EACpE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,iBAAiB,MAAY;EACzC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC;CACzC;;;;;CAMA,aAAoB,eAAgC;EAClD,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO,cAAc;CACvB;;;;;;;;;;;;CAaA,aAAoB,oBAA4C;EAG9D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAuB,MAAM,YAAY;CACjE;;;;;;CAOA,aAAoB,qBAA6C;EAC/D,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}

package/esm/models/index.d.mts

@@ -1,7 +1,9 @@
 import { Auth } from "./auth.model.mjs";
 import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
+import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token/one-time-token.model.mjs";
 import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
-
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential/passkey-credential.model.mjs";
+import { ProviderAccount, providerAccountSchema } from "./provider-account/provider-account.model.mjs";
 //#region ../auth/src/models/index.d.ts
 declare const authMigrations: import("@warlock.js/cascade").MigrationConstructor[];
 //#endregion

package/esm/models/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"mappings":";;;;;cAOa,cAAA,gCAAc,oBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"mappings":";;;;;;;cAaa,cAAA,gCAAc,oBAAA"}

package/esm/models/index.mjs

@@ -1,13 +1,28 @@
 import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
 import "./access-token/index.mjs";
+import { OneTimeToken, oneTimeTokenSchema } from "./one-time-token/one-time-token.model.mjs";
+import "./one-time-token/index.mjs";
 import { RefreshToken, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
 import "./refresh-token/index.mjs";
 import { AccessTokenMigration } from "./access-token/migration.mjs";
+import { OneTimeTokenMigration } from "./one-time-token/migration.mjs";
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential/passkey-credential.model.mjs";
+import { PasskeyCredentialMigration } from "./passkey-credential/migration.mjs";
+import { ProviderAccount, providerAccountSchema } from "./provider-account/provider-account.model.mjs";
+import { ProviderAccountMigration } from "./provider-account/migration.mjs";
 import { RefreshTokenMigration } from "./refresh-token/migration.mjs";
 import { Auth } from "./auth.model.mjs";
+import "./passkey-credential/index.mjs";
+import "./provider-account/index.mjs";
 
 //#region ../auth/src/models/index.ts
-const authMigrations = [AccessTokenMigration, RefreshTokenMigration];
+const authMigrations = [
+	AccessTokenMigration,
+	RefreshTokenMigration,
+	OneTimeTokenMigration,
+	ProviderAccountMigration,
+	PasskeyCredentialMigration
+];
 
 //#endregion
 export { authMigrations };

package/esm/models/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenMigration } from \"./access-token/migration\";\r\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\r\n\r\nexport * from \"./access-token\";\r\nexport * from \"./auth.model\";\r\nexport * from \"./refresh-token\";\r\n\r\nexport const authMigrations = [AccessTokenMigration, RefreshTokenMigration];\r\n"],"mappings":";;;;;;;;;AAOA,MAAa,iBAAiB,CAAC,sBAAsB,qBAAqB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenMigration } from \"./access-token/migration\";\nimport { OneTimeTokenMigration } from \"./one-time-token/migration\";\nimport { PasskeyCredentialMigration } from \"./passkey-credential/migration\";\nimport { ProviderAccountMigration } from \"./provider-account/migration\";\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\n\nexport * from \"./access-token\";\nexport * from \"./auth.model\";\nexport * from \"./one-time-token\";\nexport * from \"./passkey-credential\";\nexport * from \"./provider-account\";\nexport * from \"./refresh-token\";\n\nexport const authMigrations = [\n  AccessTokenMigration,\n  RefreshTokenMigration,\n  OneTimeTokenMigration,\n  ProviderAccountMigration,\n  PasskeyCredentialMigration,\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;AAaA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;AACF"}

package/esm/models/one-time-token/index.d.mts

@@ -0,0 +1 @@
+import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token.model.mjs";

package/esm/models/one-time-token/index.mjs

@@ -0,0 +1,3 @@
+import { OneTimeToken, oneTimeTokenSchema } from "./one-time-token.model.mjs";
+
+export {  };

package/esm/models/one-time-token/migration.mjs

@@ -0,0 +1,31 @@
+import { OneTimeToken } from "./one-time-token.model.mjs";
+import { migrate } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/one-time-token/migration.ts
+const OneTimeTokenMigration = migrate(OneTimeToken, {
+	name: "oneTimeToken",
+	up() {
+		this.createTableIfNotExists();
+		this.primaryUuid();
+		this.string("token_hash", 64).unique();
+		this.string("purpose", 32);
+		this.foreignId("user_id").nullable().index();
+		this.string("user_type", 50).nullable();
+		this.timestamp("expires_at").index().nullable();
+		this.timestamp("consumed_at").nullable();
+		this.integer("attempts").default(0);
+		this.index([
+			"user_id",
+			"user_type",
+			"purpose"
+		]);
+		this.timestamps();
+	},
+	down() {
+		this.dropTableIfExists();
+	}
+});
+
+//#endregion
+export { OneTimeTokenMigration };
+//# sourceMappingURL=migration.mjs.map

package/esm/models/one-time-token/migration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/one-time-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { OneTimeToken } from \"./one-time-token.model\";\n\nexport const OneTimeTokenMigration = migrate(OneTimeToken, {\n  name: \"oneTimeToken\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    // SHA-256 hex digest of the raw token — the raw token is never stored.\n    this.string(\"token_hash\", 64).unique();\n    this.string(\"purpose\", 32);\n\n    // `foreignId` follows the DataSource's default primary-key type, matching\n    // the access/refresh token tables. Nullable only for a passkey\n    // authentication challenge, which is issued before anyone is identified.\n    this.foreignId(\"user_id\").nullable().index();\n    this.string(\"user_type\", 50).nullable();\n\n    this.timestamp(\"expires_at\").index().nullable();\n    this.timestamp(\"consumed_at\").nullable();\n\n    // Failed verify attempts — only OTP codes are capped on it.\n    this.integer(\"attempts\").default(0);\n\n    // Invalidating a user's previous reset tokens filters on these.\n    this.index([\"user_id\", \"user_type\", \"purpose\"]);\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAGjB,KAAK,OAAO,cAAc,EAAE,CAAC,CAAC,OAAO;EACrC,KAAK,OAAO,WAAW,EAAE;EAKzB,KAAK,UAAU,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;EAC3C,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAEtC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAC9C,KAAK,UAAU,aAAa,CAAC,CAAC,SAAS;EAGvC,KAAK,QAAQ,UAAU,CAAC,CAAC,QAAQ,CAAC;EAGlC,KAAK,MAAM;GAAC;GAAW;GAAa;EAAS,CAAC;EAE9C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/one-time-token/one-time-token.model.d.mts

@@ -0,0 +1,173 @@
+import { Auth } from "../auth.model.mjs";
+import { Model } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/one-time-token/one-time-token.model.d.ts
+/** What a one-time token may be used for. A token only ever satisfies its own purpose. */
+type OneTimeTokenPurpose = "email-verification" | "password-reset" | "otp" | "passkey-registration" | "passkey-authentication";
+/**
+ * Seal schema for the persisted one-time token. Exported so an override can
+ * extend it (e.g. a tenant key).
+ */
+declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
+  token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+    isOptional: true;
+  };
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+  expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+  consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+    isOptional: true;
+  };
+  attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+    isOptional: true;
+  };
+}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+  token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+    isOptional: true;
+  };
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+  expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+  consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+    isOptional: true;
+  };
+  attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+    isOptional: true;
+  };
+}>, import("@warlock.js/seal").InferInputObjectShape<{
+  token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+    isOptional: true;
+  };
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+  expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+  consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+    isOptional: true;
+  };
+  attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+    isOptional: true;
+  };
+}>>;
+/**
+ * Persisted one-time secret: email-verification / password-reset token, OTP
+ * code, or passkey ceremony challenge.
+ *
+ * **Only a SHA-256 hash is stored** — the raw token exists in the notification
+ * and nowhere else, so a leaked table cannot be replayed. Single use is
+ * enforced by {@link consumeIfActive}, a conditional update in the same shape
+ * as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.
+ */
+declare class OneTimeToken extends Model {
+  static table: string;
+  static schema: import("@warlock.js/seal").ObjectValidator<{
+    token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+      isOptional: true;
+    };
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+    expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+    consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+      isOptional: true;
+    };
+    attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+      isOptional: true;
+    };
+  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+    token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+      isOptional: true;
+    };
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+    expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+    consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+      isOptional: true;
+    };
+    attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+      isOptional: true;
+    };
+  }>, import("@warlock.js/seal").InferInputObjectShape<{
+    token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+      isOptional: true;
+    };
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+    expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+    consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+      isOptional: true;
+    };
+    attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+      isOptional: true;
+    };
+  }>>;
+  /**
+   * Permanent regardless of the data source default — Mongo's driver default
+   * is `"trash"`, which would copy spent token hashes into
+   * `one_time_tokensTrash` on every `destroy()`. A purged one-time token must
+   * not survive anywhere.
+   */
+  static deleteStrategy: "permanent";
+  /** The user this token was issued for. */
+  get userId(): any;
+  /** The user-type slug this token was issued for. */
+  get userType(): string;
+  /** Whether the token has been used (or invalidated by a newer one). */
+  get isConsumed(): boolean;
+  /** Whether the expiry has passed. Fails closed: an unusable `expires_at` counts as expired. */
+  get isExpired(): boolean;
+  /**
+   * Atomically mark this token consumed ONLY if nobody has yet. Resolves `true`
+   * for the single caller that won; every concurrent or later caller gets
+   * `false`.
+   */
+  consumeIfActive(): Promise<boolean>;
+  /** Persist a new token row. `tokenHash` is the SHA-256 hex digest, never the raw token. */
+  static issue(user: Auth, purpose: OneTimeTokenPurpose, tokenHash: string, expiresAt: Date): Promise<OneTimeToken>;
+  /**
+   * Persist a passkey ceremony challenge. `user` is omitted for an
+   * authentication challenge, issued before anyone is identified.
+   */
+  static issueChallenge(purpose: OneTimeTokenPurpose, tokenHash: string, expiresAt: Date, user?: Auth): Promise<OneTimeToken>;
+  /** The user's newest unconsumed token of `purpose` (at most one for OTP). */
+  static findActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<OneTimeToken | null>;
+  /**
+   * Atomically count one verify attempt, ONLY while fewer than `max` have been
+   * counted and the token is unconsumed. Resolves `false` once the cap is
+   * reached — of N concurrent attempts, at most `max` ever resolve `true`.
+   */
+  recordAttempt(max: number): Promise<boolean>;
+  /**
+   * Hard-delete every spent row — expired, or consumed (used, invalidated by a
+   * newer token, or exhausted). Neither can ever be redeemed again, so nothing
+   * reads them. Hard-deleted, never trashed. Returns the number removed. Runs from the `auth.cleanup` CLI
+   * command (a cold batch path).
+   */
+  static purgeSpent(): Promise<number>;
+  /** Find a token by hash, scoped to a purpose — a token of the other purpose is not found. */
+  static findByHash(tokenHash: string, purpose: OneTimeTokenPurpose): Promise<OneTimeToken | null>;
+  /**
+   * Consume every still-unused token of `purpose` for the user, returning how
+   * many were invalidated. Used before issuing a new password-reset token.
+   */
+  static invalidateActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<number>;
+}
+//#endregion
+export { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema };
+//# sourceMappingURL=one-time-token.model.d.mts.map

package/esm/models/one-time-token/one-time-token.model.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/one-time-token/one-time-token.model.ts"],"mappings":";;;;;KAMY,mBAAA;AAAZ;;;;AAAA,cAWa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoBlB,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAHtB;;;;SAWgB,cAAA;;MAGH,MAAA;;MAKA,QAAA;;MAKA,UAAA;;MAKA,SAAA;;;;;;EAaE,eAAA,IAAmB,OAAA;EAgBf;EAAA,OAJH,KAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,YAAA;EAkBN;;;;EAAA,OADG,cAAA,CACZ,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,EACX,IAAA,GAAO,IAAA,GAAI,OAAA,CAAA,YAAA;EAeL;EAAA,OADM,aAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;EAAA;;;;;EAYE,aAAA,CAAc,GAAA,WAAc,OAAA;EAqCtC;;;;;;EAAA,OAlBiB,UAAA,IAAc,OAAA;EA/HF;EAAA,OA8IlB,UAAA,CACZ,SAAA,UACA,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;EA9IG;;;;EAAA,OAsJA,mBAAA,CAAoB,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,mBAAA,GAAsB,OAAA;AAAA"}

package/esm/models/one-time-token/one-time-token.model.mjs

@@ -0,0 +1,151 @@
+import { isUsableExpiry } from "../../utils/token-expiry.mjs";
+import { Model } from "@warlock.js/cascade";
+import { v } from "@warlock.js/seal";
+
+//#region ../auth/src/models/one-time-token/one-time-token.model.ts
+/**
+* Seal schema for the persisted one-time token. Exported so an override can
+* extend it (e.g. a tenant key).
+*/
+const oneTimeTokenSchema = v.object({
+	token_hash: v.string().required(),
+	purpose: v.string().required(),
+	user_id: v.scalar().optional(),
+	user_type: v.string().optional(),
+	expires_at: v.date().required(),
+	consumed_at: v.date().optional(),
+	attempts: v.int().optional()
+});
+/**
+* Persisted one-time secret: email-verification / password-reset token, OTP
+* code, or passkey ceremony challenge.
+*
+* **Only a SHA-256 hash is stored** — the raw token exists in the notification
+* and nowhere else, so a leaked table cannot be replayed. Single use is
+* enforced by {@link consumeIfActive}, a conditional update in the same shape
+* as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.
+*/
+var OneTimeToken = class extends Model {
+	static {
+		this.table = "one_time_tokens";
+	}
+	static {
+		this.schema = oneTimeTokenSchema;
+	}
+	static {
+		this.deleteStrategy = "permanent";
+	}
+	/** The user this token was issued for. */
+	get userId() {
+		return this.get("user_id");
+	}
+	/** The user-type slug this token was issued for. */
+	get userType() {
+		return this.get("user_type");
+	}
+	/** Whether the token has been used (or invalidated by a newer one). */
+	get isConsumed() {
+		return !!this.get("consumed_at");
+	}
+	/** Whether the expiry has passed. Fails closed: an unusable `expires_at` counts as expired. */
+	get isExpired() {
+		const expiresAt = this.get("expires_at");
+		if (!isUsableExpiry(expiresAt)) return true;
+		return new Date(expiresAt).getTime() <= Date.now();
+	}
+	/**
+	* Atomically mark this token consumed ONLY if nobody has yet. Resolves `true`
+	* for the single caller that won; every concurrent or later caller gets
+	* `false`.
+	*/
+	async consumeIfActive() {
+		return await this.constructor.atomic({
+			id: this.id,
+			consumed_at: null
+		}, { $set: { consumed_at: /* @__PURE__ */ new Date() } }) > 0;
+	}
+	/** Persist a new token row. `tokenHash` is the SHA-256 hex digest, never the raw token. */
+	static issue(user, purpose, tokenHash, expiresAt) {
+		return this.create({
+			token_hash: tokenHash,
+			purpose,
+			user_id: user.id,
+			user_type: user.userType,
+			expires_at: expiresAt,
+			consumed_at: null,
+			attempts: 0
+		});
+	}
+	/**
+	* Persist a passkey ceremony challenge. `user` is omitted for an
+	* authentication challenge, issued before anyone is identified.
+	*/
+	static issueChallenge(purpose, tokenHash, expiresAt, user) {
+		return this.create({
+			token_hash: tokenHash,
+			purpose,
+			user_id: user?.id ?? null,
+			user_type: user?.userType ?? null,
+			expires_at: expiresAt,
+			consumed_at: null,
+			attempts: 0
+		});
+	}
+	/** The user's newest unconsumed token of `purpose` (at most one for OTP). */
+	static findActiveFor(user, purpose) {
+		return this.query().where({
+			user_id: user.id,
+			user_type: user.userType,
+			purpose,
+			consumed_at: null
+		}).orderBy("created_at", "desc").first();
+	}
+	/**
+	* Atomically count one verify attempt, ONLY while fewer than `max` have been
+	* counted and the token is unconsumed. Resolves `false` once the cap is
+	* reached — of N concurrent attempts, at most `max` ever resolve `true`.
+	*/
+	async recordAttempt(max) {
+		return await this.constructor.atomic({
+			id: this.id,
+			consumed_at: null,
+			attempts: { $lt: max }
+		}, { $inc: { attempts: 1 } }, { trustedFilter: true }) > 0;
+	}
+	/**
+	* Hard-delete every spent row — expired, or consumed (used, invalidated by a
+	* newer token, or exhausted). Neither can ever be redeemed again, so nothing
+	* reads them. Hard-deleted, never trashed. Returns the number removed. Runs from the `auth.cleanup` CLI
+	* command (a cold batch path).
+	*/
+	static async purgeSpent() {
+		const expired = await this.query().where("expires_at", "<", /* @__PURE__ */ new Date()).get();
+		const consumed = await this.query().whereNotNull("consumed_at").get();
+		const spent = new Map([...expired, ...consumed].map((token) => [String(token.id), token]));
+		for (const token of spent.values()) await token.destroy();
+		return spent.size;
+	}
+	/** Find a token by hash, scoped to a purpose — a token of the other purpose is not found. */
+	static findByHash(tokenHash, purpose) {
+		return this.first({
+			token_hash: tokenHash,
+			purpose
+		});
+	}
+	/**
+	* Consume every still-unused token of `purpose` for the user, returning how
+	* many were invalidated. Used before issuing a new password-reset token.
+	*/
+	static invalidateActiveFor(user, purpose) {
+		return this.atomic({
+			user_id: user.id,
+			user_type: user.userType,
+			purpose,
+			consumed_at: null
+		}, { $set: { consumed_at: /* @__PURE__ */ new Date() } });
+	}
+};
+
+//#endregion
+export { OneTimeToken, oneTimeTokenSchema };
+//# sourceMappingURL=one-time-token.model.mjs.map

package/esm/models/one-time-token/one-time-token.model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/one-time-token/one-time-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport { isUsableExpiry } from \"../../utils/token-expiry\";\nimport type { Auth } from \"../auth.model\";\n\n/** What a one-time token may be used for. A token only ever satisfies its own purpose. */\nexport type OneTimeTokenPurpose =\n  | \"email-verification\"\n  | \"password-reset\"\n  | \"otp\"\n  | \"passkey-registration\"\n  | \"passkey-authentication\";\n\n/**\n * Seal schema for the persisted one-time token. Exported so an override can\n * extend it (e.g. a tenant key).\n */\nexport const oneTimeTokenSchema = v.object({\n  token_hash: v.string().required(),\n  purpose: v.string().required(),\n  // Absent only on a passkey authentication challenge (no user identified yet).\n  user_id: v.scalar().optional(),\n  user_type: v.string().optional(),\n  expires_at: v.date().required(),\n  consumed_at: v.date().optional(),\n  attempts: v.int().optional(),\n});\n\n/**\n * Persisted one-time secret: email-verification / password-reset token, OTP\n * code, or passkey ceremony challenge.\n *\n * **Only a SHA-256 hash is stored** — the raw token exists in the notification\n * and nowhere else, so a leaked table cannot be replayed. Single use is\n * enforced by {@link consumeIfActive}, a conditional update in the same shape\n * as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.\n */\nexport class OneTimeToken extends Model {\n  public static table = \"one_time_tokens\";\n\n  public static schema = oneTimeTokenSchema;\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`, which would copy spent token hashes into\n   * `one_time_tokensTrash` on every `destroy()`. A purged one-time token must\n   * not survive anywhere.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** The user this token was issued for. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The user-type slug this token was issued for. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Whether the token has been used (or invalidated by a newer one). */\n  public get isConsumed(): boolean {\n    return !!this.get(\"consumed_at\");\n  }\n\n  /** Whether the expiry has passed. Fails closed: an unusable `expires_at` counts as expired. */\n  public get isExpired(): boolean {\n    const expiresAt = this.get(\"expires_at\");\n\n    if (!isUsableExpiry(expiresAt)) return true;\n\n    return new Date(expiresAt).getTime() <= Date.now();\n  }\n\n  /**\n   * Atomically mark this token consumed ONLY if nobody has yet. Resolves `true`\n   * for the single caller that won; every concurrent or later caller gets\n   * `false`.\n   */\n  public async consumeIfActive(): Promise<boolean> {\n    const modelClass = this.constructor as typeof OneTimeToken;\n\n    const consumed = await modelClass.atomic(\n      { id: this.id, consumed_at: null },\n      { $set: { consumed_at: new Date() } },\n    );\n\n    return consumed > 0;\n  }\n\n  /** Persist a new token row. `tokenHash` is the SHA-256 hex digest, never the raw token. */\n  public static issue(\n    user: Auth,\n    purpose: OneTimeTokenPurpose,\n    tokenHash: string,\n    expiresAt: Date,\n  ) {\n    return this.create({\n      token_hash: tokenHash,\n      purpose,\n      user_id: user.id,\n      user_type: user.userType,\n      expires_at: expiresAt,\n      consumed_at: null,\n      attempts: 0,\n    });\n  }\n\n  /**\n   * Persist a passkey ceremony challenge. `user` is omitted for an\n   * authentication challenge, issued before anyone is identified.\n   */\n  public static issueChallenge(\n    purpose: OneTimeTokenPurpose,\n    tokenHash: string,\n    expiresAt: Date,\n    user?: Auth,\n  ) {\n    return this.create({\n      token_hash: tokenHash,\n      purpose,\n      user_id: user?.id ?? null,\n      user_type: user?.userType ?? null,\n      expires_at: expiresAt,\n      consumed_at: null,\n      attempts: 0,\n    });\n  }\n\n  /** The user's newest unconsumed token of `purpose` (at most one for OTP). */\n  public static findActiveFor(\n    user: Auth,\n    purpose: OneTimeTokenPurpose,\n  ): Promise<OneTimeToken | null> {\n    return this.query()\n      .where({ user_id: user.id, user_type: user.userType, purpose, consumed_at: null })\n      .orderBy(\"created_at\", \"desc\")\n      .first();\n  }\n\n  /**\n   * Atomically count one verify attempt, ONLY while fewer than `max` have been\n   * counted and the token is unconsumed. Resolves `false` once the cap is\n   * reached — of N concurrent attempts, at most `max` ever resolve `true`.\n   */\n  public async recordAttempt(max: number): Promise<boolean> {\n    const modelClass = this.constructor as typeof OneTimeToken;\n\n    const counted = await modelClass.atomic(\n      { id: this.id, consumed_at: null, attempts: { $lt: max } },\n      { $inc: { attempts: 1 } },\n      // Code-authored filter; nothing here comes from the request.\n      { trustedFilter: true },\n    );\n\n    return counted > 0;\n  }\n\n  /**\n   * Hard-delete every spent row — expired, or consumed (used, invalidated by a\n   * newer token, or exhausted). Neither can ever be redeemed again, so nothing\n   * reads them. Hard-deleted, never trashed. Returns the number removed. Runs from the `auth.cleanup` CLI\n   * command (a cold batch path).\n   */\n  public static async purgeSpent(): Promise<number> {\n    const expired = await this.query().where(\"expires_at\", \"<\", new Date()).get();\n    const consumed = await this.query().whereNotNull(\"consumed_at\").get();\n    const spent = new Map([...expired, ...consumed].map((token) => [String(token.id), token]));\n\n    for (const token of spent.values()) {\n      // `static deleteStrategy` above already forces \"permanent\" regardless\n      // of the data source default (Mongo's is \"trash\").\n      await token.destroy();\n    }\n\n    return spent.size;\n  }\n\n  /** Find a token by hash, scoped to a purpose — a token of the other purpose is not found. */\n  public static findByHash(\n    tokenHash: string,\n    purpose: OneTimeTokenPurpose,\n  ): Promise<OneTimeToken | null> {\n    return this.first({ token_hash: tokenHash, purpose });\n  }\n\n  /**\n   * Consume every still-unused token of `purpose` for the user, returning how\n   * many were invalidated. Used before issuing a new password-reset token.\n   */\n  public static invalidateActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<number> {\n    return this.atomic(\n      { user_id: user.id, user_type: user.userType, purpose, consumed_at: null },\n      { $set: { consumed_at: new Date() } },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;AAiBA,MAAa,qBAAqB,EAAE,OAAO;CACzC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAE7B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,aAAa,EAAE,KAAK,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS;AAC7B,CAAC;;;;;;;;;;AAWD,IAAa,eAAb,cAAkC,MAAM;;eAChB;;;gBAEC;;;wBAQQ;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,IAAW,aAAsB;EAC/B,OAAO,CAAC,CAAC,KAAK,IAAI,aAAa;CACjC;;CAGA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;CAOA,MAAa,kBAAoC;EAQ/C,OAAO,MAPY,KAAK,YAEU,OAChC;GAAE,IAAI,KAAK;GAAI,aAAa;EAAK,GACjC,EAAE,MAAM,EAAE,6BAAa,IAAI,KAAK,EAAE,EAAE,CACtC,IAEkB;CACpB;;CAGA,OAAc,MACZ,MACA,SACA,WACA,WACA;EACA,OAAO,KAAK,OAAO;GACjB,YAAY;GACZ;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;GACZ,aAAa;GACb,UAAU;EACZ,CAAC;CACH;;;;;CAMA,OAAc,eACZ,SACA,WACA,WACA,MACA;EACA,OAAO,KAAK,OAAO;GACjB,YAAY;GACZ;GACA,SAAS,MAAM,MAAM;GACrB,WAAW,MAAM,YAAY;GAC7B,YAAY;GACZ,aAAa;GACb,UAAU;EACZ,CAAC;CACH;;CAGA,OAAc,cACZ,MACA,SAC8B;EAC9B,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU;GAAS,aAAa;EAAK,CAAC,CAAC,CACjF,QAAQ,cAAc,MAAM,CAAC,CAC7B,MAAM;CACX;;;;;;CAOA,MAAa,cAAc,KAA+B;EAUxD,OAAO,MATY,KAAK,YAES,OAC/B;GAAE,IAAI,KAAK;GAAI,aAAa;GAAM,UAAU,EAAE,KAAK,IAAI;EAAE,GACzD,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAExB,EAAE,eAAe,KAAK,CACxB,IAEiB;CACnB;;;;;;;CAQA,aAAoB,aAA8B;EAChD,MAAM,UAAU,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAC5E,MAAM,WAAW,MAAM,KAAK,MAAM,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC,IAAI;EACpE,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC,KAAK,UAAU,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;EAEzF,KAAK,MAAM,SAAS,MAAM,OAAO,GAG/B,MAAM,MAAM,QAAQ;EAGtB,OAAO,MAAM;CACf;;CAGA,OAAc,WACZ,WACA,SAC8B;EAC9B,OAAO,KAAK,MAAM;GAAE,YAAY;GAAW;EAAQ,CAAC;CACtD;;;;;CAMA,OAAc,oBAAoB,MAAY,SAA+C;EAC3F,OAAO,KAAK,OACV;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU;GAAS,aAAa;EAAK,GACzE,EAAE,MAAM,EAAE,6BAAa,IAAI,KAAK,EAAE,EAAE,CACtC;CACF;AACF"}

package/esm/models/passkey-credential/index.d.mts

@@ -0,0 +1 @@
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";

package/esm/models/passkey-credential/index.mjs

@@ -0,0 +1,3 @@
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";
+
+export {  };

package/esm/models/passkey-credential/migration.mjs

@@ -0,0 +1,25 @@
+import { PasskeyCredential } from "./passkey-credential.model.mjs";
+import { migrate } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/passkey-credential/migration.ts
+const PasskeyCredentialMigration = migrate(PasskeyCredential, {
+	name: "passkeyCredential",
+	up() {
+		this.createTableIfNotExists();
+		this.primaryUuid();
+		this.text("credential_id").unique();
+		this.text("public_key");
+		this.bigInteger("counter").default(0);
+		this.json("transports").nullable();
+		this.foreignId("user_id").index();
+		this.string("user_type", 50).nullable();
+		this.timestamps();
+	},
+	down() {
+		this.dropTableIfExists();
+	}
+});
+
+//#endregion
+export { PasskeyCredentialMigration };
+//# sourceMappingURL=migration.mjs.map

package/esm/models/passkey-credential/migration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/passkey-credential/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { PasskeyCredential } from \"./passkey-credential.model\";\n\nexport const PasskeyCredentialMigration = migrate(PasskeyCredential, {\n  name: \"passkeyCredential\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    this.text(\"credential_id\").unique();\n    this.text(\"public_key\");\n    this.bigInteger(\"counter\").default(0);\n    this.json(\"transports\").nullable();\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,6BAA6B,QAAQ,mBAAmB;CACnE,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAEjB,KAAK,KAAK,eAAe,CAAC,CAAC,OAAO;EAClC,KAAK,KAAK,YAAY;EACtB,KAAK,WAAW,SAAS,CAAC,CAAC,QAAQ,CAAC;EACpC,KAAK,KAAK,YAAY,CAAC,CAAC,SAAS;EACjC,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAEtC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}